Determine an SSID’s Capabilities Using Wireshark

Determining an SSIDs capabilities as they are being broadcast over the air is a critical step when deploying or troubleshooting a WLAN. While these configuration settings can be seen in a WLAN or cloud based controller, it can be important to validate the network is functioning as expected in a over-the-air packet capture.

Determining an SSIDs capabilities using Wireshark

Begin by opening a monitor mode packet capture in Wireshark. SSID capabilities are sent out by APs in Beacon Management Frames. Filter for beacon frames using “wlan.fc.type_subtype == 8”. Then select a Beacon frame and expand “IEEE 802.11 Wireless Management”>”Tagged parameters”. This is where you will see most of the pertinent information for the SSID. 

There is a lot of information contained in the beacon. Some of the more useful elements include:

• “SSID parameter set”: contains the name of the SSID being broadcast
• “Supported Rates”: contains the data rates supported by the SSID in Mbps
• The “(B)” after the data rate indicates that it is a basic data rate
• “RSN Information”: contains the security capabilities of the SSID
• “HT Capabilities”, “VHT Capabilities”, and “HE Capabilities”: indicates that the SSID supports 802.11n, 802.11ac, and 802.11ax/Wi-Fi 6 respectively
• These IEs contain PHY specific information, such as support for beamforming or multiple spatial streams, as well as MAC features such as packet aggregation
  

Expanding the element further reveals more network configuration details. For example, below you can see that this AP supports 80 but not 160 MHz channels.

This information should be compared to the configuration that you are expecting to see, to confirm that your WLAN is functioning as expected. This is also useful information when troubleshooting client connectivity issues, as you can compare these details with a client’s association request.

I hope this blog encourages you to take a closer look at what capabilities the APs in your network are broadcasting.