Skip to content
HackIndex logo

HackIndex

Enumerating AP Capabilities and Clients

4 min read Mar 17, 2026

Enumerating AP capabilities goes beyond identifying that a network exists. You need to know the encryption standard, whether Management Frame Protection is active, what clients are connected, and what data rates the AP supports. This information determines which attacks are viable and which can be ruled out before spending time on them.

Monitor mode must be active. If you have not done that yet, see the monitor mode setup page.

Enumerate All Visible APs

Start with a broad scan to get an overview of the environment:

┌──(kali㉿kali)-[~]
└─$ airodump-ng wlan0mon 
 BSSID              PWR  Beacons  #Data  CH   MB   ENC   CIPHER  AUTH  ESSID

 AA:BB:CC:DD:EE:FF  -42       87     14   6  130   WPA2  CCMP    PSK   TargetNetwork
 11:22:33:44:55:66  -67       43      0  11  195   WPA2  CCMP    MGT   CorpNetwork
 77:88:99:AA:BB:CC  -81       12      0  36  405   WPA3  CCMP    SAE   HomeNet
 FF:EE:DD:CC:BB:AA  -55       31      2   6   54   WEP   WEP     OPN   OldRouter

The AUTH column is the most important for attack planning:

  • PSK — WPA/WPA2 Personal. 4-way handshake capture and offline cracking applies.
  • MGT — WPA/WPA2 Enterprise. RADIUS-based authentication. Requires a rogue AP attack to harvest credentials.
  • SAE — WPA3 Personal. Dragonfly handshake. Resistant to offline dictionary attacks. Transition mode networks may still be vulnerable.
  • OPN — Open or WEP with no authentication. All traffic is readable without credentials.

The MB column shows the maximum link rate. Values of 54 indicate 802.11g. Values of 130-300 indicate 802.11n. Values above 300 indicate 802.11ac or ax.

Enumerate a Specific AP in Detail

Lock to the target BSSID and channel to get a focused view including all associated clients:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 wlan0mon 
 BSSID              PWR  Beacons  #Data  CH   MB   ENC   CIPHER  AUTH  ESSID

 AA:BB:CC:DD:EE:FF  -42      124     41   6  130   WPA2  CCMP    PSK   TargetNetwork

 BSSID              STATION            PWR   Rate    Lost  Frames  Notes  Probes

 AA:BB:CC:DD:EE:FF  CC:DD:EE:FF:AA:BB  -51   54e-54e    0      84
 AA:BB:CC:DD:EE:FF  DD:EE:FF:AA:BB:CC  -68   11e-1e     2      12

The client section shows every station currently associated to the AP. The STATION MAC addresses are the client targets for deauthentication during handshake capture. The Lost column shows lost frame count — a high value indicates a weak client signal. The Rate column shows the transmit and receive rates for that client.

Clients with strong signal (closer to 0 dBm in PWR) are better targets for deauthentication since they are more likely to reassociate quickly and complete a new handshake.

Check for Management Frame Protection

Management Frame Protection (802.11w / MFP) protects deauthentication and disassociation frames. When MFP is required, deauthentication attacks will not force a client to disconnect. airodump-ng does not show MFP status directly. Use iw to check beacon information elements:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -A 20 "AA:BB:CC:DD:EE:FF" 
BSS AA:BB:CC:DD:CC:EE(on wlan0)
	SSID: TargetNetwork
	capability: ESS Privacy
	RSN:	 * Version: 1
		 * Group cipher: CCMP
		 * Pairwise ciphers: CCMP
		 * Authentication suites: PSK
		 * Capabilities: 1-PTKSA-RC 1-GTKSA-RC MFP-capable

Look for the MFP field in the RSN (Robust Security Network) information element:

  • MFP-capable — the AP supports MFP but does not require it. Deauthentication attacks still work against clients that do not negotiate MFP.
  • MFP-required — the AP mandates MFP for all clients. Deauthentication attacks will not work. WPA3 networks always require MFP.

Enumerate Supported Rates and Capabilities

Full capability details including supported rates, HT (802.11n), and VHT (802.11ac) capabilities are visible in the iw scan output:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -A 40 "AA:BB:CC:DD:EE:FF" | grep -E "SSID|freq|signal|HT|VHT|HE|MFP|WPS" 
SSID: TargetNetwork
freq: 5180
signal: -54.00 dBm
HT capabilities:
VHT capabilities:
WPS:

The presence of HE capabilities indicates Wi-Fi 6 (802.11ax). VHT indicates 802.11ac. WPS: in the output confirms WPS is advertised in the beacon — use wash to get the WPS lock status and version.

Identify Unassociated Clients

Clients that are not connected to any AP but are probing for networks appear in the bottom section of airodump-ng with no BSSID entry:

┌──(kali㉿kali)-[~]
└─$ airodump-ng wlan0mon 
 BSSID              STATION            PWR   Rate  Lost  Frames  Notes  Probes

 (not associated)   EE:FF:AA:BB:CC:DD  -61      0     0      23         TargetNetwork,HomeNet

The Probes column shows which SSIDs the unassociated client is actively searching for. This is useful for identifying what networks a device has previously connected to, and for targeting evil twin attacks — the client is already looking for these networks by name.

References