Study guide
14.2 Protocol Analyzers, Spectrum Analyzers and Monitoring
CWNA Certified Wireless Network Administrator CWNA-109
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 CWNA-109 Knowledge Domains and Study Strategy
2 RF Fundamentals
2.1 RF Waves, Propagation, Gain and Loss 2.2 Reflection, Multipath, VSWR and Free-Space Path Loss 2.3 RF Units and the Rule of 10s and 3s
3 RF Measurement and Antenna Systems
3.1 Noise Floor, SNR, RSSI and EIRP 3.2 Line of Sight, Fresnel Zone, Polarization and MIMO 3.3 Antenna Types, Charts, Cables and Lightning Protection
4 Industry Bodies and Legacy PHY
4.1 Industry Organizations and OSI Layers 4.2 Legacy 802.11 PHY Standards 4.3 Spread Spectrum, Modulation and MCS
5 Modern 802.11 PHY and Channel Concepts
5.1 Wi-Fi 4 HT and Wi-Fi 5 VHT 5.2 Wi-Fi 6 and Wi-Fi 6E High Efficiency 5.3 Primary Channels, OBSS, Throughput and Guard Interval
6 Spectrum Rules and WLAN Use Cases
6.1 Frequency Bands, DFS and Transmit Power Control 6.2 WLAN, Bridging, Peer-to-Peer and Mesh
7 802.11 Service Sets and Framing
7.1 Stations, BSS, ESS and the Distribution System 7.2 MSDU, MPDU, PSDU, PPDU and Aggregation 7.3 MAC Frame Format and Addressing
8 Frame Types, Discovery, and Association
8.1 Management, Control and Data Frames 8.2 Scanning, Authentication and Association
9 Channel Access, MAC Operations, and Devices
9.1 DCF, EDCA, RTS/CTS and Interframe Spaces 9.2 Roaming, Power Save and Protection Mechanisms 9.3 Access Points, Controllers and Client Devices
10 PoE, Architectures, and Proprietary Features
10.1 Power over Ethernet, PSE and Power Budgets 10.2 Centralized vs Distributed Forwarding and Network Planes 10.3 Airtime Fairness, Band Steering and RRM
11 WLAN Design and Supporting Services
11.1 Data, Voice, Video and Legacy Client Design 11.2 High-Density, Location Services and Guest Access 11.3 DHCP, DNS, Time, VLANs and AAA
12 WLAN Security
12.1 Weak and Deprecated WLAN Security 12.2 AES, WPA2-Personal and WPA2-Enterprise 12.3 WPA3, SAE and Opportunistic Wireless Encryption 12.4 PMF, Fast Roaming, WIPS and Secure Management
13 RF Validation Surveys and Tools
13.1 Post-Implementation Validation Surveys 13.2 Application and Performance Testing 13.3 Validation Tools: Survey, Protocol and Spectrum
14 Interference, Troubleshooting, and Common Faults
14.1 Co-Channel Contention vs Adjacent Channel Interference 14.2 Protocol Analyzers, Spectrum Analyzers and Monitoring 14.3 Common WLAN Faults and Hidden Nodes
14.2 Protocol Analyzers, Spectrum Analyzers and Monitoring
Key Takeaways Explain This Topic AI
A protocol analyzer decodes 802.11 frames so you can see retry bits, deauthentication reason codes, and DHCP or EAP failures inside the conversation
A spectrum analyzer shows RF energy versus frequency and time, which is how you identify non-802.11 signatures that never appear as BSSIDs
Controllers, WNMS, and syslog provide estate-wide retries, airtime, DFS events, and AP join history you cannot see from one laptop capture
A wireless LAN scanner lists SSIDs, BSSIDs, channels, security, and RSSI for a fast channel-plan and rogue survey
Pick the tool from the symptom: frames and reason codes versus energy signatures versus estate stats versus a quick SSID map
Last updated: September 2026
Objective 6.5 is not a shopping list. It is a matching skill: given a symptom, which instrument can actually see the failure. Harborline's NOC keeps four classes of tool on the cart. Using the wrong class wastes hours. This ExamFinch section teaches protocol analyzers , spectrum analyzers , management / monitoring / logging systems , and wireless LAN scanners the way CWNA-109 expects you to choose them. Independent ExamFinch material here is study teaching from ExamFinch; it does not claim CWNP approval, partnership, or exact equivalence with CWNP training.
Chapter 12 already used protocol and spectrum analyzers as security visibility (RSN IEs, rogue energy). Chapter 13 used them in validation (prove the design). Here the same hardware answers why it broke on Tuesday .
Protocol analyzers: the conversation on the air
A protocol analyzer (packet capture in monitor mode, or a vendor equivalent that records 802.11 MPDUs) sees frames . It does not see a magnetron. It does not see a duplex mismatch on the switch. It sees what stations actually transmitted.
What 6.5 wants you to read in those frames:
Retry bit. The Frame Control retry flag marks a retransmission. A capture full of retry=1 data frames with the same sequence numbers is a loss story: collisions, hidden nodes, interference, or a client at the edge. Combine it with RSSI in radiotap headers. Strong RSSI plus retries points back to 14.1 (CCC/ACI/non-Wi-Fi) or to 14.3 (hidden node). Weak RSSI plus retries is coverage or a client Tx limit.
Reason and status codes. Deauthentication and Disassociation frames carry a reason code . Association Response and Authentication frames carry a status code . Harborline's helpdesk says "Wi-Fi kicked me off." The capture says reason 2 (previous authentication no longer valid), 6 (Class 2 frame from nonauthenticated STA), 7 (Class 3 from nonassociated STA), 8 (leaving BSS), 15 (4-way handshake timeout — common after a PSK mismatch), or an Association status 18 (denied due to AP's inability to handle additional STAs) or 30/31 (association denied because of RSN/PMF mismatch, depending on the amendment wording in the capture's decode). You do not memorize every IEEE table on CWNA-109, but you do know to open the frame instead of guessing from RSSI.
DHCP failures in frames. After 802.11 association and, for Enterprise, after 802.1X, the station still needs an address. A protocol analyzer that can see the client VLAN (monitor mode plus decryption if the session is encrypted, or a wired SPAN on the AP uplink, or an unencrypted guest SSID) shows Discover / Offer / Request / ACK. Patterns:
Discovers with no Offer — helper, pool, or server.
Offers the client ignores — bad server, wrong giaddr, Option 82 policy.
Repeated Discovers while the 802.11 session stays associated — not an RF hole .
If the WLAN is encrypted and you cannot decrypt, you still see 802.11 Data frames with growing retry counts after association, then the client roam or DHCP-renew behavior in management frames. Pair the air capture with a wired capture at the DHCP relay. Objective 6.5's point is that DHCP is visible in packets , so you should look there before you reshoot the survey.
EAP failures in frames. WPA2-Enterprise and WPA3-Enterprise run EAP after association. The analyzer shows EAP Identity, method (PEAP, EAP-TLS, and so on), TLS alerts, Access-Challenge versus Access-Reject as RADIUS-encapsulated EAP-Failure, and then the 4-way handshake only if EAP succeeded. A client that associates and immediately Deauthenticates may be failing EAP, not RF. Harborline ticket: "New badge scanners cannot join HL-CORP." Capture: Association success, EAP Identity, then EAP-Failure, reason-coded teardown. RADIUS log: unknown user. The protocol analyzer told you which phase died; the AAA log told you why .
Protocol analyzer limits: encrypted payloads hide DHCP unless you have the PTK/GTK or a wired tap. A single adapter sees one channel unless you use multiple radios. You will not identify a Bluetooth hopper from MPDUs alone.
Spectrum analyzers: energy that is not a frame
A spectrum analyzer (dedicated, USB, or AP-based FFT) plots RF power versus frequency versus time . It answers 6.2's non-802.11 question and 6.5's "identify the interference source."
Signatures you should recognize at CWNA depth:
- Signature on the waterfall Likely source Why a protocol analyzer misses it
- Broadband smear ~2.45 GHz, on/off with a kitchen cycle Microwave oven No BSSID, no Duration
- Narrow hops sprinkled across 2.4 GHz Bluetooth / BLE Hops are not 802.11 PPDUs
- Periodic pulses in a DFS sub-band Radar AP may report DFS; frames do not decode as Wi-Fi
- Continuous narrow carrier Analog camera, video sender, CW test tone High duty cycle, zero MPDUs
802.11-shaped burst on an offset center Neighbor Wi-Fi / ACI Protocol analyzer on your primary may not decode them
Look at duty cycle and center frequency , not only peak dBm. A radar pulse can be strong and still rare. A Bluetooth mouse can be weak and still raise retries next to a scanner. Harborline's analog yard camera sat on 2.412 GHz at 80 percent duty cycle; scanners on channel 1 never listed it as an SSID. The spectrum analyzer named it in minutes; three days of protocol captures had shown only retries.
AP-based spectrum views are convenient for after-hours and for many floors. A walk-around analyzer is better when you must locate a source by watching the signature grow as you approach the break room. Either way, spectrum is how you identify the interferer; protocol analysis is how you prove 802.11 is the victim.
Management, monitoring, and logging systems
A laptop capture is a flashlight. The controller , wireless network management system (WNMS) , and syslog are the building's lighting panel.
Controller / WNMS stats (objective 6.5 grouping: management, monitoring, and logging) that actually close tickets:
Retry percentage and channel utilization per radio — CCC versus a quiet cell.
Client count and failed associations — capacity, PSK, or 802.1X.
SNR / RSSI distributions — coverage versus a single sticky client.
Radio resets, DFS events, PoE power-draw changes — the AP is crashing or vacating, not "Windows is slow."
Roam graphs — sticky clients versus missing neighbor coverage.
Syslog (and equivalent streaming telemetry) timestamps AP join, image download, radio state, DFS CAC, and often 802.1X fails if the controller logs them. Harborline ticket "the west IDF Wi-Fi dies every night at 02:15" was a switch reboot in syslog, not RF. Without logs you would have surveyed at noon and found nothing.
WNMS does not replace a capture. Averages hide a 30-second microwave. Use monitoring to narrow the radio, time window, and client , then drop a protocol or spectrum analyzer on that window.
Wireless LAN scanners
A WLAN scanner (survey-in-a-pocket, inSSIDer-class, or the scanner view inside survey software) lists what 802.11 networks are present : SSID, BSSID, channel, width, security, RSSI, sometimes 802.11k neighbor hints. It is the fastest way to answer:
Are we accidentally on channel 3 next to 1 and 6?
How many OBSS share 36?
Is HL-GUEST still TKIP somewhere?
Did a rogue AP appear with our SSID?
Scanners do not decode DHCP. They do not show a microwave. They do not show switch duplex. They do prevent Harborline from spending a day on spectrum when the overlay is simply four SSIDs on 2.4 GHz channel 1 from the same IDF.
How to pick a tool for a symptom
Match the question to the instrument:
Symptom First tool Why
Associated, no IP, or "limited connectivity" Protocol analyzer + DHCP server/relay logs; wired SPAN DHCP lives in packets, not in RSSI
Associates then drops; "password" or 802.1X Protocol analyzer (EAP, 4-way, reason codes) + RADIUS Phase of failure is in frames
Strong RSSI, slow apps, many BSSIDs on one channel WLAN scanner + controller airtime CCC until proven otherwise
- Strong RSSI, slow apps, few BSSIDs, retries Spectrum analyzer ACI offset or non-802.11
- Periodic lunch/break failures on 2.4 GHz Spectrum analyzer in that room Duty cycle / microwave signature
- One AP flapping, many APs fine Controller/WNMS + syslog + switch PoE Device or DS, not building-wide RF
- Guest Internet slow, local file share fine WNMS plus WAN/firewall graphs Not a protocol-analyzer PHY problem
- Unknown extra SSID WLAN scanner, then WIPS/controller Identify, then locate
- Worked Harborline NOC picks
Ticket 1902, break room, noon only: spectrum first . Protocol capture at 09:00 would have been a clean cell.
Ticket 2055, associated / 169.254.1.17: protocol analyzer on Discover, plus the Layer 3 helper. Scanner RSSI was −52 dBm and irrelevant.
Ticket 1847, four APs on 36: scanner + WNMS utilization . Spectrum would have shown 802.11-shaped energy you already knew was Wi-Fi.
Ticket 2119, EAP-Failure: protocol analyzer + syslog/RADIUS . Spectrum cannot see an Access-Reject.
On the exam
Retries, reason codes, DHCP, EAP → protocol analyzer .
Interferer signatures → spectrum analyzer .
Estate trends, DFS, AP reboots → controller / WNMS / syslog .
Who is on which channel → WLAN scanner .
Choose from the symptom , not from the tool you like.
Key Takeaways
Frames carry retries, reason codes, and DHCP/EAP outcomes.
Spectrum carries signatures that never become MPDUs.
Monitoring systems give time and estate context.
Scanners map SSIDs and channels quickly.
The exam item is which tool can see that symptom.