Anyone can listen
Radio goes through walls. Anyone nearby can capture every frame, so a WLAN needs three things: authentication (only allowed users join), encryption (nobody can read the frames) and integrity (nobody can change them).
| Method | Encryption | Status |
|---|---|---|
| Open | None | Use only with a captive portal or VPN (guest Wi-Fi) |
| WEP | RC4, static key | Broken in minutes. Never use |
| WPA | TKIP (RC4-based) | Obsolete |
| WPA2 | AES-CCMP | Common; secure with a strong passphrase |
| WPA3 | AES-GCMP / CCMP, SAE handshake, protected management frames | Current; required on 6 GHz |
Personal and Enterprise
| Mode | How users authenticate | Where |
|---|---|---|
| Personal (PSK) | Everyone shares one passphrase (8-63 characters) | Homes, small offices |
| Enterprise (802.1X) | Each user has their own login, checked by a RADIUS server; uses EAP (EAP-TLS with certificates, PEAP with passwords) | Companies |
WPA3-Personal replaces the old pre-shared key handshake with SAE (Simultaneous Authentication of Equals), so someone who captures the handshake can't guess the passphrase offline. It also gives forward secrecy: a stolen passphrase doesn't decrypt old traffic.
Below, the AP switches to WPA3. LAP1 joins with the right key; LAP2, an older laptop, doesn't support WPA3:
In NetLab
▶ AP1 NetLab access point. Type help to see the commands. AP1> wlan security wpa3 AP1> show wlan Radio : on SSID : Staff Security : WPA3-Personal Passphrase : set (12 characters) Band : 5 GHz Channel : 36 ▶ LAP1 NetLab Windows-style command prompt. Type help to see the commands. (On LAP1's Wi-Fi panel, join "Staff" with its key: failed - The network security key isn't correct) (On LAP1's Wi-Fi panel, join "Staff" with its key: connected) C:\Users\student>netsh wlan show interfaces There is 1 interface on the system: Name : Wi-Fi Description : NetLab Wireless Adapter Physical address : 00:1a:15:33:10:6b State : connected SSID : Staff BSSID : 00:1a:ab:2b:5b:14 Network type : Infrastructure Radio type : 802.11ac Authentication : WPA3-Personal Cipher : CCMP Band : 5 GHz Channel : 36 Signal : 76% ▶ LAP2 NetLab Windows-style command prompt. Type help to see the commands. (On LAP2's Wi-Fi panel, join "Staff" with its key: failed - This laptop doesn't support WPA3 security) C:\Users\student>netsh wlan show interfaces There is 1 interface on the system: Name : Wi-Fi Description : NetLab Wireless Adapter Physical address : 00:1a:7e:d5:f6:e4 State : disconnected Profile : Staff Last error : This laptop doesn't support WPA3 security
Common mistake: A short or guessable passphrase makes WPA2-Personal weak. And a shared passphrase can't be taken back from one person: that's why companies use Enterprise mode, where you just disable the user's account.