CWAP cheat sheet

Every PPDU has three parts: PHY preamble (used for sync/AGC/channel estimation), PHY header (SIG fields carrying rate/length), and the PSDU (the MAC frame, called MPDU).

Legacy DSSS/HR-DSSS preambles use 1 Mbps Barker (long) or 2 Mbps (short); the PLCP header is always transmitted at 1 Mbps long / 2 Mbps short regardless of payload rate.

OFDM (ERP-OFDM/802.11a/g) preamble is 20 us total: 8 us short training field, 8 us long training field, 4 us SIGNAL field; SIGNAL carries rate (4 bits) and length (12 bits).

HT-mixed preamble: L-STF, L-LTF, L-SIG, then HT-SIG (MCS, 20/40 MHz, guard interval, length), HT-STF and HT-LTFs; the legacy portion is decodable by 802.11a/g radios.

VHT preamble adds VHT-SIG-A, VHT-STF, VHT-LTFs, VHT-SIG-B; VHT-SIG-A is BPSK so 11n devices can decode it and defer.

HE (802.11ax) introduces HE-SIG-A and HE-SIG-B plus the HE-STF/LTF; HE-SIG-A is repeated for reliability and carries RU allocation and BSS color.

EHT (802.11be) uses U-SIG (universal SIG) plus EHT-SIG, and supports 320 MHz channels and 4096-QAM (MCS 12/13) with 16 spatial streams.

MCS index maps modulation and coding rate; e.g., 802.11ac MCS 9 = 256-QAM 5/6, 802.11ax MCS 11 = 1024-QAM 5/6. Higher MCS needs higher SNR.

Channel width doubles throughput roughly: 20, 40, 80, 160 MHz; 80+80 is non-contiguous and uses two separate RF chains.

General MAC frame: Frame Control (2 bytes), Duration/ID (2), Address 1 (2), Address 2 (6), Address 3 (6), Sequence Control (2), Address 4 (6, only in WDS/4-address), QoS Control (2, QoS data only), HT Control (4, if +HTC), Frame Body, FCS (4).

Frame Control fields: Protocol Version, Type, Subtype, To DS, From DS, More Fragments, Retry, Power Management, More Data, Protected Frame, Order.

Address 1 is always the receiver (RA); Address 2 is the transmitter (TA); Address 3 is used for BSSID or destination/source depending on DS bits; Address 4 only when both To DS and From DS are 1.

To DS=0/From DS=0 = IBSS or management/control; To DS=1/From DS=0 = uplink to AP (Addr1=BSSID, Addr2=SA, Addr3=DA); To DS=0/From DS=1 = downlink from AP (Addr1=DA, Addr2=BSSID, Addr3=SA); both 1 = WDS.

Management subtypes: Beacon (8), Probe Request (4), Probe Response (5), Authentication (11), Association Request (0), Association Response (1), Reassociation Request (2), Reassociation Response (3), Deauthentication (12), Disassociation (10).

Control subtypes: RTS (11), CTS (12), ACK (13), Block ACK Request (8), Block ACK (9), PS-Poll (10), CF-End (14). Control frames have no Frame Body.

QoS Control carries TID (4 bits), EOSP, Ack Policy, and A-MSDU Present; TID 0-7 map to four access categories: AC_VO, AC_VI, AC_BE, AC_BK.

The FCS is a 32-bit CRC over the entire frame; a bad FCS causes silent discard, so analysis tools flag it as a retransmission or missing ACK.

Duration/ID in a PS-Poll is the AID; in other frames it is NAV time in microseconds, capped at 32767.

Client join sequence: Probe Request/Response, Authentication (Open or SAE), Association Request/Response, then 4-way EAPOL handshake for WPA2/WPA3-Personal or 802.1X for Enterprise.

Passive scanning listens for Beacons (default 100 TU = 102.4 ms); active scanning sends Probe Requests and waits MinChannelTime/MaxChannelTime per channel.

DCF uses CSMA/CA with a random backoff in slots (9 us for 802.11a/g, 9 us for 11n/11ac, 9 us for 11ax at 20 MHz); CWmin depends on PHY and access category.

SIFS values: 10 us for OFDM (a/g/n/ac/ax), 16 us for DSSS, 2 us for 802.11b short slot? No - SIFS is PHY-specific: 10 us OFDM, 16 us DSSS, 2 us for 802.11ax? Use 16 us for DSSS and 10 us for OFDM.

RTS/CTS exchange: RTS (20 bytes) and CTS (14 bytes) set the NAV on all stations in range; used when frame > dot11RTSThreshold or when hidden nodes are suspected.

Block ACK improves efficiency: ADDBA Request/Response set up the session, then a single Block ACK acknowledges up to 64 MPDUs in a window.

Roaming: client decides to roam (typically at low RSSI or high retry rate), sends Reassociation Request to the new AP; 802.11r (FT) reduces the key handshake to a single exchange.

WMM admission control and U-APSD (WMM-PS) change power-save behavior; PS-Poll is legacy power save, and TIM/DTIM in the Beacon signals buffered frames.

2.4 GHz non-overlapping channels are 1, 6, and 11 (5 MHz spacing, 22 MHz wide); 5 GHz channels are typically 20 MHz wide with UNII-1 (36-48), UNII-2A (52-64, DFS), UNII-2C (100-144, DFS), UNII-3 (149-165).

Noise floor near -95 dBm is excellent; -85 dBm is marginal. SNR of 25 dB or more supports high MCS; below 10 dB falls back to legacy rates.

Co-channel interference shows as a raised noise floor under the AP's own signal; adjacent-channel interference shows as energy spilling from a neighboring channel and usually appears as retries without a raised noise floor under the AP.

Common non-802.11 interferers: microwave ovens (2.4 GHz, sweeping), cordless phones (DECT 1.9 GHz, 2.4 GHz), Bluetooth (2.4 GHz frequency hopping), video cameras, and Zigbee.

Spectrum analyzer views: waterfall (time vs frequency, shows intermittent emitters), duty cycle (percentage of time occupied), and FFT/real-time traces.

DFS: channels in UNII-2 require radar detection; an AP detecting radar must vacate within 10 seconds (channel move time) and stop transmitting for 60 seconds (non-occupancy).

Retry analysis: high retries with low noise suggest hidden nodes or weak coverage; high retries with high noise suggest interference; both cases benefit from checking channel utilization.

Channel utilization above 50-60% from 802.11 traffic indicates a congested BSS; separate airtime from co-channel and non-802.11 sources before changing channels.

Capture at the right point: monitor mode on a dedicated adapter for over-the-air frames, or a SPAN/mirror port for wired-side; monitor mode captures management and control frames that a normal client cannot see.

Display filter examples: wlan.fc.type_subtype==0x08 (Beacon), wlan.fc.type_subtype==0x0b (RTS), wlan.fc.type_subtype==0x0c (CTS), wlan.fc.type_subtype==0x0d (ACK), eapol for the 4-way handshake.

A missing ACK followed by a retransmission with the Retry bit set indicates loss on the link; repeated retries at the same rate suggest the rate adaptation is stuck or the link is marginal.

Deauthentication reason codes: 1 (unspecified), 2 (previous auth no longer valid), 3 (station leaving), 4 (inactivity), 7 (class 3 frame from nonassociated station), 15 (4-way handshake timeout).

The 4-way handshake: EAPOL message 1 (ANonce), message 2 (SNonce + MIC), message 3 (GTK + MIC), message 4 (ACK). Missing message 4 causes the AP to retransmit message 3.

Decryption requires the PSK and the handshake (or the PMK/PTK); without it, data frames show as encrypted and only headers are readable.

Beacon analysis: check beacon interval consistency, TIM/DTIM, supported rates, HT/VHT/HE capabilities, and RSN information elements for cipher and AKM mismatches.

Common failure patterns: association response status 17 (AP full), status 18 (rate set mismatch), and repeated probe requests with no response (coverage or channel mismatch).