A city public-safety SSID capture shows the 4-way handshake failing around message 3/4. Conceptually, what should the expert isolate next?
Select an answer to reveal the explanation.
Short Explanation
The 4-way handshake is a lock-and-key ceremony—message 3/4 is where the new PTK actually gets installed and confirmed. When that step flakes, stop blaming DHCP and ask whether the AP or the client dropped the keys on the floor.
Full Explanation
After successful authentication, the 4-way handshake derives and installs the PTK; messages 3 and 4 complete key installation and confirmation. Failures clustered there point to PTK install or MIC/key confirmation problems on the AP or client path, not to association or DHCP as the first cause. Capture-driven isolation of the failing message is the expert approach.