A municipal capture includes EAPOL frames. What role should an assessor recognize for those frames?
Select an answer to reveal the explanation.
Short Explanation
EAPOL is where the 4-way handshake lives for Personal-class analysis. Spot those frames and you are looking at key negotiation traffic—not Bluetooth trivia.
Full Explanation
EAPOL frames in a municipal capture carry the 4-way handshake material that is critical to Personal (PSK) offline-attack analysis classes. Recognizing EAPOL lets assessors know they have key-exchange evidence to take offline under RoE rather than endless live guessing against the AP. Enterprise networks also use EAPOL, but the stem’s Personal offline-attack framing highlights handshake utility for PSK workflows. Saying EAPOL only advertises Bluetooth pairing codes fails by concept: EAPOL is 802.1X/key-management signaling on the LAN/WLAN path, not Bluetooth pairing ads. Claiming EAPOL replaces beacons and removes the need to know the BSSID fails by concept: you still need BSS identity and usually still see beacons; EAPOL does not obsolete BSSID tracking. Asserting EAPOL proves the AP has no encryption because frames are always open data fails by concept: handshake frames are part of setting up encryption; their observability does not mean the BSS is an open network without crypto. Exam caveat: a partial handshake may be insufficient—verify message completeness before spending civic lab time on cracking attempts. Operational check: filter the capture for EAPOL, confirm the 4-way messages for the target BSSID/client, hash or label the evidence file, and only then run authorized offline passphrase testing against that material.