Why radio is different: wireless threats and the 802.11 architecture

Two sentences that create the entire need for link-layer security

A wired LAN has two properties that nobody thinks of as security controls until they are gone.

To transmit, a station must be physically connected — and plugging a cable into a socket is itself a form of authentication: some positive and presumably observable action, taken by somebody who was in the building. To receive, a station must also be attached, so a wired LAN gives a degree of privacy simply by limiting who can hear the traffic at all.

Radio has neither. Anyone within range can transmit, and anyone within range can listen, and neither act is observable. Every wireless security mechanism in this module exists to rebuild, cryptographically, two properties that a cable used to supply for free.

Four factors sharpen the risk. Channel — broadcast communication is far more open to eavesdropping and jamming than a point-to-point link. Mobility — the device is not where you left it. Resources — devices run sophisticated operating systems on limited memory and processing power, which constrains what they can spend on countering denial of service and malware. Accessibility — devices are left unattended in remote or hostile locations, exposed to physical attack.

The architecture, built up one term at a time

An access point (AP) does two things at once: it behaves as a station on the wireless medium, and it gives associated stations access to the distribution system.

A basic service set (BSS) is the group of stations governed by one coordination function — the smallest building block of a wireless LAN. The detail people get wrong: client stations in a BSS never talk to each other directly. Every frame goes station → AP → destination, even between two laptops on the same desk.

An independent BSS (IBSS) has all stations communicating directly with no AP at all; this is the ad hoc case.

A distribution system (DS) ties BSSs and integrated LANs together — and it need not be wireless. It is very often a plain Ethernet switch. Assuming the DS is radio is one of the most reliable wrong answers on this topic.

An extended service set (ESS) is two or more BSSs joined by a DS, and to the layer above it looks like a single BSS.

The error handling splits across two layers in a way the exam likes: the MAC layer detects errors with a CRC and discards bad frames, while the LLC layer optionally tracks which frames arrived and retransmits the ones that did not. Two layers, two jobs — where most data-link protocols do both in one.

Services and transitions

There are nine 802.11 services, and they are classified two different ways at once. By provider: four station services (authentication, deauthentication, privacy, MSDU delivery) and five distribution services (association, disassociation, reassociation, distribution, integration). By purpose: three support LAN access and security, six support MSDU delivery. Two partitions of the same nine.

Two of them are a confusable pair. Distribution carries MPDUs that must travel across the DS between BSSs. Integration transfers data between an 802.11 station and a station on an integrated wired LAN, handling address translation and media conversion. Across the DS, versus across a technology boundary.

Three mobility transitions: no transition (stationary, or moving within one BSS); BSS transition, moving between BSSs within one ESS, which the addressing must recognise; and ESS transition, moving between ESSs — supported only in the sense that the station can physically move, because maintenance of upper-layer connections cannot be guaranteed and disruption is likely. That last limitation is the point of the taxonomy, not a footnote to it.

Worked example — the pair of threats that look identical from the outside

A staff laptop in an office above a coffee shop shows as connected to CAFE-GUEST instead of NG-STAFF. Two completely different incidents produce exactly that symptom.

Accidental association. Transmission ranges overlap; the laptop's roaming logic locked on to a neighbouring network's AP with a stronger signal. Nobody attacked anyone. The exposure is real — that LAN's resources are now reachable from the laptop, and vice versa — but there is no adversary and the fix is configuration.

Malicious association. A device has been deliberately configured to appear to be a legitimate access point — the evil twin. It harvests credentials, and then uses them to penetrate the wired network through a genuine AP. Same symptom, an attacker behind it, and a completely different incident response: you are now hunting a device and assuming credential compromise.

The axis is intent, and you cannot read intent off the connection state. That is why the two are taught as a pair.