02. 802.11 Specifications

802.11 Management Frames

• Beacon Frame = Advertisements of AP (include info about AP's supported rates, encryption capabilities...)

• Probe Request = Frame sent by station looking for AP.
  2 types of Probe Requests:

  • Directed Probe Request = Client looks for a specific known SSID. Can be used by attacker to find hidden SSID, or to reconstruct client's PNL ("Is MyWiFi here ?").
  • Broadcast Probe Request = Client broadcast request to check if there is any wireless network nearby ("Is any WiFi here ?").

• Probe Response = Frame sent by AP to station, when replying to Probe Request. Contains similar info as Beacon Frames.

• Authentication Request = Station initiates authentication to AP.

• Association Request = After authentication, station asks for association with AP.

• Deauthentication Request = Sent by AP to client to disconnect it. Can be sent by attacker in order to try to disconnect a client.

• Disassociation Request = Sent by AP to client. Contrary to deauthentication request, disassociation is normally sent to client when AP is powered down/rebooting. An attacker can also send this type of request along with deauthentication request, to increase chances to successfully disconnect a client.

802.11 Association Handshake

	Station                                     AP
			<------- Beacon -----------------------
				      ...
			<------- Beacon -----------------------
				      ...
			-------- Probe Request --------------->
			<------- Probe Responde ---------------
			-------- Authentication Request ------>
			<------- Authentication Response ------
			-------- Association Request --------->
			<------- Association Response ---------

			<--------------- Data ---------------->

Authentication Request/Response are confusing because there is no actual authentication mechanism here.

• In Open Network, client can use the wireless network directly after this Association Handshake.
• In Protected Network (e.g. WPA/WPA2), a "real" authentication occurs after this Association Handshake.