Measuring Beacon Interval

Here is my attempt to take a wifi capture file and use the IO Graph feature in Wireshark to measure the beacon interval as well as see how beacons behave with wifi traffic.

The wifi beacon from the AP is configurable and the default is usually around 100ms. But, this is more accurately described in the CWNP article:
https://www.cwnp.com/cwnp-wifi-blog/80211-beacon-intervals/

In the Wireshark capture, I can filter on beacons by using wlan.fc.type_subtype==0x0008 and see the time delta from the previous displayed frame as 0.1025 seconds then 0.1023 seconds then 0.1024 seconds and so on which makes sense…but a graph would be much better to visualize what is happening.

Starting with the how-to I found here,
https://www.fir3net.com/Networking/How-Tos/how-to-graph-tcp-delta-times-in-wireshark.html
I started building a graph for beacon intervals. Going to Wireshark – Statistics – IO Graphs brings up the IO Graphs window. The default graph is for All Packets, but you modify this with a display filter and then add Y-axis filters if needed. After adding the entries for time deltas for Min/Max/Avg beacons, I also added a display filter for QoS Data to show when traffic was being transmitted.

The default time scale is too big to see what is going on, so next I set the Interval to 100ms.

Here the time scale to too compact, so next I zoom in.

Now you can see that the Max Beacon Interval before traffic starts and after traffic stops is measurable at 100000 microseconds or 100ms. There is a big gap at 10.24 seconds where the beacon was delayed for some reason, but I haven’t figured that out yet. When traffic starts, the beacon intervals are scattered among the traffic carrying frames because now there is more contention for air time.

Zooming in further shows how closely yet separate the beacons are from the data traffic.

Now with the original goal accomplished, measuring the beacon interval, this post also reveals that beacon intervals can change as air time becomes limited. Another cool trick is that you can also measure the beacon interval with this tshark command:

tshark -r wifi-capture.pcap -q -Y wlan.fc.type_subtype==0x0008 \
-z io,stat,0.01,”AVG(frame.time_delta_displayed)frame.time_delta_displayed” \
|grep -v “0.000000”

Partial output of this is:

====================================================================
| IO Statistics                                                    |
|                                                                  |
| Duration: 29.39 secs                                             |
| Interval:  0.01 secs                                             |
|                                                                  |
| Col 1: AVG(frame.time_delta_displayed)frame.time_delta_displayed |
|------------------------------------------------------------------|
|                |1         |                                      |
| Interval       |    AVG   |                                      |
|---------------------------|                                      |
|  0.10 <>  0.11 | 0.102500 |                                      |
|  0.20 <>  0.21 | 0.102273 |                                      |
|  0.30 <>  0.31 | 0.102406 |                                      |
|  0.40 <>  0.41 | 0.102391 |                                      |
|  0.51 <>  0.52 | 0.102361 |                                      |
|  0.61 <>  0.62 | 0.102445 |                                      |
|  0.71 <>  0.72 | 0.102400 |                                      |
|  0.81 <>  0.82 | 0.102398 |                                      |
|  0.92 <>  0.93 | 0.102402 |                                      |
|  1.02 <>  1.03 | 0.102402 |                                      |
|  1.12 <>  1.13 | 0.102409 |                                      |
|  1.22 <>  1.23 | 0.102393 |                                      |
|  1.33 <>  1.34 | 0.102381 |                                      |

Thanks for taking a look at this post!