Wireless Network Types and Architectures: 802.11 Foundations
The exam tests whether you can read a wireless network the way you read a TCP handshake: which band and channel it lives on, which frames reveal its security configuration, and how the 4-way handshake maps onto the standard. Every later attack depends on these layer-1 and layer-2 facts.
Bands, channels and standards
The 2.4 GHz band carries 802.11b/g/n with 5 MHz channel spacing; a 20 MHz channel overlaps its neighbours, so in North America only 1, 6 and 11 are non-overlapping. 802.11a/n/ac/ax use the 5 GHz UNII bands, and 802.11ax also reaches 6 GHz (Wi-Fi 6E), giving many more non-overlapping channels. 802.11i defined RSN - CCMP/AES plus the 4-way handshake - while "WPA" was the Wi-Fi Alliance's interim TKIP/Michael specification, and WPA3 replaces the PSK exchange with SAE.
Frame classes that matter
- Management: beacon, probe request/response, authentication, association, deauthentication (subtype 12), disassociation.
- Control: RTS, CTS, ACK, PS-Poll, Block Ack.
- Data: carries EAPOL during the handshake.
Beacons advertise the BSSID, the SSID (zero-length when hidden), channel, supported rates, RSN and WPS information elements, and the beacon interval in time units (1 TU = 1024 µs). Handshake order is M1 (ANonce), M2 (SNonce + MIC), M3 (GTK + MIC), M4; the PMK is PBKDF2-HMAC-SHA1 over the passphrase and SSID with 4096 iterations and a 256-bit output.
Worked example
A beacon reports a beacon interval of 100. That is 100 × 1024 µs = 102.4 ms, so the AP sends about 9.8 beacons per second - which is why airodump-ng's Beacons column climbs roughly ten per second even with no client present. If the same beacon's RSN IE lists pairwise CCMP and AKM PSK, the network is WPA2-PSK and any captured handshake can be attacked offline, provided the passphrase is 8–63 ASCII characters; shorter input cannot produce a PMK at all.
Traps
- Confusing 802.11a (5 GHz OFDM) with 802.11b (2.4 GHz DSSS), or assuming 802.11n is 5 GHz only.
- Treating a hidden SSID as invisible: it still appears in probe responses and association requests, and airodump-ng shows a zero-length ESSID.
- Reading airodump-ng's PWR column as link quality when it is signal in dBm.