You then select your desired SSID and if applicable (hopefully it is!) then enter the appropriate password to connect to that SSID.

When you enable Wi-Fi services on a respective device, typically a list of nearby APs is presented. If you choose to test this yourself you will see why! Or you can simply check out the 802.11 frame type Wikipedia page. This is by no means a full in-depth review of all of the different 802.11 frame type packets floating around unbeknownst to us. That said, this blog covers WPA2 Wi-Fi connections and some involved intricacies 802.11 frame type subtypes ( Beacon frames and Probe Requests and Responses) and the IEEE 802.1X authentication process (EAPOL, messages 1 – 4). The main scope of this post is to help you become more familiar with the WPA2 protocol and to recognize its threat landscape. Despite this, I will still mask involved MAC addresses from included images. My lab consists of a wireless access point (AP), a wireless client that is used to connect to the AP, and a third wireless-capable device listening in promiscuous mode – this third device is using Wireshark. This post is based on a testing environment where I own all involved devices. Otherwise, other modes generally only allow your machine to interpret traffic destined for it. Promiscuous mode allows a capable wireless network interface card (WNIC) to listen to all wireless traffic, regardless if the traffic is destined for your client machine or not. I know I am! This should go without saying, be responsible in what you do.

If you’ve never used Wireshark with promiscuous mode enabled, I highly recommend it – if you’re into geeky things that is.

Wireshark filter wildcard