How can I count 802.11 beacons from a SSID network I'm connected to?
Does anyone know of a way to count 802.11 beacons for the network you're already connected to? Doesn't matter if its an Access Point or Adhoc network as both will issue 802.11 beacons.
I'm asking this question from a Linux platform perspective. I've been working with Adhoc networks and Linux devices, and need a method of determining if the nodes in the network are alive without having to write a heartbeat service. I know that Access Points issue 802.11 beacons regularly for clients to detect them and wondered if an Adhoc network clients had some similarities. (there are Adhoc features relating to ESSID and BSSID that would suggest the clients would have to advertise the Adhoc network)
I've been testing this theory by using Kali Linux and an Alfa Wifi adapter to monitor 802.11 wireless traffic. (not a typical setup, and I only want to count beacons from the connect network) I then setup a 2 node Adhoc network between 2 Linux systems. airodump-ng noted that the clients were generating a lot of frames. I admittedly didn't set an iptables rule to block all outbound TCP/UDP, so the activity could have been some background process trying to get online.
After firing Wireshark up I noticed that some, if not all, of the frames were 802.11 beacons! They were emitted very regularly, like 2-5 beacons per-second.
I don't know if there's some function or configuration that 802.11 Adhoc must be in to issue these beacons or if it can be tuned, but they are there.
A function could be written to count beacons for the connected Adhoc network, and if one of the clients stops sending them, you could assume that communication was down with that client.
The problem is I need a method for seeing/counting 802.11 beacons for the network I'm already connected to, without a special wifi adapter or pen testing tools. Any suggestions? Thanks!
linux wifi android kali-linux 802.1x
asked Feb 13 '15 at 15:50
garlicmangarlicman
1161
bumped to the homepage by Community♦ 2 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
Does anyone know of a way to count 802.11 beacons for the network you're already connected to? Doesn't matter if its an Access Point or Adhoc network as both will issue 802.11 beacons.
I'm asking this question from a Linux platform perspective. I've been working with Adhoc networks and Linux devices, and need a method of determining if the nodes in the network are alive without having to write a heartbeat service. I know that Access Points issue 802.11 beacons regularly for clients to detect them and wondered if an Adhoc network clients had some similarities. (there are Adhoc features relating to ESSID and BSSID that would suggest the clients would have to advertise the Adhoc network)
I've been testing this theory by using Kali Linux and an Alfa Wifi adapter to monitor 802.11 wireless traffic. (not a typical setup, and I only want to count beacons from the connect network) I then setup a 2 node Adhoc network between 2 Linux systems. airodump-ng noted that the clients were generating a lot of frames. I admittedly didn't set an iptables rule to block all outbound TCP/UDP, so the activity could have been some background process trying to get online.
After firing Wireshark up I noticed that some, if not all, of the frames were 802.11 beacons! They were emitted very regularly, like 2-5 beacons per-second.
I don't know if there's some function or configuration that 802.11 Adhoc must be in to issue these beacons or if it can be tuned, but they are there.
A function could be written to count beacons for the connected Adhoc network, and if one of the clients stops sending them, you could assume that communication was down with that client.
The problem is I need a method for seeing/counting 802.11 beacons for the network I'm already connected to, without a special wifi adapter or pen testing tools. Any suggestions? Thanks!
linux wifi android kali-linux 802.1x
asked Feb 13 '15 at 15:50
garlicmangarlicman
1161
bumped to the homepage by Community♦ 2 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
Does anyone know of a way to count 802.11 beacons for the network you're already connected to? Doesn't matter if its an Access Point or Adhoc network as both will issue 802.11 beacons.
I'm asking this question from a Linux platform perspective. I've been working with Adhoc networks and Linux devices, and need a method of determining if the nodes in the network are alive without having to write a heartbeat service. I know that Access Points issue 802.11 beacons regularly for clients to detect them and wondered if an Adhoc network clients had some similarities. (there are Adhoc features relating to ESSID and BSSID that would suggest the clients would have to advertise the Adhoc network)
I've been testing this theory by using Kali Linux and an Alfa Wifi adapter to monitor 802.11 wireless traffic. (not a typical setup, and I only want to count beacons from the connect network) I then setup a 2 node Adhoc network between 2 Linux systems. airodump-ng noted that the clients were generating a lot of frames. I admittedly didn't set an iptables rule to block all outbound TCP/UDP, so the activity could have been some background process trying to get online.
After firing Wireshark up I noticed that some, if not all, of the frames were 802.11 beacons! They were emitted very regularly, like 2-5 beacons per-second.
I don't know if there's some function or configuration that 802.11 Adhoc must be in to issue these beacons or if it can be tuned, but they are there.
A function could be written to count beacons for the connected Adhoc network, and if one of the clients stops sending them, you could assume that communication was down with that client.
The problem is I need a method for seeing/counting 802.11 beacons for the network I'm already connected to, without a special wifi adapter or pen testing tools. Any suggestions? Thanks!
linux wifi android kali-linux 802.1x
asked Feb 13 '15 at 15:50
garlicmangarlicman
1161
Does anyone know of a way to count 802.11 beacons for the network you're already connected to? Doesn't matter if its an Access Point or Adhoc network as both will issue 802.11 beacons.
I'm asking this question from a Linux platform perspective. I've been working with Adhoc networks and Linux devices, and need a method of determining if the nodes in the network are alive without having to write a heartbeat service. I know that Access Points issue 802.11 beacons regularly for clients to detect them and wondered if an Adhoc network clients had some similarities. (there are Adhoc features relating to ESSID and BSSID that would suggest the clients would have to advertise the Adhoc network)
I've been testing this theory by using Kali Linux and an Alfa Wifi adapter to monitor 802.11 wireless traffic. (not a typical setup, and I only want to count beacons from the connect network) I then setup a 2 node Adhoc network between 2 Linux systems. airodump-ng noted that the clients were generating a lot of frames. I admittedly didn't set an iptables rule to block all outbound TCP/UDP, so the activity could have been some background process trying to get online.
After firing Wireshark up I noticed that some, if not all, of the frames were 802.11 beacons! They were emitted very regularly, like 2-5 beacons per-second.
I don't know if there's some function or configuration that 802.11 Adhoc must be in to issue these beacons or if it can be tuned, but they are there.
A function could be written to count beacons for the connected Adhoc network, and if one of the clients stops sending them, you could assume that communication was down with that client.
The problem is I need a method for seeing/counting 802.11 beacons for the network I'm already connected to, without a special wifi adapter or pen testing tools. Any suggestions? Thanks!
linux wifi android kali-linux 802.1x
linux wifi android kali-linux 802.1x
asked Feb 13 '15 at 15:50
garlicmangarlicman
1161
asked Feb 13 '15 at 15:50
garlicmangarlicman
1161
asked Feb 13 '15 at 15:50
garlicmangarlicman
1161
asked Feb 13 '15 at 15:50
garlicmangarlicman
1161
asked Feb 13 '15 at 15:50
garlicmangarlicman
1161
1161
bumped to the homepage by Community♦ 2 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 2 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Possible with wireshark
You can use a beacon filter in wireshark like
wlan.bssid==mac_address && wlan.fc.type_subtype eq 8
where
mac_address is mac address of AP emitting the beacons
wlan.fc.type_subtype eq 8 : This will capture all beacon frames only from this mac
Also wireshark has a time column which shows you the time in seconds of a beacon recieved. This can be a good indication of time lapses.
Counting recursively might be an issue but...
After executing your filter, you can get a count on your beacon filter.
In Wireshark go to:
Statistics ----->Summary
This will gave you a count at the time you check. Everytime you want to view the updated count you will have to back to summary.
answered Feb 15 '15 at 11:02
repzerorepzero
339311
1
This is only possible if the 802.11 adapter/driver can be put into monitor mode. If it can't, you can't see the 802.11 beacons as they will will be filtered out. Monitor mode opens the flood gates. I was hoping there was a way to capture beacons for an attached network, but there isn't without a supporting adapter.
– garlicman
Feb 20 '15 at 4:49
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f184708%2fhow-can-i-count-802-11-beacons-from-a-ssid-network-im-connected-to%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Possible with wireshark
You can use a beacon filter in wireshark like
wlan.bssid==mac_address && wlan.fc.type_subtype eq 8
where
mac_address is mac address of AP emitting the beacons
wlan.fc.type_subtype eq 8 : This will capture all beacon frames only from this mac
Also wireshark has a time column which shows you the time in seconds of a beacon recieved. This can be a good indication of time lapses.
Counting recursively might be an issue but...
After executing your filter, you can get a count on your beacon filter.
In Wireshark go to:
Statistics ----->Summary
This will gave you a count at the time you check. Everytime you want to view the updated count you will have to back to summary.
answered Feb 15 '15 at 11:02
repzerorepzero
339311
1
This is only possible if the 802.11 adapter/driver can be put into monitor mode. If it can't, you can't see the 802.11 beacons as they will will be filtered out. Monitor mode opens the flood gates. I was hoping there was a way to capture beacons for an attached network, but there isn't without a supporting adapter.
– garlicman
Feb 20 '15 at 4:49
add a comment |
Possible with wireshark
You can use a beacon filter in wireshark like
wlan.bssid==mac_address && wlan.fc.type_subtype eq 8
where
mac_address is mac address of AP emitting the beacons
wlan.fc.type_subtype eq 8 : This will capture all beacon frames only from this mac
Also wireshark has a time column which shows you the time in seconds of a beacon recieved. This can be a good indication of time lapses.
Counting recursively might be an issue but...
After executing your filter, you can get a count on your beacon filter.
In Wireshark go to:
Statistics ----->Summary
This will gave you a count at the time you check. Everytime you want to view the updated count you will have to back to summary.
answered Feb 15 '15 at 11:02
repzerorepzero
339311
1
This is only possible if the 802.11 adapter/driver can be put into monitor mode. If it can't, you can't see the 802.11 beacons as they will will be filtered out. Monitor mode opens the flood gates. I was hoping there was a way to capture beacons for an attached network, but there isn't without a supporting adapter.
– garlicman
Feb 20 '15 at 4:49
add a comment |
Possible with wireshark
You can use a beacon filter in wireshark like
wlan.bssid==mac_address && wlan.fc.type_subtype eq 8
where
mac_address is mac address of AP emitting the beacons
wlan.fc.type_subtype eq 8 : This will capture all beacon frames only from this mac
Also wireshark has a time column which shows you the time in seconds of a beacon recieved. This can be a good indication of time lapses.
Counting recursively might be an issue but...
After executing your filter, you can get a count on your beacon filter.
In Wireshark go to:
Statistics ----->Summary
This will gave you a count at the time you check. Everytime you want to view the updated count you will have to back to summary.
answered Feb 15 '15 at 11:02
repzerorepzero
339311
Possible with wireshark
You can use a beacon filter in wireshark like
wlan.bssid==mac_address && wlan.fc.type_subtype eq 8
where
mac_address is mac address of AP emitting the beacons
wlan.fc.type_subtype eq 8 : This will capture all beacon frames only from this mac
Also wireshark has a time column which shows you the time in seconds of a beacon recieved. This can be a good indication of time lapses.
Counting recursively might be an issue but...
After executing your filter, you can get a count on your beacon filter.
In Wireshark go to:
Statistics ----->Summary
This will gave you a count at the time you check. Everytime you want to view the updated count you will have to back to summary.
answered Feb 15 '15 at 11:02
repzerorepzero
339311
answered Feb 15 '15 at 11:02
repzerorepzero
339311
answered Feb 15 '15 at 11:02
repzerorepzero
339311
answered Feb 15 '15 at 11:02
repzerorepzero
339311
339311
1
This is only possible if the 802.11 adapter/driver can be put into monitor mode. If it can't, you can't see the 802.11 beacons as they will will be filtered out. Monitor mode opens the flood gates. I was hoping there was a way to capture beacons for an attached network, but there isn't without a supporting adapter.
– garlicman
Feb 20 '15 at 4:49
add a comment |
1
This is only possible if the 802.11 adapter/driver can be put into monitor mode. If it can't, you can't see the 802.11 beacons as they will will be filtered out. Monitor mode opens the flood gates. I was hoping there was a way to capture beacons for an attached network, but there isn't without a supporting adapter.
– garlicman
Feb 20 '15 at 4:49
1
1
This is only possible if the 802.11 adapter/driver can be put into monitor mode. If it can't, you can't see the 802.11 beacons as they will will be filtered out. Monitor mode opens the flood gates. I was hoping there was a way to capture beacons for an attached network, but there isn't without a supporting adapter.
– garlicman
Feb 20 '15 at 4:49
This is only possible if the 802.11 adapter/driver can be put into monitor mode. If it can't, you can't see the 802.11 beacons as they will will be filtered out. Monitor mode opens the flood gates. I was hoping there was a way to capture beacons for an attached network, but there isn't without a supporting adapter.
– garlicman
Feb 20 '15 at 4:49
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f184708%2fhow-can-i-count-802-11-beacons-from-a-ssid-network-im-connected-to%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
