Eq	Formula	Plain meaning	Worked number
1.1	C = B·log₂(1+SNR)	Cell capacity = bandwidth × signal quality	20 MHz @20 dB ≈ 133 Mb/s
1.2	M = Pr − Pmin	Coverage safety margin	−64 −(−67) = 3 dB
2.1	η = R / B	Speed per hertz of spectrum	600/80 = 7.5 b/s/Hz
3.1	Tsetup = Tscan+Tauth+Tassoc+Tip	Connection wait = sum of stages	60+40+20+30 = 150 ms
4.1	Pr = Pt+Gt+Gr−Lp−Lm	Link budget: what actually arrives	17+3+0−76−6 = −62 dBm
5.1	Risk = Threat × Vulnerability × Impact	Which control to prioritise	segmentation cuts Impact only

Day	Study	Target
D1	1.1 · 1.2	Layers + frames cold. Infra vs ad hoc in 3 aspects.
D2	1.3 · RF LAB link budget	Explain margin without the word "coverage".
D3	2.1 · 2.2	IEEE/IETF/ITU split. Frame header sizes 24/26/30/32.
D4	2.3 · 3.1	Capability vs suitability. The 5 connection steps.
D5	3.2 · 3.3	PANA roles. ARP by heart. 150 ms breakdown.
D6	4.1–4.3 · 5.1	Link budget by hand. Why coverage ≠ capacity. Passive vs active threats.
D7	5.2–5.4 · cheatsheet + drills	WEP's four flaws. The 4-way handshake in order. Mock exam ×2.

Idea	Ch 1	Ch 2	Ch 3	Ch 4	Ch 5
Coverage margin	M = Pr − Pmin	—	—	Pr from link budget	—
Air time is the real resource	overhead frames	OFDMA	scanning costs air time	capacity dimensioning	jamming / airtime flood
Roaming	overlap, sticky clients	—	L2/L3, 150 ms	roaming validation	deauth abuse steers clients
Old devices cost you	mixed a/b/g/n/ac/ax	backward compatibility	—	baseline client class	legacy modes weaken crypto
Frames	3 families	field layout	data frames prove service	—	spoofed management frames
ARP	why IPv4 needs it	—	roaming + gratuitous ARP	—	ARP spoofing & defences
802.1X / EAP / PANA	—	—	access methods	—	method choice, PAA→EP path
Channel width / reuse	20 MHz in 2.4	η = R/B	—	1 · 6 · 11	channel anomaly detection

Assignment	From	Rule	Status
A1	Chapter 1 exercises	Answer only one problem	SUBMITTED — problem 1
A2	Chapter 2 exercises	Answer only one problem	not decided — 5 options
A3?	Chapter 3 exercises	likely same format	6 candidates ready
A4?	Chapter 4 exercises	likely same format	5 candidates ready
A5?	Chapter 5 exercises	likely same format	6 candidates ready

// CHAPTER NOTES16 sections, in plain words

Each section: a one-line summary, short form for revision, examples, and a long form you open only when you want depth. Use ‹ › in the bar above or J / K to move.

1.1

Layers, frames, and two ways to run a network

CH1 · Architecture

A wireless network is fast only when all its parts work together — not when one part is fast.

The 5 layers

Short form: Physical (send radio signals) → MAC (decide who talks) → Network (find the path) → Transport (check delivery) → Application (your app). Layers exist so each part can improve without breaking the others.

Think of it likeA company. The mailroom (Physical) moves boxes, the schedule desk (MAC) decides whose box goes first, logistics (Network) picks the route, quality control (Transport) checks nothing was lost, and the customer (Application) gets the product.

Key ideaThe PHY–MAC border is where most observable problems live. A wide channel is a physical choice, but it leaves neighbours fewer clean channels — which shows up as MAC-level waiting and collisions. Treat the two as one coupled subsystem.

Frames — the envelopes of networking

Short form: frame = header (addresses + control) + payload (the data) + trailer with FCS (a checksum that catches damage). A frame lives for one hop; the IP packet inside travels the whole way.

Think of it likeSending a gift overseas. The gift (IP packet) goes all the way. At each stage it gets a new local envelope (frame) with the next local address on it.

That is why IPv4 needs ARP: before an IP packet crosses the local link, the sender must learn the next stop's MAC address. Wi-Fi frames come in three families:

Management — joining and leaving: discovery, authentication, association, roaming.
Control — traffic police: coordinating the medium, ACKs ("got it").
Data — your actual traffic.

ExampleThe box says 1200 Mb/s but your download crawls. Beacons, probes, ACKs and retransmissions all consume air time and carry no user data. Advertised PHY rate ≠ delivered throughput.

▸ long form — Wi-Fi frame vs Ethernet frame

An Ethernet frame is simple: destination, source, type, payload, FCS — designed for a calm wired link.

A Wi-Fi frame carries more because radio is shared and messy: how long the medium will be busy (duration), which direction the frame travels (to or from the wired distribution system), sequence numbers for duplicate detection, and up to four address fields. Chapter 2 covers the exact layout.

The four radio resources (Table 1.1)

Short form: every radio choice is a trade — wider channel = faster but fewer clean channels · stronger coding = safer but less payload · focused antennas = stronger link but must aim well · MAC style = compete (flexible, messy when busy) or schedule (tidy, complex).

Choice	You gain	You pay
Wider bandwidth	Higher top speed	Fewer channels for neighbours, more interference
Robust coding	Fewer errors at low SNR	Less room for real data
Directional antennas	Strong link, less interference	Must point right; uneven coverage
Contention MAC	Simple, flexible, bursty-friendly	Collisions, waiting under load
Scheduled MAC	Predictable, strong QoS	Needs a central brain

ExampleSit next to the AP → your laptop uses a fast risky mode (many bits per symbol). Walk to the corner → it falls back to a slow safe mode. That automatic switching is adaptive modulation and coding. One slow far-away client also occupies the channel far longer per byte — hence air-time fairness, not raw bitrate.

Infrastructure vs Ad Hoc

Short form: Infrastructure — everyone talks through a central AP: easy to manage, grows by adding APs, central security (and a single point of failure). Ad hoc — devices talk directly, no boss: quick to set up, hard to manage, no central access control.

Think of it likeA classroom with a teacher (order, rules, scales to a whole school) vs a group chat with no admin (fast to start, chaos when it grows).

Feature	Infrastructure	Ad hoc
Coordination	Central AP / base station	Shared between equal peers
Growing bigger	Add more APs	Gets messy fast
Management & security	One place for rules and monitoring	No central control, easy to eavesdrop
Used for	Offices, campuses, cellular	Emergency, tactical, temporary

Assignment 1 lives hereYour submitted answer compares these two on coordination, scalability and security — full text in the ASSIGNMENTS tab. Coverage extension (fixed backhaul + roaming vs peer forwarding only) is a good fourth angle if you ever extend it.

mark done

1.2

The parts: APs, controllers, cables, roaming

CH1 · Architecture

Stations, access points, controllers, powered cables — and the rules that let you walk without dropping.

How much can a cell carry?

EQ 1.1C = B · log₂(1 + SNR)Capacity = bandwidth × signal quality. More spectrum or a cleaner signal = more capacity. Real systems stay below this ceiling.

ExampleTwo 20 MHz channels. Good signal (SNR 20 dB = 100×) → ≈ 133 Mb/s. Weaker (10 dB = 10×) → ≈ 69 Mb/s. Same bandwidth; the cleaner channel carries almost double. (dB rule: +10 dB = 10× the ratio.)

Names you must know

Short form: SSID = the network name you see · BSS = one AP radio + its devices · BSSID = that radio's MAC address · ESS = many APs sharing one SSID, which is what makes roaming possible.

Example"CMU-WiFi" appears once on your phone, but campus has hundreds of APs. Each AP radio is its own BSS; together they form one ESS. Walking between buildings your phone jumps BSS to BSS under the same name.

Three ways to manage APs (Table 1.7)

Model	Industry label	Brain lives…	Best for	Weak point
Autonomous	FAT / standalone	On each AP	Home, small office, lab	Many APs drift out of sync
Controller-managed	FIT / thin / lightweight	Central WLAN controller	Campus, hospital, warehouse	Controller must stay reachable
Cloud-managed	Cloud AP	Cloud dashboard	Many small sites	Needs internet; define outage behaviour

CAPWAP — how an AP talks to its controller

Short form: the AP gets an IP → finds the controller → joins → then a control channel carries settings, heartbeats, status and measurements. User data crosses the controller only if the design tunnels it; otherwise it is bridged locally.

AP state — "I am AP-Library-3, both radios on, 27 clients, version 8.2."
Config commands — "Broadcast Campus-Staff, VLAN 20, WPA2-Enterprise, 5 GHz channel 36."
Keepalives — heartbeats. Several missed → controller marks the AP down and alarms.
Firmware control — "Image is old, download this one, reboot in the window, report back."
Radio measurements — channel utilisation, noise, neighbour BSSIDs, client RSSI, retries.
Events — AP join/disconnect, rogue AP, auth failure, DFS change, port power limit.

Key ideaCentral control does not require central data. The controller can command everything while user traffic takes the short local path.

▸ long form — what happens if the controller dies?

Many APs keep serving the WLANs they already know, so existing users stay online. But new configuration, telemetry, roaming optimisation and sometimes new authentications stop.

So deployments plan: controller redundancy, firewall paths for CAPWAP, certificate/trust validation, image-download behaviour, and a written answer to "what still works during an outage?"

Roaming

Short form: the client decides when to jump: it watches signal, retries and beacon loss, scans, then reassociates. Infrastructure can only suggest. Fast-roaming features skip repeated logins; keep the same VLAN everywhere or the user's IP breaks mid-walk.

Feature	Who acts	What it does
802.11k	AP → client	Neighbour list: "here are the APs near you"
802.11v	Network → client	Suggestion: "that AP would serve you better"
802.11r	Both	Fast BSS transition — keys ready, no full re-login
PMK / OKC caching	Infrastructure	Reuse key material instead of full 802.1X again

Watch out — the sticky clientA laptop clings to a far AP while standing next to a closer one. Cause: too much overlap plus lazy client thresholds. Fixes are design-level — raise minimum data rates, trim transmit power, tune overlap so devices leave earlier.

PoE — power through the network cable

Short form: one Ethernet cable carries data and power. Order: 802.3af (PoE) < 802.3at (PoE+) < 802.3bt (PoE++). Too little power and the AP quietly turns features off.

PSE = the giver (switch or injector). PD = the receiver (the AP). They negotiate before full power.
Cable: real copper (never copper-clad aluminium), Cat 5e/6/6A, all four pairs, ~100 m limit. Long or tightly bundled runs lose power as heat.
Check three things together: cable category, negotiated Ethernet speed (1 / 2.5 / 5 Gb/s), negotiated PoE class.

ExampleUsers report weak Wi-Fi on floor 3. Real cause: that AP only received 802.3af power, so it booted with one radio disabled and lower transmit power. A "radio problem" that was actually electrical.

▸ long form — PoE and resilience

PoE concentrates power in switch closets. Good: one UPS keeps many APs alive through a short outage. Bad: a failed switch or an exhausted PoE budget takes down many cells at once.

Critical sites document which switch powers which APs, how much PoE budget remains, how long UPS backup lasts, and which WLANs must survive a utility failure.

Old and new Wi-Fi living together

Short form: legacy devices are welcome but expensive — they force slow rates and weaker security. Plan: 2.4 GHz = compatibility band, 5/6 GHz = performance; legacy devices get their own SSID + VLAN; disable 802.11b rates; 20 MHz channels in 2.4 GHz.

Standard	2.4 GHz	5 GHz	6 GHz
802.11b / g	yes	no	no
802.11a	no	yes	no
802.11n	yes	yes	no
802.11ac	no	yes	no
802.11ax (Wi-Fi 6 / 6E)	yes	yes	6E
802.11be (Wi-Fi 7)	yes	yes	yes

Example — a clean migrationInventory clients first. Then: a modern main SSID for laptops and phones, a restricted "IoT-Legacy" SSID for old printers and scanners, and a retirement plan for anything demanding obsolete rates or weak security.

Controllers and RRM

Short form: Radio Resource Management is a closed loop — measure → analyse → decide → apply → repeat. It picks channels, tunes power, balances load. Danger: changing too much, too often.

Two automation risks (exercise 6)

Frequent channel changes disconnect clients — real RRM uses thresholds, hysteresis and maintenance windows.
Cutting transmit power too aggressively creates coverage holes and sticky clients.

The best design is not the most automated one: it is automation plus visibility plus an operator override.

Backhaul checkA perfect radio cell on a saturated uplink is still slow. Always ask what the cell is plugged into: capacity, oversubscription, latency, failure domains.

mark done

1.3

Coverage: margin, cells and overlap

CH1 · Architecture

"I can see the network" is not coverage. Coverage is signal with room to spare.

EQ 1.2M = P_r − P_minMargin = signal you receive − minimum the application needs. Positive margin is safety room for fading, bodies, furniture and interference.

Example — the worked one (Eq 1.3)Classroom edge: received −64 dBm, policy needs −67 dBm → margin = 3 dB. Positive but thin: a crowd or a closed door can eat it. At 0 dB you are standing exactly on the failure line — reposition the AP, improve mounting, or add a cell.

Try it live: the link-budget calculator in RF LAB computes Pr and this margin together.

Cell sizes (Table 1.8)

Scale	Environment	Strength	Planning concern
Macro	Wide-area outdoor	Continuity, few sites	Limited reuse, aggregate interference
Micro	Campus, streets, corridors	Capacity zoning with mobility	Neighbour and handoff planning
Pico	Offices, classrooms, hospitals	High density, strong reuse	Tuning effort, overlap sensitivity
Femto	Home, one localized space	Fast targeted fix	Uncoordinated interference, backhaul

Key idea — overlapToo little overlap → dead zones and broken roams. Too much → co-channel interference and sticky clients. And real cells are never circles: concrete, metal shelving, glass and lift shafts bend them, so validate predictions with a site survey.

Roaming domains

Short form: a roaming domain groups cells plus control logic so movement feels continuous. Quality = topology (which cells overlap, plausible next neighbours) × policy (how fast reauthentication is, whether keys can be reused).

Quotable"Roaming is not merely a client radio problem; it is a distributed systems problem expressed through mobility." Judge it with application-sensitive criteria — voice needs short gaps, background sync does not care.

Worked design — a three-floor academic building

Split the map: offices and corridors are coverage-driven (few users, need reliability); classrooms and the auditorium are capacity-driven (crowds at the same moment).
Size the cells: a few loud APs look great on a heat map but create one giant contention domain. Use more, smaller cells where the crowds are.
Check margin at the worst corner — the 3 dB example — and fix thin spots by placement, mounting or an extra cell.
Design roaming for voice: accurate neighbour lists, low-latency auth state transfer, overlap big enough to hand off before failure but not so big it breeds sticky clients.

▸ chapter 1 exercises — pick one for A1 (you chose #1)

1 ✓ Infrastructure vs ad hoc — coordination, scalability, security. Submitted.

2 Eq 1.1 with equal bandwidth, different SNR → the 133 vs 69 Mb/s comparison.

3 How roaming requirements shape cell overlap → hear the next AP before the old link dies, without breeding sticky clients.

4 Why a wider channel can still reduce deployment efficiency → fewer clean channels, worse reuse, more contention.

5 Table 1.1: one robustness choice (robust coding) vs one reuse choice (directional antennas / lower power).

6 RRM benefits + two risks → coordinated channels and load balance; channel-flip instability and over-aggressive power cuts.

7 Fig 1.6: measurement quality and policy stability → bad measurements give bad decisions; jumpy policy oscillates.

8 Eq 1.2: detectable ≠ application-grade → seeing the SSID needs any signal; using it needs Pr ≥ Pmin plus margin.

9 Two cell scales from Table 1.8 → e.g. macro (continuity, weak reuse, rare handoffs) vs pico (strong reuse, frequent handoffs).

10 Eq 1.3 meaning and the 0 dB case → thin headroom; at zero, redesign is mandatory.

mark done

2.1

The rule-makers

CH2 · Standards

Interoperability rests on a stack of institutions — and it usually fails at the borders between them.

Short form: IEEE writes local-network rules (the 802 family; Wi-Fi is 802.11). IETF writes internet protocol rules (routing, transport, security, management). ITU coordinates world spectrum and telecom policy. Alliances (Wi-Fi Alliance, the 3GPP ecosystem) certify that products actually work together.

Think of it likeBuilding a city: ITU zones the land (spectrum), IEEE writes the building code for houses (local links), IETF writes the road rules between houses (internet protocols), and alliances are the inspectors who certify a building before anyone moves in.

Key ideaFailures happen at boundaries between organisations, not usually inside one rulebook. A device can follow its IEEE PHY/MAC amendment perfectly and still behave badly if security negotiation, IP configuration or mobility signalling integrate weakly. Likewise a sound cellular standard is hard to deploy globally without spectrum harmonisation.

ExampleTwo products both say "802.11ax", but one skipped an optional roaming feature — the standard permits that. Certification defines the common must-pass subset, which is why the certified logo matters to enterprise buyers.

▸ long form — why standards contain optional parts

Formal standards must serve many industries for many years, so they include options, multiple operating modes and vendor freedom. That flexibility helps innovation and hurts purchasing — nobody knows which options a given product implements.

Alliances fix this by choosing testable subsets and certifying them. Standards bodies produce extensible frameworks; alliances make the market converge on recognisable, testable product behaviour. In Wi-Fi this decides whether advanced security, roaming or efficiency features are dependable enough for procurement.

mark done

2.2

Wi-Fi standards and the data frame

CH2 · Standards

Wi-Fi moved from "one fast link" to "share the air well with many users".

The generations (Table 2.1)

Standard	Band	Main trick	Goal
802.11n	2.4 / 5 GHz	MIMO	Higher throughput
802.11ac	5 GHz	Wider channels, MU-MIMO	Gigabit-class WLAN
802.11ax	2.4 / 5 / 6 GHz	OFDMA, spatial reuse	Dense deployments
802.11be	2.4 / 5 / 6 GHz	Multi-link operation	Extremely high throughput

Think of it likeOFDMA turns the AP from a single counter serving one customer at a time into a food court: the channel splits into small resource units and many small orders are served at once.

EQ 2.1η = R / BSpectral efficiency: the rate you actually achieve per hertz of occupied bandwidth.

Example600 Mb/s over 80 MHz → η = 7.5 b/s/Hz. Double the channel to 160 MHz but only reach 800 Mb/s → η = 5. Faster link, worse use of spectrum — and you consumed channels your neighbours needed. Wider is not automatically better.

Key ideaThe n → be story is a shift from peak-link optimisation (wider channels, MIMO) to system-level efficiency (OFDMA resource units, multi-user scheduling, spatial reuse, multi-link). Modern networks are limited by dense multi-user fairness and overhead, not single-user peak rate.

The IEEE 802.11 data frame (Table 2.2)

Short form: a Wi-Fi data frame is not "Ethernet over radio". It adds direction bits, air-time reservation, sequence numbers, QoS and up to four addresses. Header sizes: 24 bytes basic · 26 with QoS · 30 with a fourth address · 32 with both · +4 if HT control.

Field	Size	Plain-words job
Frame control	2	What kind of frame, and which way is it going (To DS / From DS), retry, power, protection
Duration / ID	2	"The medium is busy for X µs" — virtual carrier sensing, fewer collisions
Address 1–3	6 each	Radio receiver, radio transmitter, and the true source / destination
Address 4	0 or 6	Only when both DS bits are set — wireless bridging / WDS
Sequence control	2	Duplicate detection, ordering, fragment handling
QoS control	0 or 2	Traffic category: voice, video, best-effort, background
HT control	0 or 4	Optional high-throughput coordination
Frame body	~0–2304	LLC/SNAP payload (IPv4 / IPv6 / ARP) plus security overhead
FCS	4	Error detection before the frame is accepted

Key idea — why 3 or 4 addresses?Ethernet needs two (from, to). Wi-Fi must separate the radio hop from the real journey. Uplink: your phone transmits, the AP receives — but the destination is a server far away. Downlink: the AP transmits although the source is elsewhere. Different roles need different address fields.

The frame header calculator in RF LAB lets you toggle QoS / 4th address / HT control and see the byte count.

▸ long form — security, QoS and aggregation

With protection enabled, the frame body carries security overhead plus encrypted payload while selected header fields stay readable so the medium still functions.

With QoS enabled, the access category changes contention behaviour, queue selection and priority on air.

Modern amendments aggregate several MSDUs or MPDUs into one transmission so the header cost is paid once. The standing lesson: throughput depends on payload bits and the control structure wrapped around them.

Certification and compatibility

Short form: backward compatibility protects investment but drags efficiency — old rates waste air time and old clients hold the security floor down. Judge a standard by its transition cost, not only its lab numbers.

ExampleA brand-new 802.11be network still feels ordinary in a real office where half the clients are five-year-old laptops. Excellent in a homogeneous lab, partial gains in mixed reality.

mark done

2.3

Cellular and IoT standards

CH2 · Standards

Separate capability (what a standard can do) from suitability (what the job needs).

Short form: the 3GPP family — LTE, LTE-Advanced, NB-IoT, LTE-M, 5G NR — are complete end-to-end systems for wide-area managed mobility. IoT standards trade throughput for battery life, range and simplicity.

Growth model	IEEE 802.11	3GPP
Unit of change	Amendments (n, ac, ax, be)	Releases
Scope	Mostly the air interface	Radio + core + service classes + security context
Trade-off	Faster, more piecemeal	Consistent long-term, heavier coordination

Think of it likeA sensor is a postcard writer: a few bytes twice a day, and it must survive five years on one battery. A smartphone is a video caller. You would never build one postal system for both — that is why IoT standards exist.

Example — the worked selection (§2.3.3)One university, three jobs: lecture-hall laptops → dense-WLAN standard (802.11ax-class, OFDMA); basement environmental sensors → IoT standard (deep coverage + years of battery beat throughput); campus security staff moving around → cellular (managed roaming, wide-area continuity). Newest ≠ best; fit wins.

Key ideaThe IoT selection question is always "which constraint dominates?" — battery life, coverage depth, mobility support, operator integration, or private-deployment flexibility. The answer picks the family.

▸ chapter 2 exercises — A2 candidates

1 Compare IEEE, IETF and ITU → three levels of the stack + the "failures at the borders" insight.

2 Eq 2.1: why wider channels alone don't guarantee better utilisation → the 7.5 vs 5 b/s/Hz example.

3 Two trade-offs of backward compatibility → air time lost to legacy rates; security floor forced by old clients.

4 Why certification alliances still matter → optional features; testable subsets; predictable procurement.

5 Justify a dense-WLAN standard for one campus service and an IoT/cellular one for another → the §2.3.3 scenario.

Full comparison table and ready-made outlines live in the ASSIGNMENTS tab.

mark done

3.1

The connection lifecycle

CH3 · Connection

Seeing a network name is not a connection. Five steps stand between "signal nearby" and "usable internet".

Scanfind networks

▶

Authenticateprove identity

▶

Associatejoin the AP

▶

IP setupDHCP + ARP

▶

Datareal traffic

Think of it likeEntering a club: find the door (scan), show ID (authenticate), get the wristband (associate), get your table number (IP setup), and only then order (data). A slow queue at any step ruins the night — even if the club inside is excellent.

EQ 3.1T_setup = T_scan + T_auth + T_assoc + T_ipTotal connection delay is a sum. Optimising only one stage may not materially reduce it.

Key ideaUsers judge a network by time-to-service, not throughput alone. A network with excellent steady-state bandwidth but slow attachment feels worse than a slightly slower one that connects instantly.

Scanning: passive vs active

Short form: passive = quietly listen for beacons — saves battery and air time but waits for beacon timing. Active = send probe requests — faster answers, costs air time, and reveals more about what the client is looking for.

Smart devices shrink the search: they remember known SSIDs, preferred channels and neighbour lists instead of sweeping the whole spectrum. In dense environments this matters, because scanning itself consumes air time that could carry user data.

ExampleYour phone rejoins home Wi-Fi in a blink but takes seconds in a new mall. At home it knows exactly where to look; in the mall it scans from zero.

Association — and the trap right after it

Short form: association creates the logical attachment and binds you to policy — capabilities negotiated, identifiers recorded, VLAN / QoS / security expectations decided. But association is not working service.

Watch out — "connected, no internet"Many failures look like successful association followed by dead service. Usual suspects: wrong VLAN mapping, keys not installed, DHCP failed, ARP broken, stale forwarding state. Rule for packet captures: management frames prove association; data frames prove usable service.

▸ long form — what "data frames after association" really means

Before association and access control succeed, almost everything between client and AP is management, control, authentication or key-establishment traffic.

Only afterwards can data frames carry ARP, DHCP, IPv4, IPv6, TCP, UDP and application payload. A Wi-Fi sensor using MQTT cannot publish a single reading until this lower-layer sequence has produced usable IP connectivity.

During roaming the same test applies: the client may reassociate quickly, but applications recover only when the new AP can pass protected data frames with the correct policy, QoS treatment and Layer 2 forwarding path.

mark done

3.2

Authentication and access control

CH3 · Connection

Authentication asks who you are. Enforcement decides what you may reach.

Method (Table 3.1)	Typical context	Main property
Open access	Public hotspots	Minimal entry barrier
Pre-shared key (PSK)	Home, small office	One shared secret for everyone
802.1X / EAP	Enterprise Wi-Fi	Per-user authentication
PANA carrying EAP	IP-based access networks	EAP between an IP client and the authentication agent
SIM-based	Cellular	Subscriber identity integration

Key idea — the tradePasswords deploy easily but scale badly: revocation and accountability are painful. Certificates and subscriber modules need more structure but bind identity strongly. And stronger methods mean more signalling — so security architecture and connection performance must be designed together, especially for roaming.

ExampleA staff member leaves. On PSK: change the password and re-join every device. On 802.1X: disable one account. That difference is why enterprises pay the setup cost.

PANA — authentication over IP

Short form: PANA (Protocol for Carrying Authentication for Network Access) carries EAP over UDP/IP instead of over the link. Roles: PaC (client), PAA (authentication agent), EP (enforcement point — the gate), with an AAA server (RADIUS / Diameter) behind. It is not DHCP and not encryption.

Think of it likeA campus visitor gate: the visitor (PaC) talks to reception (PAA), reception checks with the ID office (AAA server), then tells the guard at the barrier (EP) to lift it. Reception and guard can be one person or two — but their state must stay in sync.

The PaC discovers or is configured with a reachable PAA.
PaC and PAA establish a PANA session and run an EAP conversation chosen for the deployment.
If EAP succeeds, the PAA records the authorised session and gives the EP what it needs to admit the traffic.
The EP changes its packet filters so authorised traffic passes.
Session lifetime, reauthentication, termination and liveness checks refresh or withdraw the permission.

▸ long form — PANA vs 802.1X, and what PANA is not

Both carry EAP. 802.1X carries it directly over the local link before general data access exists — the classic enterprise Wi-Fi model. PANA carries it over UDP once the device has enough limited IP connectivity to reach the authentication function, so the same model works on access networks where 802.1X is unavailable or not the desired transport.

PANA defines no new password, certificate or subscriber method — EAP methods plug in. It does not supply configuration (DHCP does) and does not protect data frames (a separate secure-association mechanism does, if the deployment needs it). PANA answers one question: is this client authorised, and how is the gate told?

Enforcement — identity becomes service reality

Short form: after login the network translates identity into treatment — VLAN assignment, traffic shaping, captive-portal logic, policy segmentation. Admission is never a plain yes/no: it is "yes, into this segment, at this service level, monitored this closely."

ExampleA student, a guest, an IoT sensor and an administrator all attach through the same physical APs and land in four different logical worlds. Connection management is the front door of network segmentation.

mark done

3.3

Mobility and session continuity

CH3 · Connection

Moving without dropping: fast handoffs, fresh address mappings, and sessions that survive subnet borders.

Layer 2 mobility

Short form: reassociate to a new AP fast, keeping link state. Speed depends on neighbour-discovery quality, reassociation efficiency, key reuse or transfer, and the client's willingness to leave the current AP at the right moment.

Key ideaTwo networks with identical coverage maps can roam completely differently: one has neighbour intelligence and fast transition support, the other makes every client rescan and fully reauthenticate.

ARP — the small protocol that glues it together

Short form: ARP maps an IPv4 address to a MAC address inside one broadcast domain. Broadcast "who has 10.0.5.1?" → the owner replies (usually unicast) with its MAC → the answer is cached. The first target after joining is normally the default gateway, because most traffic leaves the subnet through it.

Why it matters for mobility: roaming changes the radio attachment point while the client keeps the same IP and gateway. The ARP cache may stay valid, but the infrastructure must relearn where that MAC is now reachable. Switches, controllers and APs update forwarding state as frames appear from the new attachment point; gratuitous ARP announces or refreshes a mapping after movement, failover or address reassignment. Stale state sends packets down the old path — users experience voice gaps, frozen video, delayed transactions.

Watch out — ARP's two weak spots

Air time: ARP broadcasts go out at conservative rates and must be heard by everyone. In large flat WLANs that adds up. Proxy ARP and broadcast suppression let the infrastructure answer on behalf of sleeping or remote clients — but they must stay consistent with mobility and security policy.
Trust: ARP has no authentication, so an attacker on the same local network can send false mappings (ARP spoofing) to redirect or disrupt traffic. ARP belongs to both connection engineering and security.

ExampleNew laptop joins, receives 10.0.5.23 with gateway 10.0.5.1. Its first real act is to broadcast "who has 10.0.5.1?" The router answers, the mapping is cached, and only then can frames leave the subnet. No answer = "connected, no internet".

▸ long form — and what about IPv6?

IPv6 does not use ARP. It uses the Neighbor Discovery Protocol (NDP), which performs the same local reachability and address-resolution functions with ICMPv6 messages.

The architectural lesson is identical either way: successful wireless attachment is not complete when the radio link comes up. The client must also resolve local neighbours, maintain forwarding state, and preserve that state while moving.

Layer 3 mobility

Short form: cross a routed boundary and receive a new address, and applications may read that as a session failure rather than movement. L3 mobility preserves the session's logical identity with anchors, tunnels or optimised state transfer.

Key idea — locality vs continuityLocal breakout and direct routing give efficient paths but harder continuity. Central anchoring simplifies session preservation and policy control but lengthens paths. The designer chooses how much complexity sits in the access domain, the core, and the endpoint.

Worked roaming example — the 150 ms handoff

EQ 3.2T_setup = 60 + 40 + 20 + 30 = 150 msA clinician's voice handheld moving from a ward to imaging: scan 60 · authenticate 40 · reassociate 20 · IP 30.

Example — how to read it150 ms is fine for delay-tolerant apps and already noticeable for interactive voice. The largest single term is scanning (60 ms) → optimise it first with neighbour lists and 802.11k/v. But even a perfect scan leaves 90 ms: roaming quality is the whole control path, never one mechanism.
Exercise 2 variant: improve scanning by 40% → 60 → 36 ms, saving 24 ms → total 126 ms.

Move the sliders yourself in the roaming budget tool in RF LAB.

▸ chapter 3 exercises

1 Break down a real login using Figure 3.1 → scan, authenticate (802.1X), associate, DHCP + first ARP, data. Name what can go slow at each stage.

2 Eq 3.1 with scanning improved 40% → 150 → 126 ms; one stage alone gives limited relief.

3 802.1X vs PSK → per-user identity and easy revocation vs one shared secret; security and manageability.

4 PANA roles → PaC holds credentials · PAA runs EAP · AAA server verifies · EP opens the gate; PAA and EP must stay synchronised.

5 Why time-to-service beats throughput as a quality measure → users feel the wait, on first join and on every roam.

6 Eq 3.2: what to optimise first for voice → the biggest term (scanning), while noting the remaining 90 ms.

mark done

4.1

Requirements engineering

CH4 · Design

Design starts by turning vague wishes into numbers you can test against.

Requirementsmeasurable targets

▶

Site surveyreal propagation

▶

Capacity planusers & air time

▶

Deploymentinstall & configure

▶

Validationprove it works

Service objectives

Short form: coverage area, user density, application mix, throughput, mobility support, resiliency — all written as measurable statements. "Good coverage" guides nothing; "voice and cloud access for 120 concurrent users per lecture hall with bounded roaming interruption" drives real decisions.

Key idea — hard constraints vs optimisation goalsHard constraints: life-safety coverage, mandatory areas, minimum voice quality — non-negotiable. Optimisation goals: lower cost, easier expansion, less operational complexity — nice to have. Design succeeds not by maximising every metric, but by making the trade-offs explicit and aligned with what stakeholders actually value.

Example — turning a wish into requirements"Wi-Fi should be good in the lecture hall" becomes: 120 concurrent devices · voice + cloud + occasional video · ≥ −67 dBm at every seat · roaming interruption below the voice threshold · service continues if one AP fails. Now every later decision has something to be checked against.

Environmental constraints

Short form: walls, floors, reflective surfaces, weather, power availability, spectrum regulation and existing systems all limit what is buildable. Constraints work at three scales:

Scale	What limits you
Room	Dense shelving, glass, metal fixtures, moving crowds → propagation and multipath change
Building	Riser availability, cable routes, aesthetics, mounting permission → where APs may physically go
Regulatory	Channel availability and permitted transmit power → how aggressively spectrum can be reused

Watch outWireless design is never purely theoretical. Predictive models are useful but must be read through the realities of the site. Two buildings with the same floor area demand very different designs if one is open-plan office and the other a reinforced hospital wing. A generic template does not transfer cleanly.

mark done

4.2

Link budget and capacity planning

CH4 · Design

The link budget says whether the signal arrives. Capacity says whether it is enough for everybody.

EQ 4.1P_r = P_t + G_t + G_r − L_p − L_mReceived power = transmit power + antenna gains − path loss − other losses/margins. Everything in dB, so you just add and subtract.

Think of it likeA bank account in dB. Transmit power is your salary, antenna gains are bonuses, path loss is rent, and miscellaneous losses are the fees. What is left is what the receiver actually gets.

Coverage design

Short form: use Eq 4.1 to decide AP density, antenna type and expected edge performance — then verify with a survey, because real environments deviate from theoretical path-loss models. Read it as margin design, not signal-presence design (this is Eq 1.2 again).

Watch out — device diversity and the asymmetric failureA powerful laptop and a battery-constrained handheld sensor do not have the same radio, antenna or transmit behaviour. Decide which client class is the baseline design target. Networks engineered only around infrastructure transmit power overlook weak client uplinks and create asymmetric failures: the user hears the AP fine but cannot talk back reliably.

Capacity dimensioning

Short form: estimate concurrent users, average demand, peak load and protocol overhead. Capacity is harder than coverage because it depends on behaviour as much as physics.

Metric (Table 4.1)	Why it matters	Typical design use
RSSI / SNR	Indicates link quality	Coverage verification
Concurrency	Captures simultaneous usage	Access point density
Application mix	Differentiates traffic classes	QoS and capacity planning
Retry rate	Reveals contention and interference	Post-deployment tuning

ExampleThe same lecture hall behaves in two totally different ways: quiet note-taking traffic, versus a synchronised video quiz where everyone streams at the same second. Same room, same physics, completely different capacity requirement.

Key ideaAsk how much usable air time remains after control overhead, retries, contention and coexistence losses. That is why capacity can never be read off a marketed PHY rate — converting nominal rates into realistic service assumptions is engineering judgement.

Both equations are live in RF LAB: the link-budget calculator (Eq 4.1 + margin) and the Shannon calculator (Eq 1.1).

mark done

4.3

Channel assignment and validation

CH4 · Design

Plan channels across the whole interference domain — then prove the design with measurements, not faith.

Channel reuse

Short form: assign channels so neighbouring cells do not overlap on the same frequency. The classic 2.4 GHz picture is the three non-overlapping channels 1 · 6 · 11 repeated across the floor plan.

ch 1ch 6ch 11overlap at the edges = roaming room

Interference management

Short form: interference comes from neighbouring cells, non-network emitters, and hidden nodes. Effective designs layer their defences rather than relying on one tool.

Layer	What it does
Channel assignment	Reduces direct co-channel overlap
Power control	Shapes cell boundaries
Antenna placement	Controls where energy goes
Admission / policy	Stops oversubscription collapsing quality under load

Key ideaWireless design is a systems discipline: a change that improves one cell in isolation can harm the deployment by raising contention or cutting reuse elsewhere. Evaluate channel plans across the whole interference domain, never per AP. Dense offices, auditoriums, warehouses and outdoor campuses each have their own interference signature.

Post-deployment validation

Short form: validation = active tests + passive monitoring + roaming assessment + application-specific measurements. It closes the loop between assumptions and reality.

Watch outA design that is mathematically coherent can still fail operationally if traffic peaks, roaming behaviour or environmental noise differ from the planning model. Validation is not an optional final check — it is the empirical stage that confirms the design meets the service objectives.

Strong validation combines infrastructure evidence (signal levels, retry rates, channel occupancy, roaming times) with user-experience evidence (does the application actually work?). And it is iterative: pilot findings feed back into channel plans, AP placement and policy before full rollout.

Worked classroom design

80 students, laptops, web + cloud + periodic video. Predictive survey gives P_t = 17 dBm, G_t = 3 dBi, G_r = 0 dBi, L_p = 76 dB, L_m = 6 dB.

EQ 4.2P_r = 17 + 3 + 0 − 76 − 6 = −62 dBmComfortably above a −67 dBm threshold — the link budget passes.

Example — the punchline−62 dBm looks fine, so is the design done? No. The next question is whether one cell can supply enough usable air time for 80 active users during synchronised class activity. With concurrent streaming bursts, one well-covered cell is not enough: you need a denser design with better spatial reuse. Acceptable link budget does not imply acceptable capacity.

▸ chapter 4 exercises

1 Eq 4.1: how antenna gain and path loss jointly influence coverage radius → gains add dB to the budget, path loss subtracts and grows with distance; the radius is wherever Pr still clears Pmin plus margin.

2 A requirements checklist for a dense classroom WLAN → concurrency, application mix, per-seat signal threshold, roaming bound, security/VLAN policy, resiliency if one AP fails, cabling and PoE class, validation criteria.

3 Why validation is necessary even with predictive models → models miss real materials, crowds, interference and traffic peaks; validation is the empirical stage.

4 Why good signal strength alone is not good design → coverage ≠ capacity ≠ roaming ≠ policy; and weak client uplinks can fail even where the AP is loud.

5 Eq 4.2 interpretation → −62 dBm passes the budget, but 80 synchronised users need more air time than one cell provides, so capacity planning may demand extra cells.

mark done

5.1

The threat landscape

CH5 · Security

Radio does not stop at the wall. Anyone inside propagation range is already standing inside your network's edge.

Key ideaIn wired networks the door and the wall define the boundary. In wireless, propagation range defines it. The four classic threat families are eavesdropping · rogue AP · spoofing · jamming.

Passive threats

Short form: traffic analysis, metadata collection, and interception of weakly protected frames. Hard to detect because the attacker never transmits.

Even when the payload is encrypted, an observer still learns from frame timing, traffic volume, identifiers and roaming patterns. In a hospital, bursts near a ward reveal operational tempo; in a factory, repeating telemetry cycles reveal the process. So metadata deserves protection too.

Watch out — passive feeds activeBy learning network names, channels, client density and authentication methods, an attacker prepares a targeted impersonation or denial-of-service attack later. Treat passive collection as stage one of the intrusion chain: encrypt, but also keep beacons, identifiers and unnecessary management information lean.

Active threats

Short form: deauthentication abuse, replay, impersonation, protocol downgrade, denial of service. The attacker injects, modifies or suppresses communication, so integrity and availability are directly hit.

Attack	What it targets	How it works
Rogue AP / evil twin	Trust establishment	Advertises a familiar SSID; users equate a known name with legitimacy
Deauth / disassoc abuse	Continuity	Forces clients off legitimate APs — to disrupt, or to steer them to the attacker
Jamming / airtime flood	The medium itself	Raises the noise floor or consumes transmission opportunities
Replay	State validation	Re-sends captured frames where freshness control is weak
ARP spoofing	Post-join IPv4 trust	False ARP replies claim the attacker's MAC owns the gateway IP

Think of it likeAn evil twin is someone printing a copy of your café's sign and putting it on the building next door. Customers walk in confidently — the sign looked right. That is why "recognisable SSID = legitimate" is a dangerous instinct.

ARP spoofing — the Ch3 linkWPA2/WPA3 encrypt frames over the radio path, but they do not validate ARP mappings between authorised clients in the same broadcast domain. Defences: client isolation on guest WLANs, smaller broadcast domains, dynamic ARP inspection, DHCP snooping, static bindings for critical infrastructure, and alerting on rapid or inconsistent IP-to-MAC changes.

mark done

5.2

WPS, WEP, WPA2 and WPA3

CH5 · Security

The story of Wi-Fi crypto is one long lesson: a cipher name is not a security architecture.

EQ 5.1Risk = Threat × Vulnerability × ImpactNot a physical law — an analytical model for prioritising controls. Drive any factor toward zero and the residual risk falls.

Key ideaYou usually cannot change the threat (attackers exist). You reduce vulnerability with patching, strong protocols and validation, and you reduce impact with segmentation and least privilege. That is why segmentation is a risk control even though it stops no attack. (Exercise 2.)

WPS — convenience that changes the threat model

Short form: Wi-Fi Protected Setup lets a device join without typing the passphrase. PIN mode uses a short numeric PIN; push-button mode opens a short enrolment window. Both create an alternate path into a network whose passphrase may be strong.

Mode / issue (Table 5.1)	Security concern	Treatment
PIN mode	Small numeric secret; historically weak validation lets attackers confirm parts of the PIN separately	Disable — especially on enterprise and campus networks
Push-button	Temporarily accepts any nearby device during the window	Only with physical oversight; disable when not needed
Credential exposure	Successful enrolment can hand over WLAN access	Treat WPS as an admission path, not a harmless convenience
Enterprise use	No identity, accounting or policy control	Prefer EAP, certificates, MDM profiles, device registration

Watch outPush-button is not "always broken" — the problem is that it temporarily relaxes normal admission expectations. Acceptable in a home where you can see the device; risky in an apartment block, office or classroom.

WEP — the cautionary tale

Short form: RC4 stream cipher + a static shared key + a 24-bit IV sent in the clear + a CRC-32 integrity check. Every one of those four choices failed.

Step	What happens
1	Sender combines the public 24-bit IV with the shared secret key
2	That material feeds RC4, which generates a keystream
3	Plaintext XOR keystream = ciphered message, sent with the IV visible
4	Receiver repeats the same generation with the received IV and shared key, then XORs to recover the plaintext

What an IV actually isAn initialization vector is not a password or a key. It is a per-frame value mixed with the key so repeated encryption does not produce the same keystream. It is sent in the clear on purpose — the receiver needs it. Transmitting an IV is normal and fine. WEP's sin was that its IV was too small (24 bits = 16,777,216 values) and combined with the key badly.

Why that kills itOn a busy WLAN the IV space is revisited, so IVs repeat. Repeated IVs mean the same or related keystream protects different frames — statistical evidence that recovers the key. Tools such as aircrack-ng automate the comparison, and replaying ARP requests forces the AP to generate fresh encrypted frames fast, accelerating collection. Try the IV-collision calculator in RF LAB.

The shared static key problem: the same WEP key sits on the AP and on every client, typed in manually. One lost laptop, one departing employee, one leaked value — and the whole WLAN key must be changed everywhere. Key slots did not give per-user or per-session separation.

And the integrity checkCRC-32 detects accidental bit errors. It is not a cryptographic MAC, so an attacker could modify an encrypted frame in controlled ways and fix up the checksum. WEP offered no real tamper or replay protection.

The real lessonWEP did not fail because the key was short. Longer WEP keys kept every structural flaw: exposed short IV, weak per-packet key construction, static shared credentials, non-cryptographic integrity. That is exactly why the next generation introduced per-session key derivation, replay protection, real message integrity and proper authentication.

WPA2 and AES-CCMP

Short form: WPA2 replaces WEP's structure with AES-CCMP and, crucially, separates the long-term credential from the temporary session keys. Fresh working keys are derived during association, tied to one client, one AP, one session.

Long form of the acronym: Advanced Encryption Standard with Counter Mode and Cipher Block Chaining Message Authentication Code Protocol. AES is the block cipher; counter mode turns it into a keystream for confidentiality; CBC-MAC produces a MIC for integrity.

Function (Table 5.2)	How CCMP provides it	Benefit
Confidentiality	AES counter mode encrypts the payload with keys derived at association	Listeners cannot read protected data
Integrity	CBC-MAC produces a MIC over payload + selected header fields	Tampering is detected
Replay defence	Packet numbers in the nonce, checked by the receiver	Old captured frames are rejected
Per-frame uniqueness	Changing nonce material every frame	No WEP-style IV reuse
Session binding	Temporal keys from the handshake, not the password itself	Compromise stays contained to one association

Not everything is encryptedThe payload is encrypted; selected header fields are authenticated as additional data so addressing and control information cannot be altered silently. The MIC binds payload + header info + nonce + traffic key together.

TKIP was the bridge: it kept RC4-era hardware working and added per-packet key mixing plus a better integrity check than WEP — but it was a transition, not the goal. A WPA2 network should avoid legacy mixed modes, because the WLAN is only as strong as the weakest protection policy permits.

Personal vs Enterprise

Feature (Table 5.4)	WPA2-Personal (PSK)	WPA2-Enterprise
Authentication	One shared passphrase on AP and clients	Per user / device via 802.1X + EAP
Where the PMK comes from	Derived from passphrase + network name	Derived from successful EAP authentication
Scale	Home, small office, simple guest	Campus, enterprise, government
Accountability	Weak — many users, one secret	Sessions tie to identities
Revocation	Change the passphrase everywhere	Disable one account or certificate
Main risk	Weak/shared passphrase → offline guessing	Misconfigured EAP or weak certificate validation

Key ideaThe difference is not the cipher — both can use AES-CCMP. The difference is how the client is authenticated and how the master key is established.

The three roles, and who checks the password

In WPA2-Enterprise the client is the supplicant, the AP is the authenticator, and RADIUS is the authentication server. The AP mostly relays: EAP travels over the air inside EAPOL, and the AP wraps it in RADIUS toward the server. Credentials live in an identity system — a RADIUS user database, LDAP, Active Directory, a certificate authority/PKI, MDM or an MFA service.

Example — what the server actually checksWith EAP-TLS: the certificate chain, expiry, revocation status, subject identity and policy mapping. With PEAP / EAP-TTLS: the client first validates the server certificate and builds a TLS tunnel, and only then are inner credentials checked against a directory. The reusable password is never exposed to the AP — or to an evil twin.

The key never travels to the APAfter EAP succeeds, both sides derive a Master Session Key; the client computes the PMK locally and RADIUS sends AP-side key material in a protected Access-Accept. Your password or private key is never stored on the access point.

▸ long form — deploying a RADIUS-backed WLAN (Table 5.3)

1 · Platform and identity source. FreeRADIUS with a local file or LDAP for a lab; Network Policy Server with Active Directory in a Windows shop; redundant or cloud RADIUS for large institutions. Pitfall: treating RADIUS as separate from the identity lifecycle.

2 · Certificate trust. Install the server certificate, distribute the trusted CA, define the expected server name; add a client-certificate lifecycle if using EAP-TLS. Pitfall: letting clients skip server-certificate validation — that is exactly what an evil twin needs.

3 · Register the network devices. Every AP, controller or gateway must be defined as a RADIUS client by IP/range with a strong shared secret (or RadSec). Open the firewall paths; add redundant servers. Pitfall: weak shared secrets, blocked ports, single-server dependence.

4 · Policy. Which EAP methods are accepted, which identity store is consulted — then what success returns: VLAN, role, ACL, session timeout, accounting. This is where one SSID can serve faculty, students, guests and contractors differently. Pitfall: accepting weak methods or returning overly broad access.

5 · WLAN and supplicants. SSID set to WPA2/WPA3-Enterprise with 802.1X, server addresses and secrets; client profiles specifying SSID, EAP method, trusted root CA, expected server identity. Managed environments push these by MDM rather than asking users to pick security settings. Pitfall: relying on users to choose.

6 · Test and monitor. Pilot group, inspect success and failure logs, confirm certificate validation, check VLAN/role assignment, test roaming, capture EAPOL and RADIUS. Then watch accounting, failure rates, certificate expiry and help-desk tickets. Pitfall: assuming association success proves policy and validation are correct.

The four-way handshake

Short form: before it starts, both sides already hold the PMK (from the passphrase, or from EAP). The handshake proves both sides possess it without sending it, derives a fresh PTK, installs data keys, and delivers the GTK for broadcast/multicast.

Msg	Direction	Contents	Purpose
1	AP → client	ANonce	AP's fresh random contribution
2	Client → AP	SNonce + MIC	Client derives the PTK and proves it knows the right keying material
3	AP → client	GTK + install instruction + MIC	AP verifies the MIC, derives the same PTK, delivers the group key
4	Client → AP	Acknowledgment + MIC	Key installation confirmed; protected data can flow

Why nonces?A nonce is a value meant to be used once. ANonce and SNonce ensure that even when the same PMK is reused, every association derives a different PTK. The PTK is bound to the PMK and both nonces and both MAC addresses — so session keys are never just a reusable copy of the long-term credential.

Term (Table 5.5)	Meaning	Role
Nonce	Fresh single-use value	Stops repeated sessions producing identical keys
ANonce / SNonce	Authenticator / supplicant nonce	Each side's contribution to PTK derivation
MIC	Message integrity code	Proves the sender holds correct key material and nothing was altered
PTK	Pairwise Transient Key	Protects unicast traffic for one client–AP pair
GTK	Group Temporal Key	Protects broadcast and multicast frames
Replay counter	Monotonic counter	Rejects replayed frames and handshake messages

WPA2 is strong, not automaticPersonal: a weak passphrase still falls to offline dictionary guessing once the handshake is captured. Enterprise: strength depends on EAP method choice, certificate validation, server identity checking and credential lifecycle. And both rely on clients and APs implementing key installation and replay handling correctly.

WPA3-Enterprise is not just a cipher upgrade — it is a posture: managed credentials, key establishment hardened against known attack paths, and protected management frames that reduce spoofing and session disruption. A campus laptop can be required to validate the institution's authentication server before credentials are exchanged, and policy can differ by staff/student/contractor after success. Treat WPA3 as part of identity governance, not a checkbox.

mark done

5.3

EAP, EDHOC, PANA and segmentation

CH5 · Security

Who vouches for whom — and how far a compromise is allowed to travel.

EAP — a family, not a protocol

Short form: EAP carries authentication between supplicant, authenticator and authentication server. The AP mostly relays; the identity platform decides. Methods split into two families: certificate-first, and tunnel-first then inner credentials.

Method (Table 5.7)	Credential model	Main strength	Main concern
EAP-TLS	Client and server certificates	Strong mutual authentication; high resistance to credential theft	PKI lifecycle and certificate onboarding
PEAP	Server certificate + protected inner password	Familiar password integration with directories	Depends heavily on server-certificate validation
EAP-TTLS	Server certificate + flexible inner method	Broad compatibility with mixed back ends	Complexity; risk of a weak inner method
EAP-FAST	PAC-based protected tunnel	Less certificate dependence in some deployments	PAC provisioning; weaker assurance if poorly managed

Example — the certificate menu on your phoneWhen you join a campus network with PEAP, the phone asks which CA to trust or whether to validate the server certificate. That does not mean you need a personal client certificate — that would be EAP-TLS. It means the device must validate the server certificate protecting the outer tunnel. Choose "do not validate" and the protection largely evaporates: a rogue AP plus a fake authentication server can then harvest the inner username and password.

Key ideaThe design question is never "which EAP methods exist" but "which method fits this organisation's trust architecture, device-management maturity and threat model." A university with mature PKI and managed laptops → EAP-TLS. A mixed BYOD environment on directory passwords → PEAP/EAP-TTLS while working toward certificates.

PANA security considerations

Short form: PANA carries EAP over IP (Ch 3), so the strength of the decision is the strength of the chosen EAP method. Once a PANA security association exists, protected messages resist modification and replay — but PANA authenticates access signalling; it does not encrypt user traffic or remove denial-of-service risk.

Two soft spots

Discovery and startup happen before session keys exist — attackers can spoof discovery data, force state allocation or burn processing capacity. Needs conservative state allocation, retransmission control, session identifiers, sequence validation and rate monitoring.
The PAA→EP path. If the authentication agent and enforcement point are separate devices, their exchange of identity, authorization state, filters and keys must be authenticated and replay-protected — otherwise an attacker who cannot defeat EAP may forge an authorization update or keep stale access alive. (Exercise 6.)

EDHOC — key exchange for tiny devices

Short form: Ephemeral Diffie-Hellman Over COSE — a compact authenticated key exchange for constrained devices and links (sensors, meters, actuators, LoRaWAN). Three messages, binary CBOR encoding, fresh ephemeral keys every run.

Initiator proposes cryptographic parameters and sends an ephemeral Diffie-Hellman public value.
Responder sends its own ephemeral public value plus authentication evidence.
Initiator completes authentication and key confirmation → shared secret material, often exported to OSCORE so CoAP messages stay protected end-to-end through proxies and gateways.

Why "ephemeral" mattersEach run uses fresh temporary key material, so compromising a long-term credential later does not automatically expose every past session. Credentials can be raw public keys, certificates or pre-shared keys — the choice must match manufacturing, onboarding and replacement processes, not just cryptographic taste.

Think of it likeWPA2/WPA3 is a security guard at the building door. EDHOC + OSCORE is a tamper-proof envelope around the letter itself — it still protects the contents after the letter leaves the building, passes through the mailroom, and crosses town.

MQTT follows the same layeringA Wi-Fi sensor reaches its MQTT broker only after association, IP and routing succeed. WPA2/WPA3 protects the local radio hop — it does not authenticate the broker, authorise topics, or protect messages after they leave the WLAN. Secure MQTT: TLS, validate broker certificates, strong client credentials or certificates, restrict publish/subscribe per topic, rotate on device replacement. Watch for retained messages, anonymous access, wildcard topics and bridge connections that quietly move data between security domains.

Segmentation and policy enforcement

Short form: segmentation limits the blast radius. Authenticated connectivity must not imply unrestricted reachability.

Example — the hospitalClinician tablets, infusion pumps, guest phones and building sensors all use nearby APs. Flat network: compromising one guest phone opens a path toward clinical systems. Segmented: guests get internet-only, medical devices get narrow application segments, facilities sensors get a constrained management network, staff reach clinical services under defined policy. The medium is shared; the trust is not.

Key idea — and the incident argumentToo coarse and critical systems stay exposed; too granular and administration becomes brittle. Beyond blocking normal-time reachability, segmentation gives defenders manoeuvring room during abnormal operation: an isolated compromised camera fleet can be quarantined without taking down unrelated business systems.

mark done

5.4

Monitoring, response and the worked case

CH5 · Security

Raw events matter less than their operational context — and containment should be as narrow as it can be while still working.

Control (Table 5.8)	Primary objective	Example use
WPA3-Enterprise	Confidentiality and access control	Campus WLAN
Network segmentation	Containment	Separating IoT devices
WIDS / WIPS	Detection and prevention	Rogue AP detection
Certificate management	Identity assurance	Enterprise onboarding

Detection

Short form: rogue AP detection, channel anomaly analysis, failed-authentication correlation, traffic-baseline deviation. Combine radio evidence with network telemetry — attacks that look ambiguous from one vantage point become obvious when correlated.

ExampleA suspicious beacon might be a rogue AP, a neighbouring tenant, or a legitimate device misconfigured. Radio fingerprinting alone rarely decides. Confidence comes from matching beacons against wired-port state, controller inventory, certificate-validation failures and switch authentication logs. Likewise a spike in failed authentications may be brute force — or expired credentials, or one broken supplicant.

Baselines before the crisisKnow which channels are normally busy, where crowds gather, what failure rates are normal, and which device classes appear when. Without a baseline, "anomaly detection" is just noise.

WIDS listens for rogue APs, spoofed management frames, odd probe behaviour, devices on prohibited channels. WIPS adds enforcement: classify a device as unauthorised, trigger containment, coordinate across sensors and controllers.

Watch out — policy, not sensor countOver-aggressive prevention disrupts neighbouring networks and trains operators to ignore alerts. Under-tuned monitoring is a noisy event feed. Mature deployments define what counts as rogue / misconfigured / external / authorised, attach a response playbook to each, and confirm that automatic containment is legally and operationally appropriate.

Port mirroring (SPAN) — seeing the wired side

Short form: tell the switch to copy packets from a port, VLAN or subinterface to an analyzer port running Wireshark — without sitting inline with production traffic. Useful for DHCP failures, ARP spoofing, odd DNS, malware callbacks, MQTT traffic, or checking that clients land in the expected VLAN.

Identify the uplink/access port connecting the AP or Wi-Fi router to the wired network.
Decide direction: ingress, egress, or both.
Use a dedicated destination port for the analyzer — not one carrying ordinary traffic.
Capture in a controlled window; record time, source port, SSID/VLAN under test and the client device.
Remove the mirror session afterwards so it stops consuming switch resources and exposing data.

Limitations that catch people out

If the AP tunnels traffic to a controller, the local port shows CAPWAP — not individual client packets. If it bridges locally, you see the client IP traffic directly.
Encrypted payloads stay encrypted: you get metadata, addresses, ports, certificates, timing and negotiation — not content.
Mirroring can oversubscribe the analyzer port if the source carries more than the destination can take.

It is a targeted diagnostic and forensic tool used with authorization and privacy controls — not a permanent replacement for logs, flow telemetry or WIDS/WIPS.

Response

Short form: isolation → credential revocation → forensic capture → service restoration. Written procedures cut confusion because the team already knows which steps preserve evidence, which contain spread, and which restore service.

Containment is a trade-offAs narrow as possible while still effective. A broad shutdown stops the attack fast — and may also cut voice, safety systems or building management that ride the same WLAN.

Then disciplined recovery: preserve controller logs, radio captures, client events and inventory records; re-onboard from trusted state; rotate keys and credentials; validate restored configuration; communicate with affected users.

Certificates are an operational control, not paperworkThey let the network verify servers, users and devices without shared passwords. But the network can only trust them if issuance, renewal, revocation and trust-anchor distribution all work. "A certificate that is never revoked after device loss is not much better than a forgotten password." Lose a tablet from a high-trust segment → revoke one certificate, leave every other device alone. (Exercise 4.)

Worked example — the evil twin on the staff SSID

A department on two floors runs staff, student, guest and lab-instrument SSIDs. Users report intermittent disconnections near the meeting rooms; admins see failed authentications rising in the same area. It could be congestion, a software defect, or an attack.

Radio evidence: sensors confirm repeated deauthentication frames on the affected channels.
Controller logs: staff devices drop from legitimate APs, then try to reassociate with an unknown transmitter advertising a familiar name.
Inventory: switch records show no authorised AP on the expected wired ports → the device is rogue and independently connected.
Conclusion: correlating radio + identity + inventory separates an evil-twin campaign from ordinary interference.
Containment: review credentials from suspicious events, confirm certificate validation is still enforced on managed devices, apply WIPS classification/suppression where policy allows, and physically inspect the floor to remove the hardware.
Blast radius: because guest and lab systems are segmented from staff, exposure stays limited even if some users associated.
Recovery: rotate potentially exposed credentials, reinforce onboarding guidance, re-check neighbouring APs so coverage and roaming remain healthy.

The chapter's closing pointWireless security works when identity protection, segmentation, monitoring and response reinforce each other as one operational model — not as four separate products.

▸ chapter 5 exercises

1 Classify three attacks as passive or active and justify → passive: eavesdropping, traffic analysis (attacker never transmits). Active: deauth abuse, evil twin, ARP spoofing, jamming, replay (attacker injects/modifies/suppresses).

2 Eq 5.1 and segmentation → segmentation does not touch threat; it cuts impact by containing the blast radius, so residual risk falls even though attackers are unchanged.

3 Monitoring plan for rogue APs in a university building → sensors for beacons and spoofed management frames; correlate with wired-port state, controller inventory, certificate-validation failures, switch auth logs; define baselines; classify rogue/misconfigured/external/authorised; attach playbooks; tune to avoid false positives.

4 Why certificate validation and onboarding are architectural → they decide whether an evil twin can harvest credentials, whether revocation actually works, and how much trust the network may place in an endpoint. It is the trust anchor of the whole authentication path, not admin housekeeping.

5 Incident-response outline for a suspected evil twin → detect (deauth + unknown transmitter + inventory mismatch) → contain narrowly (credential review, enforce validation, WIPS classification, physical removal) → preserve evidence → recover (rotate credentials, re-onboard, verify coverage/roaming) → review.

6 Controls when PAA and EP are separate → authenticate and integrity/replay-protect the PAA→EP exchange of identity, authorization state, filters and keys; least-privilege filtering; session expiration; monitoring; plus a PaC–EP security association if the data plane needs cryptographic protection.

mark done

Item	Value
Wi-Fi MAC header (non-QoS, 3 addresses)	24 bytes
+ QoS control / + 4th address / both	26 · 30 · 32 (+4 HT control)
Address field / FCS length	6 bytes each (max 4) · FCS 4 bytes
Frame body	~0–2304 bytes before security / aggregation
Ethernet channel limit	100 m · Cat 5e / 6 / 6A · all 4 pairs
PoE order (weak → strong)	802.3af → 802.3at (PoE+) → 802.3bt (PoE++)
Channel width rule	2.4 → 20 MHz · 5 → 20/40/80 by density · 6 → wide OK
Non-overlapping 2.4 GHz channels	1 · 6 · 11
dB rule	+10 dB = 10× the ratio (20 dB = 100×)
Connection lifecycle	scan → auth → assoc → IP → data
Worked roaming handoff	60+40+20+30 = 150 ms (voice: borderline)
Classroom link budget / worked design	−62 dBm · but 80 users still need more cells
Typical Pmin design threshold	−67 dBm (as used in both worked examples)
WEP IV size / value space	24 bits = 16,777,216 — too small, repeats on busy WLANs
WEP cipher / integrity	RC4 stream cipher · CRC-32 (not a cryptographic MAC)
WPA2 cipher	AES-CCMP (counter mode + CBC-MAC)
Four-way handshake order	ANonce → SNonce+MIC → GTK+MIC → ACK+MIC
Key names	PMK (master) → PTK (unicast, per session) · GTK (broadcast/multicast)
Where the PMK comes from	Personal: passphrase + SSID · Enterprise: successful EAP (via MSK)

	Infrastructure	Ad hoc
Boss	AP / base station	Nobody — equal peers
Scale	Add APs	Messy fast
Security	Central policy	No access control, easy to eavesdrop
Weak spot	Single point of failure	Unmanageable at scale

	Autonomous (FAT)	Controller (FIT)	Cloud
Brain	On each AP	Central controller	Cloud dashboard
Best for	Home / lab	Campus / hospital	Many branches
Risk	Config drift	Controller unreachable	Internet outage

	WEP	WPA2
Cipher	RC4 stream	AES-CCMP (block, counter mode)
Per-frame value	24-bit IV, repeats	Packet number in the nonce
Key model	One static key for everyone	PMK → fresh PTK per session
Integrity	CRC-32 (accidental errors only)	MIC via CBC-MAC
Replay defence	None	Packet-number checking
If one device leaks	Whole WLAN key must change	Contained to one session/account

EAP-TLS	PEAP	EAP-TTLS	EAP-FAST
Client + server certs — strongest	Server cert + inner password	Server cert + flexible inner method	PAC-based tunnel
PKI lifecycle burden	Dies if validation is off	Weak inner method risk	PAC provisioning

Eq	Formula	Meaning	Worked
1.1	C = B·log₂(1+SNR)	Cell capacity	20 MHz @20 dB ≈ 133 Mb/s · @10 dB ≈ 69
1.2	M = Pr − Pmin	Coverage margin	−64 −(−67) = 3 dB · 0 dB = failure line
2.1	η = R / B	Spectral efficiency	600/80 = 7.5 · 800/160 = 5
3.1	Tsetup = Tscan+Tauth+Tassoc+Tip	Time-to-service	60+40+20+30 = 150 ms
4.1	Pr = Pt+Gt+Gr−Lp−Lm	Link budget	17+3+0−76−6 = −62 dBm
5.1	Risk = Threat × Vulnerability × Impact	Control prioritisation	hardening cuts V · segmentation cuts I

Short	Long	What it actually means
AP	Access Point	The central radio everyone connects through
STA	Station	Any client device on the WLAN
SSID	Service Set Identifier	The network name you see and pick
BSS	Basic Service Set	One AP radio plus its associated clients
BSSID	Basic Service Set Identifier	MAC address of that AP radio
ESS	Extended Service Set	Many BSSs sharing one SSID — the basis of roaming
DS	Distribution System	The wired backbone joining APs; source of the To/From DS bits
MAC	Medium Access Control	Layer that decides who transmits (also: hardware address)
PHY	Physical layer	Spectrum, coding, modulation, antennas
FCS	Frame Check Sequence	CRC trailer that catches damaged frames
MSDU / MPDU	MAC Service / Protocol Data Unit	Payload unit / full MAC frame — what aggregation packs together
LLC / SNAP	Logical Link Control / Sub-Network Access Protocol	Encapsulation that says which protocol the payload is
ARP	Address Resolution Protocol	Finds the MAC address for an IPv4 next hop
NDP	Neighbor Discovery Protocol	IPv6's replacement for ARP, over ICMPv6
DHCP	Dynamic Host Configuration Protocol	Hands out IP address, gateway, DNS
VLAN	Virtual LAN	Logical segment; must stay consistent while roaming
CAPWAP	Control And Provisioning of Wireless Access Points	AP ↔ controller protocol: control channel always, data tunnel optionally
RRM	Radio Resource Management	Controller loop that tunes channels, power and load
FAT / FIT AP	Autonomous / lightweight AP	Brain on the AP vs brain on the controller
PoE / PSE / PD	Power over Ethernet / Sourcing Equipment / Powered Device	Power in the data cable / the giver / the receiver
802.3af / at / bt	PoE / PoE+ / PoE++	Increasing power classes for APs
RSSI	Received Signal Strength Indicator	How strong the received signal is, in dBm
SNR	Signal-to-Noise Ratio	Signal loudness compared to background noise
dBm / dBi	decibel-milliwatt / decibel-isotropic	Absolute power / antenna gain — both add and subtract cleanly
MIMO / MU-MIMO	Multiple Input Multiple Output / Multi-User	Multi-antenna streams / serving several devices at once
OFDM / OFDMA	Orthogonal Frequency Division Multiplexing (Multiple Access)	Many subcarriers / splitting them into per-user resource units
QoS	Quality of Service	Priority lanes: voice, video, best-effort, background
DFS	Dynamic Frequency Selection	5 GHz channel change to avoid radar
802.11k / v / r	Neighbor report / network-assisted steering / fast BSS transition	Find neighbours · get suggestions · roam without a full re-login
PMK / OKC	Pairwise Master Key / Opportunistic Key Caching	Reused key material that shortens roaming
WPA2 / WPA3	Wi-Fi Protected Access 2 / 3	Wi-Fi security generations; transition mode bridges them
PSK	Pre-Shared Key	One Wi-Fi password shared by everyone
EAP	Extensible Authentication Protocol	Framework that carries many different login methods
802.1X	Port-Based Network Access Control	Carries EAP over the link — enterprise Wi-Fi login
PANA	Protocol for Carrying Authentication for Network Access	Carries EAP over UDP/IP (RFC 5191)
PaC / PAA / EP	PANA Client / Authentication Agent / Enforcement Point	Who asks / who runs the login / who opens the gate
AAA	Authentication, Authorization, Accounting	The identity back end — RADIUS or Diameter
IEEE	Institute of Electrical and Electronics Engineers	Writes local-network standards (802 family)
IETF	Internet Engineering Task Force	Writes internet protocol standards (RFCs)
ITU	International Telecommunication Union	Coordinates world spectrum and telecom policy
3GPP	3rd Generation Partnership Project	Cellular family: LTE, LTE-A, NB-IoT, LTE-M, 5G NR
NB-IoT / LTE-M	Narrowband IoT / LTE for Machines	Low-power cellular profiles for sensors
LPWAN	Low-Power Wide-Area Network	Unlicensed long-range, low-rate IoT networking
MQTT	Message Queuing Telemetry Transport	Lightweight IoT publish/subscribe — needs working IP first
Wi-Fi 6 / 6E / 7	802.11ax / ax in 6 GHz / 802.11be	Marketing names for the recent amendments
η (eta)	Spectral efficiency	Rate per hertz — R divided by B
Margin (M)	Coverage margin	Received power minus what the application needs
Link budget	Received-power model	Add gains, subtract losses, see what arrives
Sticky client	—	Device that refuses to leave a distant AP
Hidden node	—	Two clients that hear the AP but not each other, so they collide
Gratuitous ARP	—	Announcement: "this IP is now at this MAC"
Proxy ARP	—	Infrastructure answers ARP on a client's behalf to save air time
WEP	Wired Equivalent Privacy	Obsolete: RC4 + static key + 24-bit IV + CRC-32
RC4	Rivest Cipher 4	Stream cipher used by WEP; keystream XORed with plaintext
IV	Initialization Vector	Per-frame value mixed with the key — public, but must be large and unique
XOR	Exclusive OR	The bitwise operation combining plaintext with the keystream
CRC-32	Cyclic Redundancy Check	Error detection only — not tamper resistance
TKIP	Temporal Key Integrity Protocol	The WEP→WPA2 bridge: per-packet key mixing on RC4 hardware
AES	Advanced Encryption Standard	The block cipher underneath CCMP
CCMP	Counter Mode with CBC-MAC Protocol	WPA2 frame protection: confidentiality + integrity + replay defence
MIC	Message Integrity Code	Proves a message was made with the right key and not altered
PMK	Pairwise Master Key	Master key from the passphrase or from EAP; never sent over the air
PTK	Pairwise Transient Key	Per-session unicast key from PMK + both nonces + both MACs
GTK	Group Temporal Key	Shared key for broadcast and multicast frames
MSK	Master Session Key	Key material derived during EAP, from which the PMK comes
ANonce / SNonce	Authenticator / Supplicant nonce	Each side's fresh random contribution to the PTK
Nonce	Number used once	Makes every association derive different keys
WPS	Wi-Fi Protected Setup	PIN or push-button onboarding — an alternate way in; disable it
RADIUS	Remote Authentication Dial-In User Service	The enterprise authentication server that checks credentials
RadSec	RADIUS over TLS	Protected transport instead of a plain shared secret
EAPOL	EAP over LAN	How EAP travels over the wireless link to the AP
EAP-TLS	EAP Transport Layer Security	Certificates on both sides — strongest mainstream choice
PEAP	Protected EAP	Server cert builds a tunnel; password checked inside it
EAP-TTLS	EAP Tunneled TLS	Like PEAP but with more flexible inner methods
EAP-FAST	EAP Flexible Authentication via Secure Tunneling	Tunnel built from a PAC instead of certificates
PAC	Protected Access Credential	The shared credential EAP-FAST provisions to clients
PKI / CA	Public Key Infrastructure / Certificate Authority	Issues, renews and revokes the certificates the network trusts
LDAP / AD	Lightweight Directory Access Protocol / Active Directory	Where user accounts and groups actually live
MDM	Mobile Device Management	Pushes supplicant profiles and trust anchors to devices
MFA	Multi-Factor Authentication	Extra proof beyond a password
EDHOC	Ephemeral Diffie-Hellman Over COSE	Compact authenticated key exchange for constrained IoT devices
COSE / CBOR	CBOR Object Signing and Encryption / Concise Binary Object Representation	Compact binary security objects for small devices
OSCORE	Object Security for Constrained RESTful Environments	Protects CoAP messages end-to-end through proxies
CoAP	Constrained Application Protocol	Lightweight REST-style protocol for IoT
WIDS / WIPS	Wireless Intrusion Detection / Prevention System	Listens for rogue APs and spoofed frames / adds enforcement
SPAN	Switched Port Analyzer (port mirroring)	Copies switch traffic to an analyzer port for capture
DAI	Dynamic ARP Inspection	Switch feature that validates ARP replies against DHCP bindings
Evil twin	—	Rogue AP advertising a familiar SSID to harvest credentials
Blast radius	—	How far a single compromise can spread — what segmentation limits

#	Problem	Style	Effort	Math
1	Compare IEEE, IETF, ITU	Compare 3 things — same shape as your A1	low–med	no
2	Wider channels ≠ better utilisation (η = R/B)	Explain with an equation	medium	light
3	Two trade-offs of backward compatibility	Discuss two trade-offs	low–med	no
4	Why certification alliances still matter	Short argument	low	no
5	Standards choice per campus service	Applied scenario	medium	no

// WIRELESS & BROADBAND COMPUTER NETWORKSFive chapters. One console.

Readiness

The course in one line

Sections

The 6 equations

7-day plan

// COURSE PIPELINEHow the five chapters fit together

Ideas that appear in more than one chapter

Assignment map

If you only remember eight things

// CHAPTER NOTES16 sections, in plain words

Layers, frames, and two ways to run a network

The 5 layers

Frames — the envelopes of networking

The four radio resources (Table 1.1)

Infrastructure vs Ad Hoc

The parts: APs, controllers, cables, roaming

How much can a cell carry?

Names you must know

Three ways to manage APs (Table 1.7)

CAPWAP — how an AP talks to its controller

Roaming

PoE — power through the network cable

Old and new Wi-Fi living together

Controllers and RRM

Coverage: margin, cells and overlap

Cell sizes (Table 1.8)

Roaming domains

Worked design — a three-floor academic building

The rule-makers

Wi-Fi standards and the data frame

The generations (Table 2.1)

The IEEE 802.11 data frame (Table 2.2)

Certification and compatibility

Cellular and IoT standards

The connection lifecycle

Scanning: passive vs active

Association — and the trap right after it

Authentication and access control

PANA — authentication over IP

Enforcement — identity becomes service reality

Mobility and session continuity

Layer 2 mobility

ARP — the small protocol that glues it together

Layer 3 mobility

Worked roaming example — the 150 ms handoff

Requirements engineering

Service objectives

Environmental constraints

Link budget and capacity planning

Coverage design

Capacity dimensioning

Channel assignment and validation

Channel reuse

Interference management

Post-deployment validation

Worked classroom design

The threat landscape

Passive threats

Active threats

WPS, WEP, WPA2 and WPA3

WPS — convenience that changes the threat model

WEP — the cautionary tale

WPA2 and AES-CCMP

Personal vs Enterprise

The three roles, and who checks the password

The four-way handshake

EAP, EDHOC, PANA and segmentation

EAP — a family, not a protocol

PANA security considerations

EDHOC — key exchange for tiny devices

Segmentation and policy enforcement

Monitoring, response and the worked case

Detection

Port mirroring (SPAN) — seeing the wired side

Response

Worked example — the evil twin on the staff SSID

// RF LABThe six equations, live

Link budget + coverage margin

Shannon capacity