During a municipal transit-yard capture, an analyst sees the same 802.11 data-frame sequence numbers repeating for one client while the retry bit stays clear. What should that anomaly primarily drive next?
Select an answer to reveal the explanation.
Short Explanation
Duplicate sequence numbers with a clear retry bit are like seeing the same ticket stub twice at the gate—something odd happened. Treat it as a signal to dig into driver glitches, bad captures, or possible replay, not as proof that the RF design is fine. Closing the ticket or blasting more power skips the real investigation.
Full Explanation
802.11 data-frame sequence numbers should advance uniquely for a transmitter's MSDU/MPDU space; seeing the same sequence numbers repeat for one client while the retry bit stays clear is abnormal. During a municipal transit-yard capture, that anomaly should primarily drive investigation of driver bugs, capture artifacts, or possible replay as a fault or security-relevant signal before remediating RF. Clear-retry duplicates are not explained away as healthy Block Ack compression.
Treating the pattern as normal Block Ack compression and closing the ticket fails by concept: Block Ack bitmaps acknowledge outstanding scores; they do not make identical sequence numbers with clear retry bits a normal closed case. Immediately raising AP transmit power on every channel fails by concept: power changes do not repair sequence-number anomalies and can worsen interference. Disabling all QoS tagging citywide because sequence numbers only matter for voice fails by concept: sequence numbering applies across QoS data; QoS tags are not the root of duplicate SNs.
Exam caveat: Duplicate SN with retry clear is a red-flag pattern in CWNE protocol analysis—investigate integrity of the transmitter and capture path before RF redesign.
Operational check: Isolate the transit-yard client MAC, extract duplicate SN frames with retry=0, compare with a second sniffer, check driver versions, and escalate as potential replay/bug if the duplicates are confirmed on-air.