802.11 Connection Walkthrough

Every frame a client and an access point exchange to get connected, from finding the network to sending the first encrypted packet, and what changes when the client roams to another AP, with and without Fast BSS Transition (802.11r). Pick a scenario and a security type, then step through the conversation and open any frame to see what's inside it.

Scenario
Discovery
Security

Click any frame to open it. Arrow keys step through the exchange; the space bar plays and pauses.

802.11 states (IEEE 802.11-2024 §11.3.1): 1 not authenticated, not associated · 2 authenticated, not associated · 3 authenticated and associated, RSN keys pending (port blocked) · 4 authenticated and associated, RSN done or not needed.

Keys each side holds

How the security types compare

OpenEnhanced Open (OWE)WPA2-PersonalWPA3-PersonalEnterprise (802.1X)
Beacon advertisesPrivacy bit 0, no RSN elementRSN element, AKM 18 (OWE), MFPR = 1RSN element, AKM 2 (PSK)RSN element, AKM 8 (SAE), MFPR = 1RSN element, AKM 1 (802.1X); WPA3-Enterprise uses AKM 5 and MFPR = 1
802.11 AuthenticationOpen System, 2 framesOpen System, 2 frames; Diffie-Hellman keys ride in the association framesOpen System, 2 framesSAE Commit and Confirm, 4 framesOpen System, 2 frames
Who is provenNobodyNobodyAnyone who knows the passphraseAnyone who knows the password, but each guess needs a live exchangeEach user or device, checked by the RADIUS server; the client checks the server's certificate
Where the PMK comes fromNo PMKA fresh ECDH exchange at every associationPassphrase and SSID. The same for every client, every sessionA fresh value from each SAE exchangeA fresh value from each TLS session (the MSK), sent to the AP by RADIUS
4-way handshakeNone; data flows right after associationYesYesYesYes
Offline password guessing from a captureNothing to guess; traffic is readableNothing to guess; traffic is encrypted. An active evil-twin AP is still possiblePossible (4-way handshake or PMKID)Not possibleNot against the handshake; PEAP is exposed if clients don't validate the server certificate
Forward secrecyNo encryptionYesNo. The passphrase plus a captured handshake decrypts that session, even laterYesYes
Protected Management FramesOptionalRequiredOptional (off here)RequiredOptional; required for WPA3-Enterprise
Frames to connect (no ACKs)
Frames to roam, no FT (after choosing AP2, no ACKs)
Frames to roam with FT

Notes

  • This is a teaching walkthrough of a successful connection or roam. Retries, failures and WPA3 transition mode are left out.
  • Enhanced Open (OWE, RFC 8110) encrypts an open network without a password, but proves nothing about the AP. OWE transition mode lets old and new clients share one network name: the AP runs an open BSS and a hidden OWE BSS, each carrying an OWE Transition Mode element that points to the other, so OWE-capable clients quietly join the encrypted one. On 6 GHz only OWE is allowed; plain Open isn't.
  • Roaming is decided by the client. 802.11k (neighbour reports) and 802.11v (BSS transition requests) only give it advice. Without FT, a roam repeats authentication, association and key setup with the new AP; for Enterprise that includes the full 802.1X/EAP exchange with the RADIUS server.
  • PMKSA caching and OKC shorten a non-FT roam: the client names a PMK the new AP already has (because the client used that AP before, or because the controller shares PMKs between APs), so SAE or 802.1X is skipped. The 4-way handshake still runs. They aren't shown as separate scenarios.
  • Fast BSS Transition (802.11r) works only between APs in the same mobility domain (same MDID) and needs FT key management from the first connection. It folds the key exchange into authentication and reassociation, so the 4-way handshake disappears. Some older clients mishandle FT AKMs in the beacon; that's why "FT-adaptive" or mixed modes exist on many controllers.
  • Values such as MAC addresses, nonces, the SSID SIAMWireless-Lab and the IP addresses are examples. Field values follow IEEE 802.11-2024, RFC 3748 (EAP), RFC 2865/3579 (RADIUS) and the PEAPv0 and EAP-TLS specifications.
  • The network here is on 5 GHz channel 36. On 6 GHz, IEEE 802.11-2024 (12.12.2) rules out Open without encryption and WPA2-PSK and requires Protected Management Frames, so networks use OWE, SAE or 802.1X; Wi-Fi Alliance certification also requires SAE there to use Hash-to-Element. Clients find APs mostly through Reduced Neighbor Reports and FILS Discovery frames instead of probing every channel.
  • In a real enterprise exchange the RADIUS server's certificate chain doesn't fit in one EAP message, so it's split into several fragments, each acknowledged by an empty EAP-Response. They're shown here as one message.
  • Wireshark filters use the 16-bit subtype form (0x0008) of recent versions. To see frames between other devices you need a capture in monitor mode on the same channel; to read EAPOL and data frames decrypted, give Wireshark the passphrase and SSID (Personal) or the PMK.

Related tools