Wireless Networking Standards, Architectures, and Security Protocols

Comprehensive practice flashcards covering IEEE 802 standards, WiFi variants (802.11a/b/g/n/ac), WRAN (802.22), Mininet-WiFi emulation, RC4 FMS attacks on WEP, WPA/WPA2 4-way handshakes, and enterprise 802.1X security.

How does the IEEE 802 family of standards divide the OSI Data Link Layer?

It splits the OSI Data Link Layer into two sub-layers: Logical Link Control (LLC) and Media Access Control (MAC).

What is the purpose and informal name of the IEEE 802.22 standard?

Known informally as "Super Wi-Fi," IEEE 802.22 is a standard for Wireless Regional Area Networks (WRAN) using cognitive radio (CR) techniques in TV White Spaces (TVWS) to bring broadband access to low population density rural areas on a non-interfering basis.

How does centralized spectrum sensing function in an IEEE 802.22 WRAN system?

Each Base Station (BS) is equipped with a GPS receiver to report its position to centralized servers, which respond with data detailing available free TV channels and guard bands in the base station's area.

Based on this network architecture diagram, what communication constraints exist between Access Points, Client nodes, and Ad-Hoc nodes?

An Access Point cannot talk directly to another Access Point, Client (Managed) nodes cannot talk directly to other Client nodes, Ad-Hoc nodes cannot talk to Client nodes or Access Points, and Ad-Hoc nodes can only communicate with other Ad-Hoc nodes within physical range.

What three radio wave propagation phenomena cause signal degradation between a transmitter and a receiver?

Attenuation (signal loss as receiver distance increases), long-term fading (slow signal changes caused by physical obstacles like buildings or trees), and short-term fading (rapid fluctuations caused by reflection, scattering, and diffraction).

Why are channels 1, 6, and 11 the only non-overlapping channels in an 802.11b deployment within the $2.4\,GHz$ band?

The standard allocates $22\,MHz$ of channel bandwidth per channel with a channel spacing of $5\,MHz$; thus, only channels spaced at least $25\,MHz$ apart (such as 1, 6, and 11) operate without overlapping.

Why do 802.11 wireless networks use Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) instead of Collision Detection (CD)?

Wireless radios cannot physically transmit and listen simultaneously to detect packet collisions on the shared radio medium; instead, they sense the channel and use collision avoidance mechanisms such as Request to Send (RTS) and Clear to Send (CTS).

According to this comparative specification table, how do IEEE 802.11n and IEEE 802.11ac differ in MIMO support, spatial flows, PHY rate, and modulation?

IEEE 802.11n supports Single User (SU) MIMO, up to $4$ spatial flows, a maximum PHY rate of $600\,Mbps$, and $64\text{ QAM}$; IEEE 802.11ac supports Multi User (MU) MIMO, up to $8$ spatial flows, a PHY rate of $6.9\,Gbps$, and $256\text{ QAM}$.

In the Mininet-WiFi emulator architecture, which Linux kernel module virtualizes the WiFi network interfaces?

The mac80211_hwsim module virtualizes wireless cards in the Linux kernel space using the SoftMAC mac80211 framework.

What are the two primary algorithmic components of the RC4 stream cipher?

The Key-Scheduling Algorithm (KSA), which initializes and permutes a $256\text{-byte}$ state array $S$, and the Pseudo-Random Generation Algorithm (PRGA), which generates keystream bytes and mutates $S$.

In the Fluhrer, Mantin, Shamir (FMS) attack on WEP, what structural pattern defines a weak Initialization Vector (IV) for attacking key byte index $A$?

The IV must be formatted as $[A + 3, 255, N]$, where $A$ is the index of the target key byte and $N$ is any arbitrary byte value from $0$ to $255$.

What static frame characteristic enables attackers to know the first unencrypted plaintext byte in an FMS attack on WEP?

Most WiFi data frames encapsulate Subnet Access Protocol (SNAP) headers, which consistently begin with the byte 0xAA.

What mathematical "resolved condition" must hold during the FMS attack simulation before recording a key byte guess?

Setting $z = S[1]$, the resolved condition requires that $z + S[z] == A + 3$, after which the guessed key byte is computed as $(keystream\_byte - j - S[i]) \pmod{256}$.

What legacy wireless security protocol uses a 40-bit secret key combined with a 24-bit initialization vector to produce four selectable hex keys?

Wired Equivalent Privacy (WEP), which forms a combined 64-bit key (or 10 hex digits) entered into an access point.

Based on this WPA keying diagram, what is the functional difference between Pairwise keys and Group keys?

Pairwise keys provide unique, separate encryption keys (Key 1, Key 2, Key 3) for unicast traffic between the Access Point and each individual station, whereas a Group Key is shared among all associated stations to encrypt broadcast and multicast traffic.

In WPA2-Personal, what information is used to compute the Pairwise Master Key (PMK)?

The PMK is derived directly from the pre-shared passphrase and the network's Service Set Identifier (SSID).

What message is sent by the Access Point in Message 1 of the WPA2 4-Way Handshake?

The Access Point generates and sends the ANonce (a random $256\text{-bit}$ number) unencrypted to the station inside an EAPOL-Key frame.

What values does a wireless station use to derive the Pairwise Temporal Key (PTK) and Message Integrity Check (MIC) in Message 2 of the WPA2 Handshake?

The station derives the PTK and MIC from the PMK, the AP's ANonce, the station's generated SNonce, and the MAC addresses of both the station and the AP.

How does an attacker execute an offline dictionary attack against a captured WPA2 4-Way Handshake?

Because the ANonce, SNonce, MAC addresses, and MIC are sent in plaintext, the attacker computes candidate PMKs from words in a dictionary, derives the PTK, calculates the candidate MIC, and checks if it matches the captured MIC.

Why does MAC address filtering fail to provide effective security against a determined wireless attacker?

Because MAC addresses are transmitted in the clear in every wireless frame header, allowing an attacker using a packet sniffer to discover authorized MAC addresses and spoof them in software.

Why is hiding the network SSID (closed network mode) ineffective as a security mechanism?

Although beacon transmissions suppress the SSID, the SSID is still broadcast in plaintext during probe requests, probe responses, and association frames between clients and the AP, which passive tools like Kismet easily detect.

What major encryption upgrade distinguishes WPA2 from original WPA?

WPA2 implements the full IEEE 802.11i standard using Advanced Encryption Standard (AES) with CCMP, whereas WPA was an interim protocol relying on the vulnerable Temporal Key Integrity Protocol (TKIP).

In an 802.1X network using tunneled EAP methods, what is the distinction between the outer identity and the inner identity?

The outer identity (e.g., anonymous@domain) is transmitted unencrypted to route the RADIUS authentication request to the user's home realm, while the inner identity (e.g., username@domain and password) is encrypted inside a secure TLS tunnel.

How does the academic wireless federation eduroam enable international roaming across campuses?

It uses a hierarchical infrastructure of national and international RADIUS proxy servers that route 802.1X/EAP authentication requests back to the user's home university RADIUS server without exposing their private credentials to visited networks.

What depth and installation standard is recommended for burying outdoor electrical conduit containing network cables?

Conduit should be buried about $30\,cm$ deep, or below the frost line in cold climates, inside plastic electrical conduit to protect against moisture, vermin, and gardening accidents.

What CA security failure in September 2011 demonstrated the vulnerabilities of relying solely on Public Key Infrastructure (PKI)?

The Dutch Certificate Authority DigiNotar was compromised by crackers who fraudulently issued counterfeit certificates, leading to the revocation of all its trust roots and forcing the company into bankruptcy.

What OpenSSH command creates an encrypted background dynamic SOCKS proxy on local port $8080$ via a remote server?

ssh -fN -D 8080 remote.example.net (where -fN forces SSH to run in the background without executing remote commands, and -D 8080 binds the local dynamic SOCKS proxy port).

Why is Privoxy commonly paired with Tor for anonymous Internet browsing?

Because standard web browsers often send plaintext DNS queries directly to local name servers; Privoxy acts as a local SOCKS4a proxy that forces domain names to be resolved through Tor's encrypted onion network rather than leaking them locally.