A student continuously hops channels while trying to capture one municipal AP. What method correction is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Chasing one AP while channel-hopping is how handshake pieces fall on the floor. Park on that AP’s channel and stay there until the capture is complete.
Full Explanation
When capturing against one municipal AP, the interface should be fixed to that AP’s operating channel. Continuous hopping causes the radio to leave the channel while EAPOL or other critical frames fly, producing incomplete evidence. The method correction is stop hopping for focused capture once the target BSSID and channel are known. Hopping faster to guarantee every handshake on all bands simultaneously fails by concept: one radio still occupies one channel at a time; faster hops increase miss probability for a single BSS. Disabling the adapter to reconstruct missing frames from ARP caches fails by concept: ARP caches do not rebuild 802.11 handshakes. Targeting only Bluetooth LE ads because they include WPA handshakes fails by concept: WPA handshakes are 802.11 EAPOL, not BLE advertisements. Exam caveat: hopping remains useful for initial survey; the error is hopping during the focused capture phase against a chosen civic AP. Operational check: identify the target AP channel from survey, lock the monitor interface, confirm continuous beacons from that BSSID, then capture until a complete handshake appears under RoE. In civic practice, write the decision and the verification command into the engagement notes so another assessor can repeat the check on the next shift without rediscovering the same pitfall under time pressure.