Determine a Client’s Capabilities Using Wireshark

One of the first steps you should perform when troubleshooting client association issues, is to determine the client’s Wi-Fi adapter capabilities and compare them to the capabilities of your network. This information is sent by the client over-the-air when the client associates to a WLAN. 

Determining a client's capabilities using Wireshark

Begin by opening a monitor mode packet capture in wireshark, that was captured during a client association attempt. Client capabilities are sent in Association Request Management Frames. You can filter for these types of frames using “wlan.fc.type_subtype == 0”. Select an Association Request frame and expand “IEEE 802.11 Wireless Management”>”Tagged parameters” . This is where you will see most of the pertinent information for the client.

There is a lot of information here. Some of the more useful elements for troubleshooting client connectivity issues include:

• “Supported Rates”: contains the data rates supported by the client in Mbps
• The “(B)” after the data rate indicates that it is a basic data rate
• “Supported Channels”: this is useful when troubleshooting in the 5 GHz to confirm clients support DFS and updated frequency allocations
• “RSN Information”: contains the security capabilities supported by the client
• Be sure this matches with the security capabilities being broadcast by your WLAN
• “HT Capabilities”, “VHT Capabilities”, and “HE Capabilities”: this indicates that the SSID supports 802.11n, 802.11ac, and 802.11ax (Wi-Fi 6), respectively
• These IEs contain PHY specific information, such as support for beamforming or multiple spatial streams, as well as MAC features such as packet aggregation
  

You can further expand the elements. For example the client shown below supports Wi-Fi 6 deployments in 40 and 80 MHz channels, but not 160 MHz channel deployments.

 
Wireshark does an excellent job of defining the features in an understandable manner. However I recommend that you keep the IEEE 802.11 specification as a reference to look up specific fields and how they are used. This is not as daunting as it might sound. For example a simple search of the specification can quickly give you what you are looking for. In the example below I search on “channel width set”, the same words shown in the Wireshark capture to find what I need. EDIT: if this interests you, check out my blog on Visualizing 802.11 Frame Formats.

I hope in this blog you learned the value of using Wireshark to capture Association Requests to determine the capabilities of the clients connecting to your WLAN. I urge you to continue to explore the wealth of information contained in these frames.