// writing · pcap series · session 3
PCAP Series #3 — Diagnosing association failure
Shankar K.·July 2026·association failure · status codes · pcap·6 min read
"The failure is in one frame. One status code. You just have to know which frame to check." ·
The five-frame filter
wlan.addr == [client MAC] && (wlan.fc.type_subtype == 0x04 || wlan.fc.type_subtype == 0x0b || wlan.fc.type_subtype == 0x00 || wlan.fc.type_subtype == 0x01 || eapol)
Probe, Auth, AssocReq, AssocResp, EAPOL. Work through in time order. Find where the sequence stops.
AssocResp non-zero status
wlan.fc.type_subtype == 0x01 && wlan_mgt.fixed.status_code != 0
17 → Insufficient capacity at AP
18 → Basic rate mismatch
23 → 802.1X required, client not doing it
24 → Cipher suite rejected (RSN IE mismatch)
30 → PMF required, client not capable (MFPC=0 vs MFPR=1)
72 → Invalid PMKID (PMKSA cache miss)
18 → Basic rate mismatch
23 → 802.1X required, client not doing it
24 → Cipher suite rejected (RSN IE mismatch)
30 → PMF required, client not capable (MFPC=0 vs MFPR=1)
72 → Invalid PMKID (PMKSA cache miss)
EAPOL timeout
AssocResp Status 0 but no EAPOL M1: AP has no PMK ready (PSK mismatch or RADIUS unreachable). M2 but no M3: AP rejected the MIC — PSK mismatch signature. M3 but no M4: client rejected GTK — PMF/IGTK issue or driver bug. Next: Session 4 — 4-Way Handshake.
// related reference