CWSP (ABWM) cheat sheet

Passive discovery depends on beacons (default beacon interval 100 TU, approximately 102.4 ms) and probe responses; active discovery sends probe requests and exposes client SSID preference lists and hidden SSIDs in directed probes.

Management frame subtypes used in attacks: authentication 0x0B, deauthentication 0x0C, disassociation 0x0A, association request 0x00, reassociation request 0x02.

An evil twin advertises the same SSID (and often the same BSSID) as the legitimate AP to attract clients; a honeypot advertises a lure SSID to collect association attempts.

WPA/WPA2-Personal offline dictionary attacks use either the EAPOL M1/M2 pair of the 4-Way Handshake or the PMKID carried in message 1; PMK = PBKDF2(passphrase, SSID, 4096, 256 bits).

State-exhaustion floods include authentication flood, association flood, EAPOL-Start flood, and beacon flood; airtime-consumption floods include CTS, RTS, and QoS-Null frames.

WPS PIN brute force is limited to about 11,000 valid guesses because the 8-digit PIN is validated in two halves; Pixie Dust recovers the PIN offline from messages M1-M3 on vulnerable chipsets.

WLAN discovery tool categories: protocol analyzers (monitor-mode capture), scanner/stumbler utilities (SSID, RSSI, channel, security), and overlay RF sensors feeding a WIPS.

Layer 2 MITM enablers on wireless: ARP cache poisoning, rogue DHCP server, forged deauthentication to force reconnection to a malicious AP, and MAC address spoofing of an authorized device.

MAC header: 2-byte Frame Control, 2-byte Duration/ID, three 6-byte address fields, 2-byte Sequence Control; Address 4 (6 bytes) and QoS Control (2 bytes) are added for WDS and QoS data frames.

Frame Control subfields: Protocol Version (2 bits), Type (2), Subtype (4), ToDS, FromDS, More Fragments, Retry, Power Management, More Data, Protected Frame, Order.

Sequence Control = 4-bit Fragment Number plus 12-bit Sequence Number; duplicate detection uses the retry bit plus sequence number and fragment number.

ToDS/FromDS bit pairs: 00 = IBSS or management, 10 = frame to the distribution system, 01 = frame from the distribution system, 11 = WDS (four-address) frame.

Capability Information field flags: ESS, IBSS, CF-Pollable, CF-Poll Request, Privacy (1 means WEP or stronger confidentiality is required).

RSN Information Element uses element ID 48, version 1, group cipher suite, pairwise cipher list, AKM list, and RSN capabilities (PMF capable/required, preauthentication, no pairwise).

Beacon and probe response bodies carry Timestamp, Beacon Interval, Capability Information, SSID, supported rates, DS Parameter Set, TIM, and optional HT/VHT/HE and RSN elements.

Selected reason codes: 1 unspecified, 2 previous authentication no longer valid, 4 inactivity, 7 Class 3 frame from nonassociated STA, 15 4-Way Handshake timeout.

Device classification buckets: authorized/known, rogue (unauthorized and connected to the wired LAN), neighbor, external/interfering, ad-hoc, and unknown; only rogue and ad-hoc categories normally trigger containment.

Containment of a rogue AP is performed by transmitting spoofed deauthentication or disassociation frames to the rogue AP using spoofed client MAC addresses; containment of a rogue client spoofs the legitimate BSSID.

Overlay WIPS uses dedicated sensor appliances; integrated WIPS runs on infrastructure APs that scan off-channel between client service periods, reducing scan fidelity.

Signature-based detection matches known frame patterns and attack tools; anomaly-based detection baselines RF and traffic behavior and flags statistical deviation.

802.11w Protected Management Frames, when required by the target network, defeats forged deauthentication containment because deauth and disassoc frames are BIP-protected.

Location accuracy requires overlapping sensor coverage; three or more sensors hearing a device allow multilateration/triangulation of the source.

WIPS policy inputs that reduce false positives: authorized BSSID/OUI whitelists, known neighbor lists, SSID allow lists, and per-category automatic action thresholds.

Detection signatures cover deauth floods, beacon floods, SSID spoofing, MAC spoofing of authorized BSSIDs, ad-hoc associations, and wireless bridges.

802.1X roles: supplicant (client), authenticator (AP or WLC), authentication server (RADIUS); EAP is carried over EAPOL on the wireless link with EtherType 0x888E.

RADIUS carries EAP in attribute 79 (EAP-Message); attribute 80 (Message-Authenticator) is required for EAP exchange integrity and replay protection.

Ports and transport: RADIUS authentication UDP 1812, accounting UDP 1813 (legacy 1645/1646); RADIUS shared secrets authenticate the client-server pair.

EAP-TLS requires certificates on both supplicant and server and provides mutual authentication; EAP-TTLS and PEAP require only a server certificate and tunnel an inner method.

PEAPv0 inner method is EAP-MSCHAPv2; PEAPv1 commonly uses EAP-GTC; EAP-FAST replaces certificates with a PAC provisioned in phase 0.

EAP-MD5 provides one-way authentication and no key material, so it cannot be used with RSN/WPA2-Enterprise; LEAP is Cisco-proprietary and exposed to offline dictionary attacks.

Key delivery: the supplicant and authentication server derive the MSK; the first 256 bits become the PMK, which the server sends to the authenticator in MS-MPPE-Recv-Key/Send-Key attributes.

AKM suite selectors live under OUI 00-0F-AC: type 1 = 802.1X, type 2 = PSK, type 4 = FT-802.1X, type 5 = FT-PSK, type 8 = SAE.

PTK = PRF-X(PMK, 'Pairwise key expansion', Min/Max(AP MAC, STA MAC) || Min/Max(ANonce, SNonce)); the PTK is split into KCK, KEK, and TK.

The 4-Way Handshake messages 1 and 3 carry the ANonce and the GTK respectively; message 2 and 4 carry MICs computed with the KCK; message 4 acknowledges installation.

CCMP uses AES-128 in CCM mode with a 48-bit packet number and an 8-byte MIC; TKIP uses RC4 with per-packet key mixing and is deprecated by the 802.11 standard.

WPA3-Personal replaces the PSK with SAE (Dragonfly), giving forward secrecy and resistance to offline dictionary attacks; OWE provides opportunistic encryption on open networks.

802.11w PMF protects unicast management frames with the PTK and group management frames with BIP/IGTK; SA Query detects mismatched association state.

802.11r key hierarchy: PMK-R0 (derived by the R0KH from the MSK), PMK-R1 (derived per R1KH), then PTK; FTIE carries ANonce/SNonce and R0KH-ID/R1KH-ID, MDIE carries the mobility domain ID.

FT over-the-air performs the FT authentication before reassociation; FT over-the-DS tunnels the FT authentication through the old AP over the distribution system.

OKC (opportunistic key caching) derives a PMK-R1-equivalent key from a cached PMK without an FT exchange and is vendor-specific; 802.11k neighbor reports and 802.11v BSS Transition Management assist roam decisions.

Layer 2 tunneling: PPTP uses TCP 1723 plus GRE with MS-CHAPv2 and is considered broken; L2TP uses UDP 1701 and provides no encryption on its own.

L2TP over IPsec pairs L2TP (UDP 1701) with IPsec ESP; IKE uses UDP 500 and NAT-T uses UDP 4500.

Layer 3 IPsec: AH is IP protocol 51 (integrity/authentication only), ESP is IP protocol 50 (confidentiality plus integrity); IKEv2 runs over UDP 500/4500.

Transport mode protects the upper-layer payload and keeps the original IP header; tunnel mode encapsulates the entire original packet inside a new IP header.

SSL/TLS VPNs run over TCP 443; clientless mode proxies selected applications, while full-tunnel mode installs a virtual adapter and routes all traffic.

Application hardening ports: SSH 22, HTTPS 443, LDAPS 636, RADIUS over TLS (RadSec) TCP 2083, SNMPv3 with authPriv; Telnet 23 and HTTP 80 are cleartext and should be disabled.

A remote-access Layer 3 VPN over an untrusted hotspot protects traffic independently of the visited WLAN link-layer encryption, which may be open or shared-key.

SOHO model: single integrated AP/router, WPA2 or WPA3-Personal, WPS disabled, default admin credentials changed, guest SSID isolated from the internal LAN.

SMB model: multiple APs, WPA2/WPA3-Enterprise with a local RADIUS server, per-SSID VLANs, cloud-managed or on-premises controller, centralized firmware management.

Enterprise model: centralized WLC using CAPWAP control UDP 5246 and data UDP 5247, or controller-less/cloud-managed APs with distributed forwarding.

Public/guest architecture: captive portal, client isolation, bandwidth and session limits, and traffic tunneled to a DMZ anchor controller so guest traffic never enters the internal VLAN.

BYOD onboarding flow: open or PSK provisioning SSID, certificate enrollment (SCEP/EST), then 802.1X EAP-TLS access on the corporate SSID with MDM posture checks.

Scope reduction: cardholder-data WLAN placed in a dedicated VLAN and SSID with restrictive ACLs; guest and internal traffic separated by firewall policy rather than VLAN alone.

High availability: N+1 WLC redundancy, WLC clustering with AP SSO, and mobility groups that permit fast roaming across controllers.

Policy components: acceptable use, authorized device and SSID inventory, minimum encryption (WPA2-CCMP or better), key management, guest access, BYOD, and incident response.

PCI DSS 11.1 requires quarterly wireless scans for rogue APs or a continuous WIPS/WIDS, plus an inventory of authorized wireless devices; requirement 2.1.1 forbids WEP.

NIST SP 800-153 provides guidance on WLAN security configuration, monitoring, and assessment, complementing SP 800-48 for legacy and 802.11i environments.

PSK policy must account for offline attack economics: an 8-character passphrase is brute-forceable from a captured handshake, so long random passphrases are specified instead.

WIPS response policy should state per-category actions: log only, alert, contain rogue AP, contain rogue client, or dispatch physical location.

Audit evidence: WIPS reports and alert history, site survey documentation, configuration backups, RADIUS/authentication logs, and exception approvals.

Incident response sequence for wireless events: detect, classify, locate, contain, remediate/remove, and document with retained evidence.

Core WNMS functions: configuration and profile management, firmware/image management, monitoring and alerting, RF management, reporting, backup/restore, and API integration.

RRM features: dynamic channel assignment (DCA) selects channels, transmit power control (TPC) sets power; both must honor the regulatory domain channel and power limits.

WLC logical interfaces: management (in-band, AP communication), dynamic (VLAN-mapped per WLAN), virtual (captive portal/WebAuth address), and a separate out-of-band service port.

AP discovery of a controller uses DHCP option 43, DNS resolution of a configured controller name, broadcast/multicast on the local subnet, or statically configured controller addresses.

Management telemetry transports: SNMPv3 polling and traps, syslog to a central collector, NTP for time-synchronized logs, and NetFlow/IPFIX for traffic visibility.

Guest management features include sponsor approval, self-registration portals, account expiration, device limits, and per-account bandwidth quotas.

Configuration governance: templates and profiles enforce consistency across sites, and scheduled backups should be stored off-device for restore after failure.

Endpoint security stack: host firewall, HIPS/EDR, antimalware with current definitions, disk encryption, patch management, and device control.

NAC posture assessment checks OS patch level, antimalware definition age, disk encryption state, and host firewall status before granting VLAN or ACL assignment.

Agent-based posture gives richer visibility; agentless posture relies on 802.1X, RADIUS CoA, DHCP fingerprinting, and port profiling.

MDM/MAM for BYOD enforces device passcode and encryption, detects jailbreak/root, separates work data in a container, and supports selective or remote wipe.

Compliance monitoring pipeline: WIPS/WIDS and NAC alerts feed a SIEM, which correlates events, opens tickets, and retains evidence of remediation.

PCI DSS log retention: at least one year of audit trail with the most recent three months immediately available for analysis.

Continuous wireless monitoring is the accepted alternative to quarterly manual scans for the PCI DSS rogue-AP control, provided reports are retained.

Baseline comparison detects configuration drift in AP/WLC settings, enabling corrective change management.