diff --git a/protocols/beast.md b/protocols/beast.md
index 3fd8f59..7a494ac 100644
--- a/protocols/beast.md
+++ b/protocols/beast.md
@@ -4,6 +4,39 @@
 
 * 30005: server -> client feed
 
+## Format
+
+All data is escaped: `0x1a -> 0x1a 0x1a`. Note that synchronization is still
+complex, since `0x1a 0x31` may be the start of a frame or mid-data, depending
+on what preceded it. To synchronize, you must see, in order:
+* != 0x1a
+* 0x1a
+* {0x31, 0x32, 0x33}
+Escaping makes frame length for a given type variable, up to
+`2 + (2 * data length)`
+
+* Mode-AC frame
+  * `0x1a 0x31`
+  * 6 byte MLAT timestamp (TODO: endianness? units?)
+  * 1 byte signal level (TODO: units?)
+  * 2 byte Mode-AC data
+* Mode-S short frame
+  * `0x1a 0x32`
+  * 6 byte MLAT timestamp (TODO: endianness? units?)
+  * 1 byte signal level (TODO: units?)
+  * 7 byte Mode-S short data
+* Mode-S long frame
+  * `0x1a 0x33`
+  * 6 byte MLAT timestamp (TODO: endianness? units?)
+  * 1 byte signal level (TODO: units?)
+  * 14 byte Mode-S long data
+* Status data
+  * Appears to only be used by Mode-S Beast hardware later versions
+  * `0x1a 0x34`
+  * 6 byte MLAT timestamp (TODO: endianness? units?)
+  * ?? byte status data
+  * ?? byte DIP switch configuration
+
 ## Implementations
 
 * [Mode-S Beast hardware](http://modesbeast.com/scope.html)