The original 802.11 standard could move data, but it could not legally share 5 GHz with radar, could not prioritize a voice call over a file download, and its WEP encryption was broken within a few years. Three amendments fixed those gaps between 2003 and 2005: 802.11h (spectrum management), 802.11e (quality of service) and 802.11i (robust security). They are now part of the base 802.11 standard, but their names, mechanisms and information elements are still everywhere — in AP configuration, controller logs and packet captures. This post explains each one, what came after it (PMF, WPA3, Enhanced Open), and how to see them in Wireshark.
Wireless fundamentals — read in order, or jump to a topic.
- WLAN Fundamentals: 802.11 standards, architecture and CSMA/CA
- Frequency bands and channels: 2.4, 5 and 6 GHz
- RF power and OFDM: dB math, EIRP, link budgets
- Channel bonding and 802.11 frame types
- Spectrum management, QoS and security (802.11h/e/i, WPA3) (this post)
- Wireless terminology and acronyms (glossary)
| 802.11h | 802.11e | 802.11i | |
|---|---|---|---|
| Year | 2003 | 2005 (WMM certification 2004) | 2004 (WPA2 certification 2004) |
| Problem solved | Coexisting with radar and meeting European power rules in 5 GHz | Prioritizing latency-sensitive traffic | Confidentiality, integrity and authentication |
| Main mechanisms | DFS, TPC, Channel Switch Announcement, Quiet | EDCA access categories, TXOP, Block Ack, U-APSD, TSPEC | RSN, AKMs, 4-way handshake, CCMP |
| Effect on users | APs may change channel; power adapts | Voice and video get earlier access to the air | Authenticated association and encrypted data |
| Status today | Mandatory on DFS channels | WMM universal; TSPEC optional | WPA2 baseline; WPA3 current; mandatory WPA3/OWE on 6 GHz |
They stack rather than replace one another: a voice SSID on a DFS channel with WPA3-Enterprise uses all three at once.
802.11h — Spectrum Management
Why It Exists
Parts of the 5 GHz band are used by radar — military, aviation and weather systems. European regulators would only open those frequencies to Wi-Fi if devices could detect radar and get out of the way, and could limit their own power. 802.11h added those capabilities, and similar rules were then adopted in the US and elsewhere for the UNII-2A and UNII-2C bands. The bands themselves are described in Frequency Bands and Channels.
Dynamic Frequency Selection (DFS)
- Channel Availability Check (CAC) — before using a DFS channel, the AP listens for radar for 60 seconds (10 minutes on the weather-radar channels 120–128 in Europe). It cannot beacon during the check, so an AP that moves to a DFS channel goes quiet for at least a minute.
- In-service monitoring — while operating, the AP continuously watches for radar pulse patterns.
- Channel move — on detection, the AP must cease transmission within 10 seconds, with only about 200 ms of total transmission allowed in that period — enough for a few beacons carrying a Channel Switch Announcement (CSA), which tells clients the new channel and a countdown so they can follow without reconnecting.
- Non-occupancy period — the channel may not be used again for 30 minutes.
- Quiet element — lets an AP schedule silent intervals in which no station transmits, so measurements (including radar detection) are not disturbed.
False positives happen: some APs occasionally mistake other signals for radar. A log full of radar events on one channel at one site is worth investigating before disabling DFS everywhere.
Transmit Power Control (TPC)
- The Country element in beacons lists the regulatory domain, the allowed channels and maximum power.
- The Power Constraint element tells clients how many dB below the regulatory maximum they should transmit in this BSS.
- TPC Request / Report action frames let stations ask each other for their transmit power and link margin.
- Regulations in some regions require TPC (or a 3 dB power reduction) on DFS channels above certain power levels.
Clients that ignore the Power Constraint element are a common cause of power imbalance: the AP is turned down to keep cells small, but the client keeps transmitting at full power and is heard far beyond its cell.
802.11e — Quality of Service
Why It Exists
Under the original DCF access method every frame had equal priority. A voice call needs a 20 ms packet delivered every 20 ms with little jitter; a backup job does not care. With equal access, the voice frames wait behind bulk traffic. 802.11e introduced prioritized access. The Wi-Fi Alliance certifies the commonly implemented subset as Wi-Fi Multimedia (WMM), which every modern AP and client supports — and which is required for 802.11n and later high data rates.
EDCA and Access Categories
Enhanced Distributed Channel Access (EDCA) gives each station four transmit queues, called access categories, each with its own contention parameters. A category with a shorter arbitration interframe space (AIFS) and a smaller contention window statistically wins access more often.
| Access category | 802.1D user priority | AIFSN | CWmin | CWmax | TXOP limit |
|---|---|---|---|---|---|
| AC_VO (voice) | 6, 7 | 2 | 3 | 7 | 2.080 ms |
| AC_VI (video) | 4, 5 | 2 | 7 | 15 | 4.096 ms |
| AC_BE (best effort) | 0, 3 | 3 | 15 | 1023 | 0 (one frame or aggregate) |
| AC_BK (background) | 1, 2 | 7 | 15 | 1023 | 0 |
Default client parameters for OFDM PHYs. APs advertise the parameters in the WMM element of their beacons and use slightly more aggressive values themselves (for example AIFSN 1 for voice and video). AIFS = SIFS + AIFSN × slot time.
- TXOP (transmit opportunity) — once a station wins the medium, it may send a burst of frames for up to the TXOP limit, which makes video and voice more efficient.
- Block Ack — acknowledges many frames at once; later central to the aggregation that makes 802.11n and beyond fast.
- U-APSD (Unscheduled Automatic Power Save Delivery) — a phone in power save sends a frame and immediately receives its buffered downlink frames, saving battery during calls compared with legacy PS-Poll.
- TSPEC and admission control — a client can request airtime for a traffic stream (for example one voice call) and the AP accepts or refuses based on available capacity. If the AP marks a category “admission control mandatory”, clients must obtain admission before using it. Useful for dense voice deployments, but supported by fewer clients.
- HCCA — a centrally scheduled access mode defined in 802.11e, almost never implemented.
Mapping Wired QoS to Wireless QoS
On the wired network, priority travels in the IP header as a DSCP value (and in 802.1Q trunks as an 802.1p CoS value). Over the air it travels as a user priority (0–7) in the QoS Control field of each QoS data frame. The AP translates between them. RFC 8325 gives the recommended mapping:
| Traffic | DSCP | User priority | Access category |
|---|---|---|---|
| Voice (telephony) | EF (46) | 6 | AC_VO |
| Call signalling | CS5 (40) | 5 | AC_VI |
| Interactive video / conferencing | AF41 (34) | 4 (5 in many older vendor defaults) | AC_VI |
| Streaming video | AF31 (26) | 4 | AC_VI |
| Low-latency data | AF21 (18) | 3 | AC_BE |
| Default | CS0 / DF (0) | 0 | AC_BE |
| Bulk data | AF11 (10) | 0 | AC_BE |
| Scavenger / background | CS1 (8) | 1 | AC_BK |
QoS only works if markings survive end to end. The usual failures are a switch port that does not trust DSCP and rewrites it to zero, a tunnel between AP and controller that does not copy the inner DSCP to the outer header, and clients or applications that mark everything as voice. Wi-Fi is usually the narrowest link in the path, so it is where QoS matters most.
802.11i — Robust Security (RSN / WPA2)
Why It Exists
WEP used static keys shared by every user and the RC4 cipher in a way that leaked key material; by 2001 it could be cracked from captured traffic, and later in minutes. The Wi-Fi Alliance shipped WPA (TKIP) in 2003 as a stopgap that could run on WEP hardware. 802.11i, ratified in 2004 and certified as WPA2, defined the lasting architecture: the Robust Security Network (RSN).
The RSN Element: Ciphers and AKMs
APs advertise their security capabilities in the RSN Information Element (element ID 48) of beacons and probe responses; clients state their choice in the association request. The element lists:
- Cipher suites — group and pairwise: CCMP-128 (AES, suite 4) is the WPA2 standard; GCMP-128/256 (suites 8 and 9) are used by WPA3-Enterprise 192-bit and newer PHYs; TKIP (suite 2) is obsolete and prevents high data rates.
- AKM suites (Authentication and Key Management): 1 = 802.1X, 2 = PSK, 3 = FT over 802.1X, 4 = FT-PSK, 8 = SAE, 9 = FT-SAE, 12 = 802.1X Suite B 192-bit, 18 = OWE.
- RSN capabilities — including the bits for Management Frame Protection capable (MFPC) and required (MFPR).
The Key Hierarchy
Authentication and encryption are deliberately separated. Whatever method authenticates the client — 802.1X with a RADIUS server, a pre-shared passphrase, or SAE — its result is a Pairwise Master Key (PMK). The PMK is never used to encrypt traffic directly and never crosses the air. Instead, every association derives fresh keys from it.
The 4-Way Handshake
The handshake uses EAPOL-Key frames. Both sides contribute random numbers (ANonce and SNonce), so each session’s Pairwise Transient Key is unique even when the PMK is reused. The PTK is split into a key-confirmation key (for the integrity codes), a key-encryption key (to protect the delivery of the group key) and the temporal key that actually encrypts unicast data. Message 3 delivers the Group Temporal Key used for broadcast and multicast; later GTK changes (periodically, or when a client leaves) use a shorter two-message group key handshake.
A practical consequence: anyone who captures a WPA2-Personal handshake can try passphrases offline, because the PMK depends only on the passphrase and SSID. Long, random passphrases resist this; WPA3’s SAE removes the attack entirely. In 2017 the KRACK attacks showed that some implementations reinstalled keys when message 3 was replayed; the fix was in client and AP software, not in the protocol design, and patched devices are not affected.
Faster Roaming Within RSN
A full 802.1X exchange on every roam is slow. 802.11i defined PMK caching (return to a previously visited AP without new 802.1X) and pre-authentication; vendors added Opportunistic Key Caching (reuse the PMK on any AP of the same controller or system); and 802.11r Fast BSS Transition (AKMs 3, 4 and 9) standardized a key hierarchy designed for fast roaming.
After 802.11i: PMF, WPA3 and Enhanced Open
Protected Management Frames (802.11w)
802.11i encrypted data but left management frames open, so an attacker could spoof deauthentication or disassociation frames and knock clients off at will. 802.11w (2009) adds integrity protection to these and to “robust” action frames, plus an SA Query procedure so that a client cannot be tricked into dropping a valid association. PMF is capable (used when the client supports it) or required (clients without PMF cannot join). It is mandatory with WPA3 and in 6 GHz, and recommended as “capable” on WPA2 networks.
WPA3
| WPA2 | WPA3 | |
|---|---|---|
| Personal authentication | PSK — passphrase-derived PMK, offline dictionary attacks possible | SAE (Dragonfly) — resists offline attacks, provides forward secrecy |
| Enterprise authentication | 802.1X | 802.1X with PMF required; optional 192-bit mode |
| Management frame protection | Optional | Required |
| Ciphers | CCMP-128 | CCMP-128; 192-bit mode uses GCMP-256, SHA-384 and stronger certificate keys, with EAP-TLS |
| 6 GHz | Not allowed | Required (SAE with hash-to-element) |
Transition modes let WPA2 and WPA3 clients share an SSID during migration, at the cost of keeping WPA2’s weaknesses available to anyone who chooses them; some older clients also misbehave when they see the mixed configuration. Many organizations run WPA3 on a separate SSID or on 6 GHz, and WPA2/WPA3 transition on 2.4/5 GHz.
Enhanced Open (OWE)
Open guest networks send everything in clear text. Opportunistic Wireless Encryption (AKM 18) performs a Diffie-Hellman exchange during association, so every client gets its own encryption keys without a password. It does not authenticate the network (an evil twin can still offer OWE), but it stops passive eavesdropping. An OWE transition mode pairs an open SSID with a hidden OWE SSID for older clients.
Verifying It All in Wireshark
All three amendments leave clear traces in a capture taken with an adapter in monitor mode. (Older Wireshark guides use wlan_mgt.* field names, which newer releases have renamed under wlan.*; filtering on element numbers works across versions.)
802.11h — DFS and TPC
- In a beacon, expand Tagged parameters and look for Country (element 7), Power Constraint (32), TPC Report (35), Channel Switch Announcement (37), Quiet (40) and Extended CSA (60).
- During a radar event, beacons carry a CSA with the new channel and a decreasing switch count; spectrum-management action frames may appear.
# Beacons, then inspect tagged parameters
wlan.fc.type_subtype == 0x0008
# Channel switch announcements (CSA or extended CSA)
wlan.tag.number == 37 || wlan.tag.number == 60
# Power constraint present
wlan.tag.number == 32
# Spectrum-management action frames (category 0)
wlan.fixed.category_code == 0802.11e — QoS and WMM
- Beacons and probe responses carry the WMM parameter element — a vendor-specific element (ID 221) with the OUI 00:50:F2 — listing AIFSN, CWmin, CWmax and TXOP for each access category.
- QoS data frames carry a QoS Control field; its TID is the user priority.
- Block Ack and Block Ack Request control frames show aggregation in action.
# QoS data frames
wlan.fc.type_subtype == 0x0028
# Voice-priority frames (TID 6 or 7)
wlan.qos.tid == 6 || wlan.qos.tid == 7
# Vendor elements from the Microsoft/WFA OUI (includes WMM)
wlan.tag.number == 221 && wlan.tag.oui == 00:50:f2
# Block Ack Request / Block Ack
wlan.fc.type_subtype == 0x0018 || wlan.fc.type_subtype == 0x0019802.11i — RSN, WPA2 and WPA3
- The RSN element (48) in beacons shows ciphers, AKMs and the PMF bits; the association request shows what the client chose.
- EAPOL frames show 802.1X (EAP) and the four handshake messages — check that all four appear, with matching replay counters.
- For WPA3-Personal, the authentication frames use algorithm 3 (SAE) and carry the SAE commit and confirm messages.
# RSN element
wlan.tag.number == 48
# 802.1X and 4-way handshake
eapol
# SAE authentication (WPA3-Personal)
wlan.fixed.auth.alg == 3
# Association requests and responses
wlan.fc.type_subtype <= 0x0003A Fast Workflow
- Filter for a beacon from the AP and confirm the RSN element (ciphers, AKMs, PMF bits), the WMM parameter element, and the Country/Power Constraint elements.
- Check the association request and response: the client and AP should agree on the RSN settings and QoS support.
- Watch the security exchange (
eapol, or SAE authentication frames) and confirm the 4-way handshake completes. - Verify QoS in the data path: QoS data frames with the expected TID, and Block Ack activity.
- On DFS channels, look for CSA elements around the time of any reported disconnects and correlate with AP or controller radar logs.
- When validating DSCP-to-WMM mapping, capture on the air and on the wired side at the same time and compare TID with DSCP/802.1p.
Practical Tips (Aruba and General)
- 802.11h: keep DFS channels enabled unless radar is proven to be frequent at a site; review radar events in AP or controller logs. In Aruba AOS 8, AirMatch on the Mobility Conductor plans channels and power and reacts to radar events (ARM does this in AOS 6 and Instant; Central in AOS 10).
- 802.11e: keep WMM enabled (it is required for high data rates); make sure the wired network trusts DSCP on AP and controller ports; use RFC 8325 mappings; reserve admission control for dedicated voice SSIDs with clients that support it. On Aruba, roles can set DSCP/802.1p and queue voice traffic high (see Aruba Wireless Part 5).
- 802.11i and beyond: use WPA2-Enterprise or WPA3-Enterprise for staff; WPA3-Personal or MPSK instead of shared WPA2 passphrases; Enhanced Open for guests; never TKIP; PMF at least “capable” everywhere and “required” with WPA3.
Exercises
1. Users on one floor report that Wi-Fi “disappears for about a minute” a few times a week. Logs show the AP moving from channel 52 to channel 100 at those times. Explain the minute of silence and suggest a mitigation.
Show answer
Radar was detected on channel 52, so the AP had to leave. Channel 100 is also a DFS channel, so the AP had to perform a 60-second Channel Availability Check before beaconing again — clients lost the network for that minute. Mitigations: prefer moving to a non-DFS channel after radar (many RRM systems do this), exclude the specific channels that see frequent radar at that site, or use background CAC/zero-wait DFS on APs that support it.
2. Calculate AIFS for AC_VO and AC_BK on 5 GHz using the default client parameters.
Show answer
AIFS = SIFS + AIFSN × slot. AC_VO: 16 + 2 × 9 = 34 µs. AC_BK: 16 + 7 × 9 = 79 µs. Voice also backs off from 0–3 slots rather than 0–15, so it typically gains access much sooner.
3. A softphone marks voice packets EF, but captures on the air show its downstream frames with TID 0. Where would you look?
Show answer
Somewhere between the call server and the AP the DSCP is being reset to 0: an untrusted switch port, a WAN or firewall policy that remarks traffic, or an AP-to-controller tunnel that does not preserve DSCP. Capture or check markings hop by hop on the wired side; also verify the AP’s DSCP-to-UP mapping.
4. In the 4-way handshake, which message first proves that the client knows the PMK, and which proves the AP does?
Show answer
Message 2: the client’s MIC can only be correct if it derived the PTK from the right PMK. Message 3: the AP’s MIC proves the same for the AP. Message 4 confirms and both sides install keys.
5. A beacon’s RSN element lists AKM suites 2 and 8, with MFPC = 1 and MFPR = 0. What kind of network is this?
Show answer
A WPA2/WPA3-Personal transition-mode network: AKM 2 is PSK (WPA2) and AKM 8 is SAE (WPA3). PMF is capable but not required, so WPA2 clients without PMF can still join, while WPA3 clients use SAE with PMF.
6. Why does Enhanced Open improve guest networks, and what does it not protect against?
Show answer
OWE gives every client its own encryption keys through a Diffie-Hellman exchange, so other guests cannot passively read its traffic, all without a password. It does not authenticate the network, so an attacker running an evil-twin AP with the same SSID can still lure clients; application-layer encryption (HTTPS, VPN) remains important.
Summary
802.11h lets Wi-Fi share 5 GHz with radar: DFS requires a channel availability check, radar monitoring, a fast move announced by Channel Switch Announcements and a 30-minute non-occupancy period, while TPC and the Power Constraint element keep transmit power within limits. 802.11e, deployed as WMM, prioritizes traffic through four EDCA access categories with different AIFS and contention windows, plus TXOP, Block Ack, U-APSD and optional admission control; DSCP markings must survive end to end and map to user priorities as in RFC 8325. 802.11i built the RSN framework: ciphers and AKMs in the RSN element, a PMK from 802.1X, a passphrase or SAE, and a 4-way handshake that derives fresh PTKs and delivers the GTK. PMF protects management frames, WPA3 adds SAE, mandatory PMF and a 192-bit enterprise mode, Enhanced Open encrypts guest networks, and all of it can be verified in a capture.
See also: the Wireless Terminology and Acronyms glossary for quick definitions of every term used in this series.