3

Does anyone know of a way to count 802.11 beacons for the network you're already connected to? Doesn't matter if its an Access Point or Adhoc network as both will issue 802.11 beacons.

I'm asking this question from a Linux platform perspective. I've been working with Adhoc networks and Linux devices, and need a method of determining if the nodes in the network are alive without having to write a heartbeat service. I know that Access Points issue 802.11 beacons regularly for clients to detect them and wondered if an Adhoc network clients had some similarities. (there are Adhoc features relating to ESSID and BSSID that would suggest the clients would have to advertise the Adhoc network)

I've been testing this theory by using Kali Linux and an Alfa Wifi adapter to monitor 802.11 wireless traffic. (not a typical setup, and I only want to count beacons from the connect network) I then setup a 2 node Adhoc network between 2 Linux systems. airodump-ng noted that the clients were generating a lot of frames. I admittedly didn't set an iptables rule to block all outbound TCP/UDP, so the activity could have been some background process trying to get online.

After firing Wireshark up I noticed that some, if not all, of the frames were 802.11 beacons! They were emitted very regularly, like 2-5 beacons per-second.

I don't know if there's some function or configuration that 802.11 Adhoc must be in to issue these beacons or if it can be tuned, but they are there.

A function could be written to count beacons for the connected Adhoc network, and if one of the clients stops sending them, you could assume that communication was down with that client.

The problem is I need a method for seeing/counting 802.11 beacons for the network I'm already connected to, without a special wifi adapter or pen testing tools. Any suggestions? Thanks!

0

Possible with wireshark

You can use a beacon filter in wireshark like

wlan.bssid==mac_address && wlan.fc.type_subtype eq 8

where

mac_address is mac address of AP emitting the beacons

wlan.fc.type_subtype eq 8 : This will capture all beacon frames only from this mac

Also wireshark has a time column which shows you the time in seconds of a beacon recieved. This can be a good indication of time lapses.

Counting recursively might be an issue but...

After executing your filter, you can get a count on your beacon filter.

In Wireshark go to:

Statistics ----->Summary

This will gave you a count at the time you check. Everytime you want to view the updated count you will have to back to summary.

  • 1
    This is only possible if the 802.11 adapter/driver can be put into monitor mode. If it can't, you can't see the 802.11 beacons as they will will be filtered out. Monitor mode opens the flood gates. I was hoping there was a way to capture beacons for an attached network, but there isn't without a supporting adapter. – garlicman Feb 20 '15 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.