An assessor captured only two EAPOL messages toward a municipal WPA2-Personal target. What should they conclude about offline PSK testing readiness?
Select an answer to reveal the explanation.
Short Explanation
Half a handshake is like half a key—it looks related, but the lock still will not turn for offline testing. Go back, stay on channel, and capture the full exchange (or an equivalent usable set). Two lonely EAPOL frames usually mean 'not ready yet.'
Full Explanation
Offline PSK testing against a municipal WPA2-Personal target typically needs a complete handshake or an equivalent usable message set. Capturing only two EAPOL messages is often insufficient for reliable offline verification, so assessors should conclude they are not yet ready and continue collecting under RoE rather than forcing aircrack-ng against incomplete evidence. Completeness beats wishful cracking. Saying any two EAPOL frames always form a complete handshake fails by concept: message roles matter; arbitrary pairs are not automatically sufficient. Claiming two messages are ideal because tools discard message 3 and 4 by design fails by concept: tools need a usable set, not a philosophy of discarding half the handshake. Preferring incomplete captures to reduce evidence retained fails by concept: civic evidence standards favor complete, verifiable artifacts. Exam caveat: some tool versions can work with certain message combinations—verify usability in the analyzer before declaring failure, but do not assume two random EAPOL frames are enough. Operational check: inspect EAPOL message numbers for the target BSSID/client, continue passive or authorized-deauth capture until the usable set is present, then begin offline testing and document which messages supported the attempt.