Description
This article describes Beacon's management frame.
Scope
All 802.11 technologies.
Solution
All access points, stations, and IBSS use Beacon frames, are fundamental to create a communication based on WLAN networks. The beacon announces the presence of an Access Point nearby, and therefore the device can be connected to the network.
Let´s analyze the format making a comparison with one FortiAp421E, as it is visible, there are some mandatory fields and some optional fields.
It is possible to obtain a frame packet capture using a wireless card that supports monitor mode in combination with aircrack-ng and airodum-ng all under a Linux distribution system.
# airmon-ng start <interface>
# airodump-ng --band abg <interfaceMonitormode>
Some beacon Frames are already captured from the FortiAP421E, use this filter: wlan.fc.type_subtype == 8
- Timestamp (8 byte): It represents the time in microseconds the Access points have been active.
- Beacon Interval (2 byte): It represents the number of time units; the default value is 100TU (102.4 milliseconds).
- Capability Information (2 byte): It shows us the number of subfields used for optional capabilities.
- SSID (variable): Service Set Identifier is present in other frame types of probe request, probe response, association request, and re-association request, when an SSID is hidden, the element ID is 0. Consider if an SSID name is given to not exceed more than 32 characters.
- Supported Rates(variable): It is possible to find out in Beacons, Probe Req, Probe Res, Association Req, Association Res, Reassociation Req, and Re-association Response. The FortiAP is supporting these rates.
- DS parameter set (2 byte): Can be generated by stations using Clause 15, 18, or 19 PHY.
- Traffic Indication Map: It contains information for stations in low-power mode. Every AP uses DTIM to inform if it has broadcast or multicast frames buffered.
- Country: It regulates the channels or power level allowed in their regulatory domain.
- Power Constraint: Dedicated for UNII2 & UNII-2 extended (CH52,56,60,64 & CH100-139) used for weather radar, and airport radar, is related to 802.11h DFS.
- RSN Information: Authentication Cipher, Encryption Cipher, and other RSN capabilities of stations will be discovered. In the FortiAP WPA2 RSN IE - PSK / CCMP = 00-0F-AC-04 CCMP is used.
- HT Capabilities: Used in 802.11n It shows us values supported by the wireless network including the Modulation Coding Schemes, used by a FortiAP and device for sending unicast traffic.
- VHT Capabilities: Used in 802.11ac.
VHT Operation: The FortiAP works at 20MHz or 40MHz channel width.
- Vendor Specific: Related to the cipher suite selector, it includes four bytes long and it starts with an OUI for the vendor.
