Beacon-Stuffing: Wi-Fi Without Associations

In this paper, we present beacon-stuffing, a low bandwidth communication protocol for IEEE 802.11 networks that enables APs to communicate with clients without association. This enables clients to receive information from nearby APs even when they are disconnected, or when connected to another AP. Our scheme is complimentary to 802.11 association and works by overloading 802.11 management frames while not breaking the standard. The beacon-stuffing protocol is based on two key observations. First, clients receive beacons from APs even when they are not associated to them. Second, it is possible to overload fields in the beacon and other management frames to embed data. APs embed content in Beacon and Probe Response frames, while clients overload Probe Requests to send data. We have implemented beacon-stuffing on various wireless cards on Windows XP and Windows Vista. These techniques require minimal driver changes at the clients and APs.