Free CWAP-404 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

In an 802.11 network secured with WPA2, the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) is used for encryption. CCMP encrypts the payload of the data frame, which is referred to as the Frame Body. This Frame Body contains the MAC Service Data Unit (MSDU), which encapsulates the upper-layer data, including the Logical Link Control Protocol Data Unit (LLC PDU). The MAC Header is intentionally left unencrypted (in cleartext) to allow network infrastructure devices, such as access points, to read critical addressing and control information for frame processing and forwarding. The Frame Check Sequence (FCS) is also not encrypted; it is recalculated after the payload has been encrypted.

A. The MAC Header is not encrypted; it must remain in cleartext for network devices to read addressing and control information.

B. Excluding the LLC PDU would mean the actual user data is not protected, which defeats the entire purpose of encryption.

D. The whole MPDU is not encrypted because the MAC Header is transmitted in cleartext, and the FCS is recalculated post-encryption.

1. IEEE Std 802.11™-2020, "IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications."

Section 12.5.3.3, "CCMP MPDU format" and Figure 12-16: This section explicitly illustrates the CCMP-encrypted MPDU. The figure shows the MAC Header is not part of the encrypted portion. The encryption is applied to the original plaintext data (the MSDU, which forms the frame body) and the Message Integrity Code (MIC).

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 7, Section 7.3.4, "802.11 Security": This section describes the principles of 802.11i (the standard that WPA2 implements). It clarifies that encryption services are provided for the data payload of the frame, while the MAC header fields such as addresses and sequence numbers are sent in the clear.

In the 802.11 frame encapsulation process, the MAC sublayer creates the MAC Protocol Data Unit (MPDU) and passes it to the Physical (PHY) layer. The PHY layer treats this incoming MPDU as its payload, which is called the PHY Service Data Unit (PSDU). The PHY layer's primary function is to prepare this data for transmission over the air. To do this, it prepends a Preamble (for synchronization) and a PHY Header (also called the PLCP Header, containing transmission parameters like data rate and length) to the PSDU. The resulting complete unit, ready for transmission, is the PHY Protocol Data Unit (PPDU).

A. LLC: The Logical Link Control (LLC) sublayer operates above the MAC sublayer and is not involved in the creation of the physical layer frame.

B. Network: The Network layer (Layer 3) handles logical addressing (e.g., IP) and routing, passing data down to the Data Link layer (MAC/LLC).

D. MAC: The MAC layer adds the MAC header to create the MPDU. It provides the PSDU to the PHY layer but does not add the PHY header itself.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016). Section 17.2.2, "PPDU format." The diagrams and descriptions in this section illustrate that the Physical Layer Convergence Procedure (PLCP) Preamble and PLCP Header are added to the PSDU at the physical layer to form the PPDU.

2. Carnegie Mellon University, ECE 18-759: Wireless Networks, Lecture 6: IEEE 802.11 Physical Layer. Slide 10, "PLCP Frame Format." The slide explicitly shows a diagram where the "PLCP Preamble" and "PLCP Header" are prepended to the "PSDU (from MAC)" by the PHY layer. This demonstrates the PHY layer's responsibility for adding its own header.

The Arbitration Interframe Space (AIFS) is a fundamental component of the Enhanced Distributed Channel Access (EDCA) mechanism, which was introduced by the IEEE 802.11e amendment to provide Quality of Service (QoS) on Wi-Fi networks. Unlike the fixed Distributed Coordination Function Interframe Space (DIFS) used in legacy networks, AIFS is a variable time interval that a station must wait before contending for the medium. The duration of the AIFS depends on the Access Category (AC) of the data to be transmitted (e.g., Voice, Video, Best Effort, Background). Higher-priority traffic is assigned a shorter AIFS, giving it a statistical advantage in accessing the wireless medium over lower-priority traffic.

A: AIFS was introduced by 802.11e, not 802.11n, and is a widely implemented parameter within the EDCA access method as part of Wi-Fi Multimedia (WMM) certification.

C: AIFS is a MAC-layer timing parameter for medium contention, not a PHY-layer aggregation method. Aggregation is handled by mechanisms like A-MSDU and A-MPDU.

D: This describes power-saving functions. AIFS is related to medium access prioritization, not the duration a station can be in a low-power (sleep) state.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 10.22.2.3 (EDCA timing): "A non-AP QSTA using the EDCA shall transmit a frame with a particular user priority (UP) when its carrier-sense mechanism determines that the medium is idle at the end of an AIFS period for that UP... The AIFS for a particular AC (AIFS[AC]) is defined by the following formula: AIFS[AC] = AIFSN[AC] × aSlotTime + aSIFSTime". This confirms AIFS is a variable interframe space dependent on the Access Category (AC).

2. Carnegie Mellon University, ECE Course 18-759: Wireless and Mobile Networking, Lecture 10: MAC Layer (Part 3).

Slide 15 ("EDCA (Enhanced Distributed Coordination Access)"): This slide explicitly states, "DIFS is replaced by AIFS (Arbitration Inter-Frame Spacing) whose value depends on the traffic class." It shows a diagram where higher priority classes (Voice, Video) have a shorter AIFS than lower priority classes (Best Effort, Background), illustrating how AIFS is used for prioritization.

3. Bianchi, G. (2000). Performance analysis of the IEEE 802.11 distributed coordination function. IEEE Journal on selected areas in communications, 18(3), 535-547. https://doi.org/10.1109/49.840210

While this paper predates 802.11e, it provides the foundational analysis of DCF and DIFS. Later works that analyze 802.11e, such as those by Mangold et al., build upon this to show how AIFS replaces DIFS to enable service differentiation, reinforcing that AIFS is an evolution of the interframe space concept for QoS. (Note: This reference provides context for the concept AIFS replaced).

In an 802.11ac/ax network configured for wide channels (40/80/160 MHz), the total bandwidth is comprised of a single "primary" 20 MHz channel and one or more "secondary" 20 MHz channels. All management frames (e.g., Beacons, Probe Responses) and control frames must be transmitted on the primary 20 MHz channel. This channel is also used for contention (e.g., RTS/CTS) and for communication with legacy clients that do not support wider channels. Consequently, the primary channel will always exhibit higher airtime utilization than the secondary channels, which are used opportunistically for wide-channel data transmissions. The observation is a normal characteristic of 80 MHz operation.

A. The described behavior is a fundamental and expected characteristic of 80 MHz operation, not a sign of misconfiguration.

B. While non-Wi-Fi interference can cause performance issues, the specific pattern of higher utilization on only the primary channel is normal Wi-Fi protocol behavior.

D. If RRM had selected a 20 MHz channel, the AP would only be operating on that single channel, not an 80 MHz channel with varied utilization.

1. CWNP, LLC. (2021). CWAP-404 Certified Wireless Analysis Professional Official Study Guide. Sybex. In Chapter 5, "MAC Layer Analysis," the section on "VHT (802.11ac) MAC" explains that the primary 20 MHz channel is used for all management and control frames, leading to higher activity on that specific channel segment within a wider channel bond.

2. IEEE Std 802.11™-2020. (2021). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. In Clause 22.3.13, "Channelization," the standard defines the primary channel for VHT (802.11ac) operations and specifies its mandatory use for certain frame types, which inherently concentrates traffic on it.

3. Coleman, D. D., & Westcott, D. A. (2021). Certified Wireless Network Administrator CWNA-108 Official Study Guide. Sybex. Chapter 10, "802.11ac," details the channel-bonding mechanisms, explicitly stating that the primary channel carries the BSS's beacon frames and is the main channel for contention, explaining the higher utilization.

The 4-Way Handshake establishes the encryption keys used for a secure Wi-Fi session. In Message 3, sent from the Authenticator (AP) to the Supplicant (client), the Group Temporal Key (GTK) is transmitted. By this stage, both the AP and the client have independently derived the Pairwise Transient Key (PTK). The AP uses a portion of the PTK, specifically the Key Encryption Key (KEK), to encrypt the GTK before sending it. The client then uses its copy of the KEK to decrypt the GTK. The GTK is necessary for the client to decrypt broadcast and multicast traffic sent by the AP to all connected devices.

A. PMK: The Pairwise Master Key (PMK) is the initial shared secret and is used as an input to create the PTK; it is never transmitted during the handshake.

B. PTK: The Pairwise Transient Key (PTK) is derived independently by both the client and the AP using shared information; it is never transmitted across the wireless medium.

C. GMK: The Group Master Key (GMK) is a key held exclusively by the Authenticator (AP) to generate new GTKs. It is never distributed to clients.

1. IEEE Std 802.11™-2020. IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. Section 12.8.2.3, "The 4-way handshake," states: "Message 3... The Authenticator sends this message to the Supplicant. It includes the ANonce and the GTK... The Key Data field is encrypted using the KEK derived from the PTK."

2. Cisco. Understand the 4-Way Handshake in a WPA2-PSK network. (2023). This document details the handshake process, stating for Message 3: "In Message 3, the AP sends the GTK (Group Temporal Key) to the client. The GTK is encrypted by the use of the KEK."

3. Moore, A. W. (2017). Computer Networking, Lecture 16: Wireless Security. University of Cambridge, Department of Computer Science and Technology. Slide 29, "IEEE 802.11i: 4-way handshake," shows the content of Message 3 as "{GTK}KEK", indicating the GTK is encrypted with the KEK. Available at: https://www.cl.cam.ac.uk/teaching/1718/CompNet/slides/lec16.pdf

In the IEEE 802.11 architecture, data encapsulation occurs as data moves down the protocol stack. The Physical (PHY) layer receives a data unit from the MAC layer, which is referred to as the PHY Service Data Unit (PSDU). The PHY layer's Physical Layer Convergence Procedure (PLCP) sublayer then prepends a preamble and a PHY header to this PSDU. This newly created data unit, which includes the PHY-level framing and is ready for transmission over the wireless medium, is called the PHY Protocol Data Unit (PPDU).

A. MPDU: The MAC Protocol Data Unit (MPDU) is created by the MAC layer, not the PHY layer, by adding a MAC header to the MSDU.

B. PSDU: The PHY Service Data Unit (PSDU) is the payload that the PHY layer receives from the MAC layer; it is not the final framed unit created by the PHY.

C. MSDU: The MAC Service Data Unit (MSDU) is the data payload from the upper network layers before any 802.11 MAC or PHY headers are added.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems—Local and Metropolitan Area Networks—Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 17.2.2 (PLCP sublayer): States, "The PLCP sublayer adds a preamble and a PHY header to the MPDU to create the PLCP protocol data unit (PPDU)." (Note: The PSDU is the MPDU from the MAC layer's perspective).

Figure 17-2 (PPDU general frame format): Visually depicts the PPDU as being composed of the PLCP Preamble, PLCP Header, and the Data field (which is the PSDU).

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson.

Chapter 7, Section 7.3 (IEEE 802.11 Wireless LANs): This chapter describes the 802.11 frame structure, explaining that the PHY layer takes the MAC frame (MPDU) and adds its own header and preamble to create the physical-layer frame (PPDU) for transmission. This aligns with the standard's definition of encapsulation.

3. University of California, Santa Barbara, Courseware (CS 176A, Introduction to Computer Communication Networks).

Lecture Slides on "Wireless and Mobile Networks": These materials typically illustrate the 802.11 frame encapsulation process, showing the progression from MSDU to MPDU at the MAC layer, and finally to PPDU at the PHY layer, clarifying that the PPDU is the unit created by the PHY layer for transmission.

A Probe Request frame is transmitted by a station (STA) during active scanning to discover nearby wireless networks. When the SSID information element within this frame has a length of zero, it is referred to as a "null SSID" or "wildcard" probe. This specific type of Probe Request is a general broadcast inquiry, asking any Access Point (AP) that receives it to reply with a Probe Response. This mechanism allows the client STA to efficiently build a comprehensive list of all available Basic Service Sets (BSSs) within its range, rather than searching for a single, pre-configured network.

A. Promiscuous mode is a passive listening configuration for network analysis; it does not dictate the content of frames the STA actively transmits.

B. A null SSID probe is a standard discovery method in infrastructure mode and is not an exclusive indicator of a STA operating in Ad-Hoc (IBSS) mode.

C. A disabled WLAN adapter is incapable of transmitting any frames, including the Probe Request frame that was observed.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016), IEEE Standard for Information Technology—Telecommunications and information exchange between systems Local and metropolitan area networks—Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications.

Section 11.1.3.2.1, "Active scanning": "To find any AP, the STA transmits a Probe Request frame with the SSID field in the SSID element set to the broadcast SSID (i.e., the length of the SSID field is 0)."

Section 9.4.2.2, "Probe Request frame format": "The SSID element indicates the desired SSID. A STA may set the SSID element to the broadcast SSID (the SSID element with the SSID field of length 0) to request a response from any AP."

2. Carnegie Mellon University, School of Computer Science Courseware. "15-441: Computer Networks, Lecture 23: Wireless," by Srinivasan Seshan.

Slide 21, "Joining a Network: Scanning": The slide on Active Scanning describes the process: "Probe request sent on each channel... SSID = broadcast... APs send probe response...". This confirms that a broadcast SSID (null SSID) is used to discover available APs.

The fundamental difference between a legacy Data frame and a QoS-Data frame, as defined by the IEEE 802.11e amendment, is the inclusion of a 2-byte (16-bit) QoS Control field in the MAC header. This field is present only in frames with the QoS subtype. It contains several subfields, most notably the Traffic Identifier (TID), which maps the frame to one of eight User Priorities (UPs). These UPs are then mapped to specific Access Categories (ACs) for prioritized channel access using EDCA (Enhanced Distributed Channel Access). The presence of this field is the defining characteristic that enables MAC-layer Quality of Service.

A. Differentiated Services Code Point (DSCP) is a Layer 3 marking in the IP header, not a field within the 802.11 MAC frame header.

B. The QoS Information Element is used in Management frames (e.g., Beacons) to advertise QoS capabilities, not within individual Data frames.

C. An 802.1Q VLAN tag is a Layer 2 mechanism for wired Ethernet and is not a native component of the 802.11 MAC header.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016). Section 9.3.2.1, "Data frame format," states: "The QoS Control field is present when the QoS subfield of the Subtype field is 1." Figure 9-28, "MAC frame format for QoS Data frames," visually depicts the location of the QoS Control field within the MAC header.

2. Coleman, D. D., Westcott, D. A., & Harkins, B. A. (2021). Certified Wireless Analysis Professional (CWAP) Official Study Guide: Exam CWAP-404 (2nd ed.). Wiley. Chapter 4, "802.11 MAC Architecture," in the section "QoS Data Frames," explains that the key differentiator for these frames is the 16-bit QoS Control field, which carries the priority value for the frame.

3. Hiertz, G. R., Denteneer, D., Stibor, L., Zang, Y., Costa, X. P., & Walke, B. (2010). The IEEE 802.11s MAC layer management and the mesh deterministic access. IEEE Wireless Communications, 17(1), 54-62. https://doi.org/10.1109/MWC.2010.5416349. In Section II.A, "The 802.11e QoS Facility," the paper states, "The main enhancement of 802.11e is the introduction of a new data frame format, the QoS data frame, which contains a QoS control field in its MAC header."

The primary function of 802.11 Management frames is to establish, maintain, and terminate sessions within a Basic Service Set (BSS). These frames are not used for carrying user data but are essential for the lifecycle of a wireless connection. Key examples include Beacon frames for announcing a network's presence, Probe Request/Response frames for discovering networks, Authentication and Association frames for joining a network, and Disassociation/Deauthentication frames for leaving a network. Collectively, these functions constitute the management of the BSS.

A. Prioritize network administration traffic: Traffic prioritization is a Quality of Service (QoS) function, which is primarily handled by fields within 802.11 Data frames, not by Management frames.

B. Communicate configuration changes between WLAN controller and APs: This communication typically occurs over the wired distribution system using a specific protocol like CAPWAP, not through standard 802.11 Management frames over the air.

D. Manage the flow of data: Managing the flow of data on the wireless medium, including access contention and acknowledgments, is the role of 802.11 Control frames (e.g., RTS, CTS, ACK).

1. IEEE Std 802.11™-2020. (2020). IEEE Standard for Information Technology—Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks—Specific Requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. In Section 9.2.4, "Management frames," it states, "Management frames are used for the management of the MAC sublayer." The subsequent subsections (9.2.4.1 through 9.2.4.19) detail frames like Beacons, Probes, and Association, all of which manage the BSS.

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 7, Section 7.3.2, "The IEEE 802.11 MAC Protocol," the text distinguishes the three frame types, explaining that Management frames are used for "associating and disassociating with an AP."

3. Stanford University. (2019). CS144: Introduction to Computer Networking, Lecture 15: Wireless. Retrieved from https://web.stanford.edu/class/cs144/lectures/15-wireless.pdf. On slide 21, the lecture notes explicitly state that Management frames are used to "join and leave networks, and to move associations from one AP to another," which are core functions of managing a BSS.

The 802.11 Frame Control field is a 16-bit (2-byte) field that is present at the beginning of every 802.11 MAC header. This field is composed of multiple subfields that define the protocol version, frame type, subtype, and other specific characteristics. Several of these subfields are single-bit flags that indicate a particular state or attribute. These flags include To DS, From DS, More Fragments, Retry, Power Management, More Data, Protected Frame, and Order. Each flag, when set to 1, signals a specific condition, such as the frame being destined for the Distribution System (To DS) or being a retransmission (Retry).

A. All 802.11 frame types (Management, Control, and Data) contain a Frame Control field; it is a fundamental component of the MAC header.

B. The Duration/ID field, which is a separate field following the Frame Control field, is used to communicate the duration value.

D. The Frame Control field's value changes constantly to reflect the specific type, subtype, and attributes of each transmitted frame.

1. IEEE Computer Society. (2021). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. IEEE Std 802.11-2020. Section 9.2.4.1, "Frame Control field," pp. 678-681. This section explicitly details the structure of the Frame Control field, showing its various subfields, including the multiple 1-bit flags.

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 6, "The Link Layer and LANs," Section 6.3.2, "802.11 Wireless LANs," describes the 802.11 frame structure, illustrating the Frame Control field and its constituent subfields and flags.

3. University of California, Santa Barbara, Department of Computer Science. (n.d.). CS 176B: Network Computing - Lecture 10: Wireless and Mobile Networks. Retrieved from https://www.cs.ucsb.edu/~ebelding/courses/176b/w18/lectures/10Wireless.pdf. Slide 21, "802.11 MAC Frame," provides a clear diagram of the Frame Control field, breaking it down into its subfields and identifying the 1-bit flags.

The Request to Send (RTS) and Clear to Send (CTS) frames are part of the 802.11 Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) mechanism, specifically the Distributed Coordination Function (DCF). When a station (STA) intends to send a data frame that exceeds the configured RTS Threshold, it first transmits an RTS frame to the intended recipient. The recipient STA, upon receiving the RTS, responds with a CTS frame after a Short Interframe Space (SIFS). This CTS frame serves as the positive acknowledgment to the RTS and reserves the radio frequency (RF) medium for the subsequent data frame transmission, helping to mitigate the hidden node problem.

B. Ack: An Ack frame is used to acknowledge the successful reception of unicast data or management frames, not control frames like RTS.

C. RTS-Ack: This is not a defined frame type within the IEEE 802.11 standard; it is a fabricated option.

D. Block Ack: A Block Ack is a mechanism introduced in 802.11n to acknowledge a group of frames (an A-MPDU) at once, not a single RTS frame.

1. IEEE Computer Society. (2021). IEEE Standard for Information Technology--Telecommunications and Information Exchange between Systems Local and Metropolitan Area Networks--Specific Requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. IEEE Std 802.11™-2020.

Section 10.3.2.7, "RTS/CTS procedure," states: "A STA may transmit an RTS frame when it desires to transmit a frame. Upon receiving an RTS frame, the destination STA shall respond with a CTS frame after a SIFS period if the NAV at the destination STA is clear." This directly specifies that a CTS is the response to an RTS.

2. Carnegie Mellon University. (2005). 18-759 Wireless Networks, Lecture 4: MAC Layer I: 802.11. School of Electrical and Computer Engineering.

Slide 23, "RTS/CTS Handshake," illustrates the exchange sequence: "Sender sends RTS (Request to Send). Receiver responds with CTS (Clear to Send)." This confirms the fundamental protocol interaction where CTS acknowledges the RTS.

For a long-term, forensic packet capture, the primary objective is to record all raw packet data to a storage medium with the highest possible fidelity, meaning without dropping any packets. Real-time packet decoding is a computationally intensive process that interprets and displays packet contents for immediate analysis. This function consumes significant CPU and memory resources, which can overwhelm the capture station's ability to process and write incoming packets to disk, leading to packet loss. Therefore, real-time decoding is typically disabled during high-volume forensic captures; the analysis and decoding are performed offline after the capture session is complete.

B. Analyzer location: The physical and logical placement of the analyzer is critical for capturing the intended traffic, whether it's ensuring proximity and correct channel selection for wireless traffic or using a SPAN port for wired traffic.

C. Total capture storage space: Long-term captures can generate terabytes of data. Calculating and allocating sufficient disk space is a fundamental requirement to ensure the capture does not terminate prematurely due to a full disk.

D. Individual trace file size: Using a single, massive capture file is impractical and risky. Capture software is configured to segment the capture into smaller, manageable files to prevent corruption, ease transfers, and work around filesystem or application file size limits.

1. CWNP, LLC. (2021). CWAP-404 Certified Wireless Analysis Professional Study Guide.

Chapter 2, "The Protocol Analyzer," discusses the components of a protocol analyzer, distinguishing between the capture driver/engine and the decoding/analysis engine. It emphasizes that for high-performance captures, minimizing the overhead of the analysis engine (which performs real-time decodes) is crucial to prevent packet drops. The guide recommends using capture-only tools like dumpcap for this purpose.

Chapter 2 also covers "Capture Methodology," which explicitly details the importance of storage planning (total space and individual file sizes via ring buffers) and proper analyzer placement as fundamental considerations before starting a capture.

2. Pilli, E. S., Joshi, R. C., & Niyogi, R. (2010). A Framework for Network Forensics. International Journal of Computer Applications, 1(11), 1-6.

This academic paper outlines the phases of network forensics, starting with "Collection." In this phase, the "main goal is to collect the network traffic data passively and store it with minimum loss" (Section 3.1, Collection). The subsequent "Analysis" phase is where decoding and interpretation occur. This separation of concerns supports the principle that real-time analysis (decoding) is not the priority during the collection phase of a forensic capture.

DOI: 10.5120/329-483

3. Wireshark Development Team. (n.d.). Wireshark User's Guide. Wireshark.org.

Section 4.7, "Capturing Packets," and the documentation for the dumpcap utility explain that dumpcap is the command-line tool that performs the raw packet capture for Wireshark. The guide notes, "For high-traffic and/or long-term captures, it is recommended to use dumpcap directly... as it has a much lower memory and CPU footprint than the Wireshark GUI," which performs the real-time decoding. This official vendor documentation directly supports disabling real-time decodes for performance-critical captures.

The scenario describes a discrepancy between what the Access Point (AP) can receive and what the portable analyzer can capture at the same physical location (near the AP). The low retry rate (<2%) confirms that the AP is successfully receiving frames from the client station (STA). However, the analyzer at that location cannot see these frames. This indicates that the AP has a better receive sensitivity than the analyzer. The client's signal is strong enough for the AP's high-quality receiver to decode but too weak for the analyzer's less sensitive receiver at that distance. When the analyzer was near the client, the signal strength was sufficient for it to capture the frames.

A. This is incorrect because the low retry rate proves the AP is not blinded and is successfully receiving the client's packets.

B. A mismatch in spatial stream support would likely prevent the analyzer from decoding frames regardless of its proximity to the STA, which contradicts the initial successful capture.

C. This is contradicted by the evidence. The low retry rate explicitly indicates that the AP can hear the client's traffic successfully.

1. CWNP, LLC. (2021). CWAP-404 Certified Wireless Analysis Professional Official Study Guide.

Chapter 11: WLAN Frame Analysis, Section: Capture Hardware. This chapter discusses the hardware used for packet capture, noting that the capabilities of capture adapters (like those in a portable analyzer) can vary significantly and may not match the performance of an enterprise-grade AP. It states, "The quality of the radio and antenna in the capture device will affect its ability to hear frames... An enterprise-grade AP will almost always have a better receive sensitivity than a USB NIC." This directly supports the conclusion that the analyzer's hardware is less capable than the AP's.

2. Cisco. (2019). Enterprise Mobility 8.5 Design Guide.

Chapter 3: RF Design Considerations, Section: Receiver Sensitivity. This guide details the importance of receiver sensitivity for APs in establishing reliable communication links. It explains, "Receiver sensitivity is the measure of the ability of a receiver to receive weak signals." Enterprise APs are designed with high receiver sensitivity to maintain connections with clients at the cell edge. This establishes that APs are engineered to receive weaker signals than typical client-grade or portable analysis hardware.

3. Sikora, A., & Groza, V. Z. (2005). A survey of 802.11 network performance and vulnerability analysis tools. In IEEE Instrumentation and Measurement Technology Conference Proceedings (Vol. 2, pp. 1539-1544). IEEE.

DOI: 10.1109/IMTC.2005.1604421

Section III: WLAN Analysis Tools. This academic survey discusses the limitations of various WLAN analysis tools. It implicitly supports the answer by highlighting that the physical layer capabilities (PHY), including the sensitivity of the radio chipset in the analysis tool, are a critical factor in the accuracy and completeness of a packet capture. A discrepancy between the analyzer's capabilities and the network hardware's capabilities can lead to incomplete data, as seen in the question's scenario.

The IEEE 802.11k amendment, "Radio Resource Measurement," is designed to improve traffic distribution within a wireless network. A key feature is the Neighbor Report mechanism. A client station (STA) sends a Neighbor Request frame to its currently associated Access Point (AP) to ask for information about nearby APs that are suitable candidates for roaming. The AP responds with a Neighbor Report frame containing a list of these APs and their characteristics (e.g., channel, BSSID). This process allows the STA to build a comprehensive view of potential roaming targets without having to perform disruptive and time-consuming off-channel scanning, leading to faster and more efficient roaming decisions.

A. The Neighbor Request's specific purpose is to discover candidate APs for roaming, not to identify general interference sources.

B. Informing an AP of an intent to roam is a function associated with other amendments, such as 802.11r (Fast BSS Transition), not the 802.11k Neighbor Request.

D. The Neighbor Request is for a list of neighboring APs, not neighboring STAs. Protection mechanisms are determined by other factors, such as channel contention.

1. IEEE Std 802.11™-2020 (Revision of IEEE Std 802.11-2016).

Section 11.11.10, "Neighbor Report element": This section details the contents of the report, stating, "The Neighbor Report element contains information on neighbor APs... that are candidates for a BSS transition." This confirms the purpose is to provide a list of roaming candidate APs.

Section 9.6.16, "Neighbor Report Action frame format": This section defines the frame used for the request and response, solidifying its role in the AP discovery process for roaming.

2. Cisco, "Radio Resource Management under Unified Wireless Networks," White Paper.

Section: "802.11k," Page 6: The document explains, "With 802.11k, an AP can respond to a client's request for a neighbor list... The client can then use this neighbor list to have a pre-emptive idea of good roam candidates." This directly supports the function described in the correct answer.

3. Aruba Networks, "802.11k, 802.11v, and 802.11r," Technical Note.

Section: "802.11k," Page 2: "The 802.11k protocol provides a mechanism for APs and clients to dynamically measure the available radio resources. APs can provide clients with a list of neighboring APs that are candidates for roaming." This explicitly states the purpose of the Neighbor Request/Report exchange.

Display filters are applied post-capture to the entire set of collected packets. Their primary advantage over capture filters is their non-destructive nature. They merely hide packets that do not match the filter criteria, without deleting them from the capture file. This allows an analyst to apply, remove, or modify filters iteratively to examine different data subsets within the same capture file. Packets hidden by one filter can be instantly brought back into view by changing or clearing the filter. In contrast, capture-time filters permanently discard packets that do not match the criteria during the capture process, and this data is unrecoverable for later analysis.

A. Both capture and display filters allow for focused analysis by isolating packets of interest from a larger traffic stream.

B. Both filter types can be saved as expressions and reused for subsequent analysis sessions or new captures in most protocol analyzers.

D. Both filter types support complex logical expressions (using AND, OR, NOT) to apply multiple conditions simultaneously.

1. Coleman, D. D., Westcott, D. A., & Harkins, D. (2021). CWAP Certified Wireless Analysis Professional Study Guide: Exam CWAP-404 (3rd ed.). Wiley. In Chapter 2, "Protocol Analysis," the text distinguishes between the two filter types, noting that capture filters are used to "reduce the size of the capture file by discarding unwanted frames," while display filters "simply hide frames from view, and they can be unhidden later."

2. Wireshark Development Team. (n.d.). Wireshark User's Guide. Wireshark.org. In Chapter 6, "Filtering Packets," Section 6.2, "Capture vs. Display Filters," it is explicitly stated: "A display filter... does not discard any packets. When you change the display filter, all packets will be back again." This contrasts with capture filters, which are described as discarding packets permanently.

3. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. The accompanying Wireshark Labs for the textbook demonstrate this principle. For instance, in the "Getting Started" lab, students are shown how display filters can be changed "on the fly" to view different protocols, while capture filters are set before capture and determine what data is saved to the file.