Wireless Site Surveys: Predictive, Onsite, and Spectrum Analysis

A wireless site survey is the process of measuring and modeling the RF (radio frequency) environment of a space to plan access point placement, channel assignments, and power levels — or to diagnose an existing deployment that underperforms. Surveys come in two broad flavors: predictive surveys, done in software against a floor plan before any hardware ships, and onsite surveys (passive or active), done by physically walking the space with measurement tools. The tools themselves split the same way a mechanic’s do: a Wi-Fi analyzer decodes 802.11 traffic to show networks, channels, and signal strength, while a spectrum analyzer sees raw RF energy — including interference that isn’t Wi-Fi at all.

Predictive surveys: modeling before mounting

A predictive survey uses planning software and an imported floor plan to simulate coverage. The designer traces walls and assigns attenuation values to each material — drywall absorbs a little, concrete and brick a lot, metal and elevator shafts nearly everything — then places virtual APs and lets the tool render predicted heat maps, data rates, and channel plans.

Its strengths are speed and cost: no travel, no ladders, and instant what-if iteration (“what if we move this AP ten feet left?”). It is the natural first step for a new office build-out, and often the only option when the building is still under construction. Its weakness is that it is only a model. The output is exactly as good as the floor plan and the attenuation assumptions behind it; undocumented obstacles, unusual construction materials, inventory on shelves, and neighboring networks are invisible to it. Best practice treats a predictive survey as the starting design, validated afterward by an onsite walk.

Onsite surveys: passive and active

An onsite survey means taking real measurements in the real space, capturing conditions no simulation can guarantee.

A passive survey listens without connecting. The survey device walks the floor recording every beacon it hears — SSIDs (service set identifiers), BSSIDs, signal strength (RSSI, received signal strength indicator), noise, and channel usage — across all detected networks, including the neighbors’. It maps the RF landscape as a whole, which makes it the right mode for discovering existing coverage and competing networks.

An active survey associates with a specific network and generates traffic while walking, measuring what a client actually experiences: real throughput, latency, packet loss, and roaming behavior between APs. It validates end-to-end performance rather than mere signal presence — strong RSSI with terrible throughput is precisely the kind of problem only an active survey exposes.

An AP-on-a-stick survey is the pre-deployment variant: mount a real AP on a tripod at a candidate location, measure around it, move it, repeat. It grounds the predictive model in real measurements before anyone drills mounting holes.

Survey type	Hardware on site?	What it measures	Best for
Predictive	No — software model	Simulated coverage from floor plan + attenuation values	New designs, budgeting, pre-construction planning
Passive (onsite)	Yes — listening only	All beacons: RSSI, noise, channels, neighbor networks	Mapping the real RF environment, validating designs
Active (onsite)	Yes — associated client	Throughput, latency, loss, roaming	Verifying actual user experience

The Wi-Fi analyzer

A Wi-Fi analyzer is software (or a handheld device) that decodes 802.11 frames to inventory the wireless environment. Walking a building with one reveals, per detected network: SSID and BSSID, channel and channel width, signal strength, security type, and supported standards. Aggregated, that data answers the survey’s core questions — which channels are congested by neighboring networks, where signal is strong or weak throughout the space, and where overlapping cells create co-channel contention — before you finalize AP placement.

For troubleshooting, the same tool shows the two findings that explain most wireless complaints: channel overlap (multiple networks crowding the same or adjacent channels) and coverage holes (areas where signal strength falls below usable thresholds). Many analyzers render both as channel-usage graphs and walk-path heat maps.

Its blind spot is fundamental: a Wi-Fi analyzer only understands 802.11. Energy from anything that isn’t Wi-Fi — a microwave oven, a wireless camera, Bluetooth, industrial equipment — is invisible to it except as unexplained noise and degraded performance.

The spectrum analyzer

A spectrum analyzer measures raw RF energy across a frequency range, regardless of protocol. Where a Wi-Fi analyzer asks “what networks are here?”, a spectrum analyzer asks “what energy is here?” That distinction gives it two capabilities a standard Wi-Fi analyzer lacks: it detects and visualizes non-802.11 interference sources — microwave ovens, cordless phones, Bluetooth devices, wireless video, motion sensors, industrial welders — and it shows the actual RF energy and duty cycle on each frequency, letting a technician see how saturated the air is independent of what Wi-Fi frames report.

This is the escalation path when Wi-Fi mysteriously degrades but the Wi-Fi analyzer shows clean channels: a manufacturing floor with intermittent slowdowns, for example, may be suffering from machinery radiating in the 2.4 GHz band — visible only as a waveform on a spectrum analyzer. Common interference culprits are cataloged in Wi-Fi interference sources.

BSSIDs in survey work

Every AP radio broadcasts a BSSID (basic service set identifier) — a unique MAC-address-format identifier for that radio, distinct from the human-readable SSID that many APs share. Survey and security work leans on BSSIDs in two legitimate ways. First, since multiple APs advertise the same SSID, the BSSID is how a surveyor tells cells apart: it identifies which specific AP a given measurement or client association belongs to, making per-AP coverage maps and roaming analysis possible. Second, BSSIDs anchor rogue-AP detection: comparing every BSSID heard on the air against the list of authorized AP radios flags any unknown device impersonating (or simply intruding on) the network. What the BSSID cannot do is equally testable: it is not a security control, not encryption, and hiding or randomizing it does not protect traffic. See rogue APs and evil twins for the attack side.

How the N10-009 exam tests this

• Pick the survey approach. A stem contrasts predictive and onsite surveys and asks which statements are accurate. Correct discriminators: predictive = software modeling from floor plans with material attenuation values, no physical measurements; onsite passive = listening to all beacons without associating; onsite active = connecting and generating traffic to measure real throughput. Wrong answers typically swap these traits.
• Pick the tool for the described data. “Identify which channels neighbors are using, measure signal strength through the space, and detect interference before placing APs” — that’s a Wi-Fi analyzer. If the scenario stresses non-Wi-Fi interference or energy a Wi-Fi analyzer cannot decode, the answer shifts to a spectrum analyzer.
• Choose-two on analyzer capabilities. For a Wi-Fi analyzer: channel overlap/congestion and signal coverage (dead zones). For a spectrum analyzer: detecting non-802.11 interferers and displaying raw RF energy by frequency.
• Legitimate BSSID uses. Expect a choose-two pairing “distinguish which specific AP a measurement came from” with “compare heard BSSIDs against authorized APs to flag rogues” — and distractors claiming BSSIDs encrypt or authenticate traffic.

Analyzer-selection questions repeat with minor rewording — a few timed practice exams expose every variant.

Site surveys anchor the wireless troubleshooting objectives — see how they fit into the full N10-009 study guide.

Quick reference

• Predictive survey: software + floor plan + wall attenuation values; fast and cheap, but only as accurate as its inputs.
• Passive onsite survey: listens to every beacon (RSSI, noise, channels, neighbors) without associating.
• Active onsite survey: associates and pushes traffic; measures throughput, latency, loss, and roaming.
• AP-on-a-stick: temporary real AP at candidate spots to validate placement pre-installation.
• Wi-Fi analyzer: decodes 802.11 only — shows networks, channels, signal strength, overlap, dead zones.
• Spectrum analyzer: sees raw RF energy — the only tool that reveals non-Wi-Fi interference sources.
• BSSID = per-radio MAC-format identifier; used to tell same-SSID APs apart and to flag rogue APs.
• Validate every predictive design with an onsite walk before calling a deployment done.