4

I'm working on a script to tell how secure a wifi connection is. Unfortunately I've become stuck pretty early trying to decode the output of the scan - can anyone help me understand what this is actually telling me?

HT, CC, SECURITY (auth/unicast/group) enter image description here

  • From some quick googles', I suspect HT means High Throughput. My searches on High Throughput seem to be redirecting me to IEEE standards (802.11n/ac) that seem to use it but don't explicitly explain what it is; so I'm lost on what it does and if it affects security

  • uneducated guess, CC = Country Code (I'm from Canada so CA seems to cover that).

  • I understand the WPA2 with AES encryption is what I want to see; but when I do a scan I'm getting cases where the security protocol shows both WPA2 and WPA, or AES and TKIP. Do the routers actually use both?

the screen shot was output from mac terminal command 'airport -s'

Improve this question
2
  • WPA is a subset of WPA2, if WPA2 was missing that means it is using WPA, which is insecure. Yes most routers can use either WPA or WPA2, yours shows it is configured for WPA2.
    – Moab
    Feb 8, 2016 at 0:44
  • So when it shows both, it just means that it could be either without telling us which one it actually is? If that is so, is there some way to find out whether it is using WPA2 or WPA?
    – Alter
    Feb 8, 2016 at 1:56

1 Answer 1

Reset to default
1

HT does mean High Throughput. It basically refers to 802.11n technology, which aimed at increasing the throughput in WiFi networks. This is also the name of two Information Elements present in the beacon frames of a network, both giving information on the settings of the AP. So a "Y" means that the WiFi network is 802.11n-capable. For 802.11ac, we use Very High Throughput (VHT).

CC does also mean country code, which is important for regulatory purposes. It defines all sorts of things, from what channels are allowed to be used, to the maximum emission power.

The fact that there is two security protocols displayed means that the WiFi network is in mixed mode. This is a rather common sight nowadays (although it starts to be coming to an end) because there is still clients that do not support WPA2. Using mixed mode allows the AP to negotiate authentications with both types of security protocols.

Finally, between brackets you can see both the authentication methods and encryption protocols used, for each security protocol.

WPA (PSK/TKIP, AES/TKIP) means that the network uses WPA-PSK (or WPA-Personal as marketing says), with encryption possible in both TKIP and AES, although WPA mostly uses TKIP.

WPA2 (PSK/AES/TKIP) means the same thing except that the security protocol is WPA2-PSK (or -Personal, you get it). Contrary to WPA, WPA2 is encountered to be mostly using AES encryption.

And last but not least, 802.1X means that the network is using RADIUS authentication, which is seen a lot in ISP secure public networks, generally using subscriber-related credentials, like a SIM card for example. Side note: in this case, marketing says WPA-Enterprise.

Improve this answer
2
  • Is there some meaning behind the double appearance of TKIP in the line WPA(802.1x/TKIP/TKIP)? It seems redundant to mention an encryption type twice.
    – Alter
    Sep 22, 2016 at 18:17
  • I'm not familiar with the airport command enough to give a straight answer. I can only suppose that this is related to the way the information is retrieved from the 802.11 beacon frames. Maybe add -xto the options?
    – Doezer
    Sep 22, 2016 at 18:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .