# 802.11 Frames and Client Interaction

> Read and manipulate 802.11 management frames to uncover hidden SSIDs and identify personal vs enterprise authentication.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/frames-and-network-interaction
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 1
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

Wireless devices constantly interact through management frames: APs announce themselves with beacons, clients hunt for networks with probe requests, and both sides negotiate through authentication and association exchanges. PEN-210 teaches how to read and manipulate these interactions, because the information they leak (and the fact that most are unauthenticated) is what makes hidden networks discoverable and authentication types identifiable before you attack.

## Probe and Beacon Interaction

An AP can suppress its SSID in beacons, but the name still travels in the clear when a client associates. Watching probe and association frames passively reveals hidden SSIDs over time; forcing a reconnect with a deauthentication frame reveals them immediately. SSID brute forcing and targeted Wireshark/tshark filters round out the ways to uncover a network that is trying to stay quiet.

## Authentication Exchange

Reading the authentication and EAP exchange tells you whether a network uses personal (PSK) or enterprise (per-user EAP) authentication, and which EAP method is in play. airodump-ng output, iw, and a live capture of the EAP handshake distinguish the two and flag mixed personal/enterprise SSIDs, which decides whether you go after a handshake and offline crack or stand up a rogue AP to harvest credentials.

## Study material

- [Hidden SSID Discovery](https://hackindex.io/platforms/wireless/reconnaissance/hidden-ssid-discovery.md) (read, core)
- [Identifying Enterprise vs Personal Authentication](https://hackindex.io/platforms/wireless/enumeration/identifying-enterprise-vs-personal-authentication.md) (read, core)