Does anyone know of a way to count 802.11 beacons for the network you're already connected to? Doesn't matter if its an Access Point or Adhoc network as both will issue 802.11 beacons.
I'm asking this question from a Linux platform development perspective (Linux and/or Android). I've been working with Adhoc networks and Linux devices, and need a method of determining if the nodes in the network are alive without having to write a heartbeat service. I know that Access Points issue 802.11 beacons regularly for clients to detect them and wondered if an Adhoc network clients had some similarities. (there are Adhoc features relating to ESSID and BSSID that would suggest the clients would have to advertise the Adhoc network)
I've been testing this theory by using Kali Linux and an Alfa Wifi adapter to monitor 802.11 wireless traffic. (not a typical setup, and I only want to count beacons from the connect network) I then setup a 2 node Adhoc network between 2 Linux systems. airodump-ng noted that the clients were generating a lot of frames. I admittedly didn't set an iptables rule to block all outbound TCP/UDP, so the activity could have been some background process trying to get online.
After firing Wireshark up I noticed that some, if not all, of the frames were 802.11 beacons! They were emitted very regularly, like 2-5 beacons per-second.
I don't know if there's some function or configuration that 802.11 Adhoc must be in to issue these beacons or if it can be tuned, but they are there.
A function could be written to count beacons for the connected Adhoc network, and if one of the clients stops sending them, you could assume that communication was down with that client.
I don't think Netfilter will see these frames as it sits higher up in the network stack. e.g. above carrier frames
The problem is I need a method for seeing/counting 802.11 beacons for the network I'm already connected to, without a special wifi adapter or pen testing tools. Any suggestions? Thanks!
The answer is no. Generally if your 802.11 adapter/driver is not in monitor mode (promiscuous mode) beacons will simply not float up through the stack, even for a network already connected to. Monitor mode turns off all filtering. Kind of disappointing that it's all or nothing but that's what it is.