HowToFixWiFiSimple fixes  •  Better connection
Wifi Guide

What Is Beacon in Wifi? Core Concepts

Introduction If you have ever opened a Wi-Fi analyzer on your phone or laptop and watched a list of nearby networks appear, you have already seen the result of something called a beacon. Beacons are the quiet, repetitive announcements that wireless access poin

HowToFixWiFi

Introduction

If you have ever opened a Wi-Fi analyzer on your phone or laptop and watched a list of nearby networks appear, you have already seen the result of something called a beacon. Beacons are the quiet, repetitive announcements that wireless access points broadcast into the air dozens of times every second. They are the reason your device knows a network exists before you ever type a password or tap “Connect.” In this guide, we will explore the question “What Is Beacon in Wifi?” from the ground up, covering how beacon frames are built, what information they carry, how they differ from other Wi-Fi management frames, and why they matter for performance, battery life, and security. Whether you are a network administrator, a curious hobbyist, or someone studying for a wireless certification, this article will give you a solid, practical understanding of beacon frames and how to work with them.

Table of Contents

What Is a Beacon in Wi-Fi?

So, what is beacon in wifi in the simplest possible terms? A beacon is a type of management frame that an access point (AP) broadcasts periodically to announce its presence. Think of it as a digital billboard that says, “I am here, my name is this, and here is how you can join me.” Unlike data frames, which carry user traffic, or control frames, which manage the flow of data, management frames handle the housekeeping of a wireless network. The beacon is arguably the most important management frame of all.

Every Wi-Fi network you have ever connected to relied on beacons. When you walk into a coffee shop and your phone shows “CoffeeShop_WiFi” in the list of available networks, that entry appeared because your phone received a beacon frame from the shop’s access point. The beacon carries the network name (SSID), the supported data rates, security capabilities, and a timestamp that helps clients synchronize their clocks. Without beacons, passive scanning would be impossible, and devices would have no way to discover networks without actively probing the air.

Beacons are sent on the channel the AP is operating on, and they are broadcast to all stations. That means any device within range can hear them, even if it never intends to join the network. This open nature is what makes beacons both useful and, as we will see later, a potential security concern.

How Beacon Frames Work

Understanding how beacons work requires a quick look at the 802.11 frame structure. A beacon frame is a subtype of management frame identified by a specific frame control field value. It is always transmitted by an access point, never by a client station. The AP sends it at a regular interval, known as the beacon interval, which is typically 100 time units (about 102.4 milliseconds).

When an AP powers on and starts broadcasting, it begins emitting beacons on its configured channel. Each beacon contains a timestamp taken from the AP’s internal clock. Client devices that hear the beacon use that timestamp to synchronize their own timers, which is essential for features like power saving and scheduled wake-ups.

Beacons are transmitted at the lowest supported basic rate so that even devices far from the AP or using older standards can decode them. This is why you might see a network name appear on your device even when the signal is weak. The AP prioritizes reachability over speed for these announcements.

Passive vs. Active Discovery

There are two ways a client can discover a network: passively, by listening for beacons, or actively, by sending probe requests and waiting for probe responses. Passive scanning is quieter and uses less battery on the client side, but it takes longer because the client must wait for a beacon to arrive. Active scanning is faster but generates more traffic. Most modern devices use a mix of both depending on the operating system and power state.

Key Fields Inside a Beacon Frame

A beacon frame is packed with information. Here are the most important fields you will encounter:

  • Timestamp: The AP’s clock value at the moment the frame is sent. Clients use this to sync.
  • Beacon Interval: The time between consecutive beacons, usually 100 TU.
  • Capability Information: Flags indicating whether the network supports features like ESS, IBSS, privacy (WEP/WPA), short preamble, and more.
  • SSID (Service Set Identifier): The network name. Can be up to 32 bytes. May be hidden (empty) in some configurations.
  • Supported Rates: The data rates the AP supports for basic operation.
  • DS Parameter Set: The channel number the AP is operating on.
  • Country Information: Regulatory domain and allowed channels/power levels.
  • RSN Information Element: Security details for WPA2/WPA3, including cipher suites and AKM suites.
  • HT/VHT/HE Capabilities: Information about 802.11n/ac/ax support.
  • Power Constraint: Transmit power limits for the regulatory domain.
  • DTIM Count and Period: Delivery Traffic Indication Message settings for power-saving clients.

Each of these fields is encoded as an Information Element (IE), a tagged structure with an ID, length, and value. This modular design allows new capabilities to be added without breaking older devices, which simply ignore unknown IEs.

Beacon Interval and Timing

The beacon interval controls how often the AP announces itself. The default of 100 TU (102.4 ms) means roughly 9.76 beacons per second. You can change this value on most access points, and doing so has real trade-offs.

A shorter interval (for example, 50 TU) makes network discovery faster and improves responsiveness for power-saving clients, but it increases airtime consumption and can reduce throughput on busy channels. A longer interval (for example, 200 TU) frees up airtime but slows down passive scanning and can delay wake-ups for sleeping devices.

Time Units (TU) are defined as 1024 microseconds. So 100 TU equals 102.4 milliseconds. This odd number comes from the original 802.11 specification and has stuck around ever since.

Beacon vs. Probe Request and Probe Response

Beacons are not the only management frames involved in discovery. Clients can also send probe requests to actively search for networks, and APs respond with probe responses. Here is a comparison:

Feature Beacon Probe Request Probe Response
Sender Access Point Client Station Access Point
Trigger Periodic (timer-based) On demand by client In response to probe request
Destination Broadcast (all stations) Broadcast or directed Unicast to requesting client
Contains SSID Yes (may be hidden) Yes (or wildcard) Yes
Used For Passive discovery, sync, power save Active discovery Active discovery response
Airtime Cost Continuous, fixed On demand On demand

In practice, a client often sends a probe request with a wildcard SSID, and any nearby AP responds with a probe response containing its full capabilities. This is faster than waiting for a beacon, which is why active scanning is preferred when a device needs to connect quickly.

Role of Beacons in Network Discovery

Beacons are the foundation of passive network discovery. When your phone’s Wi-Fi is on but not connected, it periodically switches channels and listens for beacons. Each beacon it receives is parsed, and the SSID and signal strength are displayed in the network list. This process is entirely passive, meaning the phone does not transmit anything while scanning passively.

Hidden SSIDs complicate this picture. An AP configured to hide its SSID still sends beacons, but the SSID field is empty or zero-length. The network will not appear in a normal scan list until a client actively probes for it by name. This is a weak form of obscurity rather than real security, since the SSID is still broadcast in probe responses and other frames.

Beacons and Power Saving (DTIM)

One of the most important roles of beacons is supporting client power saving. In power-save mode, a client dozes between beacons and wakes up at each beacon interval to check whether the AP has buffered data for it. The beacon’s Traffic Indication Map (TIM) tells the client if there is pending unicast data, and the DTIM (Delivery Traffic Indication Message) indicates when broadcast and multicast traffic will be delivered.

The DTIM period is a multiple of the beacon interval. For example, with a beacon interval of 100 TU and a DTIM period of 3, broadcast traffic is delivered every third beacon (about 307 ms). Clients that only need unicast data can wake less often, while those needing broadcast traffic must wake at each DTIM.

This mechanism is crucial for battery-powered devices like smartphones, IoT sensors, and laptops. Tuning the DTIM period and beacon interval can significantly affect battery life and latency.

Beacon Frames Across Wi-Fi Standards

Beacons have evolved with each generation of Wi-Fi. While the basic structure remains the same, newer standards add more Information Elements and capabilities.

  • 802.11b/g (2.4 GHz): Basic beacons with supported rates, SSID, and capability info.
  • 802.11a (5 GHz): Similar to 802.11b/g but on 5 GHz.
  • 802.11n (HT): Adds HT Capabilities and HT Operation IEs for MIMO and channel bonding.
  • 802.11ac (VHT): Adds VHT Capabilities for wider channels and more spatial streams.
  • 802.11ax (HE): Adds HE Capabilities, BSS Color, and features for dense deployments. Wi-Fi 6 also introduces Target Wake Time (TWT), which reduces reliance on beacons for scheduling.
  • 802.11be (Wi-Fi 7): Further enhancements for multi-link operation and extremely high throughput.

Despite these additions, the beacon’s core purpose never changes: announce the network and synchronize clients.

How to Capture and Analyze Beacon Frames

Seeing beacons in action is one of the best ways to understand them. Here is a step-by-step guide using common tools.

  1. Put your wireless adapter in monitor mode. On Linux, use sudo airmon-ng start wlan0. On Windows or macOS, use a tool like Wireshark with a compatible adapter.
  2. Start a capture. In Wireshark, select your monitor-mode interface and begin capturing. Filter with wlan.fc.type_subtype == 0x08 to show only beacons.
  3. Identify a beacon. Look for frames with “Beacon frame” in the info column. Expand the 802.11 management frame to see all fields.
  4. Inspect the SSID. Under “Tagged parameters,” find the SSID tag to see the network name.
  5. Check the channel. Look for the DS Parameter Set tag to confirm the operating channel.
  6. Examine security. Look for RSN or WPA information elements to determine encryption type.
  7. Review timing. Check the timestamp and beacon interval fields.
  8. Use airodump-ng for a quick overview. Run sudo airodump-ng wlan0mon to see a live list of APs, channels, and encryption, all derived from beacons.

For a lighter approach, mobile apps like WiFi Analyzer (Android) or WiFi Explorer (macOS) parse beacons and present the data in a friendly interface without requiring monitor mode.

Security Concerns: Spoofing and Flood Attacks

Because beacons are unauthenticated broadcasts, they can be spoofed. An attacker can craft fake beacon frames advertising a network with the same SSID as a legitimate one, luring clients into connecting. This is the basis of evil twin attacks. The beacon itself does not carry authentication data, so clients must rely on higher-layer security (WPA2/WPA3) to verify the network.

Beacon flooding is another attack where an adversary broadcasts hundreds or thousands of fake beacons with random SSIDs. This overwhelms clients’ network lists and can degrade performance. Tools like mdk4 can generate these floods.

Defenses include using WPA3 with SAE, enabling 802.11w (Protected Management Frames) to protect certain management frames, and monitoring for rogue APs with a wireless intrusion detection system (WIDS).

Troubleshooting Beacon-Related Issues

Beacon problems can manifest in several ways:

  • Network not appearing in scan list: Check that the AP is broadcasting beacons and that the client is scanning the correct band. A hidden SSID will not appear passively.
  • Intermittent connectivity: A very long beacon interval or high channel utilization can delay discovery and power-save wake-ups.
  • Battery drain: Too frequent beacons or a short DTIM period can keep clients awake longer than necessary.
  • Slow roaming: Clients rely on beacons to evaluate candidate APs. If beacons are missed due to interference, roaming decisions suffer.

Use a spectrum analyzer or Wi-Fi analyzer to verify beacon presence and signal strength on the expected channel.

Tips and Best Practices

  • Keep the default beacon interval of 100 TU unless you have a specific reason to change it.
  • Set the DTIM period based on your client mix: 1 for latency-sensitive or broadcast-heavy environments, 2 or 3 for battery-focused deployments.
  • Avoid hiding SSIDs as a security measure; it provides little benefit and can complicate client behavior.
  • Enable Protected Management Frames (802.11w) where supported to harden management frames.
  • Use WPA3 to mitigate evil twin risks even if beacons are spoofed.
  • Monitor airtime usage; excessive beacons from many APs on the same channel can congest the spectrum.
  • When designing for IoT, consider Target Wake Time (Wi-Fi 6) to reduce beacon dependency.

Frequently Asked Questions

What is beacon in wifi used for?

A beacon is used to announce a network’s presence, synchronize client clocks, and support power-saving features. It is the primary mechanism for passive network discovery.

How often are beacon frames sent?

By default, every 100 time units, which is approximately 102.4 milliseconds, or about 9.76 times per second.

Can I disable beacons?

Not on a standard access point. Beacons are fundamental to 802.11 operation. Some specialized modes may reduce them, but disabling entirely would break connectivity.

Do beacons contain passwords?

No. Beacons advertise security capabilities (such as WPA2 or WPA3) but never contain passwords or keys.

What is a hidden SSID beacon?

An access point can send beacons with an empty SSID field. The network still broadcasts, but it will not appear in passive scan lists.

Are beacons a security risk?

They reveal network names and capabilities to anyone listening, and they can be spoofed. However, they do not expose credentials. Proper encryption and PMF mitigate the risks.

Conclusion

By now, the question “What Is Beacon in Wifi?” should feel much clearer. A beacon is a periodic management frame that access points broadcast to announce their existence, share capabilities, and keep clients synchronized. From passive discovery to power-saving wake-ups, beacons are the heartbeat of any Wi-Fi network. Understanding their structure, timing, and role across standards gives you a powerful foundation for troubleshooting, optimizing, and securing wireless deployments. Whether you are capturing frames in Wireshark or tuning an access point for a fleet of IoT devices, a solid grasp of beacon behavior will serve you well in every wireless project you undertake.