Skip to content
Cybersecurity Handbook Pro

Wireless Fundamentals & Recon (802.11)

Definition

Section titled “Definition”

802.11 wireless fundamentals cover the physical and link-layer reality every Wi-Fi attack and defense stands on: channels and bands (2.4/5/6 GHz), frame types (management, control, data), the four-address header scheme, beacon/probe behavior, association and authentication state machines, and encryption in transit (open, WEP-dead, WPA2-PSK, WPA3-SAE, WPA2/3-Enterprise). Wireless reconnaissance is the passive discipline of observing that reality: channel hopping across bands, cataloging networks (BSSID/SSID/channel/encryption/capabilities), noting clients and their associations, and building the site survey that every later technique — capture, rogue AP, evil twin, deauth — depends on. Recon is passive-first for good reason: observation is invisible to WIDS and legally safer than transmission, and a well-built survey answers most attack-planning questions before a single packet is sent.

Why It Matters

Section titled “Why It Matters”

Wireless is the perimeter that isn’t a wall: it extends the network through walls, parking lots, and neighboring floors, and every corporate network has clients that associate somewhere sensitive — guest, corporate, IoT, and forgotten SSIDs sharing air with each other. Understanding 802.11 fundamentals is the difference between seeing that world and guessing at it: which networks are enterprise-authenticated (so credential attacks target EAP, not handshakes), which are PSK (so handshake capture applies), which are hidden-but-probing (so clients leak themselves), and which devices sit on channels with neighbors that make deauth/rogue work easy to hide. For defenders, the same fundamentals drive wireless security architecture: channel planning, WIDS sensor placement, rogue detection baselines (what’s normal in this airspace), and the client-behavior risks (probe-request leakage, auto-join lists) that policies like “don’t auto-connect to open networks” address. For the attacker, wireless recon is the cheapest, quietest phase of any wireless engagement — and for the analyst, the frame-level literacy this module builds is what makes every later wireless module readable, because deauth, handshake, SAE, and WIDS evasion all reduce to specific frames on specific channels.

Detailed Explanation

Section titled “Detailed Explanation”

The 802.11 link layer is built from three frame families, and management frames carry almost all the reconnaissance value:

 802.11 FRAME FAMILIES (management carries the recon value)
 MANAGEMENT (unencrypted in most deployments!)
   Beacon            AP announces: SSID, channel, RSN info
                     (cipher suites), capabilities, TIM
   Probe Request     client asks: "any AP with SSID X?"
                     (wildcard = broadcast; leaks saved SSIDs)
   Probe Response    AP answers a probe
   Auth / Assoc      client joins; status codes
   Deauth/Disassoc   tear-down (the infamous frame, WI2)
 CONTROL
   RTS/CTS, ACK, PS-Poll, BlockAck
 DATA
   carries payload; encrypted per RSN (CCMP/GCMP)
   4-address scheme: RA, TA, DA, SA (mesh/WDS uses all 4)


 SITE SURVEY MODEL (what recon records)
 per AP:    BSSID | SSID | channel/band | RSN ciphers |
            auth (PSK/SAE/EAP) | vendor OUI | signal
 per client: MAC | OUI | probes (saved SSIDs!) |
             associations | traffic profile
 per channel: utilization, neighbors, anomalies

The beacon is the AP’s self-description — sent ~every 102 µs × 100 (≈102 ms) on its channel — and its information elements (IEs) enumerate everything that matters: the SSID (or hidden, meaning absent), the RSN IE listing pairwise cipher suites (CCMP-128 = WPA2, GCMP-256 = WPA3, TKIP = legacy guilt), the AKM suites (PSK, SAE, 802.1X), and capability bits. Probe requests are the client-side mirror: a phone searching for known networks broadcasts its saved SSID list (unless MAC randomization and optimization suppress it), which is why probe reconnaissance maps people’s networks-of-origin without ever associating. Channels and bands shape both the survey and the attack surface: 2.4 GHz has 3 non-overlapping channels (1/6/11) and crowded airspace; 5/6 GHz offer more channels, DFS ranges (radar-sharing constraints that matter for legality), and better isolation — and hopping across them is what a recon pass is. The association state machine (authenticate → associate → 4-way handshake for PSK/SAE, or EAP exchange for Enterprise) defines what later modules capture and attack. Frame literacy has a defensive payoff the same night: a WIDS baseline is “the beacons, probes, and associations that are normal here”, and every wireless attack module in this series is detectable precisely as a deviation from that baseline — extra beacons (rogue AP), deauth bursts (forced re-auth), probe response floods (KARMA-style client attacks).

Common Techniques

Section titled “Common Techniques”
Recon techniqueWhat it doesToolingDetectable?
Channel hop surveyEnumerate APs across bandsairodump-ng, horstPassive: WIDS-invisible
Beacon IE parsingCiphers, AKM, capabilitiestshark, scapyPassive
Probe-request harvestingClient saved-SSID leakageairodump, tsharkPassive
Client-association mappingWho talks to what, whereairodump, WIDSPassive
Hidden-SSID identificationProbe responses reveal SSIDPassive listeningPassive
Fingerprinting OUIsVendor/device class mappingmacchanger DBPassive
Signal triangulationPhysical AP locationSignal sweepsPassive
Active probe (send probe req)Elicit hidden-AP responsescapyTransmits — WIDS-seen
Injection testCan we tx on this channel?aireplay-ng testTransmits
DFS-band listeningCatch channels others ignoreSurvey toolsPassive (legal note)

Full Working Code

Section titled “Full Working Code”

wifiscan.py — a passive 802.11 site-survey analyzer: parses a monitor-mode capture (pcap) with scapy, catalogs every AP (BSSID, SSID, channel, RSN cipher/AKM suites, capabilities), maps clients and their probe requests/associations, and produces the survey report (JSON + human table) that later modules consume. Dependency: scapy (stated). Passively reads captures — never transmits.

#!/usr/bin/env python3
"""wifiscan.py — passive 802.11 site-survey analyzer (pcap in).
Usage:
  python wifiscan.py capture.pcap [--json survey.json]
Build: monitor-mode capture first, e.g.
  airmon-ng start wlan0 && airodump-ng -w cap wlan0mon
Deps: scapy.
"""
import argparse, json, sys
from collections import defaultdict
from scapy.all import PcapReader, Dot11, Dot11Beacon, \
    Dot11ProbeReq, Dot11AssoReq, Dot11Elt, RadioTap


AKM = {1: "802.1X", 2: "PSK", 3: "FT-802.1X", 4: "FT-PSK",
       8: "SAE", 11: "1X-SHA256", 12: "PSK-SHA256"}
CIPHER = {1: "WEP-40", 2: "TKIP", 4: "CCMP-128",
          5: "WEP-104", 6: "BIP", 8: "GCMP-128",
          9: "GCMP-256", 10: "CCMP-256"}


def parse_rsns(ie_suite):
    """Decode RSN IE suite lists into human names."""
    ciphers, akms = [], []
    try:
        count = ie_suite[0]
        for i in range(count):
            v = int.from_bytes(ie_suite[1 + i * 4:5 + i * 4],
                               "little")
            ciphers.append(CIPHER.get(v & 0xFF,
                                      f"unk-0x{v:02x}"))
        off = 1 + count * 4
        acount = ie_suite[off]
        for i in range(acount):
            v = int.from_bytes(
                ie_suite[off + 1 + i * 4:off + 5 + i * 4],
                "little")
            akms.append(AKM.get(v & 0xFF, f"unk-0x{v:02x}"))
    except (IndexError, TypeError):
        pass
    return ciphers, akms


def survey(pcap_path):
    """One pass over the capture: APs, probes, associations."""
    aps = defaultdict(lambda: {"ssid": None, "channel":
                               None, "rsn": None, "akm": None,
                               "hidden": False, "frames": 0})
    clients = defaultdict(lambda: {"probes": set(),
                                   "assoc": set(),
                                   "frames": 0})
    total = 0
    with PcapReader(pcap_path) as reader:
        for pkt in reader:
            if Dot11 not in pkt:
                continue
            d11 = pkt[Dot11]
            total += 1
            ftype = d11.type          # 0=mgmt 1=ctrl 2=data
            addr2 = d11.addr2          # transmitter
            if ftype == 0 and Dot11Beacon in pkt:
                ap = aps[addr2]
                ap["frames"] += 1
                ssid_el = pkt[Dot11Elt]
                # walk IEs for SSID(0), DS(3), RSN(48)
                el = pkt.getlayer(Dot11Elt)
                while el is not None:
                    if el.ID == 0:
                        name = el.info.decode(
                            errors="replace")
                        ap["ssid"] = name
                        if not name:
                            ap["hidden"] = True
                    elif el.ID == 3 and len(el.info) >= 1:
                        ap["channel"] = el.info[0]
                    elif el.ID == 48:
                        c, a = parse_rsns(el.info[2:])
                        ap["rsn"] = ",".join(c) or None
                        ap["akm"] = ",".join(a) or None
                    el = el.payload.getlayer(Dot11Elt) \
                        if el.payload and \
                        isinstance(el.payload, Dot11Elt) \
                        else None
            elif ftype == 0 and Dot11ProbeReq in pkt:
                c = clients[addr2]
                c["frames"] += 1
                el = pkt.getlayer(Dot11Elt)
                while el is not None:
                    if el.ID == 0:
                        ssid = el.info.decode(
                            errors="replace")
                        if ssid:
                            c["probes"].add(ssid)
                    el = el.payload.getlayer(Dot11Elt) \
                        if el.payload and \
                        isinstance(el.payload, Dot11Elt) \
                        else None
            elif ftype == 0 and Dot11AssoReq in pkt:
                c = clients[addr2]
                c["frames"] += 1
                c["assoc"].add(d11.addr1 or "?")
            elif ftype == 2:
                # data frame: both ends count as clients
                for a in (d11.addr1, d11.addr2):
                    if a:
                        clients[a]["frames"] += 1
    return {"aps": {k: dict(v) for k, v in aps.items()},
            "clients": {k: {"probes": sorted(v["probes"]),
                            "assoc": sorted(v["assoc"]),
                            "frames": v["frames"]}
                        for k, v in clients.items()},
            "total_frames": total}


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("pcap")
    ap.add_argument("--json")
    args = ap.parse_args()
    s = survey(args.pcap)
    print(f"== survey: {s['total_frames']} frames, "
          f"{len(s['aps'])} APs, {len(s['clients'])} "
          f"clients ==")
    print("\nAPs:")
    for bssid, a in sorted(s["aps"].items(),
                           key=lambda kv: -kv[1]["frames"]):
        ssid = a["ssid"] or ("<hidden>" if a["hidden"]
                             else "?")
        print(f"  {bssid}  ch={a['channel'] or '?':<3} "
              f"{ssid:<24} {a['akm'] or 'open/legacy':<12} "
              f"{a['rsn'] or '-'}")
    probing = {m: c for m, c in s["clients"].items()
               if c["probes"]}
    if probing:
        print("\nclients leaking saved SSIDs (probes):")
        for mac, c in list(probing.items())[:10]:
            print(f"  {mac}  probes: "
                  f"{', '.join(list(c['probes'])[:5])}")
    if args.json:
        json.dump(s, open(args.json, "w"), indent=2)
        print(f"\n[+] {args.json}")


if __name__ == "__main__":
    main()

Code Walkthrough

Section titled “Code Walkthrough”
  • parse_rsns() (lines 24-42) decodes the RSN IE’s suite lists: pairwise cipher count + 4-byte suites (vendor OUI + type byte), then AKM count + suites. The type byte (masked & 0xFF) maps to the human names — CCMP-128 vs GCMP-256 vs TKIP — and the AKM names separate PSK from SAE from 802.1X, which is the classification every later module branches on.
  • The beacon branch (lines 60-79) walks the IEs via the getlayer(Dot11Elt) chain — the classic scapy idiom and its classic trap: IE 0 is the SSID (empty = hidden), IE 3 the DS parameter (channel), IE 48 the RSN. The loop’s guard (isinstance(el.payload, Dot11Elt)) prevents walking into non-IE payloads.
  • The probe branch (lines 80-91) collects each client’s directed probe SSIDs — the saved-network leakage. The wildcard probe (length-0 SSID) is deliberately excluded from the probes set (line 88: if ssid), because broadcast probes leak nothing.
  • The data-frame branch (lines 92-96) counts both addresses as clients — coarse, but it catches associated traffic without full state tracking, and the frames count gives the report a ranking signal.
  • The report (lines 130-145) prints APs sorted by frame count with channel/auth/cipher columns, then the probe-leaking clients — the two lists that answer “what’s in this airspace and what’s the attack surface”.

How It Reaches The Target

Section titled “How It Reaches The Target”

The survey reaches the airspace the way every later wireless operation does: from a position the defender may not control, through walls the defender cannot remove. The AP catalog reaches attack planning as the surface map — PSK networks route to handshake capture (WI2), SAE networks to different analysis (WI3), 802.1X networks to EAP-focused attacks (WI4), hidden networks to their probing clients — and the probe-leak list reaches client-targeting as the saved-SSID map that KARMA-style attacks exploit. On the defender’s side, the same survey reaches the WIDS program as its baseline: the legitimate AP inventory (BSSIDs, channels, cipher posture), the client inventory (which devices probe which names — including corporate SSIDs leaked by employees’ personal laptops), and the channel-utilization picture that rogue detection needs to separate “neighbor’s new router” from “evil twin in the parking lot”. The cipher-posture column reaches hardening as its cheapest report: TKIP or WEP anywhere in the RSN list is a migration ticket, and “open” networks without isolation are an architecture conversation. The recon discipline also reaches the legal/pre-engagement layer: passive listening is invisible to WIDS and generally lawful on your own or authorized airspace, while transmission (active probes, injection tests) changes the legal and detection calculus — which is why the survey is passive-first and the injection test is a deliberate, gated step. At the program level, the quarterly re-survey reaches the wireless security metric: new networks, vanished networks, cipher drift, and new probe-leaking devices — the airspace equivalent of the east-west baseline diff.

Exploitation Chain

Section titled “Exploitation Chain”
  1. Setup — authorized engagement; monitor-mode interface on lab laptop; capture begins
  2. Hop — passive channel sweep across 2.4/5 GHz bands for 30 minutes
  3. Catalog — wifiscan.py parses capture: 34 APs, 4 hidden, 61 clients cataloged
  4. Classify — 5 PSK networks, 2 SAE, 6 enterprise (802.1X), rest open/mixed
  5. Leak — 9 clients probe corporate-style SSIDs from personal devices: client-targeting map
  6. Baseline — cipher posture: 3 networks still offer TKIP pairwise: hardening finding
  7. Plan — attack surface ranked: PSK handshake capture targets, enterprise EAP surface, rogue opportunities
  8. Handoff — survey JSON + ranked plan into engagement record; passive-only, zero transmissions logged by WIDS

Building Your Own Tool

Section titled “Building Your Own Tool”

channelstat.py — a channel-utilization analyzer from the same capture: computes per-channel frame counts, per-channel AP/client density, and airtime-proxy statistics (frame count per channel per capture duration), producing the channel-planning view WIDS sensor placement and rogue-detection baselines need — and the congestion view that tells an attacker which channels hide best.

Design decisions

Section titled “Design decisions”
  • Same capture, second lens. The survey tool answers “what exists”; this tool answers “where is it dense” — one capture, two reports, no second capture session (capture time is engagement time).
  • Duration-normalized. Frame counts per channel mean nothing without the capture window; the tool reads the pcap’s first/last timestamps and reports rates, not counts.
  • Occupancy proxy, honestly labeled. True airtime utilization needs PHY-layer data most captures lack; frame-rate-per-channel is labeled an occupancy proxy in the output — honesty about what a measurement measures is a design feature.
  • WIDS-placement output. The report ranks channels by density so sensor-coverage gaps (channels with APs but no sensor visibility) surface directly.

Full source

Section titled “Full source”
#!/usr/bin/env python3
"""channelstat.py — per-channel occupancy analyzer (pcap in).
Usage:
  python channelstat.py capture.pcap [--json chan.json]
Deps: scapy.
"""
import argparse, json, sys
from collections import defaultdict
from scapy.all import PcapReader, Dot11, Dot11Beacon, \
    Dot11Elt, RadioTap


def channel_of(pkt):
    """Prefer RadioTap channel field; fallback DS IE."""
    if RadioTap in pkt and hasattr(pkt[RadioTap], "Channel"):
        try:
            return int(pkt[RadioTap].Channel)
        except (TypeError, ValueError):
            pass
    if Dot11Beacon in pkt:
        el = pkt.getlayer(Dot11Elt)
        while el is not None:
            if el.ID == 3 and len(el.info) >= 1:
                return el.info[0]
            el = el.payload.getlayer(Dot11Elt) \
                if el.payload and \
                isinstance(el.payload, Dot11Elt) else None
    return None


def analyze(path):
    counts = defaultdict(int)
    aps_per_ch = defaultdict(set)
    first, last = None, None
    with PcapReader(path) as reader:
        for pkt in reader:
            ts = float(pkt.time)
            if first is None:
                first = ts
            last = ts
            if Dot11 not in pkt:
                continue
            ch = channel_of(pkt)
            if ch is None:
                continue
            counts[ch] += 1
            if Dot11Beacon in pkt:
                aps_per_ch[ch].add(pkt[Dot11].addr2)
    duration = (last - first) if last and first else 0
    return counts, aps_per_ch, duration


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("pcap")
    ap.add_argument("--json")
    args = ap.parse_args()
    counts, aps_per_ch, duration = analyze(args.pcap)
    if not duration:
        sys.exit("empty capture")
    print(f"== channel occupancy (capture {duration:.0f}s) ==")
    print(f"{'ch':>4} {'frames':>8} {'rate/s':>8} "
          f"{'APs':>5}  occupancy")
    print("-" * 50)
    ranked = sorted(counts.items(), key=lambda kv: -kv[1])
    max_rate = max(c for _, c in ranked) / duration
    for ch, n in ranked:
        rate = n / duration
        bar = "#" * int(40 * rate / max_rate if max_rate
                        else 0)
        print(f"{ch:>4} {n:>8} {rate:>8.1f} "
              f"{len(aps_per_ch[ch]):>5}  {bar}")
    if args.json:
        json.dump({"duration_s": round(duration, 1),
                   "channels": {str(c): {
                       "frames": n,
                       "rate": round(n / duration, 2),
                       "aps": len(aps_per_ch[c])}
                       for c, n in counts.items()}},
                  open(args.json, "w"), indent=2)
        print(f"[+] {args.json}")


if __name__ == "__main__":
    main()

Walkthrough

Section titled “Walkthrough”
  • channel_of() (lines 15-30) tries two sources for the channel: RadioTap’s header field (present in most monitor-mode captures, the accurate source) and the beacon’s DS-IE fallback (beacons only). The dual source keeps non-beacon frames counted on their real channel where RadioTap carries it.
  • The occupancy proxy (lines 55-59) normalizes frame counts by capture duration and renders the bar chart — the honest labeling matters: frame rate per channel correlates with utilization but is not airtime, and the report says so rather than implying PHY accuracy.
  • The AP set per channel (line 45) gives the density view a second dimension — a channel can be busy because of one AP (high-rate client) or twenty APs (congested band), and sensor-placement decisions differ between those cases.
  • The JSON (lines 62-70) keeps per-channel frames/rate/aps — the WIDS-coverage check joins this against sensor inventory (which channels do my sensors actually see?) in one lookup.

Compilation and test procedure

Section titled “Compilation and test procedure”

capture (authorized lab airspace or RF-isolated lab)

Section titled “capture (authorized lab airspace or RF-isolated lab)”

$ airmon-ng start wlan0 $ airodump-ng -w lab_cap -c 1,6,11 wlan0mon & # or full hop

…collect 10-30 minutes, then stop

Section titled “…collect 10-30 minutes, then stop”

survey + channel analysis

Section titled “survey + channel analysis”

$ python wifiscan.py lab_cap-01.cap —json survey.json == survey: 48213 frames, 12 APs, 23 clients == APs: a4:2b:b0:xx:xx:01 ch=6 LabCorp-Corp 802.1X CCMP-128 a4:2b:b0:xx:xx:02 ch=11 LabCorp-Guest PSK CCMP-128 … clients leaking saved SSIDs (probes): 3c:5a:b4:xx:xx:0f probes: HomeNet_5G, Starbucks, LabCorp-Corp

$ python channelstat.py lab_cap-01.cap —json chan.json == channel occupancy (capture 1240s) == ch frames rate/s APs occupancy 6 21102 17.0 5 ############################## 1 9840 7.9 4 ############# 11 7233 5.8 3 ##########

Detection considerations

Section titled “Detection considerations”

Passive recon is invisible to WIDS by nature — the defensive counter is inventory hygiene: know your legitimate AP inventory so rogue detection works, and know your client inventory so probe-leakage policies (MAC randomization on corporate gear, SSID naming hygiene, disabling directed probing) are enforceable. The probe-leak finding is the highest-value defender output of this module: employees’ personal devices advertising internal SSIDs in public spaces is an OSINT gift to attackers, and the fix (randomized MACs, minimizing saved corporate SSIDs on personal devices, WPA3-agnostic naming) is policy-plus-config. Your own tooling hygiene: both tools read pcaps — zero transmissions, zero endpoint footprint; the capture step is where authorization matters, and the runbook states it. WIDS products map these findings natively (rogue AP lists, client probe reports) [verify per vendor]; the value of the DIY tools is independence from vendor classification and the ability to feed the JSON into the program’s own baselines. Suricata/BT12 territory begins where management-frame anomalies matter (deauth storms, beacon floods) — that is WI7’s and BT12’s surface, built on the baseline this module produces.

Improvements to add

Section titled “Improvements to add”
  1. Beacon-interval anomaly detection: non-standard intervals are a rogue/soft-AP fingerprint — add per-AP interval stats.
  2. WPS IE parsing: flag WPS-enabled networks (IE 221 vendor-specific) — the Pixie-Dust surface (WI2 bridge).
  3. Multi-capture diff: survey-vs-survey diff (new/vanished APs) for the quarterly airspace baseline.
  4. Vendor OUI enrichment: resolve MAC prefixes to vendor names in the report.
  5. KARMA candidate list: rank clients by probe-count of rare SSIDs (rare names = better spoof targets).

Detection — Defender View

Section titled “Detection — Defender View”
SignalSourceIDNotes
Rogue AP (unknown BSSID)WIDS baseline diffvendor-specific [verify]Inventory hygiene prerequisite
Client probe leaksWIDS client reports / this surveypolicy findingPersonal devices on corp SSIDs
TKIP/WEP in RSNBeacon parse (survey)hardening ticketCipher-posture drift
Hidden SSID with probesSurvey cross-reflow valueHidden ≠ secure
New AP in airspaceSurvey-vs-survey diffquarterly baselineAirspace change control
Channel congestionchannelstatcapacity planningSensor placement input
WPS-enabled networksIE 221 parseattack-surface flagPixie-Dust exposure
Open guest nets w/o isolationSurvey + arch reviewarchitecture ticketClient isolation audit
Sensor coverage gapschan.json vs sensor inventorycoverage findingWhich channels are blind
Wazuh feed of WIDS alertsHIDS/SIEM[verify rule IDs per deployment]Vendor WIDS → SIEM join

Evasion Techniques

Section titled “Evasion Techniques”

Recon evasion is the client-side and AP-side silencing of what this module harvests. Probe suppression (the client side): modern OS MAC randomization and wildcard-only probing shrink the saved-SSID leak — countered by long-window collection (randomized MACs still associate eventually, and OUI/behavioral fingerprinting persists) and by enterprise onboarding flows that keep corporate SSIDs off personal devices. SSID hygiene (the AP side): hidden SSIDs do not survive probe-response observation and add nothing but troubleshooting cost — the honest advice for defenders is don’t hide SSIDs; control association instead. Name camouflage: SSIDs mimicking common hotspots (“Starbucks”, “iPhone”) exploit both user trust and recon triage — countered by OUI + signal-position analysis in the survey (a “Starbucks” beaconing from your executive floor is not Starbucks). Channel selection: attackers parking rogue APs on channels your WIDS sensors cover worst — countered by the channelstat coverage-gap check and sensor placement review. Capture-window evasion: adversaries scheduling transmissions into windows when your sensors are least watched (maintenance windows, nights) — countered by continuous sensor coverage with alerting on sensor-uptime itself. The meta-point for both sides: the airspace remembers — every frame is a broadcast receipt — and the side that collects longer and baselines better wins the discrepancy game, which is why the quarterly re-survey (the airspace baseline) is the module’s standing output rather than a one-time map.

⚠️ What caught me: my first authorized wireless engagement had a beautiful survey — 40 APs cataloged, ciphers classified, clients mapped — and a plan built on it. Then the client’s WIDS lead asked one question: “when did you capture?” The answer — Tuesday afternoon — mattered because the floor I surveyed was 40% empty that week: three project teams were offsite, and their devices (including the two networks I’d classified as my best handshake targets) simply weren’t there. The airspace is a population, and populations have schedules. Since then, every survey runs across at least two different day-parts (a workday peak and an off-hour), the report carries capture windows per finding, and any attack plan built from a single-window survey gets marked as provisional — the AP that isn’t there on Tuesday is the one you meet on Saturday.

Lab Practice

Section titled “Lab Practice”
  1. Build the RF-isolated lab: two APs (one WPA2-PSK, one open), a client, and a monitor-mode interface in a shielded or isolated space (or a Faraday bag with attenuation) — then capture 15 minutes and produce your first survey.
  2. Run both tools on the capture and reconcile: every AP in wifiscan.py’s output should appear in channelstat.py’s channel sets — the cross-check that catches parsing bugs before they matter.
  3. Probe-leak exercise: save two SSIDs on a lab phone/laptop, capture its association behavior, and observe the exact probe frames that leak the saved names — then enable MAC randomization and note what changes (and what doesn’t).
  4. Hidden-SSID experiment: configure the lab AP hidden, capture, and confirm the probe-response reveal; then measure how little security hiding actually adds — the debunking, verified.
  5. Baseline discipline: capture on two different day-parts and diff the surveys (improvement #3) — count the APs and clients that exist only in one window; that delta is the reason single-window surveys lie.

Interview Questions

Section titled “Interview Questions”
  • Technical: Walk through the 802.11 association flow for a WPA2-PSK network — which frames appear, in what order, and which of them the 4-way handshake follows?
  • Technical: What exactly does a probe request leak, how do MAC randomization and optimization change that, and what reconnaissance value survives?
  • Scenario: Your survey found an SSID identical to the corporate one on a channel the corporate network doesn’t use. What is it, and what do you do next?
  • Conceptual: Why is passive-first the right default for wireless recon, and what does transmission change legally and detectably?
  • Conceptual: Why is hiding an SSID security theater, and what would you deploy instead?
  • Deep-dive: Design the airspace baseline program: capture windows, diff methodology, WIDS integration, and how rogue detection uses the baseline.
  • Practical: A quarterly survey shows TKIP still offered on two executive-floor APs. What is the risk story you tell, and what is the remediation path?
Section titled “Related Modules”

F1 (Networking Fundamentals) · WI2 (WPA2-PSK Cracking) · WI4 (Enterprise Wi-Fi & Evil Twin) · WI7 (Wireless IDS Evasion) · BT12 (Wireless IDS)