Wi‑Fi Troubleshooting: “I Only See Beacons (No Data Frames)”
Seeing beacons but no data frames is a common “false progress” state: your adapter is hearing the AP, but you’re not actually capturing the traffic you think you are. In most labs, the cause is mismatched band/channel width, adapter/driver limitations, or simply no active clients generating traffic.
Permission-first: capture only on networks you own or have explicit written authorization to assess.
See Legal & Ethics.
1) Confirm you’re capturing the right thing
- Lock the channel: set a fixed channel and confirm the AP is actually there (beacon SSID/BSSID matches).
- Check the band: the SSID might exist on 2.4 GHz and 5 GHz; you can be listening to the wrong one.
- Don’t trust “auto”: auto channel hopping or scanning modes often miss the moment when real data occurs.
2) No clients, no data: generate predictable traffic
Beacons exist even when nobody is talking. Data frames appear when clients are associated and actually sending traffic.
- Associate one lab client: connect a single device you control to the AP.
- Generate traffic: load a simple webpage, run a speed test, or transfer a small file across the LAN.
- Use a “known-good” baseline AP: WPA2‑PSK, 2.4 GHz, 20 MHz, fixed channel.
3) Band + channel width mismatches
- 20/40/80 MHz matters: listening on the right channel number but wrong width can make decodes incomplete.
- DFS channels: 5 GHz DFS behavior can move clients or force reconfiguration unexpectedly.
- 6 GHz expectations: not every adapter supports 6 GHz monitoring; you may only “see something” via 2.4/5.
4) Adapter/driver limitations that look like “beacons only”
- Monitor mode ≠ full capture: some drivers drop data frames or fail to present them correctly to userland tools.
- Power saving: aggressive power management can reduce receive reliability.
- Overload/desense: being too close to the AP or USB 3.0 noise can reduce effective capture quality.
5) Display filters and capture settings pitfalls
- Clear filters: “data only” filters can hide management/control frames (or vice versa).
- Wrong interface: confirm you’re capturing from the monitor interface, not the managed one.
- Short captures lie: capture 60–120 seconds while generating traffic.
Validation criteria
- You can reproduce beacon + data visibility on a fixed lab AP profile (2.4 GHz, 20 MHz, WPA2‑PSK).
- You can create predictable client traffic and see corresponding data frames within a 2‑minute capture.
- Your results survive a reboot/reconnect cycle using the same channel + capture settings.