802.11 Operation and Frame Exchanges
Domain 3: 802.11 Operation and Frame Exchanges
This domain tests frame exchanges as sequences: discovery, authentication, association, security, QoS setup, and power-save. You need to recognize the order of frames, which frame carries which parameter, and what a failed or repeated exchange implies.
Discovery and join
Passive scanning listens for Beacons; active scanning sends Probe Requests and collects Probe Responses. Authentication follows: Open System is two frames; SAE (WPA3-Personal) uses a commit/confirm exchange. Association Request carries the SSID, supported rates, RSNE, and HT/VHT/HE capabilities; Association Response carries the AID and status code. Reassociation adds the current AP address and is used in roaming.
Security and QoS exchanges
WPA2/WPA3-Personal use the 4-way handshake after association: EAPOL-Key message 1 (ANonce), message 2 (SNonce + MIC), message 3 (GTK + MIC), message 4 (ACK). The PTK is derived from the nonces, MAC addresses, and PMK; the GTK is encrypted in message 3. 802.1X enterprise adds EAP before the 4-way handshake. WMM/EDCA uses four access categories; ADDBA Request/Response establishes a Block Ack agreement, then QoS Data frames are acknowledged by BlockAck.
Worked example
A capture shows Association Response with status 0, then EAPOL-Key message 1, then a retransmitted message 1, then message 2, message 3, message 4. The retransmission means the client did not receive or did not process the first message 1, commonly because of a missing ANonce or a MIC failure later. If message 2 never appears, suspect the client did not derive the PTK or the passphrase is wrong; if message 4 is missing, the AP may still install keys, but the client may not acknowledge.
Power save and protection
PS-Poll retrieves buffered frames after a beacon with the TIM bit set. U-APSD and WMM power save use trigger frames and service periods. RTS/CTS and CTS-to-self protect exchanges when legacy devices, hidden nodes, or wide channels require it. Trigger frames schedule OFDMA uplink in HE.
Traps
Do not treat the 4-way handshake as authentication; it is key derivation and confirmation. Do not assume every Association Response means the client can pass traffic; DHCP and ARP follow. Do not ignore BlockAck setup: without ADDBA, aggregation will not run. Roaming is not a single frame; look for Reassociation Request/Response and key refresh.