Tutorial Wi Fi HaLow 802 11ah

Tutorial: Wi-Fi HaLow (802.11ah)

What it is. Wi-Fi HaLow is IEEE 802.11ah, Wi-Fi in the sub-GHz bands (863 to 868 MHz in the EU, 902 to 928 MHz in the US) for long range and low power, used for IoT, cameras and industrial links. OnAir lists the HaLow networks around you from their open beacons, the way a Wi-Fi list works, with the S1G channel, bandwidth and announced security.

Read this first. Receive only. OnAir never transmits, probes, associates or joins a network, and it does not decrypt anything or try keys. Security types are information only. SSIDs identify other people's networks; do not publish them. Check your local rules. See Legal and Privacy.

What you need

• A radio that reaches the sub-GHz bands. The mode asks for 4 Msps; 1 and 2 MHz channels can also be read from 2.4 Msps, which an RTL-SDR can do. The lowest working rate is 2 Msps. With Auto, all widths the radio must run at 20 Msps (a HackRF or LimeSDR, for example). The mode table covers 863 to 928 MHz.
• An 868/915 MHz antenna.
• Frequencies from the database: 863.5 MHz (Wi-Fi HaLow EU channel 1, 863 to 868 MHz; the mode start) and 903.5 MHz (US channel, 902 to 928 MHz).

Before you start

HaLow networks are rare, and traffic is bursty. Channel widths are 1, 2 and 4 MHz in the EU (up to 16 MHz in some regions; check the Width list for your region). The wider the width, the faster the radio rate it needs. Keep gain moderate.

Step by step

1. In the mode list open IoT & sensors and choose IoT, sub-GHz (several modes share this label; pick the entry whose panel shows Networks and Frames with S1G channels).
2. Pick the radio and start the receiver.
3. Choose the region (it shows the country code and its band ranges), the channel Width, and a Channel from the S1G channel list of that region and width. The tooltip explains that the centre equals the start frequency plus 0.5 MHz times the channel number, with the operating class of the plan.
4. Choose what is read under Receive: Auto 1 - 4 MHz (the radio runs at 4 Msps), Auto, all widths (needs 20 Msps and reads 1 to 16 MHz) or a single width. A single width sets the radio rate that width needs (2, 4, 5, 10 or 20 Msps) and ignores the other widths.
5. Tick scan to step through the channels of the list. A radio that takes in a single channel misses what is sent on the others meanwhile; set the dwell time.
6. Open Networks and Frames.

What you should see

A table of networks from their S1G beacons and probe responses: SSID (full, or resolved from the compressed SSID), BSSID and vendor, S1G channel and frequency, bandwidth, MCS, the security type announced (WPA2-PSK, WPA3-SAE, OWE or open), beacon interval and level. A live frame log and a frames-per-second plot.

Reading the screen

• Networks: SSID, BSSID, Channel, MHz, MCS, NSS, SNR, security, interval and level. Select a row to filter the frames; Show all removes the filter.
• Frames: the live frame log with a Copy button.
• A channel strip shows where activity is.

Technical note: the preamble (short training field) is detected at every width, the SIG field is read and checked, and BPSK 1/2 frames (how beacons are sent) are decoded and FCS-checked. Frames at faster rates are only counted.

Options and settings

Region, width, channel, Receive, scan, dwell, Clear.

Troubleshooting

• No networks. HaLow is uncommon; confirm nearby equipment exists. Check that the region matches your country.
• Wrong width. Try Auto 1 - 4 MHz or, with a fast radio, Auto, all widths.
• Frames counted but not listed. They are at a faster rate than beacons; only beacon-rate frames are decoded.
• Missing networks when scanning. Increase the dwell.

Tips

Start in the EU 863.5 MHz channel if you have an RTL-SDR; wide channels need a faster radio.

Legal and privacy notes

Passive only. No probing, no joining, no decryption.

Under the hood

IEEE 802.11ah S1G PHY: OFDM at 1, 2, 4, 8 and 16 MHz channel widths, BPSK 1/2 for beacons, management frames per IEEE 802.11.

Related

Mode-Wi-Fi-HaLow-802-11ah, Tutorial-Wi-Fi-networks, Tutorial-Wi-SUN-FAN, Tutorial-LoRaWAN, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.