Packet Sniffing: Capturing Beacons/Probes

What Beacons and Probes Actually Are

These are two types of unencrypted 802.11 management frames that any WiFi radio in range can passively see, regardless of network encryption — this is normal WiFi operation, not a security bypass:

• Beacon frames: broadcast continuously by every access point (roughly every 100ms) announcing its presence — SSID, channel, supported rates, security type. This is how your devices find networks when you open the WiFi picker.
• Probe request frames: broadcast by client devices actively searching for networks — notably, many devices probe for SSIDs they've previously connected to by name, which is a genuine and well-documented privacy consideration (a probe request history can reveal networks a device has previously joined).

Legitimate Uses

• Site surveys — mapping WiFi coverage/channel congestion in your own space before optimizing router placement or channel selection.
• Troubleshooting your own network — confirming your AP is actually broadcasting on the channel/settings you configured.
• Understanding your own devices' privacy footprint — seeing what your own phone/laptop broadcasts in probe requests when WiFi is on but not connected.

Sniffing With the WiFi Dev Board

Marauder's Sniff menu (see the main setup guide) has separate modes for beacon and probe capture:

1. Select Sniff > Beacon (or Probe) from the Marauder menu.
2. Optionally set a channel filter to focus capture on a specific channel rather than hopping across all of them, if you know your target AP's channel.
3. Captured frames display live on Flipper's screen and can be saved to PCAP for deeper analysis (see the dedicated PCAP + Wireshark guide).

What This Doesn't Give You

Beacon/probe sniffing sees frame metadata (SSIDs, MAC addresses, signal strength, channel) — it does not decrypt actual network traffic content, which remains protected by WPA2/WPA3 encryption regardless of this passive capture. This is fundamentally different from, and much less invasive than, actually joining/decrypting traffic on a network.

MAC Randomization and What It Means for This

Modern phones (iOS and recent Android) randomize their MAC address during probe requests specifically to prevent the kind of tracking this technique could otherwise enable — if you're sniffing probes and seeing constantly-changing MAC addresses from what should be the same device, that's MAC randomization working as designed, not a capture failure.

A Practical Home Use Case

Mapping which channels your neighbors' APs are using (visible via beacon frames, since SSID broadcast is public by design unless hidden) helps you pick a less-congested channel for your own router — this is a completely benign, common use of exactly this passive scanning capability.