A city mesh WLAN loses a portal path and field APs show mesh peering/action activity in the capture. What recognition skill should the analyst apply?
Select an answer to reveal the explanation.
Short Explanation
When the city's mesh portal path snaps, the air fills with mesh peering and path Action chatter—that's the trail to follow. Don't go hunting DHCP Declines for a Layer-2 mesh breakup.
Full Explanation
Municipal mesh networks use mesh peering and path-management Action exchanges to form and repair mesh connectivity when a portal path fails. When a city mesh WLAN loses a portal path and field APs show mesh peering/action activity, the analyst should recognize those mesh peering / mesh Action and path-management frame exchanges as the protocol evidence to inspect. That is where formation, teardown, and alternate-path behavior appear on the air.
Claiming mesh networks never use Action frames and only 4-way handshakes rebuild portal paths fails by concept: mesh peering/path frames are Action-based; 4-way handshake alone does not rebuild mesh portal topology. Diagnosing portal failures exclusively with DHCP Decline on the mesh SSID fails by concept: DHCP symptoms may follow, but mesh path loss is diagnosed first in mesh management exchanges. Asserting mesh peering frames appear only on 900 MHz and cannot be captured on 2.4/5/6 GHz fails by concept: enterprise mesh peering is captured on the mesh radios' Wi-Fi bands in use.
Exam caveat: Mesh outage analysis is a distinct protocol skill from BSS client join forensics; look for mesh Action/peering before rewriting DHCP scopes.
Operational check: Filter the field-AP capture for mesh peering and path-management Action frames around the portal loss, map which peer links dropped or reformed, and verify portal-side backhaul before changing client SSIDs.