What Is Beacon Explorer and why does it matter?
Beacon Explorer is an interactive reference for understanding 802.11 Beacon management frames — the heartbeat of every wireless network. Every AP broadcasts beacons up to 10 times per second. Each beacon contains dozens of Information Elements (IEs) that describe the AP's capabilities, security configuration, supported speeds, and much more. This tool maps every IE from fixed header fields through the latest 802.11be (Wi-Fi 7) EHT elements onto a color-coded, clickable grid. Click any element to read its field definitions, spec references, and analysis tips.
Why this matters: Understanding beacon frames is a foundational skill for Wi-Fi analysis, troubleshooting, and design. A beacon tells you almost everything about a BSS before you even associate to it.
2 · The Interface at a Glance
At the top of the page is a compact diagram of the full 802.11 Beacon MMPDU — from Frame Control to FCS. It shows how the MAC Header, Frame Body (fixed fields and variable-length IEs), and MAC Trailer fit together. This is the big picture before you drill into individual elements.
Directly below the header is a row of colored toggle buttons — one per Wi-Fi generation. Click to hide or show all IEs for that generation. Use All Off then click one generation to isolate only those elements. Fastest way to answer: What did 802.11ax add over 802.11ac?
The main area displays all Information Elements as a color-coded grid. Each tile shows:
- Position number — sequential order in the frame
- Short name — abbreviated label
- EID — Element ID from the spec
Click any IE tile to open the detail panel. The panel contains:
- Amendment badge — which 802.11 generation introduced this IE
- EID and size — element identifier and typical byte length
- Purpose — one-sentence explanation
- Fields / Subfields table — every field, its size, and its meaning
- Analysis Tips — practical capture analysis guidance
The search bar filters the grid in real time. Search by name (SSID), Element ID (EID 48), amendment (HE, VHT), or any keyword in field descriptions — including terms like beamforming, OFDMA, or PMF.
With the detail panel open, use the ← → arrow keys to step through adjacent IEs. Press Escape to close the panel.
3 · Color Coding by Generation
Every IE tile is color-coded by IEEE amendment. Learning these colors lets you instantly read a beacon's generation profile before reading element names.
| Generation | Color | Key Elements |
|---|---|---|
| Fixed Fields (1–3) | Yellow | Timestamp, Beacon Interval, Capability Info — always present |
| Base 802.11 | Green | SSID, Rates, TIM, Country, RSN, ERP, BSS Load, EDCA, RNR… |
| 802.11n (HT / Wi-Fi 4) | Blue | HT Capabilities (EID 45), HT Operation (EID 61) |
| 802.11ac (VHT / Wi-Fi 5) | Purple | VHT Capabilities (EID 191), VHT Operation (EID 192) |
| 802.11ax (HE / Wi-Fi 6) | Orange | HE Capabilities, HE Operation, TWT, BSS Color, MU EDCA… |
| 802.11be (EHT / Wi-Fi 7) | Cyan | EHT Capabilities, EHT Operation, Multi-Link Element, T2LM |
| 802.11s (Mesh) | Lt. Green | Mesh ID, Mesh Config, Mesh Awake Window… |
| 802.11u (Hotspot 2.0) | Teal | Interworking, Advertisement Protocol, Roaming Consortium |
| Vendor Specific | Grey | EID 221 — OUI-prefixed proprietary extensions (WMM, WPS, P2P) |
4 · Key Information Elements to Know
Study these first — they are the most commonly analyzed IEs in real-world captures.
4.1 Fixed Fields (Elements 1–3)
4.2 Security Elements
4.3 Load and QoS Elements
4.4 Capability Elements by Generation
4.5 Wi-Fi 7 Multi-Link Elements
5 · Guided Exercises
Complete these exercises using Beacon Explorer. Click the relevant IE tile and use the detail panel to answer.
Filter to show only Base 802.11 elements. Click the RSN tile (#17).
- What AKM Suite value indicates WPA3-Personal (SAE)?
- What two RSN Capabilities bits together indicate PMF is required (not just optional)?
- Which companion IE would you check to confirm SAE Hash-to-Element is supported?
- If there is no RSN IE in a beacon, what does that tell you about the network?
Search for load. Click through BSS Load, HE BSS Load, and Extended BSS Load.
- What field in BSS Load tells you how many clients are connected?
- What Channel Utilization value indicates approximately 50% busy?
- What does HE BSS Load (EID ext 47) add that BSS Load does not?
- If Available Admission Capacity is 0, what does that mean for WMM-AC voice calls?
Toggle off all generations except 802.11ax (HE). Count the visible tiles.
- How many 802.11ax-specific IEs are visible?
- Click HE Operation (#78). What field provides the BSS Color value, and how many bits does it use?
- Click TWT (#79). What is the difference between Individual TWT and Broadcast TWT?
- Click Spatial Reuse (#82). What is OBSS PD, and why does it improve throughput in dense deployments?
Use the checklist below to determine an unknown AP's highest supported generation.
| IE Present in Beacon | Indicates | Observed? |
|---|---|---|
| HT Capabilities (EID 45) | 802.11n or later (Wi-Fi 4+) | |
| VHT Capabilities (EID 191) | 802.11ac or later (Wi-Fi 5+) | |
| HE Capabilities (EID ext 35) | 802.11ax or later (Wi-Fi 6+) | |
| HE Operation w/ 6 GHz Info | 802.11ax on 6 GHz (Wi-Fi 6E+) | |
| EHT Capabilities (EID ext 108) | 802.11be (Wi-Fi 7) | |
| Multi-Link Element (EID ext 107) | 802.11be MLO capable (Wi-Fi 7) |
6 · Common Analysis Scenarios
- Check #15 ERP Info — Use Protection=1 = legacy 802.11b device triggering CTS-to-self on every OFDM frame
- Check #35 20/40 Coexistence — Intolerant bit = AP forced to 20 MHz only
- Check #34 HT Operation — HT Protection mode 3 (non-HT mixed) = highest-overhead mode
- Check #17 RSN — AKM Suite 00:0F:AC:8 = SAE (WPA3-Personal)
- Check RSN Capabilities — MFPC=1 AND MFPR=1 = PMF required (WPA3)
- Check #75 RSNXE — Transition Disable bit = no WPA2 downgrade allowed
- Check #96 MME — present = PMF active, protecting management frames
- Check #29 Mobility Domain Element — MDID present = 802.11r FT supported
- Check #28 RM Enabled Capabilities — Neighbor Report bit = 802.11k supported
- Check #37 Extended Capabilities — byte 2 bit 3 = BSS Transition (802.11v)
- Check #63 RNR — advertises neighboring APs; required for 6 GHz discovery from 5 GHz beacons
7 · Quick Reference — Element ID Lookup
Frequently referenced Element IDs in the 802.11-2024 specification.
| EID | Name | EID | Name |
|---|---|---|---|
| 0 | SSID | 1 | Supported Rates |
| 3 | DSSS Parameters | 5 | TIM |
| 7 | Country | 11 | BSS Load |
| 12 | EDCA Parameters | 32 | Power Constraint |
| 35 | TPC Report | 37 | Channel Switch (CSA) |
| 42 | ERP Info | 45 | HT Capabilities |
| 48 | RSN | 50 | Extended Rates |
| 54 | Mobility Domain | 59 | Supported Op Class |
| 61 | HT Operation | 70 | RM Enabled Cap |
| 71 | Multiple BSSID | 76 | MME |
| 127 | Extended Capabilities | 191 | VHT Capabilities |
| 192 | VHT Operation | 201 | RNR |
| 221 | Vendor Specific | Ext 5 | RSNXE |
| Ext 35 | HE Capabilities | Ext 36 | HE Operation |
| Ext 38 | MU EDCA | Ext 39 | Spatial Reuse |
| Ext 42 | BSS Color Change | Ext 47 | HE BSS Load |
| Ext 106 | EHT Operation | Ext 107 | Multi-Link Element |
| Ext 108 | EHT Capabilities | Ext 109 | T2LM |
All EID ext values verified against IEEE 802.11-2024 Table 9-130 and 802.11be-2024 amendment. Session 15.