// reference · beacon ie decoder
Beacon IE Reference
A beacon frame is not just an AP advertisement — it's a complete protocol capability map. Every Information Element tells you exactly what the AP supports, what security it enforces, and which amendments are active.
— Shankar K. · Source: IEEE 802.11-2024 + field notes · Wireshark: wlan.fc.type_subtype == 0x08
// typical beacon — select AP generation
IEs present in this beacon type (click any for details):
Wireshark filter to see only beacons:
wlan.fc.type_subtype == 0x08 ⌕
// beacon frame structure — fixed fields (before IEs)
Timestamp
8 bytes
Number of microseconds AP has been active. Used for TSF synchronisation. When it reaches max (2^64 μs ≈ 580,000 years) it resets.
Beacon Interval
2 bytes
Time between beacons in TUs (Time Units). 1 TU = 1024 μs. Default = 100 TU ≈ 102.4 ms. Shorter = more overhead. Longer = slower discovery.
Capability Information
2 bytes
16 bits indicating AP capabilities: ESS bit (infrastructure mode), Privacy bit (WEP encryption), Short Preamble, PBCC, Channel Agility, QoS (802.11e), Short Slot Time, APSD, DSSS-OFDM.
Decode beacon IEs from a real PCAP
WiFi Analyser parses every IE automatically — RSN mismatches, missing capabilities, and BSS Color collisions flagged without reading hex manually.
// share this page
// also on this site
SK
— Shankar K., Wi-Fi engineer, Irving TX
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks
// leave a comment