The Complete WiFi Course: 802.11 Standards & Packet Capture

Explore how Wi‑Fi transmits data using modulation, placing data on a carrier to form an electromagnetic wave, and preview modulation methods like DCSS, CCK, OFDM, and OFDMA.

This lecture covers 2.4 ghz wifi channels starting at 2412 mhz, 14 channels spaced every 5 mhz, with 22 mhz for dsss/cck and 16.5 mhz for ofdm/ofdma.

Explore the FCC's definitions of operating classes and spectrum usage for U.S. devices, including 5G channels, 20 MHz spacing, DFS on channels 52, 56, 60, 64.

Understand mimo, an antenna technology that uses multiple antennas to boost throughput via spatial multiplexing, improve reliability through spatial diversity, and concentrate energy with beamforming in 3x3 configurations with ofdm.

Explore how OFDM and MIMO enable higher throughput through multiple spatial streams and guard intervals, reducing inter-symbol interference from multi-path effects with antenna count.

Explore how 802.11v makes Wi‑Fi smarter by enabling proactive network switching, and trace the evolution from Wi‑Fi 5 to Wi‑Fi 7 with MU‑MIMO, WPA3, and multi‑link operation.

Explore the OSI seven-layer architecture, from physical to application, and see how Wi-Fi emphasizes the first four layers, with IP at layer 3 and Wi-Fi at layer 2.

Explore how MLME governs MAC layer operations in 802.11 networks, including scanning, connection, disconnection, and power management, while PLME manages physical layer settings and SME coordinates them.

Explore 802.11 packets and frame types in Wi-Fi networks, and learn what packets and frames are and the various types used in wireless communication.

Explore field and information element (IE) in Wi‑Fi frames, comparing fixed-length fields to variable-length information elements that extend packets without changing the core frame.

Examine advanced frame control fields in the MAC header, including more fragment, retry, power management, more data, and protected frame; explain the HTC intercept order mechanism protecting packets from interception.

Explore HT control in 802.11n, a high-throughput field that accelerates performance by exchanging information between the station and access point, improving speed and network efficiency in the general frame format.

Explore action frames as universal management and control tools in Wi‑Fi networks, with subtype 1101 and an action field, enabling QoS, roaming, and Blockack operations.

Understand how control frames regulate data transmission in a basic service set, using frame type 01 and subtypes, where address 1 is the receiver and there is no frame body.

Examine common control frames—RTS/CTS and acknowledgments—to learn how RTS declares channel usage, CTS has no transmitter address, and block acknowledgement with ba control and ba information improves throughput.

Explore how data frames carry user data in 802.11 networks, differ from management and control frames, and how frame type 1-0 and addresses vary with toDS and fromDS.

Understand how wifi data frame addresses use ToDS and FromDS through a two-step delivery via an access point, with BSS ID and SA/DA roles.

Learn how data frames traverse the distribution system using to DS and from DS flags, with laptops C and G communicating through APs, BSS, and a wired backbone.

Explain unicast, multicast, and broadcast in wifi, showing unicast to a single recipient, broadcast to all via all F, and multicast within the bss using a 01005E mac prefix.

Identify beacon frames by frame control type 0 and subtype 8, and summarize its fields: destination broadcast address, source AP MAC, fragment and sequence numbers, and the frame check sequence.

Learn how WEP encryption uses RC4 in open and shared modes to encrypt the MAC header, payload, and integrity check value with the WEP seed, while the IV remains unencrypted.

Tkip upgrades wep by retaining rc4 and adding a michael-based message integrity code with an integrity check value, deriving initialization vector and wep key from transmitter address and temporal key.

Form a nonce from address two and the packet number, decrypt with the temporal key and header additional authentication data to recover the payload and MIC, then verify integrity.

Explain the GCMP decryption flow and direct verification of the message integrity code, comparing it to CCMP, and describe how Wi-Fi key generation enables network access.

Explore the connection methods across different 802.11 modes and learn how keys are generated within the opening flow of 802.11 connections.

Learn how AP and Stay create a pairwise key for unicast encryption and a group key for multicast protection, enabling private, decryptable messages within a BSS.

Follow the Wi‑Fi connection process from scan to the four‑way handshake, detailing supplicant and authenticator roles, key generation, and the safeguards of deauthentication and disassociation.

Broadcasts beacon frames to announce access points and share AP parameters for stations to find them. Maintains time synchronization and supports passive scanning and power-saving wakeups.

Learn how probe requests and probe responses enable active discovery of APs, and how beacon frames carry timestamp and beacon interval information not in probe requests.

Examine the authentication process for open, wpa, wpa2, and owe modes, where the STA sends an authentication request with algorithm number 0 in two steps and the AP replies.

WPA3 uses SAE (dragonfly) with elliptic curve cryptography to derive a PMK from the password through AuthCommit and AuthConfirm of R1, R2, U, and V, with optional hash-to-element support.

Explore the association process for open mode, WEP open, and WEP shared, detailing requests/responses with status code, association ID, supported rate, listen interval, SSID, and no WPA-IE or RSN-IE.

Explain PMK and PTK derivation in the pairwise key hierarchy for Wi-Fi, covering PMK generation via PBKDF2, PTK creation via PRF, and roles of KCK, KEK, TK, MIC.

Demonstrate how four-way handshake uses ANOTS, GNOTS, SNOTS, PMK, GMK, and MAC addresses to securely derive PTK and GTK for data encryption in WPA, WPA2, WPA3, and OWE.

Explore the Wi-Fi disassociation process, where either AP or STAY can initiate a disconnection using a reason code, anytime after association, affecting both devices to authenticated but not associated.

Explore PMK cache mechanism in WPA3, enabling cached PMK IDs to speed up authentications and showing how APs and STAs use PMK IDs in the four-way handshake.

Send an association request in open mode after authentication, omitting RSN-IE and WPA-IE, to the AP, which allocates resources and replies with an association ID (1).

See how WEP open authentication begins with an open system using a zero authentication algorithm, and how AP in WP open mode responds with a successful authentication frame to proceed.

Transmit data after association using WP Open without key verification; the data frame is encrypted, with the protected flag set, so mismatched keys prevent decryption.

Explore WEP shared authentication in 802.11, detailing the shared-key algorithm, the four authentication frames exchanged between the access point and station to verify the key, and the subsequent association process.

In WPA mode, after the 4-way handshake, the access point transmits GTK to the station via the group key handshake, with the GTK encrypted and the MIC confirming the data.

Explore the WPA2 four-way handshake, where a PSK validates the passphrase and derives the PTK via two EAPOL frames, nonces, and MIC, with RSN information in message 2.

Explore WPA3 scanning by analyzing probe requests and responses, noting RSNIE in the probe response and the absence of WPA-IE when the AP does not support WPA.

Explains WPA3 SAE authentication, detailing four exchanges and the authentication commit, including ECC-based parameters, masked scalar and password-derived element, with the AP replying with related parameters.

Explore the WPA3 association process, including RSN-IE with BIP information in the association request, and how an AP lacking BIP affects beacon fields yet preserves connection in the association response.

WPA3 four-way handshake completes with the access point sending message 3 containing the GTK key data, the station verifies and returns message 4, enabling encrypted transmission.

Explore how WPA3 uses a PMK cache to speed authentication by recognizing the PMK ID in RSN-IE, enabling SAE AKM and reducing frames from four to two.

Explore a WPA and WPA2 mixed mode beacon, showing how it carries both WPA-IE and RSN-IE with CCMP and PSK, enabling connections via WPA or WPA2.

Explore how 802.11 networks manage channels and coordinate data transmission, including transmitting messages, handling retransmissions, and timing access when multiple devices share a channel.

Explain how ack confirms receipt of data frames and triggers retransmission within the short time frame interval (sifs), while some frames may skip an ack.

Learn how EDCCA, the energy detection clear channel assessment, lets Wi-Fi devices listen for idle channels before transmitting and avoid collisions, with manufacturer-adjustable thresholds around -60 to -70 dBm.

Learn how inter-frame spacings govern Wi-Fi transmissions, using SIFS for ACK, DIFS or PIFS for data, and EIFS after collisions.

Rts and cts frames carry nav in the duration field to show channel occupancy, enabling stay nodes to avoid collisions and prevent hidden node problems.

Most frames carry NAV values, not just RTS and CTS; a data frame includes the ACK duration as NAV and ACK NAV is zero.