As we know, Wi-Fi APs can make use of different encryption schemes such as WEP, WPA, and WPA2. How can we detect this without connecting to the AP?

In other words, I want to know that what type of encryption protocol a particular Wi-Fi AP is running?

I have sniffing tools, but I do not know in what frame this information is transmitted by AP.

  • @LPChip Supported security modes are broadcast in the clear in every beacon. No challenge necessary. A fake connection attempt would only be necessary to get deeper details; like if the beacon said 802.1X would be required, you'd need to do a fake connection attempt to find out which EAP methods are supported. But from beacons you can get the list of supported ciphers and whether it's PSK or 802.1X authentication. – Spiff Jan 8 at 22:00

Every Beacon frame contains a list of Information Elements (IEs), which are just TLV records. There are two IEs that may be present and may contain information about which security modes are available on this AP.

The older one is known as the "WPA IE", and is present if original WPA is supported.

The newer one is known as the "RSN IE", and is present if WPA2 is supported, or if any other subset of IEEE 802.11i "Robust Security Networking (RSN)" is supported.

Wireshark can decode both of those IEs for you. Just use Wireshark in 802.11 Monitor Mode to capture management frames, tune your capture radio to the channel your target AP is on, and capture some Beacon frames from that AP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.