WPA3-Enterprise CCM128
WPA3-Enterprise CCM128 (SSID: bin4-wpa3-enterprise-ccm128) に WPA3 対応の iPhone SE/iOS13.5.1 と WPA2 対応の Galaxy SC-04F/Android 6.0.1 を EAP-PEAP で接続してみました。WPA3-Enterprise CCM128 は、802.11w PMFC (Management Frame Protection Capable) が有効になっているが、WPA2-Enterprise とほぼ同等で、WPA2 対応端末も接続することが可能です。WPA3-Personal のように opmode-transition コマンドを有効にする必要はない。
AP505# show ap debug auth-trace-buf Auth Trace Buffer ----------------- Jul 3 18:40:19 station-up * 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - - wpa2 aes Jul 3 18:40:19 eap-id-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 1 5 Jul 3 18:40:19 eap-id-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 1 10 user1 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 85 215 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 85 - Jul 3 18:40:19 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 2 6 Jul 3 18:40:19 eap-nak -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 2 8 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 86 255 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 86 - Jul 3 18:40:19 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 3 6 Jul 3 18:40:19 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 3 161 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 87 408 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 87 - Jul 3 18:40:19 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 4 1034 Jul 3 18:40:19 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 4 6 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 88 253 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 88 - Jul 3 18:40:19 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 5 1030 Jul 3 18:40:19 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 5 6 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 89 253 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 89 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 6 701 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 6 136 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 90 383 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 90 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 7 61 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 7 6 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 91 253 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 91 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 8 40 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 8 45 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 92 292 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 92 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 9 66 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 9 99 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 93 346 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 93 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 10 86 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 10 41 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 94 288 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 94 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 11 46 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 11 46 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 95 293 192.168.215.13 Jul 3 18:40:20 rad-accept <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 95 - Jul 3 18:40:20 eap-success <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 11 4 Jul 3 18:40:20 wpa2-key1 <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - 117 Jul 3 18:40:20 wpa2-key2 -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - 123 Jul 3 18:40:20 wpa2-key3 <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - 191 Jul 3 18:40:20 wpa2-key4 -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - 95 AP505# show ap debug mgmt-frames Traced 802.11 Management Frames ------------------------------- Timestamp stype SA DA BSS signal Misc --------- ----- -- -- --- ------ ---- Jul 3 18:40:19.588 assoc-resp b8:3a:5a:8b:36:d0 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 15 Success Jul 3 18:40:19.588 assoc-req 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 b8:3a:5a:8b:36:d0 48 - Jul 3 18:40:19.585 auth b8:3a:5a:8b:36:d0 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 15 Success (seq num 0) Jul 3 18:40:19.585 auth 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 b8:3a:5a:8b:36:d0 0 -
- WPA2 対応の Galaxy SC-04F (MAC address = 90:b6:86:6b:e1:1f) 接続時
Auth Trace Buffer ----------------- Jul 3 18:40:39 station-up * 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - - wpa2 aes Jul 3 18:40:39 eap-id-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 1 5 Jul 3 18:40:39 eap-id-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 1 10 user2 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 96 215 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 96 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 2 6 Jul 3 18:40:39 eap-nak -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 2 6 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 97 253 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 97 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 3 6 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 3 164 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 98 411 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 98 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 4 1034 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 4 6 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 99 253 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 99 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 5 1030 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 5 6 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 100 253 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 100 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 6 701 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 6 132 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 101 379 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 101 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 7 61 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 7 6 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 102 253 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 102 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 8 40 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 8 45 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 103 292 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 103 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 9 66 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 9 99 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 104 346 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 104 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 10 86 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 10 41 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 105 288 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 105 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 11 46 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 11 46 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 106 293 192.168.215.13 Jul 3 18:40:39 rad-accept <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 106 - Jul 3 18:40:39 eap-success <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 11 4 Jul 3 18:40:39 wpa2-key1 <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - 117 Jul 3 18:40:39 wpa2-key2 -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - 123 Jul 3 18:40:39 wpa2-key3 <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - 191 Jul 3 18:40:40 wpa2-key4 -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - 95 AP505# show ap debug mgmt-frames Traced 802.11 Management Frames ------------------------------- Timestamp stype SA DA BSS signal Misc --------- ----- -- -- --- ------ ---- Jul 3 18:40:39.402 assoc-resp b8:3a:5a:8b:36:d0 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 15 Success Jul 3 18:40:39.402 assoc-req 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 b8:3a:5a:8b:36:d0 56 - Jul 3 18:40:39.400 auth b8:3a:5a:8b:36:d0 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 15 Success (seq num 0) Jul 3 18:40:39.400 auth 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 b8:3a:5a:8b:36:d0 0 -
- Association 情報
iPhone SE および Galaxy ともに、w: 802.11w client フラグ、E: Enterprise client フラグが付いていることが分かるが、WPA3 対応かどうかの判断はできなかった。
AP505# show ap association
The phy column shows client's operational capabilities for current association
Flags: H: Hotspot(802.11u) client, K: 802.11K client, M: VHT Mu beam formee, R: 802.11R client, W: WMM client, w: 802.11w client, V: 802.11v BSS trans capable, P: Punctured preamble, U: HE UL Mu-mimo, O: OWE client, S: SAE client, E: Enterprise client, m: Agile Multiband client, C: Cellular Data Capable - network available, c: Cellular Data Capable - network unavailable, T: Individual TWT client, t: Broadcast TWT client
PHY Details: HT : High throughput; 20: 20MHz; 40: 40MHz; t: turbo-rates (256-QAM)
VHT : Very High throughput; 80: 80MHz; 160: 160MHz; 80p80: 80MHz + 80MHz
HE : High Efficiency; 80: 80MHz; 160: 160MHz; 80p80: 80MHz + 80MHz
<n>ss: <n> spatial streams
Association Table
-----------------
Name bssid mac auth assoc aid l-int essid vlan-id phy assoc. time num assoc Flags DataReady UAC
---- ----- --- ---- ----- --- ----- ----- ------- --- ----------- --------- ----- --------- ---
AP505 b8:3a:5a:8b:36:d0 84:ab:1a:11:d2:f6 y y 1 20 bin4-wpa3-enterprise-ccm128 1 a-HE-20-2ss 55s 1 WVwE Yes (Implicit) 0.0.0.0
AP505 b8:3a:5a:8b:36:d0 90:b6:86:6b:e1:1f y y 2 10 bin4-wpa3-enterprise-ccm128 1 a-VHT-20sgi-2ss 35s 1 WVwE Yes (Implicit) 0.0.0.0
Num Clients:2
- Client-table 情報
e - Beamformer フラグがついているが、こちらからは特に違いがなかった。
AP505# show ap debug client-table
Client Table
------------
MAC ESSID BSSID Assoc_State HT_State AID PS_State UAPSD TWT Tx_Pkts Rx_Pkts PS_Qlen Tx_Retries Tx_Rate Rx_Rate Last_ACK_SNR Last_Rx_SNR TX_Chains Tx_Timestamp Rx_Timestamp MFP Status (C,R) Idle time Client health (C/R) Tx_Bytes Rx_Bytes
--- ----- ----- ----------- -------- --- -------- ----- --- ------- ------- ------- ---------- ------- ------- ------------ ----------- --------- ------------ ------------ ---------------- --------- ------------------- -------- --------
90:b6:86:6b:e1:1f bin4-wpa3-enterprise-ccm128 b8:3a:5a:8b:36:d0 Associated AWvSsEe 0x2 Power-save (0,0,0,0,N/A,0) (0,0) 71 263 0 0 173 173 60 60 2[0x3] Fri Jul 3 18:41:07 2020 Fri Jul 3 18:41:14 2020 (1,1) 0 100/27 38062 11189
84:ab:1a:11:d2:f6 bin4-wpa3-enterprise-ccm128 b8:3a:5a:8b:36:d0 Associated AWvSsE 0x1 Awake (0,0,0,0,N/A,0) (0,0) 242 432 0 0 270 286 50 48 2[0x3] Fri Jul 3 18:41:14 2020 Fri Jul 3 18:41:14 2020 (1,1) 0 100/27 232574 24767
Num of associated clients: 2
UAPSD:(VO,VI,BK,BE,Max SP,Q Len)
TWT:(iTWT sessions num, bTWT groups num)
HT Flags: A - LDPC Coding; B - TX STBC; D - Delayed BA; G - Greenfield
I - HT40 Intolerant; M - Max A-MSDU; N - A-MPDU disabled
Q - Static SM PS; R - Dynamic SM PS; S - Short GI 40; W - 40 MHz
b - RX STBC; s - Short GI 20; t - turbo-rates (256-QAM)
VHT Flags: C - 160MHz/80+80MHz; E - Beamformee; V - Short GI 160
c - 80MHz; e - Beamformer; v - Short GI 80
HT_State shows client's original capabilities (not operational capabilities)
MFP Status: C - 1 if the station is MFP capable; R - 1 if the station has negotiated MFP
- WPA3 対応の iPhone SE 接続時の無線キャプチャ
WPA3 対応端末と WPA2 対応端末でシーケンスに違いを見つけられませんでした。
- WPA2 対応の Galaxy 接続時の無線キャプチャ
[English Version]
I tried to connect iPhone SE/iOS13.5.1 which supports WPA3 and Galaxy SC-04F/Android 6.0.1 which support WPA2 to Aruba AP505/Instant OS 8.7.0.0 WPA3-Enterprise CCM128 (SSID: bin4-wpa3-enterprise-ccm128) with EAP-PEAP. In WPA3-Enterprise CCM128, 802.11w PMFC (Management Frame Protection Capable) is enabled, but almost same as WPA2-Enterprise, hence WPA2 device can associate. Like WPA3-Personal, we do not need to set opmode-transition option.
AP505# show ap debug auth-trace-buf Auth Trace Buffer ----------------- Jul 3 18:40:19 station-up * 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - - wpa2 aes Jul 3 18:40:19 eap-id-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 1 5 Jul 3 18:40:19 eap-id-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 1 10 user1 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 85 215 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 85 - Jul 3 18:40:19 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 2 6 Jul 3 18:40:19 eap-nak -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 2 8 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 86 255 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 86 - Jul 3 18:40:19 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 3 6 Jul 3 18:40:19 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 3 161 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 87 408 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 87 - Jul 3 18:40:19 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 4 1034 Jul 3 18:40:19 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 4 6 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 88 253 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 88 - Jul 3 18:40:19 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 5 1030 Jul 3 18:40:19 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 5 6 Jul 3 18:40:19 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 89 253 192.168.215.13 Jul 3 18:40:19 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 89 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 6 701 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 6 136 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 90 383 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 90 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 7 61 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 7 6 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 91 253 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 91 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 8 40 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 8 45 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 92 292 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 92 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 9 66 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 9 99 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 93 346 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 93 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 10 86 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 10 41 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 94 288 192.168.215.13 Jul 3 18:40:20 rad-resp <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 94 - Jul 3 18:40:20 eap-req <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 11 46 Jul 3 18:40:20 eap-resp -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 11 46 Jul 3 18:40:20 rad-req -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 95 293 192.168.215.13 Jul 3 18:40:20 rad-accept <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0/clearpass 95 - Jul 3 18:40:20 eap-success <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 11 4 Jul 3 18:40:20 wpa2-key1 <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - 117 Jul 3 18:40:20 wpa2-key2 -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - 123 Jul 3 18:40:20 wpa2-key3 <- 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - 191 Jul 3 18:40:20 wpa2-key4 -> 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 - 95 AP505# show ap debug mgmt-frames Traced 802.11 Management Frames ------------------------------- Timestamp stype SA DA BSS signal Misc --------- ----- -- -- --- ------ ---- Jul 3 18:40:19.588 assoc-resp b8:3a:5a:8b:36:d0 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 15 Success Jul 3 18:40:19.588 assoc-req 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 b8:3a:5a:8b:36:d0 48 - Jul 3 18:40:19.585 auth b8:3a:5a:8b:36:d0 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 15 Success (seq num 0) Jul 3 18:40:19.585 auth 84:ab:1a:11:d2:f6 b8:3a:5a:8b:36:d0 b8:3a:5a:8b:36:d0 0 -
- Connecting Galaxy SC-04F (MAC address = 90:b6:86:6b:e1:1f)
Auth Trace Buffer ----------------- Jul 3 18:40:39 station-up * 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - - wpa2 aes Jul 3 18:40:39 eap-id-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 1 5 Jul 3 18:40:39 eap-id-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 1 10 user2 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 96 215 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 96 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 2 6 Jul 3 18:40:39 eap-nak -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 2 6 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 97 253 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 97 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 3 6 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 3 164 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 98 411 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 98 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 4 1034 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 4 6 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 99 253 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 99 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 5 1030 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 5 6 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 100 253 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 100 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 6 701 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 6 132 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 101 379 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 101 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 7 61 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 7 6 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 102 253 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 102 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 8 40 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 8 45 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 103 292 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 103 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 9 66 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 9 99 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 104 346 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 104 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 10 86 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 10 41 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 105 288 192.168.215.13 Jul 3 18:40:39 rad-resp <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 105 - Jul 3 18:40:39 eap-req <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 11 46 Jul 3 18:40:39 eap-resp -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 11 46 Jul 3 18:40:39 rad-req -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 106 293 192.168.215.13 Jul 3 18:40:39 rad-accept <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0/clearpass 106 - Jul 3 18:40:39 eap-success <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 11 4 Jul 3 18:40:39 wpa2-key1 <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - 117 Jul 3 18:40:39 wpa2-key2 -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - 123 Jul 3 18:40:39 wpa2-key3 <- 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - 191 Jul 3 18:40:40 wpa2-key4 -> 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 - 95 AP505# show ap debug mgmt-frames Traced 802.11 Management Frames ------------------------------- Timestamp stype SA DA BSS signal Misc --------- ----- -- -- --- ------ ---- Jul 3 18:40:39.402 assoc-resp b8:3a:5a:8b:36:d0 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 15 Success Jul 3 18:40:39.402 assoc-req 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 b8:3a:5a:8b:36:d0 56 - Jul 3 18:40:39.400 auth b8:3a:5a:8b:36:d0 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 15 Success (seq num 0) Jul 3 18:40:39.400 auth 90:b6:86:6b:e1:1f b8:3a:5a:8b:36:d0 b8:3a:5a:8b:36:d0 0 -
- Association information
We can see w: 802.11w client flag and E: Enterprise client flag on both devices, but we can not recognize WPA3 enabled or not.
AP505# show ap association
The phy column shows client's operational capabilities for current association
Flags: H: Hotspot(802.11u) client, K: 802.11K client, M: VHT Mu beam formee, R: 802.11R client, W: WMM client, w: 802.11w client, V: 802.11v BSS trans capable, P: Punctured preamble, U: HE UL Mu-mimo, O: OWE client, S: SAE client, E: Enterprise client, m: Agile Multiband client, C: Cellular Data Capable - network available, c: Cellular Data Capable - network unavailable, T: Individual TWT client, t: Broadcast TWT client
PHY Details: HT : High throughput; 20: 20MHz; 40: 40MHz; t: turbo-rates (256-QAM)
VHT : Very High throughput; 80: 80MHz; 160: 160MHz; 80p80: 80MHz + 80MHz
HE : High Efficiency; 80: 80MHz; 160: 160MHz; 80p80: 80MHz + 80MHz
<n>ss: <n> spatial streams
Association Table
-----------------
Name bssid mac auth assoc aid l-int essid vlan-id phy assoc. time num assoc Flags DataReady UAC
---- ----- --- ---- ----- --- ----- ----- ------- --- ----------- --------- ----- --------- ---
AP505 b8:3a:5a:8b:36:d0 84:ab:1a:11:d2:f6 y y 1 20 bin4-wpa3-enterprise-ccm128 1 a-HE-20-2ss 55s 1 WVwE Yes (Implicit) 0.0.0.0
AP505 b8:3a:5a:8b:36:d0 90:b6:86:6b:e1:1f y y 2 10 bin4-wpa3-enterprise-ccm128 1 a-VHT-20sgi-2ss 35s 1 WVwE Yes (Implicit) 0.0.0.0
Num Clients:2
- Client-table information
There is e - Beamformer flag on iPhone SE, but we can not recognize WPA3 enabled or not.
AP505# show ap debug client-table
Client Table
------------
MAC ESSID BSSID Assoc_State HT_State AID PS_State UAPSD TWT Tx_Pkts Rx_Pkts PS_Qlen Tx_Retries Tx_Rate Rx_Rate Last_ACK_SNR Last_Rx_SNR TX_Chains Tx_Timestamp Rx_Timestamp MFP Status (C,R) Idle time Client health (C/R) Tx_Bytes Rx_Bytes
--- ----- ----- ----------- -------- --- -------- ----- --- ------- ------- ------- ---------- ------- ------- ------------ ----------- --------- ------------ ------------ ---------------- --------- ------------------- -------- --------
90:b6:86:6b:e1:1f bin4-wpa3-enterprise-ccm128 b8:3a:5a:8b:36:d0 Associated AWvSsEe 0x2 Power-save (0,0,0,0,N/A,0) (0,0) 71 263 0 0 173 173 60 60 2[0x3] Fri Jul 3 18:41:07 2020 Fri Jul 3 18:41:14 2020 (1,1) 0 100/27 38062 11189
84:ab:1a:11:d2:f6 bin4-wpa3-enterprise-ccm128 b8:3a:5a:8b:36:d0 Associated AWvSsE 0x1 Awake (0,0,0,0,N/A,0) (0,0) 242 432 0 0 270 286 50 48 2[0x3] Fri Jul 3 18:41:14 2020 Fri Jul 3 18:41:14 2020 (1,1) 0 100/27 232574 24767
Num of associated clients: 2
UAPSD:(VO,VI,BK,BE,Max SP,Q Len)
TWT:(iTWT sessions num, bTWT groups num)
HT Flags: A - LDPC Coding; B - TX STBC; D - Delayed BA; G - Greenfield
I - HT40 Intolerant; M - Max A-MSDU; N - A-MPDU disabled
Q - Static SM PS; R - Dynamic SM PS; S - Short GI 40; W - 40 MHz
b - RX STBC; s - Short GI 20; t - turbo-rates (256-QAM)
VHT Flags: C - 160MHz/80+80MHz; E - Beamformee; V - Short GI 160
c - 80MHz; e - Beamformer; v - Short GI 80
HT_State shows client's original capabilities (not operational capabilities)
MFP Status: C - 1 if the station is MFP capable; R - 1 if the station has negotiated MFP
As far as I checked, there is no difference between iPhone SE connection sequence and Galaxy one.
- air capture on connecting Galaxy
