AKM SUITE TYPES - Auth Key Management | IEEE 802.11-2020 Table 12-622 rows#
| AKM Suite Name | OUI | Type | Description / Auth Method | WPA Version / Notes |
|---|---|---|---|---|
| Reserved | 00:0F:AC | 0 | Reserved | - |
| 802.1X (Enterprise) | 00:0F:AC | 1 | IEEE 802.1X with EAP. RADIUS/AAA server required. PTK derived from MSK. | WPA / WPA2 / WPA3 Enterprise |
| PSK (WPA2-Personal) | 00:0F:AC | 2 | Pre-Shared Key. PMK = PBKDF2-SHA1(passphrase, SSID, 4096, 256). PMKID extractable - offline attack risk. | WPA2-Personal. Avoid - use SAE (type 8) instead. |
| FT over 802.1X | 00:0F:AC | 3 | Fast BSS Transition with 802.1X (EAP). Requires 802.11r infrastructure. | 802.11r Enterprise roaming |
| FT over PSK | 00:0F:AC | 4 | Fast BSS Transition with PSK. Requires 802.11r infrastructure. | 802.11r Personal roaming |
| 802.1X SHA-256 | 00:0F:AC | 5 | 802.1X with SHA-256 PRF. Required for PMKSA caching with SHA-256. | WPA2 Enterprise with SHA-256 |
| PSK SHA-256 | 00:0F:AC | 6 | PSK with SHA-256 PRF. Stronger than type 2. | WPA2-Personal SHA-256 |
| TDLS | 00:0F:AC | 7 | Tunneled Direct-Link Setup. Peer-to-peer 802.11 links. | TDLS only - not AP-STA |
| SAE (WPA3-Personal) | 00:0F:AC | 8 | Simultaneous Authentication of Equals (Dragonfly DH). Mandatory PMF. No PMKID offline attack. Fresh PMK per session. | WPA3-Personal - RECOMMENDED |
| FT over SAE | 00:0F:AC | 9 | Fast BSS Transition with SAE. 802.11r + WPA3. | WPA3 + 802.11r roaming |
| AP Peer Key | 00:0F:AC | 10 | AP-to-AP authentication | Mesh backhaul |
| Suite B 802.1X SHA-256 | 00:0F:AC | 11 | 802.1X using Suite B, SHA-256 PRF (pairs with GCMP-128). PMKID may appear in RSN IE. | WPA2/WPA3 Suite B (CNSA-aligned) |
| 802.1X SHA-384 (192-bit) | 00:0F:AC | 12 | 802.1X with SHA-384. WPA3-Enterprise 192-bit mode. Requires GCMP-256 encryption. | WPA3-Enterprise 192-bit - CNSA suite |
| FT over 802.1X SHA-384 | 00:0F:AC | 13 | FT + 802.1X SHA-384 | WPA3-Enterprise 192-bit + 802.11r |
| FILS SHA-256 | 00:0F:AC | 14 | FILS (Fast Initial Link Setup) with SHA-256 ERP. | 802.11ai FILS |
| FILS SHA-384 | 00:0F:AC | 15 | FILS with SHA-384 ERP. | 802.11ai FILS |
| FT over FILS SHA-256 | 00:0F:AC | 16 | FILS + FT, SHA-256 | 802.11ai + 802.11r |
| FT over FILS SHA-384 | 00:0F:AC | 17 | FILS + FT, SHA-384 | 802.11ai + 802.11r |
| OWE (Enhanced Open) | 00:0F:AC | 18 | Opportunistic Wireless Encryption. Unauthenticated but encrypted via DH. Mandatory PMF. Replaces open auth. | WPA3 Enhanced Open - use for open/guest networks |
| FT over PSK SHA-384 | 00:0F:AC | 19 | FT + PSK SHA-384 | WPA3 + 802.11r |
| PASN (Pre-Association Security) | 00:0F:AC | 21 | Pre-Association Security Negotiation. Used with 802.11az ranging. | 802.11az secure ranging |
| Vendor Specific | Various | 255 | Vendor-specific AKM. OUI identifies vendor. | Common: Cisco, Microsoft proprietary methods |
CIPHER SUITE TYPES - Pairwise & Group Ciphers | IEEE 802.11-2020 Table 12-415 rows#
| Cipher Suite Name | OUI | Type | Key Length / Algorithm | WPA Version / Recommendation |
|---|---|---|---|---|
| Use Group Cipher | 00:0F:AC | 0 | Use same cipher as group suite | Legacy - only in specific contexts |
| WEP-40 | 00:0F:AC | 1 | RC4, 40-bit key | BROKEN - never use. CVE-2001+ (FMS, KoreK, PTW attacks) |
| TKIP | 00:0F:AC | 2 | RC4 with per-packet key mixing, Michael MIC (8B) | DEPRECATED - WPA1. Michael MIC attack (Beck-Tews 2009). Prohibited in Wi-Fi 6+. |
| Reserved | 00:0F:AC | 3 | Reserved | - |
| CCMP-128 (AES-CCM) | 00:0F:AC | 4 | AES-CCM, 128-bit key, 48-bit PN, 8B MIC | WPA2/WPA3 standard encryption. RECOMMENDED for most deployments. |
| WEP-104 | 00:0F:AC | 5 | RC4, 104-bit key | BROKEN - never use. Same RC4 weaknesses as WEP-40. |
| BIP-CMAC-128 | 00:0F:AC | 6 | AES-CMAC-128 for broadcast mgmt frame protection (PMF) | Group management cipher for 802.11w PMF. Used with CCMP-128 data. |
| Group addressed traffic only | 00:0F:AC | 7 | Group addressed only cipher | Special context |
| GCMP-128 | 00:0F:AC | 8 | AES-GCM, 128-bit key | Stronger than CCMP. Recommended for high-security WPA3 deployments. |
| GCMP-256 | 00:0F:AC | 9 | AES-GCM, 256-bit key | WPA3-Enterprise 192-bit mode. CNSA suite compliant. |
| CCMP-256 | 00:0F:AC | 10 | AES-CCM, 256-bit key | High security CCMP. Less common than GCMP-256. |
| BIP-GMAC-128 | 00:0F:AC | 11 | AES-GMAC-128 for broadcast mgmt | PMF group management cipher. Pairs with GCMP-128. |
| BIP-GMAC-256 | 00:0F:AC | 12 | AES-GMAC-256 for broadcast mgmt | WPA3-Enterprise 192-bit PMF group cipher. Pairs with GCMP-256. |
| BIP-CMAC-256 | 00:0F:AC | 13 | AES-CMAC-256 for broadcast mgmt | High security PMF group cipher. |
| Vendor Specific | Various | 255 | Vendor-defined cipher | Not recommended - breaks interoperability |
WPA SECURITY VERSION EVALUATOR - Score, CVEs, Migration Path8 rows#
| WPA Version | Security Score (0-10) | Cipher Suites | Known CVEs / Attacks | Forward Secrecy | PMF Required | Recommended Migration |
|---|---|---|---|---|---|---|
| WEP (legacy) | 0/10 - BROKEN | RC4-40 / RC4-104 | FMS 2001, KoreK 2004, PTW 2007 (crack in <60s). All variants broken. | No | No | Immediate: migrate to WPA2 minimum. WEP cannot be patched. |
| WPA (TKIP) | 2/10 - DEPRECATED | TKIP (RC4-based) | CVE-2008-2629 (TKIP MIC attack, Beck-Tews), CVE-2010-1196 (QoS exploit). TKIP formally deprecated by IEEE 2012. | No | No | Migrate to WPA2-CCMP. TKIP prohibited in Wi-Fi 4+ certification. |
| WPA2-Personal (PSK) | 6/10 - ACCEPTABLE | CCMP-128 | CVE-2017-13077 to 13088 (KRACK - patched). PMKID offline attack (Steube 2018 - unpatched by design). Dictionary/brute-force risk. | No | Optional | Upgrade to WPA3-SAE. If staying on WPA2: strong passphrase (20+ random chars) + enable PMF. |
| WPA2-Enterprise (802.1X) | 7/10 - GOOD | CCMP-128 | CVE-2017-13077 to 13088 (KRACK - patched). EAP method dependent risks (PEAP MitM if cert not validated). | No (EAP method dependent) | Optional (mandatory for WPA3-Ent) | Enable PMF. Validate CA certificate on all clients. Migrate to EAP-TLS or PEAP with server cert validation. |
| WPA2+PMF (CCMP+802.11w) | 7.5/10 - GOOD | CCMP-128 + BIP-CMAC-128 | KRACK still applies to data (patched). PMF prevents deauth attacks. PMKID offline risk remains for PSK. | No | YES - 802.11w | Strongly recommended: PMF mandatory. Next step: migrate to WPA3. |
| WPA3-Personal (SAE) | 9/10 - RECOMMENDED | CCMP-128 + BIP-CMAC-128 | CVE-2019-9494/9496 (DragonBlood - H2E mandatory to fix). No PMKID offline attack. No dictionary attack. | YES - fresh PMK per session (SAE Dragonfly DH) | YES - mandatory | Ensure H2E enabled (sae_pwe=1 in hostapd). Enable Transition Disable to prevent WPA2 fallback. |
| WPA3-Enterprise (802.1X) | 9.5/10 - BEST PRACTICE | CCMP-128 + BIP-CMAC-128 | EAP method risks remain. TLS 1.3 (RFC 9190) eliminates most TLS vulnerabilities. Certificate validation critical. | YES (with TLS 1.3/PFS cipher suites) | YES - mandatory | Deploy EAP-TLS with client certificates. Use TLS 1.3 (RFC 9190 EAP-TEAP). Validate server certificate on all clients. |
| WPA3-Enterprise 192-bit | 10/10 - MAXIMUM | GCMP-256 + BIP-GMAC-256 | No known practical attacks against GCMP-256 / AES-256. CNSA suite compliant for US government use. | YES | YES - mandatory | For classified/government/healthcare. Requires SHA-384 EAP-TLS. All devices must support GCMP-256. |
BEACON IE TAG NUMBERS - Key IEs for Beacon Inspector Tool22 rows#
| IE Name | Tag Number (decimal) | Tag Number (hex) | Key Fields | Standard |
|---|---|---|---|---|
| SSID | 0 | 0x00 | SSID string (0-32 bytes). Hidden: length=0 or null bytes. | 802.11-1997 |
| Supported Rates | 1 | 0x01 | Up to 8 rates. Bit7=basic rate. Value = rate_500kbps × 2 + bit7. | 802.11-1997 |
| DS Parameter Set | 3 | 0x03 | Current channel number (1 byte). Used by legacy STAs. | 802.11-1997 |
| TIM (Traffic Indication Map) | 5 | 0x05 | DTIM count, DTIM period, bitmap control, partial virtual bitmap. Up to 251B partial virtual bitmap (AIDs 1-2007). | 802.11-1997 |
| Country | 7 | 0x07 | Country code (3 chars) + channel/power triplets per regulatory class. | 802.11d |
| Extended Supported Rates | 50 | 0x32 | Rates 9+ (when >8 rates). Used with tag 1. | 802.11g |
| HT Capabilities | 45 | 0x2D | STBC, 40MHz support, SM power save, HT-delayed BA, LDPC, max AMPDU, MCS set (16 bytes). | 802.11n |
| HT Operation | 61 | 0x3D | Primary channel, STA channel width, RIFS mode, HT protection, basic MCS set. | 802.11n |
| RSN Information Element | 48 | 0x30 | Group cipher, pairwise cipher count+list, AKM count+list, RSN capabilities, PMKID count+list. | 802.11i/WPA2 |
| Extended Capabilities | 127 | 0x7F | Multi-byte bitmap: 20/40 coexist, TDLS, BSS Transition (bit19), TIM Broadcast (bit18), etc. | 802.11n+ |
| VHT Capabilities | 191 | 0xBF | Max MPDU length, channel width, Rx/Tx MCS map (2B each), SU/MU BF caps. | 802.11ac |
| VHT Operation | 192 | 0xC0 | Channel width, channel center seg 0/1, VHT-MCS set. | 802.11ac |
| WMM/WME (Vendor Specific: Microsoft OUI) | 221 | 0xDD | OUI=00:50:F2, type=2. QoS Info, reserved, 4×EDCA param records. | 802.11e/WMM |
| HE Capabilities (Extended Tag) | 255 / ExtID=35 | 0xFF/0x23 | HE MAC caps (6B), HE PHY caps (11B), Tx/Rx MCS map, PPE thresholds. | 802.11ax |
| HE Operation (Extended Tag) | 255 / ExtID=36 | 0xFF/0x24 | HE operation params, BSS Color (6b), VHT op info, 6GHz op info, HE-MCS NSS set. | 802.11ax |
| MU EDCA (Extended Tag) | 255 / ExtID=38 | 0xFF/0x26 | QoS Info + 4×MU EDCA param records (AIFSN, ECWmin/max, MU EDCA timer). | 802.11ax |
| Spatial Reuse (BSS Color) (Extended) | 255 / ExtID=39 | 0xFF/0x27 | Non-SRG OBSS PD Max Offset, SRG OBSS PD Min/Max Offset, BSS Color Bitmap, Partial BSSID Bitmap. | 802.11ax |
| Reduced Neighbor Report (RNR) | 201 | 0xC9 | Neighbor AP info: operating class, channel, TBTT offset, BSSID, Short-SSID. Used for 6GHz discovery. | 802.11ax |
| FILS Indication (Extended Tag) | 255 / ExtID=40 | 0xFF/0x28 | FILS key derivation method, FILS realm identifiers. | 802.11ai/FILS |
| EHT Capabilities (Extended Tag) | 255 / ExtID=108 | 0xFF/0x6C | EHT MAC caps, EHT PHY caps, supported EHT-MCS/NSS set, PPE thresholds. | 802.11be |
| EHT Operation (Extended Tag) | 255 / ExtID=106 | 0xFF/0x6A | EHT operation params, EHT-MCS/NSS set, disabled subchannel bitmap (puncturing). | 802.11be |
| Multi-Link (Extended Tag) | 255 / ExtID=107 | 0xFF/0x6B | Multi-Link element: basic, probe request, reconfiguration, TD-FILS. Contains per-STA profiles. | 802.11be MLO |
ACTION FRAME CATEGORY CODES - Complete list | IEEE 802.11-2020 Table 9-5125 rows#
| Category Code | Category Name | PMF Protected? | Key Action Codes | Used By Tool |
|---|---|---|---|---|
| 0 | Spectrum Management | YES (PMF) | 0=Measurement Req, 1=Meas Resp, 2=TPC Req, 3=TPC Resp, 4=Channel Switch | 802.11h DFS: Channel Switch Announcement |
| 1 | QoS | YES | 0=ADDTS Req, 1=ADDTS Resp, 2=DELTS, 3=Schedule, 4=TS Query, 5=TS Query Resp | WMM/HCCA traffic stream setup |
| 2 | DLS (Direct Link) | No | 0=DLS Req, 1=DLS Resp, 2=DLS Teardown | 802.11e DLS - obsolete |
| 3 | Block Ack | No | 0=ADDBA Req, 1=ADDBA Resp, 2=DELBA - critical for A-MPDU setup | Block Ack Analyzer, 4-Way HS debug |
| 4 | Public (GAS/ANQP) | No | 10=GAS Initial Req, 11=GAS Initial Resp, 12=GAS Comeback Req, 13=GAS Comeback Resp | Passpoint/Hotspot 2.0 network discovery |
| 5 | Radio Measurement (RRM) | YES | 0=Measurement Req, 1=Meas Resp, 4=Link Meas Req, 5=Link Meas Resp, 6=Neighbor Report Req, 7=Neighbor Report Resp | 802.11k RRM - roaming decision support |
| 6 | Fast BSS Transition | YES | 1=FT Auth Request, 2=FT Auth Response, 3=FT Action, 4=FT Ack (over-DS) | 802.11r FT Debugger |
| 7 | HT | No | 0=Notify Channel Width, 1=SM Power Save, 2=PSMP, 3=Set PCO Phase, 4=CSI, 5=Non-Compressed BF, 6=Compressed BF Report, 7=ASEL Index Feedback | 802.11n MIMO/beamforming control |
| 8 | SA Query | YES | 0=SA Query Request, 1=SA Query Response - PMF liveness check | 802.11w PMF SA Query liveness probe |
| 9 | Protected Dual of Public | YES | Same action codes as category 4 but PMF-protected | PMF-protected GAS/ANQP |
| 10 | WNM (Wireless Network Mgmt) | Partial | 0=Event Req, 1=Event Resp, 7=BSS Transition Mgmt Req, 8=BSS TM Resp, 17=TIM Broadcast Req, 27=TFS Req | 802.11v BSS Transition (steering) - Roaming Analyzer |
| 11 | Unprotected WNM | No | 28=Timing Measurement, 29=Timing Meas Resp | 802.11v timing |
| 12 | TDLS | No | 0=Setup Req, 1=Setup Resp, 2=Setup Confirm, 3=Teardown, 11=TDLS Discovery Req | Peer-to-peer TDLS links |
| 13 | Mesh | No | 0=Mesh Link Metric Report, 1=HWMP Path Req (PREQ), 2=Path Reply (PREP), 3=Path Error (PERR), 4=Root Annc (RANN) | 802.11s Mesh HWMP routing |
| 14 | Multihop | No | 0=Proxy Update, 1=Proxy Update Confirmation | 802.11s multihop |
| 15 | Self-Protected | YES | 1=Mesh Peering Open, 2=Mesh Peering Confirm, 3=Mesh Peering Close, 4=Mesh Group Key Inform, 5=Group Key Ack | 802.11s Mesh security |
| 17 | VHT | No | 0=Compressed BF, 1=Group ID Mgmt, 2=Operating Mode Notification - key for MU-MIMO group assignment | 802.11ac VHT MU-MIMO, channel width change |
| 19 | Unprotected S1G | No | HaLow S1G action frames | 802.11ah |
| 20 | S1G | YES | Capacity Indication, FILS Discovery, Probe Response Opt | 802.11ah FILS |
| 21 | Reserved / vendor-protected range | - | FILS Discovery is a Public Action frame (Category 4), broadcast between beacons for 6 GHz discovery. | 6 GHz discovery uses FILS Discovery mgmt frames / RNR |
| 25 | Protected HT | YES | 0=ANQP, 1=Robust AV Streaming | 802.11v AV streaming |
| 26 | Protected Fine Timing Measurement | YES | 0=Fine Timing Meas Req, 1=Fine Timing Meas - sub-ns timing for ranging | 802.11az ranging - FTM Analyzer |
| 30 | HE (High Efficiency) | Partial | 0=EDCA Param Update, 1=ADDBA Ext, 2=PCAP, 3=BSS Color Change Annc, 4=Query Resp Schedule, 5=NDP Feedback Report, 6=TWT Setup, 7=TWT Teardown, 8=BF Report Poll, 9=UL NDP Announcement | 802.11ax - TWT setup/teardown, BSS Color, MU sounding |
| 36 | EHT (Extremely High Throughput) | Partial | 0=EPCS Priority Access Req, 1=EPCS Resp, 2=EHT Multi-Link, 3=EHT TID-to-Link Mapping Req, 4=TID-to-Link Map Resp, 5=Link Reconfig Notif, 6=EMLSR Op Notif | 802.11be MLO - TID-to-link mapping, EMLSR operation |
| 255 | Vendor Specific | No | OUI (3B) + Vendor-specific body | Wi-Fi Alliance (OUI=00:50:F2), Apple, Cisco, etc. |