During analysis of an authorized municipal capture, an assessor filters Wireshark for EAP identity strings. What can those fields usefully reveal?
Select an answer to reveal the explanation.
Short Explanation
When Enterprise Wi-Fi talks 802.1X, identity strings can spill a username or realm into the capture. That is recon gold for understanding the AAA surface—not a free PSK for Personal networks. Filter for it, note it, stay in scope.
Full Explanation
Filtering an authorized municipal capture for EAP identity strings can reveal usernames or realms from Enterprise EAP exchanges, which helps map attack-surface context such as identity store hints, roaming realms, and potential evil-twin phishing themes. Those fields support Enterprise wireless understanding without exposing a Personal PSK. Civic analysts use them carefully because identities are sensitive. Saying EAP identity fields reveal the cleartext WPA2 PSK for every Personal network on the channel fails by concept: identities are Enterprise EAP concepts, not Personal passphrase disclosure for all BSS. Claiming they prove WPS is disabled on all neighboring APs fails by concept: identity strings do not encode neighbor WPS state. Asserting they yield GPS coordinates of every client regardless of capture location fails by concept: EAP identity is not geolocation. Exam caveat: minimize publishing raw usernames in public-facing civic reports—prefer redacted realms or counts unless the owner requires full identity evidence in a sealed appendix. Operational check: apply Wireshark/tshark EAP identity filters on the Enterprise capture, record distinct realms/usernames under privacy rules, map them to expected IdP patterns, and note anomalies that suggest misconfiguration or spoofing risk under RoE.