A civic tech intern asks why management frames still matter to an assessor when user data frames are encrypted. What is the best answer?
Select an answer to reveal the explanation.
Short Explanation
Even when the letters inside the envelopes are sealed, the mail labels still tell you who lives where. Beacons and probes are those labels for wireless topology.
Full Explanation
Even when data frames are encrypted, management and control traffic still convey operationally useful metadata. Beacons, probe requests/responses, and authentication/association exchanges reveal SSIDs (or hidden-SSID behavior), supported rates, RSN/crypto advertisements, timing, and which clients are joining which BSSIDs. Civic tech interns should understand that recon value often lives in those clear or partially clear management exchanges long before any payload decrypt succeeds. Claiming management frames always carry the cleartext PSK is false and dangerous as a mental model; PSKs are not beamed that way in beacons. Saying assessors ignore management frames because only TCP payloads matter in Wireshark undervalues wireless-specific analysis. Asserting management frames exist only on wired Ethernet mirrors denies over-the-air 802.11 operation. Exam caveat: Encrypted data does not equal “nothing to observe”; OSWP recon emphasizes management/control visibility under authorization. Operational check: In monitor mode on an in-scope channel, confirm beacons and assoc activity for the target BSSID are visible even when data payloads remain undecipherable, and record those observations before any RoE-limited active tests.