Airborne wifi survey system

[253flo]

I am looking to build an airborne wifi survey system.

My idea is to run a panel antenna off the side window of the aircraft. The antenna will connect to an LNA, then an RF combiner, then to several alfa cards including a Tetra, each radio will cover only 3-4 channels. The reason for multiple cards is due to the aircraft speed, I do not want to miss APs, clients, or devices. My thought with using multiple alfas is that I can dwell on channels at a higher rate vice having only one radio and hopping on a bunch of channels which will likely lead to missing APs, clients, and devices. The alfas would then run to a usb hub and then to a laptop. I would really like to use PineAP as the SW interface.

Questions:

-Can I use external wifi cards like an Alfa with a Tetra and PineAP?

-Is PineAP a viable UI and capable interface for this setup?

[Cap_Sig]

You are correct the more adapters you have locked on smaller channel ranges or possibly one adapter per channel the better your scans.  

There are compatible USB adapters that work with the tetra but I'm not sure about a way to use them with PineAP for anything other than a client mode adapter.

Have you considered doing a setup with kismet?  It is a great tool for what you are looking to do.  If you plan to directly connect the USB adapters to your laptop why would you want the GUI interface to be PineAP?  The adapters would not work with the tetra this way as they would need to be connected to the tetra directly.  You should look into the new kismet interface that is a browser based GUI.  You could even use a raspberry pi to run the kismet server and manage the interfaces if you want a standalone device.  This way you could have a standalone device with several adapters then just connect to the pi and access the kismet GUI.  You can also run the whole show from a laptop as well that has kismet and connect all your USB interfaces to it directly.

[Cap_Sig]

Also just curious, what kind of aircraft do you plan to do this from?  I'm hoping a small personal aircraft.  I would not recommend having out a laptop, tetra, several USB adapters, and patch antennas in a commercial airline...

[253flo]

11 hours ago, Cap_Sig said:

You are correct the more adapters you have locked on smaller channel ranges or possibly one adapter per channel the better your scans.  

There are compatible USB adapters that work with the tetra but I'm not sure about a way to use them with PineAP for anything other than a client mode adapter.

Have you considered doing a setup with kismet?  It is a great tool for what you are looking to do.  If you plan to directly connect the USB adapters to your laptop why would you want the GUI interface to be PineAP?  The adapters would not work with the tetra this way as they would need to be connected to the tetra directly.  You should look into the new kismet interface that is a browser based GUI.  You could even use a raspberry pi to run the kismet server and manage the interfaces if you want a standalone device.  This way you could have a standalone device with several adapters then just connect to the pi and access the kismet GUI.  You can also run the whole show from a laptop as well that has kismet and connect all your USB interfaces to it directly.

Thanks for the response, the reason my first thought was to use PineAP (which I have never used) is that the GUI seems to be a little more user friendly when I'm looking at going beyond a survey. I have been playing around with the Kismet lately and do like the layout, sounds like this is the right solution if mutilpe cards cannot be supported by the PineAP. One idea is to use a Tetra and PineAP when targeting a specific AP or device.

Another part I'm struggling with is how to geolocate APs and devices. I have looked into GISkismet but, to my knowledge there is no way to indicate the antenna reference while incorporating GPS. For example, if I put the antenna on the right side window and the parameters are for a 30deg coverage. GISkismet will not know the antenna location. Thus not providing accurate geolocation of APs and devices. I'm not saying this is the gospel but this is how I understand it so far. I would be interested if anyone has any feed back on this.

 

[253flo]

1 hour ago, Cap_Sig said:

Also just curious, what kind of aircraft do you plan to do this from?  I'm hoping a small personal aircraft.  I would not recommend having out a laptop, tetra, several USB adapters, and patch antennas in a commercial airline...

Haha yes planning to do this on a buddies Cessna however that would be awesome to see someone doing this on a comm bird.

[Cap_Sig]

9 hours ago, 253flo said:

Another part I'm struggling with is how to geolocate APs and devices. I have looked into GISkismet but, to my knowledge there is no way to indicate the antenna reference will incorporating GPS. For example, if I put the antenna on the right side window and the parameters are for a 30deg coverage. GISkismet will not know the antenna location. Thus not providing accurate geolocation of APs and devices. I'm not saying this is the gospel but this is how I understand it so far. I would be interested if anyone has any feed back on this.

This would probably require some custom work.  I don't now of any scanner that will incorporate that feature as is at this point.  The way most programs GPS locate an AP is by storing the point of strongest signal received (point referenced being the location of the GPS unit).  You are getting more into the realm of triangulation of a signal.  This could be done but again will not be your typical setup.  Kismet will log what adapter saw the AP so you could rename your adapters in the config file for the specific antennas.

9 hours ago, 253flo said:

the reason my first thought was to use PineAP (which I have never used) is that the GUI seems to be a little more user friendly when I'm looking at going beyond a survey.

Just a friendly reminder, to do so you will need permission to access those networks if they are not OPEN...

9 hours ago, 253flo said:

Haha yes planning to do this on a buddies Cessna however that would be awesome to see someone doing this on a comm bird.

This what I figured haha.  Also thought giving it a try would be interesting even with standard setup like a few adapters and kismet.

 

[253flo]

20 minutes ago, Cap_Sig said:

This would probably require some custom work.  I don't now of any scanner that will incorporate that feature as is at this point.  The way most programs GPS locate an AP is by storing the point of strongest signal received (point referenced being the location of the GPS unit).  You are getting more into the realm of triangulation of a signal.  This could be done but again will not be your typical setup.  Kismet will log what adapter saw the AP so you could rename your adapters in the config file for the specific antennas.

 

Tracking the RSSI values based on each GPS position drive where GISKismet plots a lat/long which from what I understand is all based off an omni directional antenna. However, since I will likely only be using a panel antenna, I think I would have to somehow indicate to GISKismet that based on my GPS heading my antenna is always pointing +90deg (if antenna is in right window) and my antenna coverage is 30deg off the 90deg bearing. A lot to unpack there.... No clue where to start.

[Cap_Sig]

@253flo it is an interesting concept.  Maybe someone else will have some info to lead you in the right direction.

I'm differently interested in the idea and will do some thinking on it.  May try the kismet discord and see what you come up with there as well.

Post any updates!

[Cap_Sig]

29 minutes ago, 253flo said:

Tracking the RSSI values based on each GPS position drive where GISKismet plots a lat/long which from what I understand is all based off an omni directional antenna.

This is true but does not necessarily require an omni antenna.  It is just looking at highest RSSI strength then logging the GPS long/lat of the strongest recorded position.  Still though no help for what you are looking to do as this would just log the location of the GPS unit.

So just to clarify for myself and future members, you are just wanting to reference what antenna direction the adapter is facing when logging an AP?

Just wanting to make sure that you are not wanting to "triangulate" the location of an AP as this would require more than that.  

[253flo]

10 minutes ago, Cap_Sig said:

@253flo it is an interesting concept.  Maybe someone else will have some info to lead you in the right direction.

I'm differently interested in the idea and will do some thinking on it.  May try the kismet discord and see what you come up with there as well.

Post any updates!

Thanks, I would love to hear other ideas on how to make this happen. I will checkout discord and was also just looking at Kestrel, it maybe another mapping option.

[253flo]

11 minutes ago, Cap_Sig said:

This is true but does not necessarily require an omni antenna.  It is just looking at highest RSSI strength then logging the GPS long/lat of the strongest recorded position.  Still though no help for what you are looking to do as this would just log the location of the GPS unit.

So just to clarify for myself and future members, you are just wanting to reference what antenna direction the adapter is facing when logging an AP?

Just wanting to make sure that you are not wanting to "triangulate" the location of an AP as this would require more than that.  

One of my goals is to geolocate APs and devices utilizing a directional panel antenna and being able to visualize this data geospatially. Referencing the angle of the antenna will be one of the key peices into this calculation. Since I plan to only have one antenna perpendicular to the aircrafts heading, I will likely be "forced" into triangulating.

I imagine flying in a circle around my house would likely give me the most accurate location of my AP....essentially triangulating.

 

[Cap_Sig]

Gotcha.  I better understand what you are trying to do now.  Think I might have confused myself more than you did 😂

So after thinking a little more on it,  You might start looking at wifi heat mapping projects for a starting point.  Pretty much is the same thing you are wanting to do, expect it would just need some modification to display the central point.

This is another idea I remember seeing that is what you are looking to do just different method and hardware. https://hackaday.io/project/11611-wifi-triangulation

Also thinking about it more, I don't think you need to be so worried as to the antenna configuration with the program used.  All of the angle information should really only be needed if you are trying to locate something in the Z plane.  What you are looking to do is only the X Y planes (long,lat). The biggest part of it will be collecting as many points as possible with signal strength information.  

But back on the subject of your directional antennas.  To use them would require a LOT of backend program work as it would need to know every aspect of the antenna (EVERYTHING) as well as a way to log plane headings so the program can calculate the actual antenna direction...

My opinion for what its worth, give it a try with higher powered wifi adapters using omni directional antennas.  See how the results are and go from there.

[253flo]

1 hour ago, Cap_Sig said:

This is another idea I remember seeing that is what you are looking to do just different method and hardware. https://hackaday.io/project/11611-wifi-triangulation

Thanks, I'll dig into this, I haven't seen this article yet.

1 hour ago, Cap_Sig said:

Also thinking about it more, I don't think you need to be so worried as to the antenna configuration with the program used.  All of the angle information should really only be needed if you are trying to locate something in the Z plane.  What you are looking to do is only the X Y planes (long,lat). The biggest part of it will be collecting as many points as possible with signal strength information.  

Can you expand on this? I'm not really sure what you mean.

1 hour ago, Cap_Sig said:

But back on the subject of your directional antennas.  To use them would require a LOT of backend program work as it would need to know every aspect of the antenna (EVERYTHING) as well as a way to log plane headings so the program can calculate the actual antenna direction...

Agreed, there is absolutely some type of SW plug-in or add-on I would need built for Kismet and/or PineAP to ingest the current GPS heading to identify the relative angle of the antenna adjacent to aircraft heading. Would love to hear any ideas on this.

1 hour ago, Cap_Sig said:

My opinion for what its worth, give it a try with higher powered wifi adapters using omni directional antennas.  See how the results are and go from there.

Not a bad idea, but my concern with this is that the range of a 15dbi omni antenna with a clear line of sight will only give me a range of about 1100ft (please correct me if I am wrong). Flying around at 500ft isn't really ideal. I'm sure adding a LNA or something like this: https://shop.hak5.org/collections/wifi-gear/products/long-range-wifi-kit will help. This is why I continue to go back to a panel antenna where my range will increase significantly.

[Cap_Sig]

1 hour ago, 253flo said:

3 hours ago, Cap_Sig said:

Also thinking about it more, I don't think you need to be so worried as to the antenna configuration with the program used.  All of the angle information should really only be needed if you are trying to locate something in the Z plane.  What you are looking to do is only the X Y planes (long,lat). The biggest part of it will be collecting as many points as possible with signal strength information.  

Can you expand on this? I'm not really sure what you mean.

So when mapping a GPS location you have Longitude, Latitude, and Elevation(Altitude).  When pin pointing an AP location the elevation is not really that important, we are just wanting the long/lat location of the AP.  So as long as a omni directional antenna is used there is no need for all the antenna related information on the backend to achieve this.  Or the possibility of using an array of directional antennas to more or less "blanket" 360 degree view the same way a single omni antenna would could possibly work.  

1 hour ago, 253flo said:

Not a bad idea, but my concern with this is that the range of a 15dbi omni antenna with a clear line of sight will only give me a range of about 1100ft (please correct me if I am wrong). Flying around at 500ft isn't really ideal. I'm sure adding a LNA or something like this: https://shop.hak5.org/collections/wifi-gear/products/long-range-wifi-kit will help. This is why I continue to go back to a panel antenna where my range will increase significantly.

To answer that requires more information.  Your range of an antenna is more than just the dbi of that antenna.  It is also based off the transceiver used and its RX sensitive as well as other factors like coax loss and SWR of the setup.  On top of that the transmitting power of the AP will change the range it is seen from.

[253flo]

22 hours ago, Cap_Sig said:

So when mapping a GPS location you have Longitude, Latitude, and Elevation(Altitude).  When pin pointing an AP location the elevation is not really that important, we are just wanting the long/lat location of the AP.  So as long as a omni directional antenna is used there is no need for all the antenna related information on the backend to achieve this.  Or the possibility of using an array of directional antennas to more or less "blanket" 360 degree view the same way a single omni antenna would could possibly work.  

To answer that requires more information.  Your range of an antenna is more than just the dbi of that antenna.  It is also based off the transceiver used and its RX sensitive as well as other factors like coax loss and SWR of the setup.  On top of that the transmitting power of the AP will change the range it is seen from.

Something that was pointed out to me was that Kismet is going to geotag received packets with its current location; so the packet location in the db is not really the emitter location but the sensor location. So pointing the antenna directly down under the aircraft to geo emitters may be best.

Any idea what the most common or avg TX power of an AP and device is?

 

[Cap_Sig]

5 hours ago, 253flo said:

Something that was pointed out to me was that Kismet is going to geotag received packets with its current location; so the packet location in the db is not really the emitter location but the sensor location. So pointing the antenna directly down under the aircraft to geo emitters may be best.

That's correct.  This is why multiple points (the more the better around the target AP) is required to then process all those db entrees to find the center location.  This is how near all "triangulation" works in some manner.

5 hours ago, 253flo said:

Any idea what the most common or avg TX power of an AP and device is?

There may be some "common" numbers, but in the wild (reality) it is widely varying.  Just an example lower cost AP that some ISP provided are 50-100 mW but some nicer Netgear routers like the R7000 can be set to auto adjust or turned up to 1 W.  Now 1 W is probably not very common in the big picture but it is out there.  And there are APs that can be set even higher.  In the USA the max TX power by law is 1 watt, EIRP 36 dBm, and 4 watts EIRP.  The transmit power is straight forward but your EIRP is a relation of TX power and antenna gain.

This is probably a little bit of information overload...

Now really what you are worried about wise of hardware on your side is RX.  Really just want to have a high sensitivity receiver and antenna type.

You mind sharing some more details on what wifi adapters and antennas you plan to use?  If go some free time I'd take a look at it all just out of curiosity. I have seen a build for doing this kind of thing with a drone, but it is lower AGL in flight, slower speed, etc making it easier with basic equipment.

[253flo]

14 hours ago, Cap_Sig said:

Now really what you are worried about wise of hardware on your side is RX.  Really just want to have a high sensitivity receiver and antenna type.

Bingo, this is why I keep going back to a panel antenna.

14 hours ago, Cap_Sig said:

You mind sharing some more details on what wifi adapters and antennas you plan to use?  If go some free time I'd take a look at it all just out of curiosity. I have seen a build for doing this kind of thing with a drone, but it is lower AGL in flight, slower speed, etc making it easier with basic equipment.

Absolutely....this will probably be a little bit more extensive than what you'd find on a drone. A personal aircraft can carry a larger payload, so I'm going to take advantage:

• Panel antenna: I will likely go with a panel between 30-60deg with at least 9dbi. If I go with the face the panel down to locate emitters I will probably want less of a deg coverage but if I go with the panel in the window to target already know emitters I will want a wider deg coverage. I will probably settle for something in the middle due to the cost.

https://www.simplewifi.com/collections/antennas/products/panel?variant=43139723151

• LNA: These can get very expensive, I will start off cheap. I realize I will get what I pay for but if the cheaper LNAs work I'll use them. I'm gonna grab a cheap one from ebay and then try my luck with an LNA4ALL.

https://www.ebay.com/itm/Bias-Tee-Wideband-10-6000-MHz-6GHz-for-HAM-radio-RTL-SDR-LNA-Low-Noise-Amplifier/322365135389?epid=17021762201&hash=item4b0e759a1d:g:YC4AAOSwZoBdJHZU

https://lna4all.blogspot.com/2013/04/lna-for-all-low-noise-amplifier-for.html

• Battery: A battery will be required to power the LNA.
• RF Combiner: Not sure the level of quality I need here but something like this in the link below should do just fine for 2.4ghz.

https://www.ebay.com/itm/RF-4-Way-Power-Splitter-Combiner-2-4Ghz-N-Female/141504372027?hash=item20f2515d3b:g:qhAAAOSwaNBUigvc

• Wifi cards: I will go with 4x Alfa AWUS036NH cards for 2.4ghz, I've been using this card for a year plus and its been great. Not yet sure what I'll use for 5ghz or what the gain/loss benefits are on a dual band card, same goes for the antenna, not sure the gain/loss benefits are on a dual band antenna. I would like to use a Tetra for monitoring specific APs, the Tetra might be used when the panel is in the window.
• Cables and connectors: I'm going to use thick high quality cables and get the shortest possible ones available. If I can just use connectors I will, not sure yet if its doable. I have not sources these yet.
• USB hub: I'm looking at a 4-7 port 3.0 usb hub, something on amazon should do the job.
• Laptop or Pi: I have a Lenovo that has an i7 processor, 16gb of ram, running Kali on VM which should be just fine. Another idea I had was to connect the cards to a pi and kick back the data via a 3g/4g dongle to a server then retrieve the data at home from my laptop, I'm still a ways off on figuring out how to do  that so I will start off with the laptop.

Feedback on the HW setup is absolutely welcome. Fire away!!

[Cap_Sig]

20 hours ago, 253flo said:

Absolutely....this will probably be a little bit more extensive than what you'd find on a drone. A personal aircraft can carry a larger payload, so I'm going to take advantage:

Agreed and understand.  I'm a pilot, so I have some understanding from the manned aircraft side of things.

20 hours ago, 253flo said:

If I go with the face the panel down to locate emitters I will probably want less of a deg coverage but if I go with the panel in the window to target already know emitters I will want a wider deg coverage. I will probably settle for something in the middle due to the cost.

Downward facing antennas are going to be the easiest way to start and possibly even the best way.  Your biggest issue with this is going with directional antennas will mean that your system only works in level flight.  If your are banking your antenna beam now becomes off center.

The big question in making an antenna selection is deciding what AGL you plan to maintain in the aircraft.  You will need to run a calculation at that AGL what you antenna beam width will be at the surface.  This can help determine a lot about reception quality and coverage.

Also, I think doing this in slow flight will probably have to be done as well.  Flying at cruise speed even in a slower C172 will probably be to fast for it to work and not be several hundred $ in on the equipment.  

21 hours ago, 253flo said:

LNA: These can get very expensive, I will start off cheap. I realize I will get what I pay for but if the cheaper LNAs work I'll use them. I'm gonna grab a cheap one from ebay and then try my luck with an LNA4ALL.

You just want to keep in mind that in the radio world side of things cheap LNAs can cause added unwanted noise reducing your systems ability.  For the cost give it a go.  It may work perfect.

20 hours ago, 253flo said:

RF Combiner: Not sure the level of quality I need here but something like this in the link below should do just fine for 2.4ghz.

What is your need for this?  If you are running 4 adapters, do you plan to have multiple antennas on each? 

20 hours ago, 253flo said:

Alfa AWUS036NH

My go to adapter for a lot of projects.  Probably a good and affordable starting point.

20 hours ago, 253flo said:

Laptop or Pi

This really just comes down to how much throughput you want to get and how extensive of data you plan to collect.

20 hours ago, 253flo said:

Another idea I had was to connect the cards to a pi and kick back the data via a 3g/4g dongle to a server then retrieve the data at home from my laptop

I would recommend avoiding this idea.  You will extremely bottleneck your throughput.  Not to mention how spotty cell service can be even at 1,000 ft AGL at times, but this really is more of a local issue that may work for certain areas.

 

These are just my thoughts on what you presented.  Your first step maybe taking a AWUS036NH with a cheap panel antenna and fly your intended AGL to see what kind of reception you actually get.  This could really set the road for what steps are next in this build.  It is a really cool idea and look forward to hearing more!

[253flo]

14 hours ago, Cap_Sig said:

Downward facing antennas are going to be the easiest way to start and possibly even the best way.  Your biggest issue with this is going with directional antennas will mean that your system only works in level flight.  If your are banking your antenna beam now becomes off center.

The big question in making an antenna selection is deciding what AGL you plan to maintain in the aircraft.  You will need to run a calculation at that AGL what you antenna beam width will be at the surface.  This can help determine a lot about reception quality and coverage.

Agreed, straight and level passes will should provide the most accurate positions. Funny you mention the beam width at the surface, I worked on this, this morning. The calc is: TAN(1/2 the horizontal beam width in deg)*alt*2= horizontal beam width distance, so if I have a beam width of 30deg and at 1000ft agl, I will have a 535.9ft horizontal beam width coverage on the ground. 30deg at 2500 agl = 1340ft ground coverage.

14 hours ago, Cap_Sig said:

Also, I think doing this in slow flight will probably have to be done as well.  Flying at cruise speed even in a slower C172 will probably be to fast for it to work and not be several hundred $ in on the equipment.  

Agreed 100%, the slower the better. This is also why I am using 4 alfa cards each card can monitor several channels hopefully not missing too much.

14 hours ago, Cap_Sig said:

What is your need for this?  If you are running 4 adapters, do you plan to have multiple antennas on each? 

The four alfa cards antenna cables will run to the rf combiner, the input will run to the antenna.

14 hours ago, Cap_Sig said:

I would recommend avoiding this idea.  You will extremely bottleneck your throughput.  Not to mention how spotty cell service can be even at 1,000 ft AGL at times, but this really is more of a local issue that may work for certain areas.

True, I have some other ideas how I really want this to work, an airborne solution probably isn't the best.

14 hours ago, Cap_Sig said:

These are just my thoughts on what you presented.  Your first step maybe taking a AWUS036NH with a cheap panel antenna and fly your intended AGL to see what kind of reception you actually get.  This could really set the road for what steps are next in this build.  It is a really cool idea and look forward to hearing more!

Thanks, I really appreciate all the feedback. Its good to hear others viewpoint and recommendations.

[Cap_Sig]

Overall I think you have a good starting point to give it a try.  I think all should work fine down to actually pinpointing the AP location.  This is where work may need done.

But, using of a downward facing antenna might help this by using more of a "foxhunt" method of tracking.  This has been done for a long time on the ground with amateur radio.  Biggest difference here is in traditional foxhunting very focused antennas are usually used to do final pinpointing of transmitters.

Maybe one question I should have asked is how accurate you are looking to get?  Are you wanting the dot on the map to be near the "room" the AP is in? or just in the yard of the structure? If the latter is true, then you may have no further software side needs than kismet.

Might talk to your pilot friend if they use ForeFlight.  Depend on the version they have you could even lay out grid flight paths then use it as a form of guidance to better map your target area based off your antenna calculation to insure the best coverage possible! 

[253flo]

On 9/10/2019 at 2:57 PM, Cap_Sig said:

Maybe one question I should have asked is how accurate you are looking to get?  Are you wanting the dot on the map to be near the "room" the AP is in? or just in the yard of the structure? If the latter is true, then you may have no further software side needs than kismet.

I'd like to get down to the house. I think that should be somewhat reasonable.

On 9/10/2019 at 2:57 PM, Cap_Sig said:

Might talk to your pilot friend if they use ForeFlight.  Depend on the version they have you could even lay out grid flight paths then use it as a form of guidance to better map your target area based off your antenna calculation to insure the best coverage possible! 

Foreflight is money!

[Cap_Sig]

1 hour ago, 253flo said:

I'd like to get down to the house. I think that should be somewhat reasonable.

I think that is a fair and reasonable goal.  I think kismet as is with your described setup could possibly achieve this.

1 hour ago, 253flo said:

Foreflight is money!

Yes it is! Though I learned with paper maps and an E6B, never leave the house without it 👍

[253flo]

I keep going back and forth on LNAs currently looking at this LNA: https://www.tindie.com/products/gpio/low-noise-amplifier-10mhz-to-8000mhz-w-40-db-gain/, I really like the USB power option (makes life easier) and obviously +30db gain at 2.4ghz is good and I could use it for 5ghz. If its too much gain I can get an attenuation pad.

Then I started thinking that I may not only want to receive but transmit, which would be awesome. I'd need a bidirectional amplifier for this, after looking around I found 4 Alfa products but not seeing any options outside of Alfa. The three products (attached) only work on b/g but, I think most networks are on -n by now. The APAG05-2 ($125) is advertising a range of 20-40km with no obstructions......that's ridiculous. The APAG05-2-PoE (not attached) advertises it works on -n.

What to do.....

57a69d42-66db-425d-9825-246e95ca3bf5_APA05MD.pdf 2863c393-1abc-49df-b609-8f815e74a3ad_APAG05-2 Outdoor Booster.pdf f09b9bc6-62e6-4cf7-8f49-d577f2f65fa1_APA05 - PEN Booster.pdf

[Cap_Sig]

I will take a look at what you posted and do a little additional looking around.  The USB option is convenient.  Not sure what exact model Cessna your friend has but quite a few have or have been upgraded with a 12 volt source which could be a possibility if you are trying to avoid a battery pack.   

A lot of routers by default (rarely changed in my experience) support b,g,n so having a g amp should still be a feasible solution as well.  That range you referenced will be effected by antenna selection so my do some research on to what kind of antenna that is rated on.  

I should get some time to dig into it with the next day.  Have you decided on a software to go with?  Still think kismet might be a good starting point with how well documented it is and the configuration options for channel selections on each adapter to give better coverage of the spectrum.

[Cap_Sig]

1 hour ago, 253flo said:

Then I started thinking that I may not only want to receive but transmit

On this though, what kind of things would you want to do from the air transmitting?

The reason I ask is doing so from a moving airplane is probably not the most practical with stationary mounted antennas and the fact of having to always stay within range of a AP.  This could lead to some difficulty without some large power on the TX side or some sort of signal tracker antenna setup.