Engineers must analyze a tablet that fails while roaming across three APs in a municipal clinic. Which capture strategy is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Roaming is a three-AP handoff movie — one camera stuck on the opening scene misses the plot. Multi-channel or multi-adapter captures catch each BSS as the tablet moves. Wired SPAN alone won't show the air-side dance.
Full Explanation
Analyzing a tablet that fails while roaming across three APs in a municipal clinic requires a multi-channel or multi-adapter capture so frames on each involved AP channel are recorded across the roam sequence. A single adapter stuck on the first AP’s channel misses target-AP exchanges. Expert roam analysis plans channel coverage for the path the client walks.
Leaving one adapter on the first AP’s channel for the entire walk is insufficient for multi-AP roam events. Relying only on wired SPAN because “roaming is not an air-side exchange” ignores over-the-air reassociation and keying. Disabling roaming before capturing so the client never changes APs prevents observing the failure mode under investigation.
Exam caveat: roam captures are multi-channel problems in multi-AP civic clinics. Operational check: map the three AP channels on the clinic path, use two adapters or a multi-channel capture system, walk the roam, and verify probe/auth/reassoc/key frames for each BSSID appear in the timeline. Label capture files with clinic path and AP channel list so later analysts know which roam legs were actually observed. When only one adapter is available, perform three controlled walks parked on each AP channel in turn and merge timelines carefully rather than claiming full roam coverage from one scan.