Analysis: what the sensor can detect and attribute¶

Date: 2026-10-20; the table updated on 2026-10-21. Question: how far the goal holds after the first week with the hardware and ten testlab scenarios: detecting a client's problem and attributing it to one outcome (AP side, client side, RF environment, upstream / not Wi-Fi, measurement limit, undecided). Sources: docs/measurements/, the testlab recordings (testlab.md, test data), the hint rules (rules) and the code of BlockAckTracker and HintRules. Labels: [B] measured or in the code · [W] likely · [O] uncertain.

The actions that follow from it are in the plan (docs/status.md), the scorecard in test data.

Summary¶

• Problems made of events (login, disconnect, roam) are detectable and attributable over the air: the testlab scenarios with a wrong PSK, a refused SAE group, a client leaving, an AP kick and an AP reboot came out as caused [B]. With PMF the reasons, BTM and 11k are encrypted and move to Mist; the sender of a frame stays visible [B].
• Performance complaints are detectable: BA success per direction works where the data decode does not [B]. Their side is often not attributable from beside the client: the sensor hears the client's surroundings, not the AP's. Without Mist or a second vantage point an uplink loss stays undecided [B, by design]. In the first cases undecided is likely the most common outcome for a performance complaint [W]; that is honest, not a failure.
• Upstream is a conclusion by elimination ("Wi-Fi looks fine", on a quiet channel). It is as good as BA success, which has no ground truth yet and counts a PPDU lost whole and delivered on a retry as delivered [B, code]; the TXOPs that start with an RTS show part of that (txop-loss.md) [B].
• Mist turns from an addition into a prerequisite: for the encrypted evidence, for the side of an uplink loss and for a positive upstream finding.
• The rules fit the home testlab: ten of the sixteen scenario recordings came out right only after a rule change, and no recording was held out [B]. The false alarm rate in dense campus RF is unknown [B].

What holds¶

• The capture chain: rule 1 verified by cross-capture, the truncation enforced in the kernel, no drops at the testlab's rates [B].
• BA success survives the sensor's limits. With the monitor at 20 MHz next to a 160 MHz BSS it still came out at 99.7 % down and 98.0 % up from 55,000 BAs (eht-6g-20-A in eht-capture.md) [B]. The primary metric therefore holds where data frames are not decoded: EHT MCS 13 [B], 320 MHz and puncturing [W, untested].
• The sensor misses data mainly at a high MCS, when the link is good; at a low MCS it decodes it (eht-6g-160-B: every downlink MPDU at MCS 4–6) [B]. The blind spot of the rates shrinks where the rates matter.
• The decision model separates tested from untested, and an observation without a side does not decide [B]. With one expert user that matters more for trust than any further rule.

Per problem class¶