Before a single byte of your data moves, a device and an access point exchange a short, fixed conversation. Knowing its order is the fastest way to find out why a client will not connect.
1. DefinitionThe words
- Discovery: finding networks, by listening for beacons (passive scanning) or by sending probe requests (active scanning).
- Authentication: in 802.11 terms a formal first step. Open-system authentication proves nothing; WPA3 uses it to carry the SAE exchange.
- Association: the client joins the access point, which records its capabilities and gives it an association ID.
- Key management: turning a password or an enterprise credential into the keys that encrypt the traffic.
- Roaming: moving from one access point to another without losing the session. Steering is the access point or controller persuading a client to move.
2. PurposeWhat it protects against
Radio signals reach everyone nearby, so the network has to prove that a device is allowed in and keep what it sends private. Without encryption anyone in range can read the traffic and join the network. The handshake gives each client its own key, so one client cannot read another’s traffic.
3. MechanismStep through the connection
Choose the type of network and click through each step. The diagram shows the frames, the card shows what they do, the Wireshark filter to find them and what failure looks like at that point.
| Security | Introduced | Protects with | Notes |
|---|---|---|---|
| WPA | 2003 | TKIP | A stop-gap for older hardware; no longer acceptable |
| WPA2 (IEEE 802.11i) | 2004 | AES-CCMP; four-way handshake | Personal (shared password) or Enterprise (802.1X / EAP) |
| WPA3 | 2018 | SAE for Personal; stronger keys for Enterprise; protected management frames | Required for Wi-Fi 6E and 6 GHz operation, together with Enhanced Open (OWE) for open networks |
4. VisualRoaming and the sticky client
A client walks between two access points. It decides for itself when to roam. Raise the roaming threshold and the client moves earlier; lower it and the client holds on to the first access point long after the second is stronger.
5. MathematicsKeys and thresholds
- Pairwise transient key. Both sides compute PTK = PRF(PMK, ANonce, SNonce, AP address, client address). The master key (PMK) comes from the password (Personal) or from 802.1X (Enterprise). The nonces are random numbers, so each connection gets fresh keys, and the key itself never crosses the air.
- Roaming rule. A typical client roams when its signal drops below a threshold and a candidate is stronger by a margin: here, with the access points 40 m apart and a threshold of -70 dBm, the client holds on to the first access point for about 7 m beyond the halfway point. The model uses free-space loss at 5 GHz with an exponent of 3.
- Beacon interval. The default is 100 time units; one time unit is 1024 µs, so 102.4 ms. A client scanning 13 channels spends at least that long on each channel to hear every beacon, which is why active scans and 802.11k neighbour lists matter.
6. Real-world behaviourFailures and fixes
| Reason code | Meaning | Usual cause |
|---|---|---|
| 1 | Unspecified reason | Anything; look at what happened just before |
| 2 | Previous authentication no longer valid | Client or AP lost its state, often after a restart or a roam |
| 3 | Deauthenticated because the sender is leaving | A client disconnecting normally |
| 4 | Disassociated due to inactivity | The AP’s idle timer expired, often a sleeping device |
| 5 | AP unable to handle all current stations | The AP is full |
| 15 | 4-way handshake timeout | Wrong password, or weak signal during the handshake |
| 16 | Group key handshake timeout | Client stopped answering during a key update |
Reason codes from IEEE Std 802.11-2020, Table 9-49.
- Sticky clients. Raise the minimum rate or signal an access point will accept, enable 802.11k and 802.11v where the clients support them, and avoid power levels so high that a distant access point still looks strong.
- Slow reconnects. A full re-authentication with 802.1X takes much longer than a handover with 802.11r (fast BSS transition), which carries the keys ahead.
- Protected management frames (802.11w) stop spoofed deauthentication frames from forcing a client off; WPA3 and the 6 GHz band require them.
Practical validationProve it in a capture and on a spectrum analyser
Reading about a band is one thing; seeing it in your own evidence is the skill. These checks work with any monitor-mode capture:
- Capture a client joining a network and find each step:
wlan.fc.type_subtype == 0x000b(authentication),0x0000and0x0001(association request and response),eapol(the four-way handshake). - Walk between two access points with a laptop capturing and find the reassociation request (
wlan.fc.type_subtype == 0x0002). Note the signal of the old access point at that moment. - Look for deauthentication (
0x000c) and disassociation (0x000a) frames and read the reason code. - Question to answer: a client repeatedly fails with reason 15 on one SSID only. What is the first thing to check?
Check your understandingQuick quiz
ReferencesSources and further reading
- IEEE Std 802.11-2020 (IEEE Xplore)
- Wi-Fi Alliance: Wi-Fi security
- IETF RFC 3748: Extensible Authentication Protocol (EAP)
- Wireshark display filter reference: IEEE 802.11 (wlan)
Frame subtypes, reason codes (Table 9-49) and the beacon interval come from IEEE Std 802.11-2020. WPA, WPA2 and WPA3 dates and requirements are from the Wi-Fi Alliance. The roaming model is a simplified illustration with stated assumptions, not a model of any particular client.