The Request to Send (RTS) and Clear to Send (CTS) frames are part of the 802.11 Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) mechanism, specifically the Distributed Coordination Function (DCF). When a station (STA) intends to send a data frame that exceeds the configured RTS Threshold, it first transmits an RTS frame to the intended recipient. The recipient STA, upon receiving the RTS, responds with a CTS frame after a Short Interframe Space (SIFS). This CTS frame serves as the positive acknowledgment to the RTS and reserves the radio frequency (RF) medium for the subsequent data frame transmission, helping to mitigate the hidden node problem.

B. Ack: An Ack frame is used to acknowledge the successful reception of unicast data or management frames, not control frames like RTS.

C. RTS-Ack: This is not a defined frame type within the IEEE 802.11 standard; it is a fabricated option.

D. Block Ack: A Block Ack is a mechanism introduced in 802.11n to acknowledge a group of frames (an A-MPDU) at once, not a single RTS frame.

1. IEEE Computer Society. (2021). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. IEEE Std 802.11™-2020.

Section 10.3.2.7, "RTS/CTS procedure," states: "A STA may transmit an RTS frame when it desires to transmit a frame. Upon receiving an RTS frame, the destination STA shall respond with a CTS frame after a SIFS period if the NAV at the destination STA is clear." This directly specifies that a CTS is the response to an RTS.

2. Carnegie Mellon University. (2005). 18-759 Wireless Networks, Lecture 4: MAC Layer I: 802.11. School of Electrical and Computer Engineering.

Slide 23, "RTS/CTS Handshake," illustrates the exchange sequence: "Sender sends RTS (Request to Send). Receiver responds with CTS (Clear to Send)." This confirms the fundamental protocol interaction where CTS acknowledges the RTS.

For a long-term, forensic packet capture, the primary objective is to record all raw packet data to a storage medium with the highest possible fidelity, meaning without dropping any packets. Real-time packet decoding is a computationally intensive process that interprets and displays packet contents for immediate analysis. This function consumes significant CPU and memory resources, which can overwhelm the capture station's ability to process and write incoming packets to disk, leading to packet loss. Therefore, real-time decoding is typically disabled during high-volume forensic captures; the analysis and decoding are performed offline after the capture session is complete.

B. Analyzer location: The physical and logical placement of the analyzer is critical for capturing the intended traffic, whether it's ensuring proximity and correct channel selection for wireless traffic or using a SPAN port for wired traffic.

C. Total capture storage space: Long-term captures can generate terabytes of data. Calculating and allocating sufficient disk space is a fundamental requirement to ensure the capture does not terminate prematurely due to a full disk.

D. Individual trace file size: Using a single, massive capture file is impractical and risky. Capture software is configured to segment the capture into smaller, manageable files to prevent corruption, ease transfers, and work around filesystem or application file size limits.

1. CWNP, LLC. (2021). CWAP-404 Certified Wireless Analysis Professional Study Guide.

Chapter 2, "The Protocol Analyzer," discusses the components of a protocol analyzer, distinguishing between the capture driver/engine and the decoding/analysis engine. It emphasizes that for high-performance captures, minimizing the overhead of the analysis engine (which performs real-time decodes) is crucial to prevent packet drops. The guide recommends using capture-only tools like dumpcap for this purpose.

Chapter 2 also covers "Capture Methodology," which explicitly details the importance of storage planning (total space and individual file sizes via ring buffers) and proper analyzer placement as fundamental considerations before starting a capture.

2. Pilli, E. S., Joshi, R. C., & Niyogi, R. (2010). A Framework for Network Forensics. International Journal of Computer Applications, 1(11), 1-6.

This academic paper outlines the phases of network forensics, starting with "Collection." In this phase, the "main goal is to collect the network traffic data passively and store it with minimum loss" (Section 3.1, Collection). The subsequent "Analysis" phase is where decoding and interpretation occur. This separation of concerns supports the principle that real-time analysis (decoding) is not the priority during the collection phase of a forensic capture.

DOI: 10.5120/329-483

3. Wireshark Development Team. (n.d.). Wireshark User's Guide. Wireshark.org.

Section 4.7, "Capturing Packets," and the documentation for the dumpcap utility explain that dumpcap is the command-line tool that performs the raw packet capture for Wireshark. The guide notes, "For high-traffic and/or long-term captures, it is recommended to use dumpcap directly... as it has a much lower memory and CPU footprint than the Wireshark GUI," which performs the real-time decoding. This official vendor documentation directly supports disabling real-time decodes for performance-critical captures.

The scenario describes a discrepancy between what the Access Point (AP) can receive and what the portable analyzer can capture at the same physical location (near the AP). The low retry rate (<2%) confirms that the AP is successfully receiving frames from the client station (STA). However, the analyzer at that location cannot see these frames. This indicates that the AP has a better receive sensitivity than the analyzer. The client's signal is strong enough for the AP's high-quality receiver to decode but too weak for the analyzer's less sensitive receiver at that distance. When the analyzer was near the client, the signal strength was sufficient for it to capture the frames.

A. This is incorrect because the low retry rate proves the AP is not blinded and is successfully receiving the client's packets.

B. A mismatch in spatial stream support would likely prevent the analyzer from decoding frames regardless of its proximity to the STA, which contradicts the initial successful capture.

C. This is contradicted by the evidence. The low retry rate explicitly indicates that the AP can hear the client's traffic successfully.

1. CWNP, LLC. (2021). CWAP-404 Certified Wireless Analysis Professional Official Study Guide.

Chapter 11: WLAN Frame Analysis, Section: Capture Hardware. This chapter discusses the hardware used for packet capture, noting that the capabilities of capture adapters (like those in a portable analyzer) can vary significantly and may not match the performance of an enterprise-grade AP. It states, "The quality of the radio and antenna in the capture device will affect its ability to hear frames... An enterprise-grade AP will almost always have a better receive sensitivity than a USB NIC." This directly supports the conclusion that the analyzer's hardware is less capable than the AP's.

2. Cisco. (2019). Enterprise Mobility 8.5 Design Guide.

Chapter 3: RF Design Considerations, Section: Receiver Sensitivity. This guide details the importance of receiver sensitivity for APs in establishing reliable communication links. It explains, "Receiver sensitivity is the measure of the ability of a receiver to receive weak signals." Enterprise APs are designed with high receiver sensitivity to maintain connections with clients at the cell edge. This establishes that APs are engineered to receive weaker signals than typical client-grade or portable analysis hardware.

3. Sikora, A., & Groza, V. Z. (2005). A survey of 802.11 network performance and vulnerability analysis tools. In IEEE Instrumentation and Measurement Technology Conference Proceedings (Vol. 2, pp. 1539-1544). IEEE.

DOI: 10.1109/IMTC.2005.1604421

Section III: WLAN Analysis Tools. This academic survey discusses the limitations of various WLAN analysis tools. It implicitly supports the answer by highlighting that the physical layer capabilities (PHY), including the sensitivity of the radio chipset in the analysis tool, are a critical factor in the accuracy and completeness of a packet capture. A discrepancy between the analyzer's capabilities and the network hardware's capabilities can lead to incomplete data, as seen in the question's scenario.

The IEEE 802.11k amendment, "Radio Resource Measurement," is designed to improve traffic distribution within a wireless network. A key feature is the Neighbor Report mechanism. A client station (STA) sends a Neighbor Request frame to its currently associated Access Point (AP) to ask for information about nearby APs that are suitable candidates for roaming. The AP responds with a Neighbor Report frame containing a list of these APs and their characteristics (e.g., channel, BSSID). This process allows the STA to build a comprehensive view of potential roaming targets without having to perform disruptive and time-consuming off-channel scanning, leading to faster and more efficient roaming decisions.

A. The Neighbor Request's specific purpose is to discover candidate APs for roaming, not to identify general interference sources.

B. Informing an AP of an intent to roam is a function associated with other amendments, such as 802.11r (Fast BSS Transition), not the 802.11k Neighbor Request.

D. The Neighbor Request is for a list of neighboring APs, not neighboring STAs. Protection mechanisms are determined by other factors, such as channel contention.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016).

Section 11.11.10, "Neighbor Report element": This section details the contents of the report, stating, "The Neighbor Report element contains information on neighbor APs... that are candidates for a BSS transition." This confirms the purpose is to provide a list of roaming candidate APs.

Section 9.6.16, "Neighbor Report Action frame format": This section defines the frame used for the request and response, solidifying its role in the AP discovery process for roaming.

2. Cisco, "Radio Resource Management under Unified Wireless Networks," White Paper.

Section: "802.11k," Page 6: The document explains, "With 802.11k, an AP can respond to a client's request for a neighbor list... The client can then use this neighbor list to have a pre-emptive idea of good roam candidates." This directly supports the function described in the correct answer.

3. Aruba Networks, "802.11k, 802.11v, and 802.11r," Technical Note.

Section: "802.11k," Page 2: "The 802.11k protocol provides a mechanism for APs and clients to dynamically measure the available radio resources. APs can provide clients with a list of neighboring APs that are candidates for roaming." This explicitly states the purpose of the Neighbor Request/Report exchange.

Display filters are applied post-capture to the entire set of collected packets. Their primary advantage over capture filters is their non-destructive nature. They merely hide packets that do not match the filter criteria, without deleting them from the capture file. This allows an analyst to apply, remove, or modify filters iteratively to examine different data subsets within the same capture file. Packets hidden by one filter can be instantly brought back into view by changing or clearing the filter. In contrast, capture-time filters permanently discard packets that do not match the criteria during the capture process, and this data is unrecoverable for later analysis.

A. Both capture and display filters allow for focused analysis by isolating packets of interest from a larger traffic stream.

B. Both filter types can be saved as expressions and reused for subsequent analysis sessions or new captures in most protocol analyzers.

D. Both filter types support complex logical expressions (using AND, OR, NOT) to apply multiple conditions simultaneously.

1. Coleman, D. D., Westcott, D. A., & Harkins, D. (2021). CWAP Certified Wireless Analysis Professional Study Guide: Exam CWAP-404 (3rd ed.). Wiley. In Chapter 2, "Protocol Analysis," the text distinguishes between the two filter types, noting that capture filters are used to "reduce the size of the capture file by discarding unwanted frames," while display filters "simply hide frames from view, and they can be unhidden later."

2. Wireshark Development Team. (n.d.). Wireshark User's Guide. Wireshark.org. In Chapter 6, "Filtering Packets," Section 6.2, "Capture vs. Display Filters," it is explicitly stated: "A display filter... does not discard any packets. When you change the display filter, all packets will be back again." This contrasts with capture filters, which are described as discarding packets permanently.

3. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. The accompanying Wireshark Labs for the textbook demonstrate this principle. For instance, in the "Getting Started" lab, students are shown how display filters can be changed "on the fly" to view different protocols, while capture filters are set before capture and determine what data is saved to the file.