hey guys today I'm gonna do a capture of some beacons because I know you like
beacons but I'm going to pay particular attention to the beacon interval I'm
just going to have a look at that in a couple of different scenarios okay to do
this I've got just a run-of-the-mill tp-link access point router thing here
and it's running in a 2.4 gig because I want to also capture some other networks
in the neighborhood I've got the MacBook here doing the packet capture so it's
not joined up it's just there doing the packet captures and this Linux box over
here is a client to the access point and in the background I've just got the
spectrum display which may show some stuff but I'm not paying too much
attention to that it's just they're running so what I'm going to do now is
do a quick packet capture just at the moment there's no traffic going through
my network anyway and it'll pick up some stuff from the neighbors I'm just on
channel 1 here so I'll just run that and save what I've got there okay I've just
saved that first capture when nothing was really happening now what I'm going
to do is start a video stream playing on here this is just from one of my
security cameras I've just got coming through ok via this access point on
channel 1 and you can see on the RF there channel 1 is getting smashed a bit
so I'm going to do a packet capture again while that's got some you know
traffic going through there and one as I said what I'm going to do is look at the
interval between the beacons and see see how that's affected when there's a lot
of traffic around so that should be enough I'll just stop the capture now
okay so I've done those captures with the MacBook but I'll load them up into
Linux and we'll have a look through the beacons in there ok I've just opened up
the first packet capture the one when the laptop wasn't doing much and we'll
just have a look at what beacons are around so first of all when I open the
packet capture we see you know a lot of all sorts of stuff these things here
with the black through them that's because it's a corrupt frame you can see
the FCS didn't add up that's most probably because it's just sort of half
got the beacon from a far-off neighbor so it's not the best anyway we
want to look to my beacon so the one is called SSID CW and e88
okay so foot the first thing I'll do is just filter for that SSID so you can see
the SSID there right click apply is filter there it is
so that's that's beacons and other things but I don't have anything else in
this capture so it's the only thing that's showing the SSID are the beacons
now beacons have a time interval between them and even though most routers in
their config say a hundred milliseconds it's actually a hundred and two point
four milliseconds okay that's a nice computer number they're 102 for its 102
point 4 milliseconds ideally so if we have a look here I'll just skip into the
middle of it somewhere you can see a beacon frame you see the time now you
could do it and your head go 0.55 one eight two six five four three but
there's an easier way in Y shark the first line down here has the has a whole
bunch of things to do at the time and one here is the time Delta from the
previously displayed frame okay now I've got a display filter so this is the
displayed frames if I just right click on that and apply that as a column when
you get a new column here so it's a lot easier to see the time Delta between
this and the previous frame so you can see from that the most part they're
roughly 0.10 to four but they're not all exactly one oh two four okay now any
wireless frame wherever it's a beacon or data frame or whatever before it
transmits it has to make sure as best it can that there's nothing else already
transmitting okay so if it goes to transmit in this case of beacon and it
detects this energy and the channel and it can't transmit then it can't transmit
it has to wait and it'll be a bit longer than the point 102 4 seconds so as you
can see one oh two four seven one oh two four two and some are less the reason is
it has its interval when it wants to transmit so let's say it's now and then
0.10 2 4 after that ideally it would like to transmit the next beacon but if
it can't because because something was transmitting it has to be delayed a bit
let's say goes to a point 102 5 the next beacon it will try to bring back to
where it should have been had it kept going at point 1 or 2 4 okay so that's
why some of them are a bit less than point 1 or 2 4 okay but now that I've
applied this as a column you can just click that column and like most programs
just sort by the column so now I forget the first couple you can see the lowest
interval is point 102 1 going right up to point 102 8 now that's a bit of a
problem because it's a lot longer than it should be and beacons are used for
timing that of the network ok the clients use them for it controls the
network it doesn't just transmit an SSID okay it's used for other things as well
and a primary one is timing so if they get too far out it can be a problem okay
now that was with no real activity going on the laptop so I'm going to show one
now the other one not a talk when I had the video stream going through ok this
time I got the capture opened but I also had a client on so even though I'm
looking for the SSID of CW any 88 we've got other packets in here that also
contain the SSID because remember it's not just the beacon that has the SSID
but we're only interested in beacons at the moment so what I'm going to do is
just filter that by the SSID and the end for beacons the type of beacons which is
w land frame controller type the sub type equals 8 because I know that's
beacons ok so now I'm looking at just beacons and just the ones that have the
SSID of CW in the 88 so now looking at all my beacons when I had the video
stream going so now I just sort them by the time of the previous displayed frame
again and see what we've got now you can see if I start off at the smallest why
is the first couple we're again down to 102 - which means in itself straight
away you know that it must have missed someone somewhere along the way at their
planned interval such that the next one had to be brought you know a less
interval between those two so going through 102.1 or
was the optimal one but there's a lot more that are above that okay all right
and then we got this 204 eight so that's a double so straight away you know it's
mr. beacon and that's bad so if I if I now just put them without the filter so
we see everything and go back in time order which we already are what we see
is what our not in time order now yeah what you can see is what happened before
that beacon at all on the network so I'm unfiltered now so there's the beacon
that was late which you can't tell from that really you can't tell automatically
when the previous beacon was but with a bit of fancy filtering you can soon find
these things it's just a bit of Wireshark through there okay
but you can see there was a lot going on before it there was a lot of requests to
send clear to send data block acts bang bang and somewhere in that the beacon
got lost they couldn't make it for whatever reason and I would have
captured it because it was right next to it so if a beacon can't get sent out on
time it can become a problem now this can be a real problem when there's a lot
of beacons in the air okay hidden or not doesn't matter it's using up our f space
and especially if they're using low bit rates which I know this is if you look
at if I just put one of these beacons you can see that they use right down to
1 mega second which is bad and this particular one if we go to the radio tap
header which I've shown in a video how to do you can see that it's using one
mega second so that's pretty bad which I expect from a home type of device but
that's how beacons work okay the main thing is even though there's 100
milliseconds in most config it's 102 point 4 milliseconds and ideally it
would like to transmit them every 100 and 2 point 4 milliseconds but if one's
late the next one will still try to be where its original one is okay point two
I for 8 from the previous one - can't try and keep them where they should be
but anyway that's just a brief overview of the beacon interval and in coming
videos I'll probably dive more into beacons or
maybe some Wireshark or a bit of both just take it as it comes along and I'll
see you next time with something new