What Are Beacons in Wifi? Network Discovery Signals Explained

Introduction

If you have ever wondered how your phone or laptop seems to “know” that a Wi-Fi network is nearby before you even tap connect, the answer is beacons. Understanding What Are Beacons in Wifi? is the first step to mastering how wireless networks announce themselves, how devices discover them, and why some networks appear instantly while others stay hidden. In this guide, we will explore network discovery signals in depth, covering how they work, what they contain, and how you can observe and troubleshoot them yourself.

Wi-Fi beacons are small management frames broadcast by access points at regular intervals. They are the backbone of network discovery, carrying the SSID, supported data rates, security settings, and timing information. Whether you are a network administrator, a security researcher, or a curious enthusiast, learning about beacons will give you clearer insight into the wireless world around you.

Table of Contents

• What Are Beacons in Wifi?
• How Wi-Fi Beacons Work
• Beacon Frame Structure
• Beacon Interval and Timing
• Passive vs Active Scanning
• Types of Wi-Fi Discovery Signals
• Beacon vs Probe Request/Response
• How to Capture and Analyze Beacons
• Hidden SSIDs and Beacon Behavior
• Impact on Battery and Performance
• Security Considerations
• Tips and Best Practices
• Frequently Asked Questions
• Conclusion

What Are Beacons in Wifi?

So, What Are Beacons in Wifi? At their core, beacons are management frames defined by the IEEE 802.11 standard. An access point (AP) transmits them periodically to announce its presence. Every device with a Wi-Fi radio listens for these frames to build a list of available networks. Without beacons, your phone would have no passive way to discover nearby networks.

Beacons operate on both the 2.4 GHz and 5 GHz bands, and increasingly on 6 GHz. They are sent at the lowest supported basic rate so that even distant or low-capability clients can decode them. This design ensures maximum compatibility and coverage.

Each beacon contains essential information: the network name (SSID), timestamp, beacon interval, capability information, supported rates, and various information elements such as channel number, country code, and security parameters. Think of a beacon as a digital billboard that says, “I am here, this is my name, and here is how to connect.”

How Wi-Fi Beacons Work

When an access point powers on, it begins broadcasting beacons at a configured interval, typically every 100 time units (TU), where one TU equals 1024 microseconds. That translates to roughly 102.4 milliseconds, or about ten beacons per second. Clients in range receive these frames and update their scan results.

The process is simple but elegant. The AP queues a beacon frame in its transmission buffer, waits for the medium to be idle, and sends it. Because beacons are broadcast frames, they are not acknowledged by clients. This keeps overhead low but means there is no delivery guarantee.

Clients that are awake listen on each channel for a dwell time long enough to catch at least one beacon. This is called passive scanning. Once a beacon is received, the client records the network details and moves on. If no beacon arrives within the dwell time, the channel is considered empty.

Timing and Synchronization

Beacons also help synchronize client clocks. The timestamp field in a beacon allows clients to align their timing for power-saving operations. In infrastructure mode, clients use this timestamp to coordinate awake and doze states, which is critical for battery-powered devices.

Beacon Frame Structure

A beacon frame consists of a MAC header, a frame body, and a frame check sequence. The frame body carries the most interesting data. Here is a simplified breakdown of the key fields:

• Timestamp: The AP’s local clock value at transmission time.
• Beacon Interval: The time between consecutive beacons in TU.
• Capability Information: Flags indicating ESS, IBSS, privacy, and other features.
• SSID: The network name, up to 32 bytes.
• Supported Rates: Basic and extended data rates.
• DS Parameter Set: The channel number.
• Country and Power Constraint: Regulatory information.
• RSN / WPA Information Elements: Security parameters for WPA2/WPA3.
• HT/VHT/HE Capabilities: High-throughput and advanced PHY features.

Information elements are tagged fields that follow a type-length-value format. This extensibility allows new features to be added without breaking older clients, since unknown elements are simply ignored.

Beacon Interval and Timing

The beacon interval is one of the most important configurable parameters. A shorter interval means faster discovery and more reliable connectivity, but higher airtime overhead. A longer interval reduces overhead but can delay discovery and affect roaming performance.

Most enterprise networks use the default 100 TU. In dense environments, administrators sometimes increase the interval to reduce contention. In latency-sensitive deployments such as voice over Wi-Fi, keeping the default or even shortening it can improve roaming speed.

It is worth noting that beacons are not always sent exactly on schedule. The AP may delay transmission if the medium is busy, using a mechanism called target beacon transmission time (TBTT). The actual send time can slip, but the timestamp field reflects the intended TBTT.

Passive vs Active Scanning

Clients discover networks using two methods: passive scanning and active scanning. Passive scanning relies entirely on beacons. The client tunes to a channel, waits, and listens. Active scanning, by contrast, involves the client sending probe request frames and waiting for probe responses from APs.

Passive scanning is stealthier and consumes less client transmit power, but it can be slower because the client must wait for a beacon. Active scanning is faster but generates more traffic and can reveal the client’s presence. Many modern devices use a hybrid approach, switching strategies based on context.

In environments where beacons are suppressed or hidden, active scanning becomes essential. Conversely, in areas with many networks, passive scanning may be preferred to reduce probe traffic.

Types of Wi-Fi Discovery Signals

While beacons are the most common discovery signal, they are not the only ones. The 802.11 standard defines several management frames that assist in discovery and association:

• Beacon frames: Periodic broadcasts announcing the network.
• Probe request frames: Sent by clients to solicit responses.
• Probe response frames: Sent by APs in reply to probe requests, similar in content to beacons.
• Association request/response: Used after discovery to join the network.

Additionally, in mesh and ad hoc networks, beacons play a role in timing synchronization across peers. In Wi-Fi 6 and 7, new features like target wake time (TWT) build on beacon timing to improve power efficiency.

Beacon vs Probe Request/Response

Understanding the difference between these signals helps clarify What Are Beacons in Wifi? and how discovery really works. The table below summarizes the key distinctions.

Feature	Beacon Frame	Probe Request	Probe Response
Direction	AP to all clients	Client to all APs	AP to requesting client
Trigger	Periodic timer (TBTT)	Client scan request	Receipt of probe request
Contains SSID	Yes (or wildcard)	Yes (or wildcard)	Yes
Acknowledged	No	No	No
Use Case	Passive discovery	Active discovery	Active discovery reply

As you can see, beacons and probe responses carry similar information, but their triggers and directions differ. Beacons are unsolicited and periodic, while probe responses are solicited by clients.

How to Capture and Analyze Beacons

If you want to see beacons in action, you can capture them with a Wi-Fi adapter that supports monitor mode. Here is a step-by-step process:

1. Install a compatible adapter: Use a USB Wi-Fi adapter with monitor mode support, such as those based on Atheros or MediaTek chipsets.
2. Enable monitor mode: On Linux, use airmon-ng start wlan0 to create a monitor interface.
3. Set the channel: Tune to the channel you want to inspect, for example iwconfig wlan0mon channel 6.
4. Capture with Wireshark or tcpdump: Run tcpdump -i wlan0mon -w beacons.pcap or open Wireshark and filter by wlan.fc.type_subtype == 0x08.
5. Analyze the frames: Inspect SSID, beacon interval, supported rates, RSN information elements, and channel.
6. Compare networks: Look at differences between vendors and configurations.
7. Document findings: Save notes for troubleshooting or auditing.

On Windows and macOS, tools like Wireshark with Npcap or Airport Utility can also capture beacons, though monitor mode support varies. Always ensure you have permission to capture traffic in your environment.

Useful Wireshark Filters

To focus on beacons, use the display filter wlan.fc.type_subtype == 0x08. To filter by SSID, use wlan.ssid == "YourNetwork". To view beacon intervals, check the wlan.beacon.interval field. These filters make analysis faster and more precise.

Hidden SSIDs and Beacon Behavior

A hidden SSID network does not include the SSID in its beacon frames; instead, it sends a null or empty SSID. This is intended to make the network less visible, but it is not a strong security measure. Clients that know the SSID will still send probe requests with the full name, which can leak the SSID in plaintext.

From a beacon perspective, hidden networks still broadcast beacons at the configured interval. The only difference is the SSID field. This means the network is still detectable, and tools can easily reveal it. For real security, rely on strong encryption and authentication, not SSID hiding.

Impact on Battery and Performance

Beacons influence battery life because clients must wake periodically to listen for them. In power-save mode, a client dozes between beacons and wakes at the TBTT to receive the beacon. If the beacon indicates buffered traffic, the client stays awake to retrieve it.

In dense environments with many APs, the cumulative beacon traffic can be significant. Each beacon consumes airtime, and with dozens of networks, the overhead adds up. Wi-Fi 6 introduces features like OFDMA and BSS coloring to mitigate contention, but beacons remain a baseline cost.

For battery-powered IoT devices, tuning the beacon interval or using target wake time can extend battery life substantially. However, this must be balanced against discovery speed and connectivity reliability.

Security Considerations

Beacons themselves are not encrypted, so anyone in range can read them. This is by design, since discovery must happen before authentication. However, this means attackers can gather information about your network, including supported ciphers and AP capabilities.

Security best practices include using WPA3, disabling WPS, and keeping firmware updated. Do not rely on hidden SSIDs for protection. Additionally, monitor for rogue APs that broadcast misleading beacons to lure clients into connecting.

Some attacks, such as evil twin or karma attacks, exploit the trust clients place in beacons and probe responses. Implementing 802.1X and certificate validation helps mitigate these risks.

Tips and Best Practices

• Keep the default beacon interval of 100 TU unless you have a specific reason to change it.
• Use strong WPA3 encryption rather than hiding your SSID.
• In dense deployments, consider adjusting transmit power and channel plans to reduce co-channel interference.
• Monitor beacon overhead with a spectrum or protocol analyzer.
• For IoT and battery devices, explore target wake time and optimized power-save settings.
• Document your network configuration and regularly audit for rogue APs.
• Test roaming behavior in your environment to ensure beacons support smooth handoffs.

Frequently Asked Questions

What Are Beacons in Wifi exactly?

They are periodic management frames broadcast by access points to announce network presence and parameters.

Can I disable beacons?

No, beacons are fundamental to 802.11 operation. You can adjust the interval, but you cannot disable them entirely in standard infrastructure mode.

Do beacons affect internet speed?

Indirectly. Beacons consume airtime, so in very dense environments they can reduce available throughput slightly.

Are beacons encrypted?

No, beacons are transmitted in plaintext so clients can discover the network before authentication.

How often are beacons sent?

Typically every 100 time units, or about 102.4 milliseconds, though this is configurable.

What is the difference between a beacon and a probe response?

Beacons are unsolicited and periodic; probe responses are sent only when a client requests them.

Conclusion

Understanding What Are Beacons in Wifi? gives you a window into how wireless networks communicate, how devices discover them, and how performance and security are shaped at the lowest level. Beacons are simple in concept but rich in detail, carrying everything from SSID to security parameters. By learning to capture and analyze them, you can troubleshoot connectivity issues, optimize deployments, and strengthen security. Whether you manage enterprise networks or just want to understand your home Wi-Fi better, beacons are a fundamental piece of the puzzle.