Protocol Analysis and Troubleshooting
Domain 5: Protocol Analysis and Troubleshooting
This domain tests the workflow of turning a capture into a diagnosis: capture correctly, filter deliberately, quantify symptoms, and prove a cause. You need to know common 802.11 failure signatures and the metrics that distinguish them.
Capture and filtering
Use monitor mode on a dedicated adapter, set the channel and width to match the BSS, and capture both directions when possible. Capture filters drop packets before the buffer; display filters hide them afterward. Useful display filters include wlan.fc.type_subtype, wlan.addr, wlan.retry, wlan.fc.protected, and eapol. For 802.11ac/ax, confirm the adapter supports the PHY and width; otherwise you will see corrupted or missing frames.
Metrics and signatures
Track retry rate, duplicate frames, data rate/MCS, RSSI, SNR, channel utilization, and airtime per client. High retries on one client suggest RF or rate adaptation; high retries across all clients suggest contention or interference. Broadcast/multicast at low rates consumes airtime. A sticky client stays associated to a distant AP at a low MCS. Missing ACKs, repeated RTS/CTS, and fragmented frames point to hidden nodes or protection overhead. DHCP failures after association are upper-layer, not association failures.
Worked example
A capture shows one client at -72 dBm with a 45% retry rate and MCS 1, while other clients on the same AP run MCS 7 with 5% retries. The AP is not overloaded and channel utilization is 35%. Reasoning: the problem is localized to the client link, not the channel. The client is likely far away or behind an obstruction, and rate adaptation has dropped it to a robust MCS. Check roaming and antenna placement; do not blame the AP channel.
Traps
Do not diagnose from a single frame; look at the exchange. Do not confuse a retry with an LLC duplicate; the sequence number and retry bit together identify retransmission. Do not treat all missing frames as loss; capture drops and monitor-mode limitations cause false negatives. Do not ignore management overhead: beacons, probes, and action frames can dominate airtime in dense environments.