OffSec Wireless Professional key terms

A frame type used to establish and maintain wireless links, including beacon, probe request/response, authentication, association, and deauthentication subtypes; these frames are typically unencrypted even on protected networks.

A management frame broadcast periodically by an access point advertising its SSID, supported rates, channel, and security capabilities; passive scanners rely on it to discover nearby networks.

A management frame sent by a client station seeking access points; a directed probe names a specific SSID and reveals the client's preferred network list to anyone capturing traffic.

A management frame an access point returns to a probe request, supplying its SSID, capabilities, and channel so the station can decide whether to associate.

The human-readable network name carried in beacon and probe frames; it identifies a wireless network to users but is not a security control and can be hidden or spoofed.

The MAC address identifying a specific access point radio within a basic service set; tools use it to distinguish access points that share an SSID.

The fundamental 802.11 topology of one access point and its associated stations; multiple BSSs joined by a distribution system form an extended service set.

A set of basic service sets sharing one SSID and linked by a wired distribution system, allowing clients to roam between access points without reconfiguring their network settings.

An 802.11 topology in which stations communicate directly with each other without an access point, forming an independent basic service set; it lacks centralized management and policy enforcement.

A wireless adapter operating mode that delivers all captured 802.11 frames, including management and control frames, to the operating system without associating to any network.

The default adapter mode in which the driver behaves like an Ethernet interface, joining one network and passing only data frames to the host; it cannot capture raw 802.11 headers.

Transmitting crafted 802.11 frames from a monitor-mode adapter, used for deauthentication, beacon flooding, and replay attacks; it requires a chipset and driver that support raw frame transmission.

The Linux kernel subsystem that implements 802.11 station and access point logic, sitting between cfg80211 and hardware drivers and exposing wireless interfaces to user-space tools.

The Linux kernel configuration layer that provides a netlink interface for wireless management, handling regulatory domains, channel settings, and interface mode changes for mac80211 drivers.

A command-line utility that configures Linux wireless devices through cfg80211, listing interfaces, supported modes, channels, and allowing monitor-mode creation; it replaces the older wireless-tools package.

A legacy wireless-tools command showing and setting basic interface parameters such as ESSID and mode; it relies on the deprecated Wireless Extensions and is unreliable for modern mac80211 drivers.

A metadata header prepended to captured 802.11 frames recording channel, signal strength, data rate, and flags; it is the standard capture format used by Wireshark and Aircrack-ng.

A collection of command-line tools for wireless assessment, including airmon-ng for mode changes, airodump-ng for capture, aireplay-ng for injection, and aircrack-ng for key recovery.

An Aircrack-ng tool that passively scans channels, listing access points and clients with signal, encryption, and channel details, and optionally writes capture files containing all observed frames.

An Aircrack-ng tool that injects frames, most commonly sending deauthentication packets to force a handshake capture and performing fake authentication or ARP replay against WEP.

A passive wireless detector and network sniffer that discovers access points and clients across channels, logs them to databases, and can also capture packets for later analysis.

A saved record of observed frames, usually in pcap or pcapng format, that preserves radiotap metadata and can be reopened in Wireshark for filtering, decryption, and forensic review.

An expression applied to an already loaded capture to show only matching packets, using protocol fields such as wlan.fc.type_subtype or eapol to isolate relevant traffic.

The Extensible Authentication Protocol over LAN frame format used in the 802.11 four-way handshake; capturing all four messages lets an analyst attempt offline verification of the pre-shared key.

The WPA/WPA2 exchange in which access point and station derive and confirm session keys from the pre-shared key and nonces; a captured handshake enables offline passphrase guessing.

The process of recording a complete four-way handshake by monitoring a channel, often triggering reconnection with a deauthentication burst so a client repeats the exchange.

A key identifier derived from the pairwise master key and sent in the first EAPOL message of some access points; capturing it allows offline passphrase attacks without a full handshake.

Wi-Fi Protected Setup, a convenience feature using a PIN or push button to join clients; weak PIN validation and brute-forceable registrar flows have made it a common attack path.

An eight-digit code used to authorize a client via Wi-Fi Protected Setup; because validation is split and the last digit is a checksum, the search space is small enough to brute force.

An offline attack against WPS that exploits weak random number generation in some chipsets, recovering the PIN from a single registration exchange without repeated online guesses.

A tool that performs online brute-force attacks against WPS PINs, recovering the access point PIN and then the WPA passphrase; it is slow and may trigger lockouts on hardened devices.

Wired Equivalent Privacy, an obsolete 802.11 encryption scheme with flawed RC4 key scheduling and short initialization vectors, allowing statistical key recovery from captured traffic.

A per-packet value combined with the key in stream ciphers; in WEP its 24-bit size causes reuse, which enables keystream recovery and statistical attacks on the key.

A key reinstallation attack against the WPA2 four-way handshake that tricks a client into reusing an already-installed key, enabling decryption or injection on affected implementations.

A rogue access point that clones a legitimate network's SSID and BSSID to lure clients into associating, enabling credential capture, traffic interception, or captive-portal phishing.

Any unauthorized access point connected to or imitating a network, whether planted maliciously or installed carelessly by staff; detection relies on comparing observed BSSIDs against an authorized inventory.

A technique in which a rogue access point answers every directed probe request with a matching SSID, exploiting clients that broadcast their preferred network list to attract associations automatically.

Forged deauthentication management frames sent to a client or access point to sever their link, used to force reconnection for handshake capture or to disrupt service.

An 802.11w feature that cryptographically signs robust management frames such as deauthentication and disassociation, preventing forgery and blocking classic deauthentication attacks.

The set of SSIDs a client has saved and will automatically probe for or join, making it a target for spoofing because attackers can impersonate any name on the list.

The country-specific rules enforced by the kernel and driver that determine permitted channels, transmit power, and frequencies; an incorrect setting can hide or block usable channels.