Wi-Fi Security Reference

The RSN IE (id=48) in a Beacon or AssocReq tells you everything about what security the AP is offering and what the client actually negotiated. It is the single most important IE for security diagnosis. Every mismatch between the Beacon RSN IE and the AssocReq RSN IE is a potential authentication failure.

WPA2 = 802.11i (RSN) with CCMP/AES as the mandatory cipher. The 4-way handshake derives the PTK (Pairwise Transient Key) from the PMK and two random nonces. CCMP uses AES in counter mode with CBC-MAC for both encryption and integrity. The handshake is visible in every WPA2 connection - capture it, count the frames, read the timing.

WPA3 has two variants that are often conflated. WPA3-Personal replaces PSK with SAE for home / SMB networks. WPA3-Enterprise replaces WPA2-Enterprise's SHA-1 AKM with SHA-256 (AKM 5) for 802.1X networks. Both mandate PMF. Both are required on 6 GHz. SAE and 802.1X-SHA256 are not interchangeable - they solve different problems.

WPA3-Enterprise is 802.1X with SHA-256-based key derivation, not SAE. Client still authenticates via EAP (EAP-TLS, PEAP, TTLS) to a RADIUS server exactly like WPA2-Enterprise. The difference is the AKM suite (5 instead of 1), the PMF requirement (mandatory), and the cipher suite options (CCMP-128 standard, GCMP-256 for the 192-bit "Suite-B" mode used in government / defence).

Transition Mode allows WPA2 (PSK) and WPA3 (SAE) clients on the same SSID during migration. The Beacon RSN IE advertises both AKM type 2 (PSK) and type 8 (SAE). WPA3 clients use SAE - WPA2 clients fall back to PSK. In PCAP: check the AssocReq AKM per client - a WPA3-capable client should use type 8. If it uses type 2, it fell back to WPA2 despite the AP advertising SAE. Transition mode is not permitted on 6 GHz - the AP must advertise AKM 8 (SAE) or AKM 5 (802.1X-SHA256) only.

Vendor-proprietary schemes assign a unique PSK per user or device while presenting a single SSID. RUCKUS DPSK, Aruba iPSK, Cisco Meraki iPSK, and generic PPSK all fit this pattern. Originally built on WPA2-PSK. For 6 GHz the vendor has to extend the scheme to WPA3-SAE - RUCKUS ships this as DPSK3, which maps per-user keys onto SAE so 6 GHz is usable. Most other vendors have not shipped the SAE variant yet. The trade-off for DPSK3 is onboarding: clients have to bind the passphrase on 2.4 or 5 GHz first before the 6 GHz radio accepts them. Plain DPSK (WPA2) and generic PPSK are not permitted on 6 GHz because the RSN IE cannot advertise a 6-GHz-valid AKM.

Without PMF, deauthentication and disassociation frames are sent in the clear and can be forged by anyone. An attacker can send a spoofed deauth to any client and disconnect them instantly - no encryption key needed. PMF encrypts these management frames so forged deauths are rejected. Required for WPA3, optional for WPA2.

The 6 GHz band is governed by a clean-slate security policy. No legacy protocols. No WPA2. No transition modes. The Wi-Fi Alliance mandates that APs operating in 6 GHz advertise only WPA3 (Personal or Enterprise) or OWE, with PMF mandatory on all of them. This applies to Wi-Fi 6E and Wi-Fi 7 devices. Non-compliant security modes are not certified and the AP is required to disable the 6 GHz radio or refuse associations on that band.

Wi-Fi 7 certification added Beacon Protection on top of PMF - a Management MIC Information Element in the beacon itself, so associated clients can verify the beacon wasn't tampered with. Wi-Fi 7 also tightened the cipher story: newer profiles require GCMP-256 (AKMs 24/25 for SAE-EXT-KEY and its FT variant), though CCMP-128 is still widely deployed for client compatibility. Hash-to-Element (H2E) is mandatory for SAE on Wi-Fi 6E / Wi-Fi 7 - the older Hunting-and-Pecking SAE variant is not certified for 6 GHz.

Enterprise Wi-Fi uses 802.1X for authentication - the AP acts as an authenticator, the client is the supplicant, and a RADIUS server is the authentication server. EAP (Extensible Authentication Protocol) runs inside 802.1X. The specific EAP method determines how credentials are verified and what a failure looks like in a PCAP.

Every Wi-Fi attack leaves a protocol signature. These are the patterns I look for when diagnosing a suspected attack - each with the exact Wireshark filter to find it.