2.4 GHz is crowded. Even non-DFS 5 GHz is pretty crowded. The question is, how much?
The RT-AX82U has two metrics: noise and channel utilization. Right now, it is showing -89 dBm for noise and 18% utilization for 2.4 GHz channel 9. Both are very good!
Unfortunately, it is only for the current channel.
As far as I can find, the lowest-end router/AP that has dedicated spectral analyzer is the U7 Pro XGS (replaces the Pro Max model). It can map all bands and interference from all sources — including non-WiFi ones, this is crucial — "simultaneously". It uses only one radio to do so, I presume it takes some time to sweep through all the channels.
I'm surprised this is not more common — I thought nerds would be interested in such info. Maybe they don't live in such high-density housing as Singapore. We can expect 10 neighbours in HDB/condo housing.
The U7 Pro XGS plus a PoE++ injector is pretty costly, though.
After many days of googling for alternatives, I came across this command:
sudo iw dev wlan0 survey dump
It shows noise level and busy time. Busy time includes non-WiFi interference — this is key. You can calculate channel utilization from it (busy time / active time). There is also 'receive time' to tell how much of 'busy time' is WiFi traffic. Neat!
I have a spare WiFi USB adapter — I used it to connect my notebook to my home network when its network card is flaky, but I notice it is dropping connection much less with UDR 7.
I should be able to collect some stats from my Linux box! :lol:
First problem. The 5.x kernel was too old. It did not have the driver out of box. Luckily, the kernel could be upgraded to 6.x by itself.
With anticipation, I ran:
sudo iw dev wlan0 survey dump
Nothing appeared. It turned out the WiFi card was based on Realtek 8822BU. Realtek chipset does not support wireless stats. What a letdown.
This works:
sudo iw dev wlan0 scan
It gives standard info from beacons that APs are broadcasting. I'm able to tease a bit more info compared to SSID scanner apps — probably because they want it simple for layman to use.
Some APs indicate channel utilization (from their PoV) and no. of clients.
It is a little more info, but it is not very useful. Will need a WiFi adapter that supports 'survey dump'.
Is it always right to choose channel 1, 6 or 11?
|Chn|Utilization|Interference (dBm)| |---|---|---| |1|41%|-66| |2|33%|-54| |3|37%|-78| |4|18%|-86| |5|19%|-83| |6|45%|-75| |7|23%|-54| |8|23%|-78| |9|9%|-96| |10|27%|-74| |11|46%|-22| |12|15%|-86| |13|11%|-88|
I have another router at channel 11, that's why interference is so high.
I'm beginning to wonder if it is better to use channels 3 - 4 and 9 - 10, especially if channels 1, 6, 11 are relatively weak, e.g. -75 dBm and below. Use neighbouring channels to overpower the weak signals instead of being forced to cooperate with them.
Notice that channels 4 and 9 are exceptionally clean.
By default, routers send beacon frames at 1 Mbps for 802.11b compatibility — this has not been needed for years! This uses ~2.34% airtime per SSID (assuming default 10 Hz broadcast rate). If changed to 6 Mbps (802.11g), it becomes 0.39%.
You can expect around 10 neighbours in HDB housing, with 1 to 3 SSIDs each.
Cons:
I'm still a long way from foolproof parental control, though I have some new ideas. Parental control without cooperation of client device is hard.
First, create a network for controlled devices. Apply a schedule to it. Problem: devices can still connect to guest network, so guest network needs a schedule too.
Unfortunately, routers don't log DNS queries — the first step towards blocking websites. Looks like there is no choice, will need to run a local DNS server. The router is responsible for redirecting external DNS queries and blocking DoT and DoH.
Step 1: block DNS-over-HTTPS (DoH). This is not easy. UDR 7 has a traffic rule to block mainstream public DoH providers, but it is not comprehensive, of course.
Test:
curl --doh-url https://cloudflare-dns.com/dns-query https://example.com
Step 2: block port 853 (DNS-over-TLS). It is encrypted, so it cannot be redirected. Clients that do not switch to port 53 will fail to work.
Step 3: redirect all port 53 (DNS) to router. (In the future, this will be changed to the DNS server.)
An additional rule is needed if the DNS server is on the same subnet. The traffic must be routed through the router so that the DNS server does not reply to the client directly! (The client will see a different src addr and may reject the packet as spoofed.)
Adding this rule means the DNS server won't be able to tell which client made the request, as they all come from the router. The fix is to put the DNS server in its own subnet.
QUIC is 'replacement' for TCP and is used for HTTP/3. It runs over UDP port 80 and 443. It uses UDP port 53 for DNS, but sometimes UDP port 443 (DoQ; DNS-over-Quic). Due to lack of support for blocking DoQ, the whole port has to be blocked.
VPN is a massive loophole. Either block well-known ports or deny all and whitelist selected ports — and do some sort of packet inspection to ensure no tunneling. This is reaching enterprise-level setup!
Mobile remains an ever loophole. The mobile device can be under parental control, but it can create a hotspot and let other devices connect to it. The only solution is to block the ability to enable hotspot.
|Network|AP|Mode|Band|Chn|Purpose| |---|+--|+--|+--|---|+--| |A|UDR 7|Router|5 GHz, 6 GHz|–|Home| |B|UDR 7|Router|2.4 GHz|1|Home| |C|AX82U|AP|2.4 GHz|11|IoT| |D|AX82U|AP|2.4 GHz|11|Guest|
Network B is for coverage. I don't like to mix 2.4 GHz and 5 GHz as I have bad band steering experience. Maybe it is better now.
6 GHz uses 5 GHz for out-of-band discovery — it is much faster.
Network C is the AP's primary network. Asus router cannot define guest network alone. I repurpose it as the IoT network because in AP mode, Asus router enforces client isolation on guest networks — no option to disable it.
Network D is a guest network. It is client isolated.
Networks C and D only have access to Internet. Only the AP is accessible from the intranet — needs explicit firewall rules.
In hindsight, I could have done the same with a pair of AX82U, which I already have.
|Network|Mode|Band|Chn|Purpose| |---|+--|+--|---|+--| |A|Router|5 GHz|–|Home| |B|Router|2.4 GHz|11|IoT| |C|Router|2.4 GHz|11|Guest| |D|AP|2.4 GHz|1|Home|
The UDR 7 has more advanced routing, though. AX82U is like a toy next to it.
