# Wireless Networks

> Understand wireless network architecture (infrastructure vs ad-hoc), the AP/station/BSSID/ESSID components, and enumerate and map them.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/wireless-networks
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 1
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

A wireless network is more than an SSID. PEN-210 covers the architecture and components you attack: the access point, the stations (clients), and the identifiers that tie them together, the BSSID (the AP's MAC address), the ESSID (the human-readable network name), and the channel the cell operates on. Networks run in infrastructure mode (clients associate to a central AP forming a BSS, multiple APs sharing an ESSID form an ESS) or ad-hoc mode (peer-to-peer IBSS with no AP). Knowing which components exist and how they relate tells you what to target and how.

## Enumerating APs and Clients

Reading an access point's advertised capabilities (supported rates, cipher suites, WPS state, management frame protection) and mapping which clients are associated to it turns a list of SSIDs into a concrete target picture. Unassociated clients broadcasting probe requests are attack surface in their own right. This is the enumeration that decides which attack path is viable against a given network.

## Visualizing Network Relationships

In a crowded environment, a list of BSSIDs and station MACs is hard to reason about. Graphing the AP-to-client relationships from an airodump-ng capture shows at a glance which clients belong to which network and which devices are probing for networks that are not present, the relationships that seed deauthentication, rogue AP, and KARMA attacks later.

## Study material

- [Enumerating AP Capabilities and Clients](https://hackindex.io/platforms/wireless/enumeration/enumerating-ap-capabilities-and-clients.md) (read, core)
- [Visualising AP and Client Relationships with airgraph-ng](https://hackindex.io/platforms/wireless/post-exploitation/visualising-ap-client-relationships-airgraph-ng.md) (read, core)