The Sniffer Vantage Trap
Every RSSI value in a capture is the signal strength as measured by the capture radio, sitting wherever you put it. It is not what the AP heard. It is not what the client heard. Treating sniffer RSSI as the AP's reception, or the client's, is the most common way a PCAP-based diagnosis goes confidently wrong.
Shankar K. · Wi-Fi engineer, 15 years · Last reviewed: June 2026
A monitor-mode capture measures every frame from the position of the capture radio, so the RSSI it records for a transmitter is the signal at the sniffer, which is almost never the signal at the device that frame was actually sent to.
The sniffer sits near the client, so it records the client's transmissions strong. The AP, further away, receives those same transmissions weak. If you read the capture RSSI as the AP's reception, you conclude the uplink is healthy when it may not be.
Radiotap RSSI is a measurement made by the capture interface as the frame arrives at that interface. There is no field in any 802.11 frame that carries how strongly the intended receiver heard it. The receiver knows its own RSSI, but it does not write that number into the air for a sniffer to read. So a capture can tell you, with precision, how loud each frame was at the sniffer, and nothing direct about how loud it was at the AP or the client it was meant for.
The gap between those is set by geometry. Move the sniffer and every RSSI in the capture changes, even though the link under test did not change at all. The capture point is a third party standing in the room, reporting what it personally hears.
Sniffer near the client reads the client's frames strong. You conclude the AP hears the client fine. The AP, further away, may be barely hearing it.
Sniffer far from the AP reads the AP's beacons weak. You conclude coverage is poor. A client sitting near the AP hears it perfectly well.
Uplink and downlink frames read at different RSSI in the capture purely because the sniffer is closer to one endpoint than the other, not because the link is actually asymmetric.
- ▸ Treat capture RSSI as the sniffer's view, always. Note where the sniffer physically sat relative to the AP and the client before you interpret a single number.
- ▸ To assess what the AP hears, place the sniffer as close to the AP as you can, so its view approximates the AP's. To assess what the client hears, place it next to the client.
- ▸ Use relative trends from a fixed sniffer position, a rate dropping over time, retries rising, rather than absolute RSSI as ground truth for either endpoint.
- ▸ Cross-check against the endpoints' own reported stats (controller client RSSI, client OS link metrics) when you need the receiver's actual view.
- ▸ When you must judge a link from a capture, say which end you are judging and where the sniffer stood. That single habit prevents most vantage errors.
This is one instance of a broader principle: the view of a link depends on where you stand. The sniffer, the AP, and the client each see the same link differently. For the full picture, including transmit power, RX-SOP, and rate adaptation, see /asymmetric-link-visibility. For capture setup itself, see /wifi-packet-capture-fundamentals and /wlanpi-pcap-guide.
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks