A county NOC engineer hunting power-save behavior notices QoS Null…

Question

A county NOC engineer hunting power-save behavior notices QoS Null and Null data frames are sparse or absent in a capture despite clients clearly sleeping. What analyzer limitation should the CWNE keep in mind?

Accepted Answer

Some analyzers and PHY/sniffer combinations have limited visibility into Null data / QoS Null power-save frames, so missing them does not by itself prove the client never sent them — Null frames are the client's "do not disturb" note—and some sniffers just don't hear every whisper. Empty PCAP rows aren't proof the handheld never sent them. Know your adapter's blind spots before blaming the STA.

Answer

Null frames are illegal on enterprise SSIDs, so their absence always proves a rogue AP

Answer

QoS Null frames are only used on 6 GHz and cannot appear on 2.4/5 GHz captures

Answer

Power-save Null frames are always encrypted as MSDUs, so decrypting the GTK reveals every one

A county NOC engineer hunting power-save behavior notices QoS Null and Null data frames are sparse or absent in a capture despite clients clearly sleeping. What analyzer limitation should the CWNE keep in mind?

Short Explanation

Full Explanation