1.Beacon frames are transmitted periodically to anonunce presence of wireless network and contain all information about it(data rates, channels, security ciphers, key management etc):
2.Probe request, is sent by STA to obtain information from AP:
3.Probe response, AP responds with with a probe response frame, containing capability information, supported data rates, etc., when after it receives a probe request frame from STA:
4.802.11 authentication is a process whereby the access point either accepts or rejects the identity of a radio NIC. The NIC begins the process by sending an authentication frame containing its identity to the access point. With open system authentication (the default), the radio NIC sends only one authentication frame, and the access point responds with an authentication frame as a response indicating acceptance (or rejection).:
a.Dot11 authentication request:
b.Dot11 authentication response:
802.11 association enables the access point to allocate resources for and synchronize with a radio NIC. A NIC begins the association process by sending an association request to an access point. This frame carries information about the NIC (e.g., supported data rates) and the SSID of the network it wishes to associate with.
a.Dot11 association request:
After receiving the association request, the access point considers associating with the NIC, and (if accepted) reserves memory space and establishes an association ID for the NIC.
b.Dott11 association response:
6.4-way handshake, during this phase PTK is created, PSK is used as PMK to construct those values:
a.AP sends 802.1x authentication frame with ANonce, STA now has all information to construct PTK:
b.STA responds with 802.1x authentication frame with SNonce and MIC:
c.AP constructs 802.1x frame with new MIC and GTK with sequence number, This sequence number will be used in the next multicast or broadcast frame, so that the receiving STA can perform basic replay detection:
d.STA sends ACK:
From that point all data is sent encrypted.
The process if fairly the same as in previous section, I’ll highlight only information that is different.
1.WPA2 AP management frame include RSN element that included unicast cipher suite, AKM information and GTK cipher suite (if both AES and TKIP are selected, then less stronger encryption method will be used for GTK).
2.During 4-way handshake frames contain version information for WPA2 in “Type” fields.
Note: you can decrypt WEP/WPA-PSK/WPA2-PSK encrypted wireless traffic if 4-way handshake key exchange frames are included in trace and PSK is known.
In order to encrypt wireless traffic in wireshark open Preferences-> Protocols->IEEE 802.11 and provide PSK information and select “Enable decryption option”.
To decrypt WPA/WPA2 encrypted traffic specify Key in format:
Note: In order to filter out WLAN traffic from specific STA in wireshark you could use “WLAN Statistic” option.
In order to filter traffic from specific STA go to “Statistics -> WLAN Traffic”, from the list of SSIDs select corresponding SSID STA is associated with, and apply filter based on the STA.
1)WPA(TKIP)/WPA2(AES) with dot1x (PEAP)
This process follows the same steps like previous except for the AKM method and deriving PTK/GTK and AP advertised attributes in 802.11 management frames.
a.In this example AP advertises WPA(TKIP)/WPA2(AES) with dot1x authentication, both RSN and WPA tag attributes for AKM contain WPA value, whether in case of PSK authentication this field contains “PSK”. Also in this example TKIP is used for WPA and AES is used for WPA2
b.STA selects one of authentication methods and cipher suites advertised by AP. In this case WPA2 with AES was selected, that can be seen in RSN IE parameters.
c.After successful dot11 association dot1x authentication takes place, during this process we can see what EAP method is used by STA for authentication and certificate(s) exchange information between supplicant and AAA server.
d.After successful dot1x authentication PMK is trasmited to AP in “Access-Accept” message from AAA server and the same PMK is derived on the client, next 4-way handshake takes place and PTK and GTK establishment.
Radius exchange between WLC and AAA server:
General flow diagram:
WPA(TKIP)/WPA2(AES) with dot1x (EAP-TLS)
Difference for this type of authentication compared to the previous one is that client provides its certificate in “Client Hello” message and mutual authentication is performed between client and AAA server based on certificates.
EAP exchange between STA and WLC:
Radius exchange between WLC and AAA server:
General flow diagram:
2)WPA(TKIP)/WPA2(AES) with dot1x (FAST)
Only dot1x authentication stage is a bit different comparing to the previous example. After successful dot11 association dot1x authentication takes place, AP sends dot1x identity request to the STA and STA provides identity response, the response depends on what PAC provisioning is been in use (in-band PAC provisioning (phase 0) or out-of-band PAC provisioning). In case of in-band provisioning PAC is sent to the client from AAA server, once client has PAC it goes to EAP-FAST phase1 from this point TLS tunnel establishment starts (phase 1)
After TLS tunnel is established inner authentication method (phase 2) starts inside encrypted tunnel. On successful authentication PMK is send in “Access-Accept” message to AP from AAA server, the same key is derived based on dot1x exchange on STA. This key (PMK) is used to calculate PTK during 4-way handshake that will be used to secure communication between STA and AP.
I am not much experienced with WLC but I was deploying two 5520 WLCs and ran into this issue. These both are connected to a Nexus 9k, I have configured Management Port to have 10.8.3.97/24 with vlan tag 10 and made switchport an access port with accessing...
I'm looking for a tablet anywhere in the world that uses Android which you can place a UK mobile phone sim card in and use the unlimited data plan on it to stream Netflix and iPlayer. I'm asking the community as its for a disabled relative who can not get...
HI everyone，This is the problem,could you help me to resoved it? 1、Product & Software：WLC PID：AIR-CT2504-K9AP PID：AIR-AP1852I-H-K9software：220.127.116.11、Symptom：The AP1852I can be registered to the WLC2504 normally and works normally. However, after...
Hi, I am planning to upgrade 5508 WLC from 18.104.22.168 to 22.214.171.124. As per release notes of 126.96.36.199, anything prior to 8.2.15x has to be first upgraded to 8.2.16x or 8.3.x and then 188.8.131.52. The WLC is currently running 184.108.40.206 and it's a ...