Wifi

Wifi

Introduction

Wi-Fi, rumored on corners of the internet to be short for Wireless Fidelity, is a technology that allows devices to connect to a network wirelessly using the IEEE 802.11 standards. It enables laptops, smartphones, IoT devices, and countless other systems to exchange data over radio waves instead of physical cables. Operating primarily in the 2.4 GHz and 5 GHz bands—now extended to 6 GHz with Wi-Fi 6E—Wi-Fi is a cornerstone of modern digital communication, both in homes and in industrial, academic, and military environments.

History and Evolution of Wi-Fi Versions

Since its inception, Wi-Fi has evolved significantly in speed, range, and efficiency. The following table summarizes major iterations:

Wi-Fi Version	IEEE Standard	Year	Max Speed	Key Features
Wi-Fi 1	802.11b	1999	11 Mbps	First widely adopted standard
Wi-Fi 2	802.11a	1999	54 Mbps	Operated in 5 GHz band
Wi-Fi 3	802.11g	2003	54 Mbps	Backward-compatible with 802.11b
Wi-Fi 4	802.11n	2009	600 Mbps	MIMO (Multiple Input, Multiple Output)
Wi-Fi 5	802.11ac	2014	1.3+ Gbps	Beamforming, wider channels
Wi-Fi HaLow	802.11ah	2016	~347 Mbps	Sub-1 GHz, long-range IoT, similar to LoRa
Wi-Fi 6	802.11ax	2019	9.6 Gbps	OFDMA, MU-MIMO, Target Wake Time
Wi-Fi 6E	802.11ax (6 GHz)	2021	9.6 Gbps	Expansion to 6 GHz spectrum
Wi-Fi 7	802.11be	2024-2025	30+ Gbps	Extremely low latency, 320 MHz channels

Enterprise Wi-Fi (WPA2/WPA3-Enterprise, 802.1X)

Most home and café Wi-Fi uses WPA-Personal (WPA-PSK) — one shared password that everybody types in. Workplaces, universities, and other large organizations instead use WPA-Enterprise, built on the IEEE 802.1X standard. There is no shared Wi-Fi password. Instead, each person authenticates with their own credentials (a username and password, and sometimes a certificate), which are checked against a central RADIUS server.

This is the type of network you meet when joining something like a university Wi-Fi (e.g., NYU’s nyu network or the inter-institutional eduroam network). On macOS and Windows it usually “just works” after one prompt, because the OS ships a configuration profile and silently trusts the server certificate. On Linux you have to fill in the same fields by hand — which is why it feels harder. The fields are always the same; you just have to know them.

How it works

802.1X involves three parties:

Role	What it is	Example
Supplicant	Your device (the thing logging in)	Laptop, phone
Authenticator	The access point / switch that gates network access	Wi-Fi AP, controller
Authentication server	The RADIUS server that says yes/no	FreeRADIUS, Microsoft NPS, cloud RADIUS

Authentication runs over EAP (Extensible Authentication Protocol). The supplicant and the RADIUS server negotiate an inner method and exchange credentials inside a TLS tunnel. The access point just relays packets — it never sees your password. The most common EAP methods:

EAP method	Credentials	Notes
PEAP (PEAP-MSCHAPv2)	Username + password	Most common at schools/offices. Password sent inside a server-authenticated TLS tunnel.
EAP-TTLS	Username + password (PAP/MSCHAPv2 inner)	Similar to PEAP; common with FreeRADIUS.
EAP-TLS	Client certificate (no password)	Strongest. No password to phish or reuse; needs per-device certs + onboarding.

The single most important setting: validate the server certificate

The one field people skip on Linux — and the one that actually matters for security — is CA certificate + server/domain name. If your device doesn’t verify the RADIUS server’s certificate, an attacker can stand up a fake AP with the same network name, capture your PEAP/MSCHAPv2 exchange, and crack your organizational password offline. Never select “No CA certificate is required” / “Do not validate”. Always pin the CA and the expected server name.

Advantages

• Per-user credentials. No shared password to leak, post in a group chat, or rotate for everyone when one person leaves. Revoke one account without disrupting anyone else.
• Accountability & policy. RADIUS logs who connected and can push per-user policy: VLAN assignment, bandwidth limits, time-of-day rules, device posture.
• Stronger crypto path. Each session derives unique keying material; there is no single PSK that, once cracked, exposes all traffic.
• Phishing-resistant option. EAP-TLS (certificate-based) removes the password entirely — nothing to steal or reuse.
• Scales cleanly. One identity store (often the same directory used for email/SSO) serves thousands of users and ties into existing accounts.

Disadvantages

• Setup complexity. Requires a RADIUS server, server certificates, and AP/controller configuration — far more than typing a PSK into a home router.
• Client friction. Manual setup on Linux (and misconfigured profiles anywhere) leads to support tickets. The CA-cert/domain step is easy to get wrong.
• Credential-theft risk if mis-set. A client that skips server-cert validation is worse than WPA-Personal, because the credential exposed is the user’s real org password (see warning above).
• IoT/legacy gaps. Many printers, smart-TVs, and IoT devices don’t speak 802.1X — they need a separate PSK SSID or MAC-based onboarding.
• Infrastructure dependency. If RADIUS or the directory is down, nobody can join. It’s a service to monitor and make redundant.

The settings you’ll always need

Whatever the OS, an enterprise Wi-Fi join asks for the same things. Get these from your IT/helpdesk before you start:

Setting	Typical value	Notes
Security	WPA2-Enterprise or WPA3-Enterprise	wpa-eap key management
EAP method	PEAP (or EAP-TTLS, EAP-TLS)	Ask IT which one
Phase 2 / inner auth	MSCHAPv2 (for PEAP)	PAP for some TTLS deployments
Identity / username	Your account name	Some networks want user, others user@domain
Password	Your account password	Or a client certificate for EAP-TLS
CA certificate	The org’s RADIUS root CA	Often a public root already in the OS trust store
Server / domain match	e.g., radius.example.edu	The name the server cert must present
Anonymous / outer identity	usually blank, or anonymous@domain	Hides your real username outside the TLS tunnel

Worked example — university Wi-Fi

A real university (nyu) network looks like this: Security WPA2-Enterprise · EAP PEAP · Phase 2 MSCHAPv2 · Identity your NetID (no @ domain on the internal SSID; NetID@nyu.edu on eduroam) · CA USERTrust RSA Certification Authority (a public root already bundled in every OS) · Domain match rad.nyu.edu. The only “Linux-specific” friction is that you must select that CA file and type the domain by hand — values your IT department publishes.

Setting it up on Linux

Linux exposes every field, which is why it feels harder. The CA certificate for most enterprise networks is a public root already shipped in your distro’s ca-certificates package:

• Debian/Ubuntu: /etc/ssl/certs/ (e.g., /etc/ssl/certs/USERTrust_RSA_Certification_Authority.pem)
• Fedora/RHEL: /etc/pki/tls/certs/ or /etc/ssl/certs/ca-bundle.crt

If your org uses a private internal CA, they’ll give you a .pem/.crt file — save it somewhere stable like /etc/ssl/certs/myorg-ca.pem.

GUI (GNOME/KDE): pick the network, then set:

• Security: WPA & WPA2 Enterprise (or WPA3 Enterprise)
• Authentication: Protected EAP (PEAP)
• Anonymous identity: (blank, unless IT specifies one)
• Domain: the expected server name (e.g., radius.example.edu)
• CA certificate: browse to the CA file above (do not check “No CA certificate is required”)
• PEAP version: Automatic
• Inner authentication: MSCHAPv2
• Username / Password: your credentials

nmcli (fastest, scriptable):

nmcli connection add type wifi con-name myorg ifname '*' ssid 'MyOrgSSID' -- \
  wifi-sec.key-mgmt wpa-eap \
  802-1x.eap peap \
  802-1x.phase2-auth mschapv2 \
  802-1x.identity 'YOUR_USERNAME' \
  802-1x.password 'YOUR_PASSWORD' \
  802-1x.ca-cert /etc/ssl/certs/USERTrust_RSA_Certification_Authority.pem \
  802-1x.domain-suffix-match radius.example.edu

nmcli connection up myorg

Keep the password out of the root-readable connection file by making it agent-owned (prompts via your keyring):

nmcli connection modify myorg 802-1x.password-flags 1   # 1 = agent-owned

For EAP-TLS (certificate login, no password), swap the last lines for your client cert + key:

nmcli connection add type wifi con-name myorg ifname '*' ssid 'MyOrgSSID' -- \
  wifi-sec.key-mgmt wpa-eap 802-1x.eap tls \
  802-1x.identity 'YOUR_USERNAME' \
  802-1x.ca-cert /etc/ssl/certs/myorg-ca.pem \
  802-1x.client-cert /etc/ssl/certs/myorg-client.pem \
  802-1x.private-key /etc/ssl/private/myorg-client.key \
  802-1x.private-key-password 'KEY_PASSPHRASE' \
  802-1x.domain-suffix-match radius.example.edu

Use the onboarding tool if your org offers one

Many institutions publish a eduroam CAT installer or a tool like geteduroam / SecureW2 that auto-configures NetworkManager (or wpa_supplicant) with the correct CA and server name. Use it — it removes the error-prone CA/domain step entirely.

Setting it up on macOS

macOS makes this nearly automatic:

1. Click the Wi-Fi menu → select the enterprise SSID.
2. Enter your username and password at the prompt.
3. A “Verify Certificate” dialog appears showing the RADIUS server’s cert. Confirm the server name matches what IT published (e.g., rad.nyu.edu) before clicking Continue — this is the macOS equivalent of the Linux CA/domain step. You may be asked for your local admin password to trust it.

For managed fleets, IT distributes a .mobileconfig configuration profile (built with Apple Configurator or an MDM like Jamf/Intune) that pre-loads the SSID, EAP type, CA, and server-name pinning — so users get zero prompts. That profile is exactly what makes macOS feel effortless versus Linux.

Setting it up on Windows

1. Settings → Network & Internet → Wi-Fi → select the SSID → Connect.
2. Enter your username and password.
3. Windows shows “Continue connecting?” with the server certificate details — verify the server/thumbprint matches IT guidance, then continue.

If Windows doesn’t auto-detect the right method, configure it manually under Control Panel → Network and Sharing Center → Set up a new connection → Manually connect to a wireless network, then in the connection’s Security tab set authentication to Microsoft: Protected EAP (PEAP), open Settings, tick Verify the server’s identity by validating the certificate, enter the expected server name, and select the org’s Trusted Root CA. Under Configure… for MSCHAPv2, untick “automatically use my Windows logon” unless IT says otherwise. Enterprise fleets push all of this via Group Policy or Intune Wi-Fi profiles.

Deploying enterprise Wi-Fi at your organization

Everything above is the client side — how to join an enterprise network. If you run the network and want to build one (per-user logins instead of one shared password), the moving parts are:

• A RADIUS server that checks credentials (FreeRADIUS, Microsoft NPS, or a built-in/cloud RADIUS like UniFi or JumpCloud).
• A server certificate clients can validate, from a public CA or your own internal CA — its name is what users pin in the “domain match” field.
• Your access points / controller pointed at that RADIUS server, with the SSID set to WPA2/WPA3-Enterprise.
• An onboarding method (config profile, eduroam CAT, MDM) so users never face the raw CA/domain fields and can’t skip cert validation.

➡️ For the hands-on, step-by-step build — FreeRADIUS on OPNsense/pfSense, built-in RADIUS on UniFi, or a standalone FreeRADIUS box, plus AP config, certificates, VLAN assignment, and IoT handling — see Router Hardening → Setting Up WPA-Enterprise (802.1X) on Your Own Network.

Join the federation

Universities and research institutions can join eduroam, a global federation where your home credentials work on any member’s Wi-Fi worldwide. Members run their own RADIUS server and federate it upward — students roam seamlessly between campuses.

Wi-Fi as a Signal Intelligence Vector

While Wi-Fi is best known for its utility, it is also a rich source of wireless signal intelligence. Every Wi-Fi-enabled device emits frames containing identifiers, signal strength, channel usage, and even hints of user behavior. Open-source tools, such as Aircrack-NG and Kismet Wireless, can passively intercept and analyze these emissions.

Aircrack-NG and Wireless Surveying

The Aircrack-NG suite is a powerful collection of open-source tools used for auditing Wi-Fi network security. At the heart of this toolkit is Airodump-NG, a packet capture utility tool that allows users to monitor all nearby wireless traffic while collecting critical metadata such as BSSIDs, ESSIDs, encryption types, and client association data. Airodump-NG can capture WPA2 four-way handshakes when clients connect to access points.

Once a handshake is captured, Aircrack-NG can be used to attempt to recover the pre-shared key (PSK) by executing dictionary-based or brute-force attacks against the encrypted credentials found in the .pcap file. This makes Aircrack-NG a foundational toolset in Wi-Fi penetration testing, especially for assessing the effectiveness of a network’s Wi-Fi security settings an the strength of user-chosen passwords on WPA/WPA2 networks.

Kismet Wireless Overview

Kismet is a robust, open-source wireless network detector, sniffer, and intrusion detection system. It supports most Wi-Fi cards capable of monitor mode and can work in both passive and active scanning modes. Kismet does not transmit packets by default, making it ideal for covert data collection and RF analysis.

Key Features:

• Capture of beacon, probe request, probe response, and data frames

• Real-time detection of new devices and access points

• Logging and replay capabilities in pcap and netxml formats

• Integration with GPS for geolocation of detected networks and clients

• Support for 802.11a/b/g/n/ac/ax, and 802.15/802.11-based SDR sniffing

Capturing WPA2 Four-Way Handshakes

The WPA2-PSK (Wi-Fi Protected Access 2 - Pre-Shared Key) authentication model relies on a four-way handshake exchange between a client and access point. Using Airodump-NG (a tool of the Aircrack-NG suite), passive capture of a 4-way handshake and even the “half handshake” are possible - allowing that network’s PSK to be cracked. Kismet can be configured to passively capture this handshake, a critical step in offline password cracking using tools like hashcat or aircrack-ng.

Steps to Capture a Handshake Using Kismet

Enable monitor mode on a compatible wireless card.

2. Launch Kismet and configure it to use the desired interface and lock to the channel of targeted AP.

3. Wait for a client to connect to the target AP or force a reconnection (with external tools like aireplay-ng).

4. Kismet will automatically log the handshake when the client rejoins.

5. Extract the handshake from the Kismet logs (.pcap format) and analyze it with cracking tools.

Wi-Fi Direction Finding and Target Tracking

Each Wi-Fi device, whether an access point or a client, emits frames containing its MAC address and other metadata. These emissions serve as a unique digital signature, especially when randomized MAC features are disabled or circumvented.

With multiple antennas or mobile setups, Kismet (in conjunction with other tools such as rtlamr, Yagi antennas, or GPS) can be used to:

• Estimate signal strength and triangulate a source’s location

• Correlate devices across time and space using MAC address persistence

• Track specific clients (e.g., mobile phones) through probe requests or known AP responses

This kind of RF telemetry is often employed in:

• Penetration testing and red team operations

• Crowd monitoring and de-anonymization research

• Asset tracking in secure environments

Ethical and Legal Considerations

While tools like Kismet and Aircrack-NG are invaluable for legitimate security research and network diagnostics, unauthorized interception of wireless traffic may violate local or federal laws. Always ensure you have explicit authorization before engaging in wireless surveillance or traffic capture.

Conclusion

Wi-Fi is more than a convenient way to access the internet—it is a constantly emitting RF signature that can be analyzed, mapped, and, under the right circumstances, exploited. Tools like Aircrack-NG and Kismet Wireless democratize access to this data, enabling defenders, researchers, and ethical hackers to better understand the RF landscape, secure networks, and conduct technical reconnaissance in a wireless-first world.

Disclaimer

This wiki page is intended for educational and informational purposes only. All content, including guides, tools, and methodologies discussed herein, is provided with the explicit understanding that it will be used responsibly, ethically, and legally.

Unauthorized access, surveillance, or manipulation of networks, systems, or devices without proper consent is illegal and strictly condemned by the administrators of this wiki. We do not condone or support any activities that violate laws, terms of service, or the privacy of individuals or organizations.

Users are solely responsible for how they apply the knowledge found on this site. Always ensure you have clear permission before engaging in any form of network analysis, penetration testing, or signal monitoring. Use common sense, good judgment, and respect for legal boundaries at all times.

Related

• Router Hardening — Securing home/SOHO routers, WPA3, open-source firmware, and the firewall-plus-AP pattern that can also host a small-office RADIUS server
• Travel Routers — Portable routers for connecting safely on untrusted networks
• VPN Recommendation — Encrypt traffic on top of any Wi-Fi, trusted or not

External Links

• Official Kismet Website

• Kismet GitHub Repository

• Official Aircrack-NG Website

• Wi-Fi Alliance