802.11 Connection Walkthrough
Every frame a client and an access point exchange to connect or roam, from scanning to the first encrypted packet. Compare Open, Enhanced Open (OWE), WPA2, WPA3 and Enterprise, roaming with and without Fast BSS Transition (802.11r), and open any frame to see what's inside.
How to use this tool controls and what to look for
Choose a scenario and a security type, then press Play or step with Next to follow every frame. Open any frame to see its fields.
Controls to change
- Scenario: choose Initial connection, Roam, or Roam with FT (802.11r).
- Discovery: compare a Passive scan (listening for beacons) with an Active scan (probe requests).
- Security: switch between Open, Enhanced Open (OWE), WPA2-Personal, WPA3-Personal and Enterprise.
- EAP method: for Enterprise, choose PEAP-MSCHAPv2 or EAP-TLS.
- Passphrase: set it to Wrong to see where the connection fails.
- FT method: for FT roaming, choose Over the air or Over the DS.
- Show ACK frames: show the acknowledgement after every frame.
What to look for
- Open System authentication and association happen for every security type. The real login comes after them.
- With a wrong passphrase, WPA2 fails at message 2 of the 4-way handshake, while WPA3 fails earlier, in the SAE exchange.
- Enterprise adds a whole EAP conversation with the RADIUS server before the 4-way handshake.
- Roaming with FT folds the key exchange into authentication and reassociation, so far fewer frames are needed.
About this tool
This walkthrough shows every frame a client and an access point exchange to get connected, from finding the network to sending the first encrypted packet, and what changes when the client roams to another AP, with and without 802.11r Fast BSS Transition. Pick a scenario and a security type, then step through and open any frame to see what's inside.
What you'll learn
- How clients find networks with beacons and probe requests
- What authentication and association do
- How WPA2 and WPA3 Personal and 802.1X/EAP logins lead to the 4-way handshake
- How 802.11r shortens roaming
Common questions
What happens when a device connects to Wi-Fi?
It finds the network, authenticates and associates, completes the security login if there is one, runs the 4-way handshake to install its keys, and then gets an IP address.
What is the 4-way handshake?
Four EAPOL-Key messages in which the client and AP prove they share the same master key (PMK), derive fresh session keys and install them.
How does 802.11r make roaming faster?
Keys for the next AP are prepared in advance, so the client can move with the key exchange folded into authentication and reassociation, without a new 802.1X login.
Free for private and educational use. This interactive model is a simplified teaching aid and may contain mistakes. It is provided as is, without warranty. Use it to understand the concepts, not as a substitute for a site survey, vendor documentation or professional design advice.