As a frequent reader here will know, my Wi-Fi Analyzer of choice is called WinFi. It has been around many years as is fabulous.
In version 2, and the new version 3, you can capture Wi-Fi Beacon Frames and examine them. This post will explain what you can capture and how this is useful.
What You Will Need
You need two things to make this work:
- WinFi the program – grab the latest here then click on the latest Release (right side)
- Wireshark the program – grab the latest here.
- If you don’t want Wireshark, it’s OK. Make sure you have an editor, and towards the end of the post below I will explain how you can view the critical information as text.
First Step
With both of those installed, first open WinFi and let it scan for a minute or so. You will have a screen similar to this (I have deliberately blurred potential sensitive info):
Step 2
On the WinFi screen, select the network you are interested in, right click on the WLAN Network Name, and from the pop up, select Open Network as a Pcap:
This will automatically start Wireshark and you will get something like this:
Note that we now have the “beacon frame” from the network (1). A beacon frame in a WLAN (Wireless Local Area Network) is a type of management frame broadcast periodically by an Access Point (AP) to announce its presence and provide essential network information to nearby wireless devices. This frame includes details such as the Service Set Identifier (SSID), supported data rates, timestamp, capabilities (e.g., encryption types), and information about the AP’s operating channel. Beacon frames enable client devices to discover available networks, synchronize their clocks with the AP, and determine compatibility before initiating a connection. They are crucial for network visibility and maintaining efficient wireless communication.
We also see the contents of this frame (2) on the lower left. Those little “>” carets can be clicked on and expanded to see the details, but I will stop there as this can get rather deep rather fast.
A Couple of Things to Make This Even Better
This first thing is to make Wireshark a ton better, grab my WLAN Wi-Fi Troubleshooting Profile here and install it in Wireshark, then you will get this:
Many columns to extract important information (1) and filter buttons (2) than are probably more useful if you were to capture in monitor mode, but still cool.
Second, the new version of WinFi – version 3 – is about to be released. Version 3 does the same exact operation to view these Beacon Frames. Look for it soon. I am using it and you can download the latest WinFi V3 version from here: https://github.com/HelgeKeck/dummy/releases/download/dummy-3.0.0.75/dummy.zip Here is a preview:
Third, lets say you do not have Wireshark, you can still see the beacon frame info simply as Text (also CSV, etc). In fact you have two ways to do this:
Option 1, simply select the WLAN Network Name you are interested, again, right click, this time selecting Copy as Text:
Once copied, paste into any text editor or word processor:
Option 2 – if you are using the version 3 or later version of WinFi, you can literally view this information inside the tool. Simply select the network you are interested in from the list, then in the bottom part of the screen, select Parameters:
Done! All the critical information from that Beacon Frame can be seen, pasted into a trouble ticket, whatever.
Comments are welcomed below from registered users. You can also leave comments at our Discord server.
If you would like to see more content and articles like this, please support us by clicking the patron link where you will receive free bonus access to courses and more, or simply buying us a cup of coffee!