802.

11 Authentication
and Association

Mohit P. Tahiliani
Assistant Professor,
Dept. of Computer Science and Engineering,
NITK Surathkal
Overview
Wireless medium has its own share of security
concerns because the radio waves cannot be
confined within the premises, unlike the wired
medium whose access can be controlled.

➔ 802.11 Frame Types

➔ Active vs Passive scanning

➔ 802.11 Frame Structures

➔ 3 states of 802.11 connection

➔ Authentication techniques

➔ Association rules and codes

Association happens only in
infrastructure based networks 2
802.11 Frame Types

Management Control Frames Data Frames (e.g.,

Frames (e.g., (e.g., data link actual data
Beacon frame) layer ACK frame) frame)

3
802.11 Authentication and Association
1. Periodic beacons broadcasted by AP
2. Probe request from the STA
3. Probe response from the AP
4. Authentication request from STA to AP
5. Authentication response from AP to STA
6. Association request from STA to AP
7. Association response from AP to STA
8. Data exchange begins

Image Credits: https://www.semfionetworks.com/ 4

Active Scanning
STA initiates the search effort by broadcasting a probe
request

Note
Probe is a special type of
frame.

Probe request is sent on

every channel in the
frequency range.
Passive Scanning
STA does not initiate the search effort, instead waits for a
beacon from the AP

Note
Beacon is a special type
of frame which is
periodically broadcasted
by an AP.

STA listens for the

beacon frame on every
channel in the frequency
range.
Beacon Frame Format

7
Image Credits: CWAP Official Study Guide
Beacon Frame Format
● Frame Control (2 bytes) has three sub-fields
a. Version (2 bits -- typically 0) [1]
b. Type (2 bits -- Management frame in this example - 00) [2]
c. Subtype (4 bits -- 1000 is for beacon) [2]
d. Flags (8 bits) -- details are in [1]
● Sequence Control (2 bytes) has two sub-fields
a. Frame Number (4 bits)
b. Sequence Number (12 bits)

Question 1: Why is Source Address needed in the Beacon frame structure?

[1] http://www.sharetechnote.com/html/WLAN_Beacon.html
[2] https://en.wikipedia.org/wiki/802.11_Frame_Types#Types_and_SubTypes 8
802.11 connection states

S1: Not S2: Authenticated

S3: Authenticated
authenticated but not
and
or yet
associated
associated associated