// writing · pcap series · session 4
PCAP Series #4 — The 4-Way Handshake in PCAP
Shankar K.·July 2026·eapol · 4-way handshake · wpa2·7 min read
"Four frames. If you see all four followed by encrypted data, it worked." ·
eapol && wlan.addr == [client MAC]
M1 — AP sends ANonce
Key Info: Pairwise=1, ACK=1, MIC=0. No MIC — frame unprotected. PMKID in M1 can be extracted for offline dictionary attack even without a full handshake.
M2 — Client sends SNonce + MIC
MIC computed over the frame using KCK derived from PMK. AP verifies MIC. Fails to verify = client has wrong PMK (wrong PSK). No M3 follows. This is the PSK mismatch signature: M1 + M2, then silence.
M3 — AP sends GTK encrypted
Key Info: Install=1, Encrypted=1, MIC=1. Replay Counter must be higher than M1. Same Replay Counter as M1 = KRACK retransmission trigger (CVE-2017-13077).
M4 — Client ACKs
Next frames should have Protected=1. If Protected=0 after M4, cipher activation failed.
M1 only → Client ignoring M1 (PMK not ready)
M1+M2, no M3 → PSK mismatch
M1+M2+M3, no M4 → Client rejected GTK (PMF/IGTK issue)
Complete but Protected=0 → Driver cipher activation failure
M1+M2, no M3 → PSK mismatch
M1+M2+M3, no M4 → Client rejected GTK (PMF/IGTK issue)
Complete but Protected=0 → Driver cipher activation failure
Next: Session 5 — Why clients won't move to 6 GHz.
// related reference