Report URL

Anonymized sample output. Original capture excluded from this Explorer page.
This capture was made on May 10, 2026 using the Airtool packet capture application on an M1 Mac with a built-in WiFi adapter. It was made inside a single-family residence without WiFi services in the San Francisco East Bay area. The zip code is 94706.

CBS Explorer

Explorer translates analyzer output into the CBS reading order: Observation, Evidence, and Inference. CSV and JSON files feed the tables; the table design controls the interpretation.

Capture Summary

High-level characteristics of the analyzed collection.

FieldValueNotes
Capture fileairtool_2026-05-10_11.17.18.AM.pcapAnonymized sample job output; the original capture should not be published.
Capture size9.14 MBSmall demonstration capture.
Total frames parsed34570All packets read from the file.
802.11 packets34568Packets recognized as 802.11 frames.
Beacon frames20689Infrastructure/AP advertisement signal.
Probe requests190Client scanning/solicitation behavior.
Probe responses741AP responses to probes.
Association requests2Client-to-AP association attempts.
AP candidates171Rows in the AP table.
Client candidates40Rows in the client table.
Observed devices691Rows in the device inventory table.

Data provenance: Parsed capture metadata, 802.11 headers, RadioTap metadata, analyzer counts, and generated CSV/JSON summaries.

See also: Fields Used by CBS Module 1; Observation Constraints

Observation Constraints

How this collection shapes the conclusions that can be drawn from the observation.

ConstraintImpact
Single uploaded captureThe observation is a point-in-time collection, not a long-term baseline.
20 channel values appear in outputChannel visibility depends on the capture adapter and capture settings; absence on a channel is not evidence of absence.
RSSI values presentRSSI supports proximity estimates, but readings vary with receiver position, walls, antenna orientation, and motion.
Anonymized identifiersDevice relationships are preserved, but direct MAC addresses are replaced with stable pseudonyms.
Management/control emphasisCBS currently emphasizes observable Wi-Fi management/control behavior rather than reconstructing payload content.

Data provenance: Derived from capture metadata, anonymization state, channel fields, RSSI availability, and CBS Module 1 analysis scope.

See also: Frame Census; RSSI Interpretation

Frame Census

Counts of selected frame categories found in the collection.

Frame TypeCount
Beacon20689
Probe Request190
Probe Response741
Association Request2
Reassociation Request0
Other 802.1112946

Data provenance: Parsed from 802.11 frame type/subtype values.

Note: Selected management-frame subtypes are classified; other 802.11 frames may be counted as Other.

See also: 802.11 Frame Types; Fields Used by CBS Module 1

Channel Activity

Basic information about activity on observed channels.

ChannelBandAPsDevice CountSSID CountAverage RSSINotes
1253113-85.6Observed in sample output.
2497-86.4Observed in sample output.
33105-88.5Observed in sample output.
4202610-85.9Observed in sample output.
5011-88.4Observed in sample output.
6202412-82.8Observed in sample output.
7032-82.6Observed in sample output.
810136-84.7Observed in sample output.
9266-84.5Observed in sample output.
10898-82.4Observed in sample output.
11343810-82.0Observed in sample output.
12011-70.8Observed in sample output.
13021-76.6Observed in sample output.
36332-91.5Observed in sample output.
44553-91.1Observed in sample output.
48221-93.9Observed in sample output.
52111-86.1Observed in sample output.
100111-93.5Observed in sample output.
153111-94.0Observed in sample output.
157994-87.6Observed in sample output.

Data provenance: RadioTap channel/frequency and signal metadata, plus derived counts.

Note: Channel observations depend on capture settings and receiver behavior.

See also: RSSI Interpretation; Observation Constraints

Vendor OUI

Vendor attribution counts found in the collection.

Vendor AttributionConfidenceDevice CountReason/Caveat
Locally Administered / RandomizedLow248No AP behavior observed.
Locally Administered / RandomizedMedium48Strong AP behavior from beacon traffic; AP behavior observed on non-obvious infrastructure device.
eero inc.High45Acts as AP and vendor is eero; vendor is eero; AP behavior observed.
UnknownLow42No AP behavior observed.
eero inc.Low31No AP behavior observed.
Vantiva USA LLCHigh23Acts as AP and vendor looks like network infrastructure (Vantiva USA LLC); vendor looks like network infrastructure (Vantiva USA LLC); AP behavior observed.
TP-Link Systems IncLow16No AP behavior observed.
Espressif Inc.Low14No AP behavior observed.
BroadcomLow13No AP behavior observed.
Google, Inc.Low11No AP behavior observed.
Hitachi Energy USA Inc.Low11No AP behavior observed.
Apple, Inc.Low10No AP behavior observed.
Hitachi Energy USA Inc.Medium8Strong AP behavior from beacon traffic; AP behavior observed on non-obvious infrastructure device.
Intel CorporateLow8No AP behavior observed; probe requests seen without stronger identity signals; no AP behavior observed.
NetgearHigh8SSID suggests extender/repeater; acts as AP and vendor looks like network infrastructure (Netgear); vendor looks like network infrastructure (Netgear); AP behav
Tuya Smart Inc.Low7No AP behavior observed.
ASUSTek COMPUTER INC.High6Acts as AP and vendor looks like network infrastructure (ASUSTek COMPUTER INC.); vendor looks like network infrastructure (ASUSTek COMPUTER INC.); AP behavior observed.
NetgearLow6No AP behavior observed.
TP-Link Systems IncHigh6Acts as AP and vendor looks like network infrastructure (TP-Link Systems Inc); vendor looks like network infrastructure (TP-Link Systems Inc); AP behavior observed.
Vantiva USA LLCLow6No AP behavior observed; probe requests seen without stronger identity signals; no AP behavior observed.
AzureWave Technology Inc.Low5No AP behavior observed.
HUMAX Co., Ltd.Low5No AP behavior observed.
Smart Innovation LLCLow5No AP behavior observed.
Hewlett PackardLow4No AP behavior observed.
UnknownMedium4Strong AP behavior from beacon traffic; AP behavior observed on non-obvious infrastructure device.

Data provenance: Vendor enrichment from MAC prefix lookup against the configured OUI source.

Note: Vendor attribution may be inaccurate or unavailable for randomized/local MAC addresses.

See also: Vendor Attribution; Confidence Labels; Reasons to Doubt

Persistence

Entities with longer observed duration or repeated activity in the capture.

DeviceVendorPresenceObserved DurationBeaconProbe ReqAssocAvg RSSICaveat/Reason
device_0137Locally Administered / RandomizedPersistent48.7 min.000-82.61No AP behavior observed.
device_0034UnknownPersistent48.7 min.000-82.52No AP behavior observed.
device_0021CIMSYS IncPersistent48.3 min.000-79.65No AP behavior observed.
device_0134Locally Administered / RandomizedPersistent48.3 min.000-80.01No AP behavior observed.
device_0136Locally Administered / RandomizedPersistent48.3 min.000-80.10No AP behavior observed.
device_0545eero inc.Persistent48.3 min.000-80.10No AP behavior observed.
device_0236Locally Administered / RandomizedPersistent47.8 min.000-80.97No AP behavior observed.
device_0387eero inc.Persistent47.8 min.000-76.41No AP behavior observed.
device_0413Smart Innovation LLCPersistent47.6 min.000-73.40No AP behavior observed.
device_0301ecobee incPersistent46.7 min.000-71.88No AP behavior observed.
device_0352ASUSTek COMPUTER INC.Persistent46.3 min.29520-81.93Acts as AP and vendor looks like network infrastructure (ASUSTek COMPUTER INC.); vendor looks like network infrastructure (ASUSTek COMPUTER).
device_0295Hui Zhou Gaoshengda Technology Co.,LTDPersistent45.6 min.000-77.09No AP behavior observed.
device_0337Locally Administered / RandomizedPersistent45.2 min.000-81.81No AP behavior observed.
device_0036UnknownPersistent44.4 min.000-81.60No AP behavior observed.
device_0033UnknownPersistent43.7 min.000-73.86No AP behavior observed.
device_0350ASUSTek COMPUTER INC.Persistent43.3 min.22700-78.18Acts as AP and vendor looks like network infrastructure (ASUSTek COMPUTER INC.); vendor looks like network infrastructure (ASUSTek COMPUTER).
device_0423Smart Innovation LLCPersistent43.0 min.000-76.48No AP behavior observed.
device_0089Apple, Inc.Persistent42.5 min.000-88.57No AP behavior observed.
device_0039UnknownPersistent42.3 min.000-83.64No AP behavior observed.
device_0655Locally Administered / RandomizedPersistent40.5 min.000-87.99No AP behavior observed.
device_0325Google, Inc.Persistent39.6 min.0220-86.97Probe requests seen without stronger identity signals; no AP behavior observed.
device_0487Locally Administered / RandomizedPersistent39.5 min.0100-88.40Probe requests seen with randomized MAC; no AP behavior observed.
device_0032UnknownPersistent39.3 min.000-81.14no AP behavior observed
device_0361Locally Administered / RandomizedPersistent39.1 min.010-91.51Probe requests seen with randomized MAC; no AP behavior observed.
device_0433Vantiva USA LLCPersistent38.4 min.000-89.92No AP behavior observed.
device_0547Apple, Inc.Persistent34.0 min.000-83No AP behavior observed.
device_0466Apple, Inc.Persistent31.9 min.000-84.36No AP behavior observed.
device_0406Apple, Inc.Persistent31.1 min.000-78.17No AP behavior observed.
device_0689eero inc.Semi-persistent27.7 min.000-73.47No AP behavior observed.
device_0536eero inc.Semi-persistent23.0 min.000-88.54No AP behavior observed.

Data provenance: Derived from first/last observation timing and per-device frame counts.

Note: Persistence describes what this sensor observed, not total occupancy.

See also: Persistence Labels; Observation Constraints; Reasons to Doubt

Device Class Census

Observed devices grouped by inferred device class.

Device ClassCountConfidenceEvidence RuleCaveats
Unknown489LowLimited observable evidenceLocally administered/randomized MAC reduces confidence.
Access point (unclassified)66MediumBeaconing behavior, Probe activity, Association activity, Hotspot/AP indicatorsLocally administered/randomized MAC reduces confidence.
Wi-Fi router / access point55HighBeaconing behavior, Probe activity, Hotspot/AP indicators
Mesh AP / router node45HighBeaconing behavior, Hotspot/AP indicators
Likely mobile client scanning16LowProbe activityLocally administered/randomized MAC reduces confidence.
Likely client scanner13LowProbe activity
Wi-Fi printer3HighBeaconing behavior, Hotspot/AP indicators
Range extender / repeater2HighBeaconing behavior, Hotspot/AP indicators
Client device1MediumAssociation activity
Client device (randomized MAC)1LowAssociation activityLocally administered/randomized MAC reduces confidence.

Data provenance: Derived from observed frame behavior, SSID/BSSID patterns, OUI enrichment, hotspot indicators, and confidence rules.

See also: Device Classes; Evidence Rules

Network Relationships

SSID/BSSID relationships surfaced by the analyzer.

SSIDBSSIDVendorClients
Hiddendevice_0003Hitachi Energy USA Inc.No associated client listed.
Hiddendevice_0008Hitachi Energy USA Inc.No associated client listed.
Hiddendevice_0009Hitachi Energy USA Inc.No associated client listed.
Hiddendevice_0011Hitachi Energy USA Inc.No associated client listed.
Hiddendevice_0012Hitachi Energy USA Inc.No associated client listed.
Hiddendevice_0013Hitachi Energy USA Inc.No associated client listed.
Hiddendevice_0014Hitachi Energy USA Inc.No associated client listed.
Hiddendevice_0020Hitachi Energy USA Inc.No associated client listed.
Hiddendevice_0024eero inc.No associated client listed.
EmoAppdevice_0025eero inc.No associated client listed.
Hiddendevice_0026eero inc.No associated client listed.
Hiddendevice_0028Unknowndevice_0342
Hiddendevice_0052eero inc.No associated client listed.
Hiddendevice_0053eero inc.No associated client listed.
Sonic-xxxxdevice_0054eero inc.No associated client listed.
Hiddendevice_0055eero inc.No associated client listed.
Hiddendevice_0056eero inc.No associated client listed.
Hiddendevice_0058eero inc.No associated client listed.
Hiddendevice_0059eero inc.No associated client listed.
Sonic-xxxxdevice_0060eero inc.No associated client listed.
Hiddendevice_0061eero inc.No associated client listed.
Hiddendevice_0062eero inc.No associated client listed.
Hiddendevice_0064eero inc.No associated client listed.
Sonic-xxxxdevice_0065eero inc.No associated client listed.
Hiddendevice_0066eero inc.No associated client listed.
CarCam_yyyyyydevice_0075Shenzhen Bilian Electronic Co.，LtdNo associated client listed.
Hiddendevice_0079Smart Innovation LLCNo associated client listed.
Hiddendevice_0083Locally Administered / RandomizedNo associated client listed.
Bear10pcdevice_0084Locally Administered / RandomizedNo associated client listed.
Xfinity Mobiledevice_0085Locally Administered / RandomizedNo associated client listed.
Hiddendevice_0086Locally Administered / RandomizedNo associated client listed.
Bear10pcdevice_0087Locally Administered / RandomizedNo associated client listed.
xfinitywifidevice_0088Locally Administered / RandomizedNo associated client listed.
1235 AIRdevice_0102TP-Link Systems IncNo associated client listed.
Punctum2_2GEXTdevice_0116NetgearNo associated client listed.
Linksys00000device_0120Belkin International Inc.No associated client listed.
WiFi Hotspot 5954device_0126LG ElectronicsNo associated client listed.
CarPlay_xxxxdevice_0305Alpsalpine Co,.LtdNo associated client listed.
Hiddendevice_0309UnknownNo associated client listed.
Hiddendevice_0314eero inc.No associated client listed.
Sonic00device_0315eero inc.No associated client listed.
Hiddendevice_0316eero inc.No associated client listed.
Unknowndevice_0326Unknowndevice_0110
Hiddendevice_0332TP-Link Systems IncNo associated client listed.
Hiddendevice_0333TP-Link Systems IncNo associated client listed.
Noodledevice_0335Locally Administered / RandomizedNo associated client listed.
Noodledevice_0336Locally Administered / RandomizedNo associated client listed.
Hiddendevice_0339eero inc.No associated client listed.
CAdevice_0340eero inc.No associated client listed.
Hiddendevice_0341eero inc.No associated client listed.

Data provenance: Derived from BSSID/SSID observations and adjacency output.

Note: This table does not prove ownership or physical location.

See also: Adjacency Graph; Access Point Details

Mobility Indicators

Signs of mobility or scan-like behavior found in the capture.

IndicatorEvidenceConfidenceCaveat/Limitation
Likely mobile devices37 devices labeled likely mobileMediumMobility is inferred from signal/behavior patterns, not physical tracking.
Reassociation observed0 devices with reassociation count > 0MediumReassociation can reflect roaming, capture artifacts, or normal client behavior.
High RSSI variation43 devices with RSSI variation ≥ 20 dBLow/MediumRSSI varies with environment and receiver conditions.
Probe-heavy behavior5 devices with at least 10 probe requestsMediumProbe behavior may indicate scanning, but does not identify user intent.
Multiple channels observed7 devices with multiple channel valuesLow/MediumCan reflect capture settings, device movement, or multi-channel observation.

Data provenance: Derived from reassociation counts, channel observations, RSSI variation, probe behavior, and mobility labels.

See also: RSSI; Reasons to Doubt

RSSI

RSSI values for devices with signal samples in the collection.

DeviceVendorRoleAverage RSSIRSSI RangeRSSI VariationSamplesProximity
device_0536eero inc.-88.54-92 to -81113161Distant
device_0394NetgearAP-86.53-94 to -79151530Distant
device_0568HUMAX Co., Ltd.AP-82.38--911254Distant
device_0381eero inc.AP-86.10-92 to -77151245Distant
device_0388Unknown-88.46-92 to -8571042Distant
device_0594Vantiva USA LLCAP; Probe Client-68.92--84828Moderate distance
device_0345TP-Link Systems IncAP-79.04-93 to -6528652Distant
device_0384eero inc.AP-72.91-84 to -6915575Moderate distance
device_0498Google, Inc.-86.54-94 to -8311558Distant
device_0444Intel Corporate-83.63--89545Distant
device_0328Intel Corporate-84.58-92 to -8210495Distant
device_0383eero inc.AP-82.17-91 to -7516495Distant
device_0307Locally Administered / Randomized-85.37-94 to -8311472Distant
device_0532Locally Administered / RandomizedAP-88.79-94 to -859464Distant
device_0540eero inc.AP-78.80--89454Distant
device_0675Hewlett PackardAP-75.00-83 to -6716414Moderate distance
device_0482Nokia Solutions and Networks GmbH & Co. KGAP-81.44-89 to -6722407Distant
device_0438Vantiva USA LLCAP; Probe Client-91.09-94 to -877400Distant
device_0596Vantiva USA LLCAP-67.72-70 to -664397Moderate distance
device_0657ASUSTek COMPUTER INC.AP-73.29-84 to -6618382Moderate distance
device_0036Unknown-81.60-95 to -7025378Distant
device_0352ASUSTek COMPUTER INC.AP; Probe Client-81.93-95 to -7520371Distant
device_0533Locally Administered / RandomizedAP-88.01-91 to -856371Distant
device_0595Vantiva USA LLCAP-67.71-70 to -664366Moderate distance
device_0350ASUSTek COMPUTER INC.AP-78.18-94 to -7024366Distant
device_0351ASUSTek COMPUTER INC.AP; Probe Client-87.93-91 to -856364Distant
device_0679AzureWave Technology Inc.-85.08-91 to -838353Distant
device_0597Vantiva USA LLCAP-67.79-70 to -664343Moderate distance
device_0603Vantiva USA LLCAP-82.40-85 to -805343Distant
device_0598Vantiva USA LLCAP; Probe Client-82.30-84 to -804342Distant
device_0602Vantiva USA LLCAP-82.24-84 to -804340Distant
device_0385eero inc.AP-80.02-83 to -758336Distant
device_0464Locally Administered / RandomizedAP-80.37-95 to -7619336Distant
device_0599Vantiva USA LLCAP-82.24-84 to -804334Distant
device_0683eero inc.AP-72.11-76 to -5719330Moderate distance
device_0658ASUSTek COMPUTER INC.AP-91.03-94 to -886328Distant
device_0600Vantiva USA LLCAP-82.26-84 to -804325Distant
device_0504Ubiquiti IncAP-89.65-95 to -8510322Distant
device_0461Locally Administered / RandomizedAP-76.66-90 to -6921316Distant
device_0462Locally Administered / RandomizedAP-77.02-94 to -7222305Distant

Data provenance: RadioTap signal metadata aggregated by anonymized device identifier. Some RSSI-derived values are temporarily suppressed pending validation of RSSI processing.

Note: RSSI is an approximate signal indicator, not a precise distance measurement.

See also: RSSI Interpretation; Observation Constraints

Reasons to Doubt

Caveats and qualifying reasons surfaced by analyzer output.

Finding / CaveatCountInterpretation
No AP behavior observed.520Caveat or supporting evidence surfaced by analyzer output.
Locally administered/randomized MAC reduces confidence.296Caveat or supporting evidence surfaced by analyzer output.
AP behavior observed.100Caveat or supporting evidence surfaced by analyzer output.
Strong AP behavior from beacon traffic.66Caveat or supporting evidence surfaced by analyzer output.
AP behavior observed on non-obvious infrastructure device.66Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor is eero.45Caveat or supporting evidence surfaced by analyzer output.
Vendor is eero45Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (Vantiva USA LLC).23Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (Vantiva USA LLC).23Caveat or supporting evidence surfaced by analyzer output.
Probe requests seen with randomized MAC.16Caveat or supporting evidence surfaced by analyzer output.
Probe requests seen without stronger identity signals.13Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (TP-Link Systems Inc).6Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (TP-Link Systems Inc).6Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (ASUSTek COMPUTER INC).6Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (ASUSTek COMPUTER INC).6Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (Netgear).6Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (Netgear)6Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (Nokia Solutions and Networks GmbH & Co. KG).3Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (Nokia Solutions and Networks GmbH & Co. KG).3Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (Commscope).3Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (Commscope).3Caveat or supporting evidence surfaced by analyzer output.
SSID matches HP printer direct-connect naming.3Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (Ubiquiti Inc).3Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (Ubiquiti Inc).3Caveat or supporting evidence surfaced by analyzer output.
SSID suggests extender/repeater.2Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (Humax Networks).2Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (Humax Networks).2Caveat or supporting evidence surfaced by analyzer output.
Acts as AP and vendor looks like network infrastructure (HUMAX Co., Ltd.).2Caveat or supporting evidence surfaced by analyzer output.
Vendor looks like network infrastructure (HUMAX Co., Ltd.).2Caveat or supporting evidence surfaced by analyzer output.
Association/client behavior seen, but randomized MAC weakens vendor inference.1Caveat or supporting evidence surfaced by analyzer output.

Data provenance: Analyzer warnings, caveats, classification reasons, and derived confidence notes.

Note: A caveat is not a dismissal; it tells the reader how cautiously to interpret a finding.

See also: Confidence Labels; Observation Constraints