Beamforming Sounding Procedure

Null Data Packets have no PSDU. Most monitor mode captures miss them entirely because they have no frame body to decode. You see the NDP Announcement and the CBR response but not the NDP itself. The sounding trigger is inferred.

Some APs sound every client every 100ms. Others use traffic-triggered sounding (only when sending data). High-density deployments with many clients reduce per-client sounding frequency to manage airtime.

In MU mode, the first client in the NDP Announcement responds immediately after the NDP (no BRP needed). Each subsequent client waits for an explicit Beamforming Report Poll. If a client misses the BRP, the AP cannot beamform to it in that exchange.

VHT CBR: Category 21, Action 0. HE CBR: Category 30, Action 0. EHT CBR: Category 36, Action 0. The frame shape is similar but the MIMO Control field width and bit layout change. EHT MIMO Control is 6 bytes; VHT is 3 bytes.

802.11n introduced uncompressed beamforming (rarely implemented, high overhead). 802.11ac switched to explicit compressed beamforming only. The compression uses Givens rotations to represent the precoding matrix compactly. The compression is what makes BFI useful for sensing -- it acts as a noise filter.

An enterprise WLAN admin notices their WIDS flagging a high volume of Action No Ack frames between clients and APs in the 6 GHz band. The frames are large (2,000-4,000 bytes), periodic, and originate from every associated client. No authentication anomaly. No deauth flood. Health score drops on the monitoring system.

These are EHT Compressed Beamforming Reports (Category 36, Action 0). The AP is running the sounding procedure to maintain steering matrices for every active client. In a dense deployment with many 6 GHz clients and a high-antenna-count AP (Nr=7 or more), the combined airtime for CBR frames can be significant. Each 3,134-byte CBR at 4 Hz per client occupies real airtime at the lowest MCS available (broadcast/management rate).

The sounding procedure step shows exactly what the AP sends (NDPA, NDP) and what it receives (CBR). The MIMO Control decoder shows you how many antennas and streams the AP is measuring per client, directly from the captured hex. The privacy risk section explains why this traffic cannot be encrypted at the link layer and what an external observer can infer from it.

Beamforming means the AP focuses its Wi-Fi signal toward a specific device rather than broadcasting in all directions. To do this, the AP needs to know which way to aim. It finds out by sending a special training packet called a Null Data Packet (NDP) — a frame with no payload, just training symbols that let the client measure the channel.

The client measures how the NDP arrived — what the channel looks like between them — and sends a compressed summary back to the AP. That summary is called the Compressed Beamforming Report (CBR), and the channel information inside it is the Beamforming Feedback Information (BFI).

The AP uses the BFI to compute a steering matrix, then starts sending toward the client using that matrix. This improves throughput, especially over distance. The sounding procedure repeats periodically to track changes in the channel.

The sounding sequence begins when the AP transmits a VHT/HE/EHT NDP Announcement frame (NDPA). This is a management Action frame (not an Action No Ack) that announces which clients should provide feedback. Each client is listed by AID, along with the number of feedback streams it should report. A SIFS after the NDPA, the AP transmits the actual Null Data Packet (NDP) — a PPDU containing multiple LTF (Long Training Field) symbols per spatial stream, but no PSDU. The NDP is what the client measures.

In SU-MIMO, there is only one client. It responds with a CBR immediately after the NDP (no poll needed). In MU-MIMO, the first client responds immediately; subsequent clients each wait for an explicit Beamforming Report Poll (BRP) from the AP. This polling ensures only one client transmits at a time on the shared channel.

The CBR contains the MIMO Control field (Nc, Nr, BW, Grouping, Codebook) followed by the compressed steering matrix as quantized Givens rotation angles. The compression uses Givens factorization of the precoding matrix; the bit widths of phi and psi angles are determined by the Codebook field. Larger antennas, more spatial streams, and wider bandwidths produce larger CBR frames — a 7-antenna AP with 2 streams at 320 MHz produces approximately 3,134 bytes of Givens data per sounding event.

Givens rotation compression. The precoding matrix V is factored into a product of Givens rotation matrices. Each rotation is parameterized by two angles (phi, psi), quantized to b-phi and b-psi bits respectively. b-phi is determined by the Codebook field in MIMO Control (2 or 4 bits); b-psi = b-phi - 2. The quantized angles are packed LSB-first into the CBR body in a specific order defined by the spec (sweeping over subcarrier groups, then antenna pairs). The compression has an important side effect for sensing: it acts as a noise filter, eliminating per-subcarrier noise that contaminates raw CSI measurements. This is why BFId achieves HIGHER accuracy than CSI-based methods at large population sizes.

Why BFI outperforms CSI for sensing. CSI is measured at the receiver side and requires driver-level access (nexmon, PicoScenes) to extract. Each device requires its own hardware-modified driver. BFI is the same information but at the sender side, broadcast in plaintext. One passive monitor captures BFI from every associated client simultaneously, providing multiple spatial perspectives of the same room — effectively a multi-antenna sensing array at zero cost to the attacker. BFId showed that this multi-perspective advantage compensates for the coarser quantization compared to raw CSI.

Proposed mitigations. The BFId researchers call for privacy protections in 802.11bf. The most technically complete proposal (arXiv 2512.18529, Dec 2025) introduces a differential-privacy quantizer applied to Givens angles: instead of deterministic rounding, angles are quantized with calibrated noise (epsilon-DP stochastic quantizer). The mechanism is standards-compatible (same bit-width output as the normal quantizer), admits closed-form sensitivity bounds in angular representation, and degrades beamforming gain by less than 1 dB in simulation. No commercial router firmware had shipped this as of May 2026.

802.11bf and BFI. IEEE 802.11bf (ratified September 2025) defines an explicit sensing framework using dedicated Sensing Measurement Request / Response / Report frames. This is a separate mechanism from beamforming sounding BFI. However, 802.11bf sensing also uses NDPs and can optionally report CSI via Sensing Measurement Report frames. The BFId attack uses beamforming sounding BFI (Category 30/36, present since Wi-Fi 5) — not 802.11bf sensing frames — and works on any Wi-Fi 5/6/7 network regardless of 802.11bf support.