Do hidden networks send beacons? I have seen hidden networks in backtrack and Ubuntu using airodump-ng. The output is weird like the power is shown as -1. Why does this happen? enter image description here

enter image description here

As you can see here there are no beacons for a hidden network.

  • 1
    You have sniffed the packets sent by the clients, but you are out of reach from the AP. That's why you don't know the SSID and you have no beacons, but you still know that it exists.
    – LatinSuD
    Commented Jul 7, 2014 at 17:45

2 Answers 2


Yes, hidden network still send a beacon frame, just without the SSID.

Your wireless hardware sends the estimated received power level to Aircrack-NG. It could be due to unsupported hardware or your hardware is not able to come up with a good power figure for the signal. Check out this forum for some older info, and look at their hardware compatibility list

  • So how can we figure their SSID with aireplay-ng if no beacons are sent?
    – M.Tarun
    Commented Jun 21, 2014 at 17:12
  • 1
    You can disassociate the client from the AP, then read the association packets. See Aireplay-NG help#hidden_ssids_length Commented Jun 21, 2014 at 17:17
  • 1
    I don't believe so - I believe that it essentially sends a lot of malformed packets to the AP using the valid client MAC. After association, the packets don't have to have a SSID anymore, since the association is between MAC addresses on a specific frequency. Commented Jun 21, 2014 at 17:24
  • 1
    If i use aireplay-ng for deauthenticating an access point that is hidden it waits for the beacon from the access point like : Waiting for beacon frame (BSSID: D4:4C:24:2B:EE:80) on channel 1.
    – M.Tarun
    Commented Jun 21, 2014 at 17:28
  • 1
    Let us continue this discussion in chat.
    – M.Tarun
    Commented Jun 21, 2014 at 17:38

The beacons are still sent, however the SSID field is set to NULL. You can learn the SSID when a client is in fact connecting. This can be done through being patient, or by spoofing a deauthentication frame coming from the client.

Instead of increasing the security posture, I think that the security is instead weakened by turning off the SSID broadcast. What is instead happening is that clients will start beaconing for the network with the appropriate SSID EVERYWHERE THEY GO. So your clients, wherever they may be, will be asking for the appropriate network everywhere, potentially revealing information about your clients that they don't want to share. E.g. if you've been on a "business trip" and visited a wireless network of the name "Shady Lady Ranch". Uou don't want your colleagues to know you visited there, however they can simply sniff the traffic when you arrive back at the office, and they will see you probing for the network, revealing that you've been previously connected.

All in all, the beacons are still being sent, however the job to specify the SSID is now burdened on the client instead of the AP.

  • Can't we deauthenticate the clients using aireplay-ng?
    – M.Tarun
    Commented Jul 7, 2014 at 15:52
  • @M.Tarun yes with the --deauth option
    – Chris Dale
    Commented Jul 7, 2014 at 19:49
  • But when I try to use it it just shows Waiting for beacon frame (BSSID: D4:4C:24:2B:EE:80) on channel 1.
    – M.Tarun
    Commented Jul 8, 2014 at 3:53
  • Try not to lock yourself on channel 1. There is 14 channels to sniff on, try some channel hopping and see if your result improves.
    – Chris Dale
    Commented Jul 8, 2014 at 6:45
  • The result is same
    – M.Tarun
    Commented Jul 10, 2014 at 8:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .