// visualiser · frame exchange

Frame Exchange Animator

Four exchanges, drawn frame by frame and paced to the real capture timestamps from Frame Challenge. Scrub the timeline, or click any row in the list to jump there.

Playback is slowed so it is watchable. The clock always shows the real elapsed capture time, and the strip below compares the four exchanges at true relative scale.

// real duration, all four to the same scale
EAP-TLS
442.0 ms
FT Roam
76.0 ms
Wi-Fi 7 MLO
39.2 ms
Failed handshake
off scale
4029.0 ms
An FT roam completes in 76 ms. A full EAP-TLS association takes 442 ms, 5.8 times longer, and almost all of that is the certificate exchange. That gap is the entire argument for 802.11r on a voice network. The failed handshake is scaled off the end at 4029 ms, because four one-second retry timeouts are not a duration you compare against a working association.
Full 802.1X association

WPA3-Enterprise, 5 GHz. Three lanes, because two lanes tell a lie: most of this association is not happening on the air at all. The dashed legs to RADIUS are inferred from the gaps, not captured, since a wireless sniffer never sees the wired side.

0.000 s
STA_7e:c1:03 AP_a4:2b:10 RADIUS not in the capture 45.4 ms 146.5 ms 45.4 ms 0 100 200 300 400 ms Authentication Open System, SEQ=1 04 Authentication SEQ=2, Status=0 05 Association Request 06 Association Response Status=0, AID=4 07 EAP Request Identity 08 EAP Response Identity 09 EAP Request TLS 10 EAP Response TLS 11 EAP Request TLS (1188 bytes) 12 EAP Response TLS 13 EAP Success 14 EAPOL Key M1 ANonce 15 EAPOL Key M2 SNonce + RSNE 16 EAPOL Key M3 GTK 17 EAPOL Key M4 ack 18
// where the 442 ms actually goes
802.11 over the air 20.6 ms 4.7%
RADIUS round trips 237.3 ms 53.7%
Client-side crypto 169.9 ms 38.4%
AP starting EAP 14.2 ms 3.2%
Only 4.7% of this association is 802.11 exchange. Over half is the AP waiting on RADIUS, and 38.4% is the client doing TLS crypto. When someone reports slow onboarding, the capture says the air was idle for most of it. Check the RADIUS path and the client, not the RF.
Vertical position is proportional to capture time. Frames closer than 3.7 ms are nudged apart so they stay clickable, a maximum error of 0.63% of the axis. 9 of 15 labels fit; the full list is on the right.
// share this page
// also on this site
reference
Status & Reason Codes
reference
Wireshark Filters
quiz
Frame Analysis Pro
← previous
pcap
Frame Challenge
next →
pcap
Frame Lab
SK
Shankar K., Wi-Fi engineer, Irving TX
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks
// leave a comment