September 13th, 2021
In This Release
This version of Eye P.A. finally supports 2.4 GHz! Nah, just kidding. But the version number is undeniably fun.
In the filter bar, we grouped 2.4 and 5 GHz channels, so if you have a PCAP that spans lots of channels, you can now filter out an entire frequency band with a couple of clicks.
If you give Eye P.A. a large PCAP file, it will split it into “Pages” that you can navigate between. Previously, Eye P.A. wouldn’t persist filter selections whenever you switched pages, which was pretty frustrating. Good news, now they persist! When you click “Next” or “Back”, your filter settings will be preserved.
There was a “Root Node” label in the navigation breadcrumbs. It wasn’t really useful for anything, so we removed it to save screen real-estate. For those of you with 1366x768 displays… you’re welcome!
Previously, you could crash Eye P.A. by pasting a MAC address with a trailing space into the filter bar. We’re very happy to report that this doesn’t happen anymore!
We found some PCAP files that crashed Eye P.A., so we fixed the crash!
Some users reported issues with the Linksys WUSB6300. It seems that Linksys did a hardware revision, which causes it to not work with our packet capture engine. We updated our packet capture drivers to support the new revision, so all Linksys WUSB6300 adapters should work in Eye P.A. again (even brand new ones).
To keep things simple and streamlined, we decided that it was time to remove support for Tarlogic’s NDIS capture driver, which enabled a couple of older adapters, such as the Linksys AE2500 (which is an older 2-stream 802.11n adapter).
The “Close” button in the About window was the wrong color. It was bothering us, so we fixed it.
There seems to be a nasty bug that can cause Eye P.A. to miss some packets during a packet capture. Yikes! We made some improvements to the packet capture engine, including splitting things up into a couple of different threads to ensure that we don’t have performance bottlenecks. We aren’t totally sure that this fixed the problem, we have decided to not hold back all of the other fixes and improvements while we continue to investigate. If you notice any missing frames, be sure to let us know.
January 6th, 2021
- Added the Previous Page button to navigate large captures.
- Fixed missing data when using the Export to .CSV feature.
August 29th, 2020
- Updated software update process for improved security.
- Improved robustness around opening captures.
- Improved robustness and reliability of license activation.
- Fixed an issue where the Save Capture menu was disabled after capturing packets.
- Fixed an issue where starring a network did not take effect.
- 802.11ac is no longer appears in the 2.4 GHz band.
- Fixed an issue where “Unscanned Channel” would show up under the Analyze tab.
May 5, 2020
- Implemented a new and massively improved packet parsing engine - packet parsing is now 2x faster, and requires much less memory!
- Added the MCS Index and Spatial Stream columns to the Packets Table.
- Improved large PCAP handling by automatically splitting large PCAP files in to sections of 500,000 packets.
- The Network list in Analyze tab now shows AP alias, not just MAC address.
- Improved handling of unsupported PCAP link types.
- Drill-down no longer resets when filters or time window changes! Can you tell it was bugging us? 😆
June 06, 2019
- Export-To-Wireshark support for latest Wireshark versions (2.6.9 and 3.0.2)
- Beacon color is now dark purple, and miscellaneous frames are light grey
- Corrected problem where PhyType can be incorrectly parsed during captures.
- Fixed some parsing errors that were preventing the loading of some capture files.
April 10, 2019
- Now shows the 802.1X Authentication 4-Way Handshake!
- Improved color palette makes it easier to follow RTS, CTS, QoS Data, Block ACK pattern.
- Beacons are now gray, to keep focus on actual network communications.
- Added support for TP-Link Archer T9UH v2 AC1900 Wi-Fi Adapter.
- Multicast and Broadcast
clientsare now aggregated together for a cleaner, more accurate client list.
November 14, 2018
- Added ability to capture packets on multiple channels simultaneously with supported 802.11ac adapters.
- Added experimental support for .pcap/.pcapng files captured from enterprise access points (Cisco, Meraki, Ruckus, Aruba, AeroHive).
- Added duration and channel columns to the Packets table (right click on the Packets table headers to show the new columns).
- Fixed a copy-to-clipboard issue in the Packets table.
- Fixed the calculation of guard intervals for 802.11ac packets with RadioTap headers.
- Improved parsing of files containing some invalid packet types in addition to 802.11 packets.
- Special thanks to Dennis Bössing and Joel Michael for Aruba .pcap files!
Supported 802.11ac PCAP Adapters
- Linksys WUSB6300
- Linksys WUSB6400M
- ASUS USB-AC68
- ALFA Network AWUS1900
- EnGenius EUB1200AC
- D-Link DWA-182 rev C1
- D-Link DWA-192
- TRENDnet TEW-805UB
- TP-LINK Archer T4U v2
- TP-LINK Archer T4UH v2
- Edimax EW-7822UAC
- Edimax EW-7833UAC
- ASUS USB-AC53 Nano
- Edimax EW-7822 ULC
- Edimax EW-7822 UTC
- Fixed an issue with licensing that prevented new users from registering the software
- Native 802.11ac packet capture with some standard supported Wi-Fi adapters, such as the Linksys AE2500.
- Files now open much faster!
- Improved interface to diagnose Wi-Fi issues faster.
- Eye P.A. is now able to capture 802.11 a/b/g/n packets using a WiFi adapter! This version of Eye P.A. supports Linksys AE2500 and Netgear A6200 adapters.
- Fixed the VendorVendor bug.
- If you are near MetaCare expiration, Eye P.A checks the status of your license on startup to make sure that it doesn't miss any MetaCare extensions that you may have recently purchased.
- Improved the layout of the Packet Table columns.
- Increased the default width of the Right Side Bar to make it easier to get to the data you need
P.S. Happy International IPA Day on August 3rd! We hope you get to enjoy some delicious hoppy beverages.
- Send us feedback: We love hearing from our customers about how they enjoy using our products and what enhancements would make their work easier. Use the new in app feedback feature and let us know what you think of Eye P.A.!
- Locate packets on timeline: Ever wonder where a packet appears on the over-time graph? On the packets table, select a row and then check out where it shows up on the graph!
- Active selection updates: The active selection window is pretty awesome and provides handy data. It now provides even more handy data by telling you exactly where the active selection starts, where it ends, and how much time occurs in-between. Awesome.
- Licensing fix: Some users used to be blocked from using Eye P.A. when they were disconnected from the Internet. Used to be…
- Improved compatibility: Wireshark and Eye P.A. broke up for awhile, but they’re back together again! Eye P.A. can once again export packets to the latest version of Wireshark. Be sure to update Wireshark as well, as this update breaks compatibility with older versions.
- Easier license renewal: The MetaCare renewal experience wasn’t awesome, so we made it awesome (that means it’s easier and faster).
- Streamlined bug reporting: If Eye P.A. crashes (and it won’t, right?!), you can now report app crashes to let us know that it broke, which will allow us to better prioritize and fix issues.
- Improved auto updates: We didn’t like our old auto updater, so we made a new one called “Magpie.” Also, it’s open source!
- Adds beta update integration: Want to test the latest releases? Eye P.A. now has a beta channel! Opt in via the Help menu, but be warned, beta versions are experimental, and might contain bugs!
- Update/Settings fix: Wasting time is lame, so Eye P.A. app settings are now retained when updating to the latest version.
- Desktop icon fix: Desktop icons are totally 2003, so we no longer add a desktop shortcut automatically upon installation of Eye P.A. But it’s still in your Start menu, and if you want to be trendy you can pin a shortcut to your taskbar for quick access (it’s what all the cool kids are doing... or so we hear).
January 4, 2016
- Proxy password field is now masked
- Improved random deactivation issues
- Improved license entitlement behaviors
- Added "Deactivate" button to Activation window
February 25, 2015
- Roaming clients easier to track around the Treepies
- AP Aliasing allows for friendly names (Cisco and Aruba info is automatically populated)
- Probe requests are now grouped under Broadcast
- A "Probe" client has been added to group probe responses
- Non-US 2.4GHz channels (12, 13, 14) are now available for built-in capture with AirPcap Nx
- "Unknown" SSIDs now have MAC Address displayed
- Additional information in details tables
- Various performance enhancements and bug fixes
- Updated color scheme
- Packets tab columns are now persistent
- Improved performance with larger captures
- Fixed issue exporting to latest version of Wireshark
- Additional bug fixes
May 28, 2014
- ESSID and Radio Rings—organize packets by their ESSID or by Radio.
- Group by Radio or Group by ESSID functionality—toggle between Group by Radio and Group by ESSID
- Display Device Names for Cisco AP’s—see the Device Name in place of the Radio MAC for convenient identification
- Visualize tab-Analyze tab tab sync—When an SSID is selected in the Visualize tab, that network is now selected on the Analyze tab offering smoother workflow
- UI and UX polish
- Additional bug fixes
April 29, 2014
- Clicking on the Treepie name will now switch chart to the main view
- Disable Channel filter if only one Channel is captured
- Selecting the filter Auto-complete no longer requires an Enter keystroke
- Registration is more robust
- UI and UX polish
- Additional bug fixes
March 12, 2014
- Filter clients by vendor—include or exclude clients by their vendor designation as recorded in current Organizationally Unique Identifier (OUI) file
- MAC Address Filter with autocomplete—enter in the beginning digits of a MAC address to include or exclude addresses for analysis
- Y-axis label on Histogram—get at-a-glance context for amounts and percentages for BYTES, PACKETS, and AIR TIME
- Channel selector for multi-channel captures—select only the packets from one channel to accurately analyze Air Time contention domain issues
- Fixed data rate columns in Active Selection to accurately display all data rates in capture
- UI polish
- Additional bug fixes
January 20, 2014
- Added Support for 802.11ac. See 802.11ac frames and data rates
- Added the ability to open .wcap files. It is no longer needed to change the extension to “.pcap” when using captures taken from a Mac
- Added a Data Rate bar chart in the Active Selection. See See the percentage of packets transmitted at each data rate
- Added visual improvements to the Histogram
- Added ability to recover failed captures
- Additional bug fixes
- Users can now see both filtered and unfiltered data in the Time Span slider. Get enhanced visibility into the full channel view as you drill into the packet capture file Current data will be displayed in a brighter color, filtered data will be semi-transparent
- Improved Air Time calculations
- Improved packet filtering
- Various bug fixes
- Transitioned to more a flexible and user-friendly licensing system
- Includes new software maintenance program called MetaCare
- The ANALYZE TAB allows you to select your network (or networks) to see channel observations and receive expert tips on improvements.
- Multiple AirPcap adapters are now supported, allowing users to capture several channels at the same time.
- When opening or capturing a file, a new Loading and Processing window allows for greater control.
- The FILE DETAILS section has been moved from VISUALIZE and PACKETS tabs to the new ANALYZE tab.
- Several crash bugs have been fixed.
- Copy content from Eye P.A. into your clipboard! ACTIVE SELECTION and FILE DETAILS will copy text within the tables. HISTOGRAM will copy the visual selection you’ve made as an image. After clicking the clipboard icon, paste the data into the application of your choice.
- Drag and drop new files into Eye P.A. to open a new file at any time
- When using filters, SSID’s will now autocomplete as you type into the filter bar.
- Eye P.A. will now remember any changes you make to the column order or visibility with both the ASSOCIATED DATA and PACKETS tables.
- Added New Sample files
- Added FILE NAME to the FILE DETAILS section
- Now your RECENT FILE list will remain persistent between opens or upgrade
- Miscellaneous bug fixes
- New Filter Bar – Filter packets for more flexibility in only see the data that you’re interested in, allowing for super quick “zoom into” problem areas. Also, select to display or hide invalid or malformed packets within the filter bar.
- Filter by: SSID, Vendor, MAC Address, Channel, Data Rate, RSSI Value
- New Packet Viewer – Integrated into the PACKET tab is our new Packet Viewer, eliminating the need to go back and forth between Wireshark and Eye P.A. Do all your packet analysis in one application. Right click on the column header to select what standard packet information you’d like to show. New Workflow Design – LEARN, START, VISUALIZE, PACKETS navigation condenses and groups together the steps of Packet Analysis for better customer use.
- Other Changes
- Persistent treepie memory now maintains the same drill-down when you move the Adjustable Time Graph or apply filters.
- Adjustable Time Graph display updates to match any changes made to filters or treepie drill-downs.
- Added a “Would you like to save this capture before exiting Chanalyzer?” prompt upon exit of the application. This can be disabled both from within the prompt and from the FILE menu.
- Collapsible Sections within new Workflow screens.
- The title TIME has been changed to AIR TIME.
- Eye P.A. now has the ability to capture live wireless data packets with a Riverbed AirPcap USB device. Simply connect an AirPcap to your computer and initiate the capture feature from within Eye P.A. in the FILE menu to create a .pcap file that opens immediately after completing the capture for quick analysis.
- To increase performance, we’ve visually condensed sections that are 1% or less of the displayed treepie view into a MISCELLANEOUS treepie slice. Packet information is still available in the Data Table.
- Added a link for SUPPORTED DEVICES in the HELP menu to help customers understand which devices are currently supported with the Live Capture feature.
- Fixed a minor parsing issue with ACK packets.
- MetaGeek designed and implemented a completely new parsing engine for .pcap files – now most files open 30% faster.
- Using new color swatches, individual frame types can be filtered out with our SUB-FRAME PACKET FILTERS option under VIEW menu more easily – filter menu colors now match the associated section of the treepie.
- Eye P.A. supports the new Wireshark file type – .pcapng.
- Eye P.A. also has experimental support for Microsoft® Network Monitor .cap and Comview® .ncf files. Currently, export to Wireshark will not work for these file types. Regardless, we wanted to give you the ability to do quick visual troubleshooting in Eye P.A. with those file types.
- 15-day trial
- Other Changes
- Fixes issue opening big endian file format.
- Displays both SSID and MAC address in the ACTIVE SELECTION window.
- Fixed sorting order for ASSOCIATED DATA TABLE on time frame adjustments.
- Fixed parsing for Hidden_xx:xx:xx SSID.
- Fixed (find name in app) .csv export where data may be displayed incorrectly.
- Renamed APPLICATION INFORMATION to LEGEND.