On this page
IEEE 802.11be-20249.4.2Clauses 10 and 11Clauses 35 and 36
Device: None. This is the method episode, so there is no device under test yet.
Runs: No capture here. The one number I give is a sanity check: about 585 beacons in 60 seconds per BSS.
MeasuredExtension IDs 106 to 109, checked against the extension ID table in the IEEE 802.11be standard.
InferredNothing in this article depends on a capture.
OpenWhich sniffer settings suit your own adapter. That one is yours to test.
Episode 1 · About 8 minutes
This is how I capture Wi-Fi frames I can trust: how I read the IEEE 802.11 standard, set up monitor mode, and check a file before I believe it.
I am starting a weekly series where I take one section of IEEE 802.11 and check it against a real packet capture. Before the first topic, I need to explain how I read the standard and how I capture, because every article after this one depends on both. It is the first episode of the series, and every capture opens in Wireshark.
The short version. Read the frame format clause first, capture on a channel you control, and only trust a capture once you have proven the sniffer did not miss frames.
Why I do this
I work in CPE hardware development and test Wi-Fi gateways and extenders for a living. When a device does something odd, the answer is almost always in the frames, and the frames only make sense next to the clause that defines them. The base standard alone is 5,956 pages in my copy of 802.11-2024, and 802.11be adds another 1,020. Nobody reads that front to back. I read it backwards from a capture.
The reference I use for this series is IEEE Std 802.11be-2024 (Extremely High Throughput, Wi-Fi 7), which amends IEEE Std 802.11-2024. I will cite clause numbers, not paste text. The standard is copyrighted, so everything in the articles is my own wording and my own diagrams.
How the standard is laid out
Four places carry most of what you need when you are looking at a capture.
Clause 9: frame formats
This is where every field, bit and element is defined. If Wireshark shows you a field and you want to know what it means, it is in clause 9.
Clause 9.4.2: elements
Each element has an Element ID. For newer elements the ID is 255 and a second number, the Element ID Extension, says which one it is.
Clauses 10 and 11: procedures
What a device does with a frame once it receives it. Association, power save, TWT.
Clauses 35 and 36: EHT
The EHT MAC and PHY behaviour in 802.11be. Channel access, preamble, resource units.
In 802.11be, the table of extension IDs gives EHT Operation as 106, Multi-Link as 107, EHT Capabilities as 108 and TID-To-Link Mapping as 109. I checked these against the IEEE 802.11be standard. You will see them again in the next articles.
My habit is simple. I find the frame in the capture, find its subtype in clause 9, find the elements it carries in 9.4.2, then go to clause 10 or 11 only if behaviour is the question.
How I capture Wi-Fi frames
A capture is only as good as the sniffer. Three things go wrong most often.
1. Wrong channel or width
A 5 GHz capture on channel 36 at 20 MHz will miss most of an 80 MHz BSS. I set the channel and width to match the AP before I start, and I confirm it from the beacon.
2. Adapter cannot see the PHY
To see EHT frames on 6 GHz, the adapter and driver have to support 6 GHz and report the EHT radiotap fields. I check this with a known-good AP before I trust anything.
3. The capture drops frames
I check the radiotap flags and the sequence numbers. Gaps in the sequence number of a single transmitter tell me frames went missing.
On macOS I use the sniffer in Wireless Diagnostics, or tcpdump -I -i en0 -w capture.pcap once the channel is set. On Linux I put a second adapter into monitor mode:
sudo ip link set wlan1 down
sudo iw dev wlan1 set type monitor
sudo ip link set wlan1 up
sudo iw dev wlan1 set channel 36 80MHz
sudo tcpdump -i wlan1 -w e001.pcapngI keep the sniffer close to the AP and away from the client, so I hear the AP at full strength. Then I note the setup in the capture folder: adapter, driver, channel, width, date, frame count.
The first three Wireshark filters
These three get me oriented on any capture.
wlan.fc.type_subtype == 0x08Beacons only. I use this to confirm the channel, the SSID and which elements the AP advertises.
wlan.tag.number == 255Frames that carry an extended element. If this returns nothing on a Wi-Fi 6 or Wi-Fi 7 AP, the capture is broken or the filter is wrong.
wlan.fc.type_subtype == 0x00 || wlan.fc.type_subtype == 0x01Association request and response. This is where capabilities are exchanged and where most interop problems show up.
What I check before I trust a capture
Count the beacons
At the default interval of 102.4 ms, a clean 60 second capture should hold roughly 585 beacons per BSS. Far fewer means the sniffer is dropping frames or I am on the wrong channel. This is a quick sanity number, not a proof.
Match the addresses
I look for the AP’s own MAC in the association response and match it to the BSSID in the beacon. If they do not match, I am looking at two different BSSs.
Name the file for what it is
I save the capture with a name that says what it is, such as E001_beacon_ch36_80MHz_2026-10-23.pcapng.
What comes next
Next week I look at the EHT elements inside a real beacon: EHT Operation and EHT Capabilities, what each field says, and what the AP I captured actually advertises. I use the same method to capture Wi-Fi frames from a Wi-Fi 7 beacon and read them against IEEE 802.11be.
That is how I capture Wi-Fi frames I can trust, checked against the clause and a real capture. If I read a field wrong, tell me. Questions, technical debate and topic requests are always welcome.
Clause references in this article: IEEE Std 802.11be-2024, clause 9.4.2 (information elements), clauses 35 and 36 (EHT MAC and PHY). The views here are my own, and every capture comes from my own equipment and is anonymised.
Resources
- IEEE Std 802.11 on the IEEE Standards site
- Wireshark documentation
- radiotap.org: the radiotap header format
- tcpdump.org
Cite this article
If you use this in your own notes or a report, this is how I would like it cited.
Next episode
E002 reads a Wi-Fi 7 beacon: the EHT Operation and EHT Capabilities elements, field by field. It is not live yet.
Your turn
What is the first thing you check before you trust a capture? I would like to read your answer on LinkedIn or in the comments.
Leave a Reply
You must be logged in to post a comment.