Wireless Client Association Process: Discovery, Authentication, and Association in 802.11 Wi-Fi

Today I am going to be discussing the association process when a client is trying to connect a wireless network. The “association process” typically takes three steps. 

1. Discovery (Finding the wireless network) 
2. Authentication
3. Association 

Network Discovery Phase 1

The first step is the discovery phase. The discovery can either be through active scanning or passive scanning. The type of frames used during discovery are beacon frames, probe requests and probe responses. 

Beacon – A beacon frame are periodic management frames transmitted by an AP to advertise the presence of a wireless network on a specific channel. These frames include important network information about the network’s capability such as the SSID, supported data rates (transmission speeds), channel information, security settings (WPA2, WPA3), timestamps, and other network capabilities. Beacons are typically transmitted by an AP every 100 milliseconds.

Passive Scanning – Beacon frames are used during  “passive scanning,” meaning the wireless device scans through available channels and waits for APs to advertise themselves. The wireless device does not initiate anything hence the word passive. Once the device receives the beacon transmission, the wireless network will appear to the user of the device. 

Active Scanning – Active scanning on the other hand is a more proactive approach on finding available APs and their SSID/capabilities. Instead of waiting for the periodic beacon transmission, the device tunes its radio to a specific channel and sends a probe request to receive an immediate response from APs within its range. The device typically does this across multiple channels to discover every possible option. 

Probe Request/Response – Probe request and response frames are management frames used during the “network discovery” phase when a client is trying to find available wireless networks. As stated before, a probe request is sent by a client device during active scanning. It can either be a broadcast request where its asking “any “ nearby AP within the channel or a directed request when it is targeting only one SSID (Service Set Identifier.) When an AP receives a probe request, it replies with a probe response which provides the same information a beacon frame would, the only difference is that it is sent immediately after the probe request. For a reminder, the information is the SSID, supported data rates, security information, channel information, timestamps and more. 

Authentication Phase 2

Authentication – After a client has successfully received all of the wireless network information, it moves on to the authentication phase. Authentication request and response frames represent the “first formal handshake” (mac frame exchange) between a client device and an AP after the discovery. Not to be confused by the name “authentication,” this is not a typical username and password exchange at least not yet. In modern networks using WPA2 and WPA3, this process uses “open system authentication, “ which is a simple MAC frame exchange between the client and AP without actually validating credentials. The client sends an authentication request to indicate its intent (desire) to join the network, and the AP responds with an authentication response containing a status code indicating whether the client is allowed to move on to the next step or denied from forwarding. If the client was approved, the client moves on to the next step in this process called the “association” phase. 

Association Phase 3

Association – Association request and response frames are management frames used after authentication to formally establish a connection between a client device and an AP. After a successful authentication, the client sends an association request to an AP. The client will now send its own capabilities to the AP instead of the other way around. It will include information such as supported data rates (transmission speeds), security settings (WPA2, WPA3), QOS support, and other wireless parameters. This is important because if there is a speed mismatch or a security setting mismatch, and the AP and device cannot align to the same speed or security the association may not be successful. The information sent by the client enables the AP to decide whether it can support the client and allow it into the network. After the request, the AP sends an association response which indicates whether the association request was accepted or rejected. If accepted, the frame will include an (AID) association ID used to help identify the client within the BSS (Basic Service Set.)