8.2 Scanning, Authentication and Association

Independent OpenExamPrep teaching for CWNA-109 objective 3.5 is the join path: discover a BSS, pass 802.11 Authentication, then associate. Harborline Terminals fails this objective when helpdesk says "the laptop is not authenticated" and means 802.1X, or when someone hides the SSID and calls that a security control. The MAC join is a three-state machine. Enterprise encryption and EAP sit on top of that machine; they do not replace it.

Service-set vocabulary (STA, BSS, SSID, BSSID, ESS) belongs with wireless service sets. Frame types belong with management, control, and data. This section uses those names to teach scanning, 802.11 Authentication, association, BSS selection, and hidden SSIDs.

Passive scanning versus active scanning

A STA that is not yet in a BSS must discover candidate access points. Discovery is scanning. There are two methods.

Passive scanning is a receive-only tour. The STA tunes channel 1, listens, tunes channel 6, listens, and so on through the allowed set. If a Beacon arrives, the STA records BSSID, SSID (if present), capabilities, rates, channel, and RSN. Harborline's overnight inventory scanner can use long passive dwells to save battery and stay off the air. The cost is time: a 100 TU beacon interval means you may wait about a tenth of a second per AP per channel, and you must still dwell long enough to catch the Beacon.

Active scanning sends Probe Request. A wildcard (empty) SSID asks every BSS on that channel to answer. A directed Probe Request includes a specific SSID string and is how a client finds a hidden SSID, or reconnects to a known network quickly. APs that match unicast a Probe Response. Min channel time and max channel time bound how long the STA waits for the first response and then for additional responses. Harborline's laptop lid-open in the warehouse office usually probes so join time is short.

DFS caution: on some 5 GHz radar-shared channels a client must not transmit until it knows an AP is already operating there. In that neighborhood, passive discovery is the legal instinct. 6 GHz discovery often uses out-of-band hints such as a Reduced Neighbor Report (RNR) in 2.4/5 GHz Beacons rather than blindly probing every 6 GHz channel. That is Wi-Fi 6E discovery hygiene, not a third scanning Type bit.

BSS selection at CWNA depth

The standard does not ship a single vendor roam score. At CWNA depth the STA (and later the roam algorithm) compares candidates using:

1. Received signal strength — RSSI or RCPI of Beacon/Probe Response. Harborline's far aisle AP can win on RSSI and still be a bad choice if it is at −70 dBm on a loaded channel.
2. Capabilities — PHY (HT/VHT/HE), channel width, security (RSN AKM and ciphers the client can do), mandatory rates the client can support, spectrum management, PMF required vs optional.
3. Load — the BSS Load (QBSS Load) element, when present, reports station count, channel utilization, and available admission capacity. A closer AP at 80 percent utilization can be a worse pick than a slightly weaker AP at 15 percent.

Harborline's voice handset should not join the yard bridge BSSID just because RSSI is excellent if that BSS lacks the voice access category, the right RSN, or has a station count far above the warehouse APs. SSID match is necessary and not sufficient. Open versus RSN mismatch fails later as a 4-way or 802.1X failure; capability mismatch can fail at association with a status code.

Vendor band-steering and 802.11k neighbor reports refine this picture in design and roaming chapters. For 3.5, be ready to name RSSI, capabilities, and load as the portable selection trio.

Hidden SSIDs: directed probes, not security

An AP can omit the SSID string from Beacons (SSID element length 0). The BSS is still there: timestamp, rates, RSN, and BSSID still air. Harborline tried this on "HL-MGMT" so visitors would not see the name in a Windows list.

What actually happens:

• Beacons continue; they just do not contain the name.
• A STA that already knows the string sends a directed Probe Request with that SSID. The AP can Probe Response, often including the SSID.
• Association Request includes the SSID. A protocol analyzer beside the AP still reads the name.
• Wildcard probes typically do not elicit a named response from a hidden BSS (implementations vary; do not bet a security policy on the variant).

Hiding the SSID is not a security control. It is a weak obscurity setting. It increases directed probing (clients shout known hidden names in every airport), breaks casual guest discovery, and does nothing to WPA2/WPA3. Treat it as a usability choice, then move security to RSN, PMF, and 802.1X in the security chapters.

Connecting to a hidden SSID on Harborline's laptop: configure the SSID manually, enable the hidden/connect-even-if-not-broadcast setting the OS uses, and expect directed probes plus the normal Open System → association → 4-way path. If probes never go out, the BSS will never appear.

802.11 Authentication is not 802.1X

This is the highest-yield wording trap on the join path.

802.11 Authentication is a management-frame exchange that moves a STA from state 1 (unauthenticated, unassociated) to state 2 (authenticated, unassociated). The Authentication algorithm number in those frames is what the MAC is doing.

Open System Authentication (algorithm 0) is two frames: Authentication Request, then Authentication Response with a success status. There is no shared secret at this step. WPA2-Personal, WPA2-Enterprise, and WPA3-Enterprise use Open System Authentication as the 802.11 Authentication algorithm. Confidentiality comes later: the 4-way handshake after association, and for Enterprise the 802.1X/EAP conversation after association (and then the 4-way). Open System is "I am a well-formed 802.11 STA; please mark me authenticated at the MAC." It is not proof of user identity.

Shared Key Authentication (algorithm 1) is deprecated. It is a four-frame WEP challenge: request, challenge text, encrypted challenge response, success or failure. It required WEP. It is weaker than Open System plus modern RSNA because it exposed WEP to the join path. Harborline must not enable Shared Key on a WPA2/WPA3 SSID. If an item pairs Shared Key with WPA2, the item is testing whether you know Shared Key belongs on the WEP junk pile.

IEEE 802.1X is port-based access control with EAP (often to a RADIUS server). On a WPA2-Enterprise or WPA3-Enterprise BSS, 802.1X runs after the STA is associated. The 802.11 Authentication frames did not carry EAP-TLS. Helpdesk saying "802.1X authentication failed" is talking about EAP, not about the two Open System management frames. If Open System failed, the STA never associated and never started EAP.

WPA3-Personal SAE still uses 802.11 Authentication frames (SAE commit/confirm), not 802.1X and not Shared Key. SAE mechanics live with WLAN security. For objective 3.5, keep the contrast: 802.11 Authentication versus 802.1X, and Open System versus deprecated Shared Key.

Association: membership and AID

Association binds the STA to one AP in the ESS for this radio (multi-link operation is outside CWNA-109). The STA sends Association Request. The AP answers Association Response.

Association Request includes capability information, listen interval (how many Beacons the STA may sleep through — it drives AP buffer lifetime), SSID, supported rates, RSN, and HT/VHT/HE capabilities. Association Response includes capability information, status code, AID on success, and the AP's rate/IE set. Valid AIDs are in the range the TIM bitmap can represent; classic teaching uses 1–2007, with AID 0 reserved for group addressed traffic in the TIM story.

Status codes matter in troubleshooting. Success allows Class 3 data. Refusal reasons include rates the AP marked basic that the STA cannot do, spectrum-management required when the STA lacks it, or RSN mismatch. Harborline's old handheld that only speaks TKIP against an AES-only RSN fails association or the 4-way, not "Open System."

Reassociation is the roam variant: Reassociation Request includes the current AP address so the new AP can pull buffered frames through the distribution system. Full roam and fast-secure-roam detail is a later objective. For 3.5, know that first join is Association and AP-to-AP move in an ESS is Reassociation.

Only associated STAs should send ordinary ToDS/FromDS data in the infrastructure BSS. That is why a capture that shows Open System success but no Association Response will show no scanner IP traffic on HL-YARD.

State machine: 1 → 2 → 3, and how you fall off

Classic 802.11 states:

1. Unauthenticated and unassociated. The STA may scan (passive or active) and may complete Class 1 frames. It is not in the BSS for data.
2. Authenticated and unassociated. Open System (or SAE, in the WPA3-Personal story) succeeded. Association has not. Class 2 frames (association) are allowed.
3. Authenticated and associated. The STA has an AID. Class 3 data is allowed. WPA2/WPA3 still need the 4-way (and 802.1X on Enterprise) before protected data is useful, but the 802.11 membership state is already 3.

Disassociation (management) drops the STA from state 3 to state 2: still 802.11-authenticated, no longer a member. Deauthentication (management) drops the STA to state 1 from 2 or 3. Either side may send these notifications. A Harborline AP that ages out a stale AID may deauthenticate. A laptop that leaves the SSID may disassociate, then deauthenticate. A spoofed deauthentication flood also returns victims to state 1 — which is why PMF exists later, not because deauthentication changed Type.

Scan does not by itself change state. A STA can passively scan forever in state 1. Association cannot skip Open System on a WPA2 BSS: you do not jump 1 → 3 without 802.11 Authentication first. Items that claim "WPA2 uses Shared Key because there is a PSK" are wrong: the PSK feeds the 4-way handshake, not Shared Key Authentication.

Harborline walk-throughs

Office laptop, WPA2-Enterprise, visible SSID. Active scan with wildcard and directed probes → choose the warehouse AP with acceptable RSSI, HE capabilities, matching RSN, and lower BSS Load → Open System Authentication (two management frames) → Association Request/Response with AID → EAP to RADIUS → 4-way handshake → QoS Data. If RADIUS rejects the user, the 802.11 state may already be associated; the failure is 802.1X, not Open System.

Yard scanner, DFS 5 GHz, battery mode. Passive scan on the DFS channel until Beacons appear → Open System → Association → WPA2-Personal 4-way. The scanner did not probe during CAC silence because there was no AP to answer yet.

Hidden HL-MGMT. Directed Probe Request containing HL-MGMT → Probe Response → Open System → Association (SSID present in the request) → 4-way. A visitor laptop with no configured SSID never sees the name in the picker. A protocol analyzer still sees it. Harborline should not call that "secure."

Wrong security story. Enabling Shared Key on an old AP "to match WPA2" breaks modern clients. Shared Key is the WEP join. WPA2's 802.11 Authentication is Open System.

Name the step, then the protocol. Scanning finds BSSIDs. 802.11 Authentication marks state 2. Association marks state 3 and issues the AID. 802.1X is Enterprise identity after that. Hidden SSID only changes how probes are addressed, not whether the BSS is discoverable to anyone who already knows the name.