Field notes / 010
802.1X Explorer Joining a wireless network is a conversation: discovery, an identity check, then a key exchange that neither side ever transmits. Step through that conversation for open, personal, identity-based, and enterprise networks — then break it on purpose and watch where it stops.
Walkthrough Build a config Troubleshoot Practice
Client supplicant Access point authenticator RADIUS auth server Probe request / response 802.11 Authentication Association request / response EAPOL-Start EAP-Request / Identity EAP-Response / Identity Access-Request (EAP-Message) EAP-TLS ServerHello / Certificate TLS key exchange Inner MSCHAPv2 Access-Accept (MS-MPPE keys) EAP-Success EAPOL-Key message 1 (ANonce) EAPOL-Key message 2 (SNonce + MIC) EAPOL-Key message 3 (GTK) EAPOL-Key message 4 (ACK) Encrypted data frames The client asks who is on the channel. The AP answers with its capabilities, including the AKM (802.1X) and cipher it will accept. 01 · client → ap Discovery Probe request / response 02 · client → ap Open system authentication 802.11 Authentication 03 · client → ap Association Association request / response 04 · client → ap The supplicant speaks up EAPOL-Start 05 · ap → client Identity requested EAP-Request / Identity 06 · client → ap Outer identity EAP-Response / Identity 07 · ap → radius Relayed to RADIUS Access-Request (EAP-Message) 08 · radius → client Server proves itself EAP-TLS ServerHello / Certificate 09 · client → radius TLS tunnel authenticating the server only TLS key exchange 10 · client → radius Inner authentication Inner MSCHAPv2 11 · radius → ap Accepted, with keys Access-Accept (MS-MPPE keys) 12 · ap → client EAP success EAP-Success 13 · ap → client 4-way handshake: ANonce EAPOL-Key message 1 (ANonce) 14 · client → ap 4-way handshake: SNonce EAPOL-Key message 2 (SNonce + MIC) 15 · ap → client 4-way handshake: group key EAPOL-Key message 3 (GTK) 16 · client → ap 4-way handshake: keys installed EAPOL-Key message 4 (ACK) 17 · client → ap Authorized Encrypted data frames WPA2-Enterprise (802.1X) Per-user credentials checked by RADIUS. The EAP exchange produces a unique PMK for every session.
Key management 802.1X
RADIUS involved Yes
PMF Optional
Frames in exchange 17 Most common enterprise setup. Safe only if clients are told which CA and server name to trust.
Discovery Probe request / response
The client asks who is on the channel. The AP answers with its capabilities, including the AKM (802.1X) and cipher it will accept.
