Wireless station not joining a specific SSID

Run Wireshark in monitor mode and filter the traffic sent and received by a wireless station (device under troubleshooting), with applicable filters.

As discussed in previous chapters, locate the field of interest in a given frame, right-click on it, and select Apply as Column to add the field as a column. For example, you can add data rate, strength, and so on, which will be very helpful during troubleshooting.

Consider a scenario where an Apple wireless device just got activated and joining is an SSID. As you see next, the wireless device sends a probe request and gets a probe response from the AP. Filter used: (wlan.fc == 0x4000) or (wlan.fc == 0x5008):

Figure 9.13:  Probe request and response

Please note that the probe request is a broadcast, which is destined to all Fs mac-addresses.

Figure 9.14: Probe response header details: radio, AP, and BSS

As you see here, a valid probe response will have radio/link-layer information such as frequency, channel, SNR, and so on in the 802.11 radio information header, and transmitter and BSS information in the 802.11 probe response header.

The next image shows SSID, supported rates in Mbps, and other capabilities in the 802.11 wireless LAN header. Make sure that all of the information looks valid and compatible to the wireless adapter.

Figure 9.15: Probe response header details: SSID and rates

After getting a response, the wireless client gets associated with a specific SSID serviced by the AP. As shown next, after the probe request and response, the client and AP exchange a few more messages to complete the association process.

Figure 9.16: Wireless client and AP association process

If you look at the 802.11 Wireless LAN header in the final Association Response frame sent by the AP, you should see the Status Code field as Successful. This indicates successful association of the client with the specific AP and SSID.

Figure 9.17: Wireless client and AP association: status code
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
13.58.121.131