Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a personal hotspot?.

I did some research into both questions, and determined that personal hotspot was communicated as part of the vendor tag / information element in the beacon.


I want to see if we can decode the Apple vendor tag in the 802.11 beacon to see exactly which elements are what, including what defines if it is a personal hotspot. If we do perhaps we can include it in the Wireshark decoding.

My research

Doing a trace of my iPhone with Wireshark I see:

  Tag: Vendor Specific: Apple, Inc.
    Tag Number: Vendor Specific (221)
    Tag length: 10
    OUI: 00:17:f2 (Apple, Inc.)
    Vendor Specific OUI Type: 6
    Vendor Specific Data: 06010103030000

Hex:  dd 0a 00 17 f2 06 01 01 03 03 00 00

A guide about making OpenWRT appear as a personal hotspot they used vendor_elements=DD0A0017F206010103010000' and it worked (ref yichya.dev).

Some additional info that can help. If you run airport -s --xml on MacOS you can see both the IE and what appears to be some parsing of the element:

         <true />

User @hewigovens found a private method determine if it is a personal hotspot based on the IOS_IE (ref):

char -[CWNetwork(Private) isPersonalHotspot](void * self, void * _cmd) {
    eax = [*(self + 0x4) objectForKey:@"IOS_IE"];
    eax = LOBYTE(eax != 0x0 ? 0x1 : 0x0) & 0xff;
    return eax;

At minimum I think this should be enough for us to determine which bit(s) encode if it is hotspot.

Unanswered questions

What do IOS_IE_FEATURES / IOS_IE_FEATURE_VERSION / IOS_IE_FEATURE_WOW_DISALLOWED represent? How do they map to the vendor tag?

I had a different vendor tag then yichya.dev 06 01 01 03 03 00 00 vs. 06 01 01 03 01 00 00 but the decoded XML elements were the same.

IOS_IE_FEATURE_WOW_DISALLOWED might represent Woke on Wireless, but not sure if that is configurable to test.

Also can we get more insight from the CoreWLAN implementation?

This same vendor tag might be used for CarPlay networks, what does it look like in a trace?

Was this tag used with AirPort routers? Do we have examples?

For iPhone and personal hotspot are there any settings I can change to see if results in any changes?

Attempting to decode

The first octet is probably the length: 06

Edit: The first octet is the Vendor Specific OUI Type. In this case 06. For the same OUI (00:17:f2) iOS devices also uses OUI Type 10 in the Probe Request and Associate Request (ref)

Decoding IOS_IE_FEATURES value AQAA from base64 gives us 01 00 00 which doesn't directly map the vendor tag for either example, but it might just be the first octet that matters.

One of the octets is probably IOS_IE_FEATURE_VERSION: 01

The next octet matches for both, but unsure the meaning: 03

The final octet is 01 for them and 03 for me.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.