Undocumented Qualcomm mesh topology 802.11 frames

Name: Undocumented Qualcomm mesh topology 802.11 frames
Availability: InStock
Author: dweekly

by dweekly·Apr 9, 2026·2 points·0 comments

Visit Project View on HN

AI Analysis

●●●BangerWizardryDark Horse

Passive mesh topology discovery from beacon frames that Wireshark doesn't even parse.

Strengths

•Verified against three independent sources: SOAP API, OpenWrt ubus, and beacon captures.
•Undocumented 31-byte Qualcomm IE not found anywhere — genuine protocol reverse engineering.
•Enables topology mapping without associating to any access points in the mesh.

Weaknesses

•Niche to Netgear Orbi WiFi 7 systems with this specific Qualcomm implementation.
•No tooling provided yet — just the research findings and packet captures.

Post Description

Netgear Orbi WiFi 7 nodes broadcast a Qualcomm vendor IE (8C:FD:F0) in every beacon that contains the parent node's MAC address. I caught a live star-to-daisy-chain reroute and confirmed it against three APIs. Undocumented, not in Wireshark, field map and open questions in the post.

Pretty neat: you can see the whole layout without even being associated to any of the APs!