Enterprise roaming captures at city hall show reassociation with PMKID/PMK caching evidence and no full EAP on most AP moves, while a second SSID still runs full 802.1X every roam. What does the first pattern demonstrate?
Select an answer to reveal the explanation.
Short Explanation
Full EAP every hop is like redoing airport security between every gate. PMK caching is the TSA PreCheck stamp—reassociate, skip the long line, keep moving. Seeing that in the capture means roam optimization is actually working.
Full Explanation
Enterprise fast roam optimizations reuse keying material so most AP moves avoid a full 802.1X EAP exchange. At city hall, reassociation with PMKID/PMK caching evidence and no full EAP on most AP moves demonstrates that PMK caching (or equivalent fast-roam caching) is reducing full EAP on roam—the desired enterprise roam optimization signal—while a second SSID that still runs full 802.1X every roam has not applied that optimization.
Claiming PMK caching is disabled whenever reassociation frames appear fails by concept: reassociation is the normal roam frame type and coexists with PMK caching when caching works. Asserting full EAP on every roam is mandatory for all WPA2-Enterprise municipal designs fails by concept: standards and enterprise practice allow PMK caching/FT-style optimizations precisely to avoid full EAP each roam. Saying PMKIDs only apply to open OWE networks fails by concept: PMKID/PMK caching is an enterprise 802.1X roam optimization mechanism, not an OWE-only construct.
Exam caveat: CWNE roam analysis distinguishes successful fast-roam caching (reassoc without full EAP) from broken roaming that forces EAP every move; presence of reassociation frames alone does not mean caching is off.
Operational check: Filter city-hall roam events for Reassociation Request/Response and EAPOL-Start/EAP, confirm PMKID/PMK cache hits on the optimized SSID, and compare EAP count per roam against the second SSID that still full-authenticates.