Wireless Frame Analysis involve understanding what to look for in the 802.11 packet. Here lets look at “Beacon” Wi-Fi Management frames and those Interesting packet fields that can come handy while you troubleshoot client connectivity and performance issues caused by beacon frames.
802.11 management frames enable stations to establish and maintain communications.
The following are common 802.11 management frame subtypes:
The access point periodically sends a beacon frame to announce its presence and relay information, such as timestamp, SSID, and other parameters regarding the access point to radio NICs that are within range. Radio NICs continually scan all 802.11 radio channels and listen to beacons as the basis for choosing which access point is best to associate with.
The Beacon frame has some information that we could glance through.
Section 1 : Physical Header of a Beacon: The radio tap header information are basically pseudo-header to supply additional info from driver to userspace.
And I use wire-shark to decode the packets for analysis and sometime it also depends on how best the software decodes the Wi-Fi packets for analysis. Rarely you might get to see some issues on the protocol analyzers that fail to decode the information right. we might need to double confirm with another (It just happens in corner cases)
The following are few information we have in physical header
*The signal strength
*data rate of the packet
Section 2 : MAC Header and Frame Control of a beacon frame
Following information’s are available in MAC-LAYER.
*Type of fame
*Frame control Flags
*Source address of the frame
*Destination address of the frame : FF:FF:FF:FF:FF:FF(Broadcast)
Section 3: Beacon Frame Body
Following information’s are available in frame body of Beacon frame.
*capability information: Support for APSD, BLOCK-ACK
*Vendor Specific attributes
Wi-Fi troubleshooting with Beacon Frame:
1.)Beacon Miss : I have experienced issues where client missing to hear the beacons would cause them go for repeated frequency scanning and re-association request or disconnections. Some clients are so sensitive that missing 3 or 4 beacons will cause a disconnection and few other survive till 7 too.
You might need to analyse the AIR traffic to see if AP sending out beacons at regular interval or if the beacons getting corrupted in Air or if client receives a corrupted frames.
In such cases try to plot a IO graph in your Wireshark application and/or enable the column DELTA TIME in Wireshark, which ever is your choice or if both. I prefer to use IO output(this can be further more customized during the Tshoot). NOTE: Getting the exact/close enough problem time frame is key thing.
The Below sample graph shows you the total traffic on AIR captured VS Beacon (IN RED)send out by AP for a given time.
Y-axis represents number of packets and X-axis shows with respect to the time interval.
Default beacon interval time on most vendors are usually every 0.1024 second.
2.)Wifi signal strength identifier: If you get to sniff the traffic staying as close as possible to the client machine , you get to see how well the client can hear the SSID(signal strength). [ considering comparing receiving sensitivity of the sniffing adapter and client NIC ]. Then by Looking at the signal strength parameter you can tell if the client is connected to far away access point or having week signal.
This will help mostly to isolate issues such as network coverage holes especially for engineers who is validating the network from remote.
3.)Date rate: Looking at the rate Beacon is sent out, you can tell if lower data rate has been disabled or not. Since Beacons always sent out @ lowest rate (base rate) configured on the Essid. Also the supported rate parameter in the frame body gives you information at the lowest rate the data packet(QoS data) will be send.
4.) BSSID parameter on the Beacon will tell you which AP the beacon belong to. So you get to know how far the AP is away from the user(if the capture is taken close to the user). NOTE: BSSID is unique to an AP.
Unless the wireless infrastructure is a single channel architecture where all the APs will share the same BSSID on a given radio.
5.) If you want to know whether if the AP supports or advertising its support for WMM, Fast BSS transition support , you should be able to find that by looking at the beacon frame.
6.)RSN information on the Beacon frame will tell if the SSID is secured or open. This field is critical for a wireless client to identify if they are connected to open network or secured network and after the wireless layer 1 association(I like to call this as Layer-1) if client need to send out a DHCP packet(Layer-3) or it has to perform layer 2 authentication further like MAC-AUTH/MACHINE-AUTH/DOT1.X before layer 3.
Seen following cases in field: On a beacon frame RSN bit is set for a captive portal SSID(incorrect behavior of AP a software bug) causing the client connection issues. While in the same environment Macintosh laptops were able to survive this issue while the other IOS devices couldn’t and they were not able to associate to Wireless network.
7.)Beacon frame carries information about the AP vendor and even the AP chipset vendor in use.
Its been helpful for me adding some useful column’s such as “DATE RATE , SIGNAL STRENGTH, CHANNEL, RETRY, DELTA-TIME” in Wire-shark application during my packet analysis.
You can always add more packet list column preference that will help your packet analysis.