# Enumerating AP Capabilities and Clients

> Discover AP capabilities, supported standards, encryption types, and connected clients using passive/active wireless enumeration techniques.

- **URL:** https://hackindex.io/platforms/wireless/enumeration/enumerating-ap-capabilities-and-clients
- **Path:** Wireless > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/wireless/enumeration.md)
- **Published:** 2026-03-17
- **Updated:** 2026-09-15

Enumerating AP capabilities goes beyond identifying that a network exists. You need to know the encryption standard, whether Management Frame Protection is active, what clients are connected, and what data rates the AP supports. This information determines which attacks are viable and which can be ruled out before spending time on them.

Monitor mode must be active. If you have not done that yet, see the monitor mode setup page.

## Enumerate AP Capabilities with airodump-ng

Start with a broad scan to get an overview of the environment:

```bash
airodump-ng wlan0mon
#  BSSID              PWR  Beacons  #Data  CH   MB   ENC   CIPHER  AUTH  ESSID
#
#  AA:BB:CC:DD:EE:FF  -42       87     14   6  130   WPA2  CCMP    PSK   TargetNetwork
#  11:22:33:44:55:66  -67       43      0  11  195   WPA2  CCMP    MGT   CorpNetwork
#  77:88:99:AA:BB:CC  -81       12      0  36  405   WPA3  CCMP    SAE   HomeNet
#  FF:EE:DD:CC:BB:AA  -55       31      2   6   54   WEP   WEP     OPN   OldRouter
```

The **AUTH** column is the most important for attack planning:

- **PSK**: WPA/WPA2 Personal. 4-way handshake capture and offline cracking applies.
- **MGT**: WPA/WPA2 Enterprise. RADIUS-based authentication. Requires a rogue AP attack to harvest credentials.
- **SAE**: WPA3 Personal. Dragonfly handshake. Resistant to offline dictionary attacks. Transition mode networks may still be vulnerable.
- **OPN**: Open or WEP with no authentication. All traffic is readable without credentials.

The **MB** column shows the maximum link rate. Values of 54 indicate 802.11g. Values of 130-300 indicate 802.11n. Values above 300 indicate 802.11ac or ax.

## Enumerate a Specific AP in Detail

Lock to the target BSSID and channel to get a focused view including all associated clients:

```bash
airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 wlan0mon
#  BSSID              PWR  Beacons  #Data  CH   MB   ENC   CIPHER  AUTH  ESSID
#
#  AA:BB:CC:DD:EE:FF  -42      124     41   6  130   WPA2  CCMP    PSK   TargetNetwork
#
#  BSSID              STATION            PWR   Rate    Lost  Frames  Notes  Probes
#
#  AA:BB:CC:DD:EE:FF  CC:DD:EE:FF:AA:BB  -51   54e-54e    0      84
#  AA:BB:CC:DD:EE:FF  DD:EE:FF:AA:BB:CC  -68   11e-1e     2      12
```

The client section shows every station currently associated to the AP. The **STATION** MAC addresses are the client targets for deauthentication during handshake capture. The **Lost** column shows lost frame count: a high value indicates a weak client signal. The **Rate** column shows the transmit and receive rates for that client.

Clients with strong signal (closer to 0 dBm in PWR) are better targets for deauthentication since they are more likely to reassociate quickly and complete a new handshake.

## Check for Management Frame Protection

Management Frame Protection (802.11w / MFP) protects deauthentication and disassociation frames. When MFP is required, deauthentication attacks will not force a client to disconnect. airodump-ng does not show MFP status directly. Use iw to check beacon information elements:

```bash
iw dev wlan0 scan | grep -A 20 "AA:BB:CC:DD:EE:FF"
# BSS AA:BB:CC:DD:EE:FF(on wlan0)
# 	SSID: TargetNetwork
# 	capability: ESS Privacy
# 	RSN:	 * Version: 1
# 		 * Group cipher: CCMP
# 		 * Pairwise ciphers: CCMP
# 		 * Authentication suites: PSK
# 		 * Capabilities: 1-PTKSA-RC 1-GTKSA-RC MFP-capable
```

Look for the MFP field in the RSN (Robust Security Network) information element:

- **MFP-capable**: the AP supports MFP but does not require it. Deauthentication attacks still work against clients that do not negotiate MFP.
- **MFP-required**: the AP mandates MFP for all clients. Deauthentication attacks will not work. WPA3 networks always require MFP.

## Enumerate Supported Rates and Capabilities

Full capability details including supported rates, HT (802.11n), and VHT (802.11ac) capabilities are visible in the iw scan output:

```bash
iw dev wlan0 scan | grep -A 40 "AA:BB:CC:DD:EE:FF" | grep -E "SSID|freq|signal|HT|VHT|HE|MFP|WPS"
# SSID: TargetNetwork
# freq: 5180
# signal: -54.00 dBm
# HT capabilities:
# VHT capabilities:
# WPS:
```

Key capability indicators in the output:

- **HE capabilities**: Wi-Fi 6 (802.11ax)
- **VHT capabilities**: 802.11ac
- **HT capabilities**: 802.11n
- **WPS**: WPS is advertised in the beacon. Use wash to get the WPS lock status and version.

## Identify Unassociated Clients

Clients that are not connected to any AP but are probing for networks appear in the bottom section of airodump-ng with no BSSID entry:

```bash
airodump-ng wlan0mon
#  BSSID              STATION            PWR   Rate  Lost  Frames  Notes  Probes
#
#  (not associated)   EE:FF:AA:BB:CC:DD  -61      0     0      23         TargetNetwork,HomeNet
```

The **Probes** column shows which SSIDs the unassociated client is actively searching for. This is useful for identifying what networks a device has previously connected to, and for targeting evil twin attacks: the client is already looking for these networks by name.

## References

- [Aircrack-ng: airodump-ng documentation](https://www.aircrack-ng.org/doku.php?id=airodump-ng) - Full output field reference including AUTH, ENC, and CIPHER columns
- [Linux Wireless: iw documentation](https://wireless.wiki.kernel.org/en/users/documentation/iw) - iw scan output fields and RSN capability parsing