CWAP Prep Podcast

Part five of Domain 6 covers Hotspot 2.0 from the phone's side: the questions a phone asks an access point before it joins, and how it gets in afterward.

In this episode, an airport installs access points to carry a mobile carrier's traffic. The carrier's test phones see the network and stay on cellular. Each phone asks the access point a question, gets an answer, and walks away. The question is why a phone would ask and never join.

• What the beacon says about Hotspot 2.0, and what it leaves out
• The questions a phone asks before joining, and the frames that carry them
• Long answers that arrive in pieces
• How a SIM phone decides its carrier's subscribers can sign in here
• The access point's report on its own internet link, and why it is not a speed test
• Why the phone's own rule, not the standard, decides what to do with that report
• Proving the real internet path before calling a report false
• Joining, SIM authentication, and the four-way handshake after the questions
• Ten points to remember

The case is a constructed illustration. This is the last episode of the series, and it completes all six CWAP domains.

Part four of Domain 6 covers radios that send more than one stream at once, and APs that serve more than one client at once.

In this episode, a training room gets new four-stream Wi-Fi 6 APs, sold as built to serve the whole room at once. An acceptance test fails them: "AP limited to two streams. No multi-user transmissions observed." The install is about to be rejected. The question is whether the APs failed, or the test did.

• Radio chains, spatial streams, and users, and why capability is a ceiling
• What a capture adapter must support to decode a transmission
• Explicit beamforming: VHT sounding and HE sounding, the NDP Announcement, the NDP, and the feedback frames
• MU-MIMO and OFDMA: spatial streams versus resource units
• Trigger frames: Common Info, User Info, Basic, MU-RTS, and MU-BAR
• Why multi-user needs traffic queued for several clients
• Reading capability, schedule, capture, and application results as separate evidence
• Ten points to remember

The case is a constructed illustration.

Part three of Domain 6 looks at the air after a client is connected: data frames, acknowledgements, power save, and protection.

In this episode, pickers in a warehouse say every scan hesitates before it beeps. The signal is fine, and the server answers in a few milliseconds. The delay is somewhere between the AP and the scanner.

• Data and QoS Data frames, the ACK, SIFS, and what the Retry bit does and does not prove
• The Duration field and the NAV, and what an RTS reserves
• CTS-to-self, ERP protection on 2.4 GHz, and HT protection
• Block Ack: ADDBA Action frames, A-MPDUs, and the Block Ack bitmap
• Legacy power save: the Power Management bit, the TIM, the DTIM, and PS-Poll
• U-APSD trigger and delivery, and a short look at TWT
• Reading the wire, the air, and the device settings together
• Ten points to remember

The case is a constructed illustration. Next episode: MIMO, beamforming, MU-MIMO, OFDMA, and Trigger frames.

Part two of Domain 6 covers how a client joins a WPA3 network, how an open network can still be encrypted, and what happens when a client moves to another AP.

In this episode, people on a corporate campus take Wi-Fi calls while they walk across a glass skybridge between two buildings. The call never drops, but the audio cuts out for nearly a second on the bridge. Both APs advertise fast roaming. Something still sends the phone the long way.

• SAE: Commit and Confirm, what they carry, and what they do not
• WPA3-Personal, transition mode, and protected management frames
• OWE (Wi-Fi Enhanced Open): encryption without a password, and what it does not prove
• How a client decides to roam, sticky clients, and the Reassociation Request
• Capturing a roam on two channels at once
• PMKSA caching, OKC, and 802.11r Fast BSS Transition, over the air and over the DS
• The Mobility Domain element, and why a matching domain ID is not enough
• Ten points to remember

The case is a constructed illustration. Next episode: Frame Exchanges part three, what happens on the air after a client is connected.

Domain 6 of the CWAP-405 exam is 802.11 frame exchanges. It is the largest domain on the exam, so it takes more than one episode. Part one follows a client as it joins a network.

In this episode, a warehouse picker says their tablet connects for a second, drops, and loops, but IT says the password is right. Discovery works, authentication works, association works. Then the AP keeps asking for the same handshake message.

• Passive and active discovery: Beacons, Probe Requests, and Probe Responses
• SSID versus BSSID
• Open System authentication, and why it checks nothing
• Association Request and Response, the RSN element, and status codes versus reason codes
• The four-way handshake: ANonce, SNonce, the MIC, and how each side derives the PTK
• Why an ACK on message two does not mean the AP accepted it, and what reason 15 means
• Message three, the GTK, and the two-message group key handshake
• How 802.1X/EAP produces the PMK before the same four-way handshake
• Ten points to remember

The case is a constructed lab illustration. Next episode: Frame Exchanges part two, WPA3-Personal, Enhanced Open, and roaming.

Domain 5 of the CWAP-405 exam is WLAN medium access: how a station decides when it is allowed to send, and how QoS changes the odds.

In this episode, a nurse on a hospital ward says her voice badge breaks up when she is listening, but not when she is talking. Same AP, strong signal, and the caller hears her fine. Only one direction of the call is broken.

• Physical and virtual carrier sense: CCA, the NAV, and the Duration field
• SIFS, DIFS, and AIFS, and what the gaps decide
• Backoff, the contention window, and what a missing ACK does and does not prove
• EDCA: four access categories, AIFSN, CWmin, CWmax, and TXOP
• The WMM Parameter element, WMM Power Save, and admission control
• The TID in QoS Control, and why a filter on voice priority can miss the voice
• End-to-end QoS: DSCP on the wire, user priority at the AP, TID on the air
• Ten points to remember

The case is a constructed lab illustration. Next episode: Domain 6, 802.11 Frame Exchanges.

Domain 4 of the CWAP-405 exam is the MAC sublayer: frame types and formats, what a beacon carries, what a client says when it joins, aggregation, and retries.

In this episode, a loading-dock handheld with a strong signal takes all morning to sync while the phone next to it finishes in minutes. The dashboard says Wi-Fi 5 and healthy. The capture says something else.

• Frame Control, the To DS and From DS bits, the three addresses, Retry and FCS
• Beacon fixed fields and elements: rates, basic rates, RSN, HT and VHT
• The Association Request: what the client offers, and the element that is missing
• Why TKIP and high throughput do not mix, and what a saved profile can do to a connection
• A-MPDU, A-MSDU, Block Ack, and why sequence numbers run in separate counts per traffic class
• Ten points to remember

The case is a constructed lab illustration. Next episode: Domain 5, WLAN Medium Access.

Domain 3 of the CWAP-405 exam is PHY Layers and Technologies. It is 10 percent of the exam, and it decides what your capture can and can't show you.

In this episode:

• What every PHY puts at the front of a transmission, from DSSS through EHT: preambles, training fields, and signaling
• Why the legacy fields always go out at 6 Mbps, and what L-SIG spoofing is
• HT, VHT, HE, and EHT formats, MCS and stream counts, aggregation, resource units, and puncturing
• The pseudo-header: what radiotap and PPI carry, where each value comes from, and why the frame itself has no rate field
• What never reaches the capture file: PHY headers, NDPs, and anything your adapter can't decode
• Choosing a capture adapter for the PHY, width, and streams you need to see
• How Domain 3 shows up as exam questions, and the traps
• A lecture hall where the capture says the Wi-Fi 7 tablets aren't using Wi-Fi 7
• Ten points to remember for the exam

Next episode: Domain 4, MAC Sublayer and Functions.

Domain 2 of the CWAP-405 exam is spectrum analysis: seeing the energy a Wi-Fi capture can't decode.

In this episode, nurses' voice badges lose words near the nurses' station, all day and worse at lunch. The ticket says the signal is good. Russell and Juliet carry a spectrum analyzer to the counter to find what the badges hear that nobody has measured.

• Noise floor, signal-to-noise, and why a reading taken somewhere else proves nothing
• Real-time FFT, waterfall, swept spectrogram, density, and historic views
• Duty cycle and utilization, and why numbers from different tools don't subtract
• Access point and sensor spectrum reports, and where they listen from
• Wi-Fi shapes: the rounded hump, the flat top, channel width, and the primary channel
• Turning a center frequency into a channel number
• Microwave ovens, hopping devices, cordless phones, IoT devices, jammers, and video senders
• Finding a source with a directional antenna, and a source-off test to prove it
• Points to remember

The case is a constructed illustration.

Next episode: Domain 3, PHY Layers and Technologies.

Domain 1 of the CWAP-405 exam is protocol analysis: getting a capture you can trust, and reading it.

In this episode, a warehouse's handheld scanners stall for a few seconds at every shift change. The dashboard is green, the contractor's capture shows clean air, and the database is fast. Russell and Juliet work out where the seconds went, starting with why the first capture missed it.

• Defining the problem so a test can prove it wrong, and finding who has it
• Monitor mode, and what one adapter on one channel can and can't record
• Capture filters, display filters, slicing, buffers, triggers, and saving to disk
• Capturing a device that moves: several adapters, channels and widths, and aligned clocks
• Decodes, columns, colors, expert flags, peer maps, and statistics
• Discovery tools, central monitoring, and client experience sensors
• Decryption: what it needs for personal and enterprise networks
• A full login on every roam, and the profile setting that fixed it
• Writing it down, the step people skip most often
• Points to remember

The case is a constructed illustration.

Next episode: Domain 2, Spectrum Analysis. The retries are high, the signal looks good, and the capture can't tell us why.