The 4-way handshake is the process that establishes the pairwise transient key (PTK) between the client and the AP in WPA2-PSK. The PTK is derived from the PSK, the SSID, and some random numbers exchanged in the handshake frames. The PTK is used to encrypt and decrypt the data frames between the client and the AP.  Therefore, in order to decrypt WPA2-PSK data packets, a protocol analyzer needs to capture the 4-way handshake frames and have the PSK and SSID configured in the analyzer software 1 2  References:

CWAP-405 Study Guide, Chapter 3: 802.11 MAC Layer Frame Formats and Technologies, page 87

CWAP-405 Objectives, Section 3.5: Analyze security exchanges

A STA that supports 802.11k Radio Measurement would send a Neighbor Request to an AP to request a list of neighboring APs which the STA can use as roaming candidates. A Neighbor Request is an Action frame that contains a subelement specifying the type of information that the STA wants to receive from the AP. A Neighbor Report is an Action frame that contains a subelement with a list of neighboring APs that match the criteria specified in the Neighbor Request. The Neighbor Report provides information such as BSSID, channel, operating class, and PHY type of each neighboring AP. This information helps the STA to perform intelligent roaming decisions based on signal quality, load, and compatibility . References: CWAP- 405 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 12: 802.11k/v/r/u/w/ai Amendments, page 434; CWAP- 405 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 12: 802.11k/v/r/u/w/ai Amendments, page 435.

The beamformee transmits a Feedback Matrix within the Compressed Beamforming frame to the beamformer. The Feedback Matrix contains information about the channel state between the beamformee and each spatial stream of the beamformer.  This information is used by the beamformer to adjust its transmit weights and optimize its signal for the beamformee 3 4 . References: CWAP- 405 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 11: 802.11n/ac/ax PHYsical Layer Frame Exchanges, page 403 3 ; CWAP- 405 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 11: 802.11n/ac/ax PHYsical Layer Frame Exchanges, page 406 4 .

The users on floor 5 are being subjected to a denial of service attack, as this is happening across the entire floor it is likely to be a misconfigured WIPS solution belonging to the tenants on the floor below. This is because the Deauthentication frames have a source address that matches the BSSIDs of the customer’s APs and a destination address that is a broadcast address (FF:FF:FF:FF:FF:FF). This indicates that someone is sending spoofed Deauthentication frames to all STAs associated with the customer’s APs, causing them to disconnect from the wireless network.  This is a common type of DoS attack on wireless networks, and it could be caused by a rogue device or a WIPS solution that is configured to protect the wireless network of another tenant on the floor below 1 2 . References: CWAP- 405 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 13: Troubleshooting Common Wi-Fi Issues, page 496 1 ; CWAP- 405 Certified Wireless Analysis Professional Study and Reference Guide, Chapter 14: Troubleshooting Tools, page 527 2 .