Tutorial Wi Fi networks

Tutorial: Wi-Fi networks

What it is. Wi-Fi access points announce themselves in beacon frames. OnAir lists the networks around you from the beacons alone, like the Wi-Fi list on a phone: SSID, BSSID, channel, security and signal level. It is a passive site survey.

Read this first. Passive only: beacons and probe responses are read. Data frames are counted, never decoded. OnAir never transmits, probes, joins or decrypts. SSIDs and BSSIDs identify people's homes; do not publish them. Check your local rules. See Legal and Privacy.

What you need

• A radio that reaches the band with enough bandwidth. The mode asks for 20 Msps for a 20 MHz channel; the tuner tells you if the radio cannot reach 20 Msps or the frequency. HackRF, PlutoSDR, LimeSDR and BladeRF are typical choices. An RTL-SDR cannot.
• An antenna for the band (2.4 GHz, and 5 or 6 GHz if the radio and the selected band support it).
• Frequencies from the database: 2.4 GHz channels 1 to 13 (2412 MHz for channel 1, 2437 MHz for channel 6, 2472 MHz for channel 13; 2484 MHz is channel 14, Japan only), 5 GHz channels from 36 (5180 MHz) to 177 (5885 MHz), and 6 GHz preferred scanning channels such as 5 (5975 MHz) and 37 (6135 MHz). The mode starts on 2437 MHz.

Before you start

One 20 MHz channel at a time unless the radio can capture much more (50 Msps and up hears several). Wider networks beacon on their 20 MHz primary channel. Channels 1, 6 and 11 do not overlap in the 2.4 GHz band, so hopping over those finds most networks. Keep gain moderate.

Step by step

1. In the mode list open IoT & sensors and choose Beacons, 2.4 GHz.
2. Pick the radio at 20 Msps and start the receiver.
3. Under Band choose 2.4, 5 or 6 GHz. Choose a Domain (the channels each region allows; All lists every channel).
4. Choose a Channel or tick hop to step through the band's channels. The dwell is longer than the 102.4 ms beacon interval; set it with the slider. In 6 GHz tick PSC only to use the preferred scanning channels (5, 21, 37 and so on, which carry FILS discovery); in 5 GHz tick skip DFS to leave out radar channels.
5. Open Networks and Beacons.

What you should see

A list of networks with name, BSSID, vendor, channel, security (open, WEP, WPA, WPA2, WPA3, enterprise), rates, beacon interval, level history and last seen.

Reading the screen

• Networks: Network (SSID, hidden networks as (hidden)), BSSID, Vendor, Band, Ch, Security, Interval, Level, Last seen, with newer standards marked (for example ax / be).
• Beacons: a log of beacons with Time UTC, Ch, Bytes and details.
• Filters: Filter, open only, WPA3 / OWE, Level above.

Options and settings

Band, domain, channel, hop, dwell, PSC only, skip DFS; Clear and Copy.

Troubleshooting

• Nothing appears. Check the radio reaches the band at 20 Msps.
• Access points missing. Those that beacon only at OFDM rates (802.11g or n only) are not heard in 2.4 GHz, as the panel notes.
• Hidden networks. They beacon with an empty name and are shown as hidden.
• Hopping misses networks. Increase the dwell time.

Tips

Use channels 1, 6 and 11 first for a quick survey.

Legal and privacy notes

Do not collect or publish neighbours' network names. Never join, probe or decrypt.

Under the hood

2.4 GHz beacons are read as 802.11b DSSS (1 Mbit/s DBPSK with Barker-11) frames; the management frames follow IEEE 802.11. On 5 and 6 GHz the beacons are OFDM at 6 Mbit/s and are read by a separate OFDM receiver (6 GHz FILS discovery frames are counted too). A capture of 43.5 Msps or more on 5 or 6 GHz is split into the 20 MHz channels it holds.

Related

Mode-Wi-Fi-networks, Tutorial-Wi-Fi-HaLow-802-11ah, Tutorial-Bluetooth-LE, Tutorial-Zigbee-802-15-4, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.