PCAP Series #2 — Reading Beacon IEs
"The Beacon is the AP resume. Most engineers read the SSID and move on." ·
Session 2. We have a capture. Now: what to look for in a Beacon in under 3 minutes.
Step 1 — Isolate one Beacon
Step 2 — RSN IE (ID 48)
Group Cipher Suite: 00-0F-AC:4 = CCMP-128. AKM: 00-0F-AC:2 = PSK, :8 = SAE. RSN Capabilities: bit 6 = MFPC, bit 7 = MFPR. MFPR=1 with client MFPC=0 = association rejected. Most common WPA3 migration failure.
Step 3 — QBSS Load (ID 11)
Channel Utilization field: divide by 255. Above 160/255 in a production office — throughput problems are expected regardless of signal strength. Check this before anything else in a slow Wi-Fi complaint.
Step 4 — Compare Beacon RSN vs AssocReq RSN
If the client RSN IE does not include any of the AP pairwise ciphers, association rejected Status 24. The mismatch is visible directly in the two RSN IEs side by side. Next: Session 3 — diagnosing a failed association.