How to Audit Wireless Networks: A Practical Methodology

What this covers and who it is for

Auditing a wireless network means systematically discovering every access point and SSID in radio range, proving which ones belong to the organisation, testing how each one authenticates and what a client can reach after associating, and documenting the result well enough that someone can fix it and you can prove the fix later. It is a five-phase job: scope and authorisation, passive reconnaissance, active enumeration and capture, configuration and segmentation testing, and reporting with a re-test. This hub is the map for that job, and it links the tool-level guides that make each phase repeatable.

It is written for three readers: the IT generalist handed a laptop, an adapter and a vague instruction to check the wifi; the security practitioner who needs a defensible methodology rather than a bag of commands; and the manager who has to read the report and approve the fix. No prior wireless audit experience is assumed, but you should be comfortable on a Linux command line and know what a VLAN and a DHCP scope do.

Scope and authorisation: Everything in this guide that transmits — deauthentication, association attempts, WPS PIN attempts, captive portal testing, evil twin simulation — must run only against networks you own or have written permission to test. Get the rules of engagement in writing before you plug in an adapter: named BSSIDs in scope, excluded BSSIDs (neighbours, tenants, anything you cannot attribute), permitted techniques, whether disruption is allowed, the testing window, the escalation contact, and where capture files go afterwards. Passive listening is not automatically legal either: many jurisdictions treat intercepting radio traffic as interception regardless of intent. If you cannot produce a signed authorisation, stay a spectator.

The short version

Audit the configuration, not the crack. A passphrase you recovered is evidence; the finding is the weak policy, the missing segmentation, or the client that trusts any access point with the right name.

1. Paper first. Written scope, BSSID list, technique allowlist, stop conditions.
2. Listen before you talk. Passive survey with a monitor-mode adapter, logged, walked and reconciled against the asset register.
3. Enumerate and capture. One access point at a time, on the right channel, with a capture you have verified is usable.
4. Test what a client can reach. Association, DHCP, DNS, client isolation, VLAN boundaries, management interfaces.
5. Test the client, not just the access point. Enterprise wireless fails at certificate validation far more often than at the RADIUS shared secret.
6. Report with evidence, then re-test. Every finding gets a screenshot, a capture reference, a fix, an owner and a date.

Key concepts you need first

Wireless auditing has its own vocabulary, and most report confusion comes from mixing layers. Keep these separate.

• BSSID versus ESSID. The ESSID is the name users see. The BSSID is the radio’s MAC address. One ESSID is usually several BSSIDs — a 2.4 GHz radio, a 5 GHz radio, a 6 GHz radio, plus repeaters. Scope in BSSIDs, report both.
• Managed versus monitor mode. Your adapter must enter monitor mode and capture raw 802.11 frames with radiotap headers. Without that you are auditing what the operating system chooses to show you, which is not an audit.
• The encryption family. Open, WEP (broken by design — report it rather than spending a day proving it), WPA and WPA2-Personal (a shared passphrase plus a handshake or PMKID you can attack offline), WPA2 and WPA3-Enterprise (802.1X with EAP, where the interesting failures are client-side), WPA3-SAE (no offline dictionary attack on the handshake, though transition modes still matter), and OWE for encrypted open networks.
• Captures. A four-way handshake proves a client associated. A PMKID can sometimes be pulled from the access point without a client at all. Both are only useful if the passphrase is guessable, and that is a policy question, not a tool question.
• Rogue, evil twin and shadow IT. A rogue access point is unauthorised hardware on your network. An evil twin impersonates a legitimate ESSID. Shadow IT is the access point someone bought because the wifi in the warehouse is bad. All three appear in a passive survey; only the first two are usually attacks.
• Management frames. Deauthentication and disassociation frames are unauthenticated unless protected management frames (802.11w, or PMF) are enforced. That is why deauth is both the easiest disruption to cause and the easiest to detect.

How to apply this

Phase 1: scope and authorisation

Build the target list before you transmit anything. Pull the SSID and BSSID inventory from the controller or your own records, mark what is in scope and what is excluded, and agree which techniques are permitted. Two questions catch most later problems: may I deauthenticate clients, and what if I find an access point nobody recognises? Record the answers. Agree capture handling too, because handshakes contain material that can be attacked offline indefinitely and EAP captures can contain usernames.

Phase 2: passive survey and inventory reconciliation

Walk the site with a monitor-mode adapter and a logging tool. The passive survey answers the two questions that matter most: what is actually radiating here, and which of it is yours? Log across a full business day and a quiet period; personal hotspots appear and vanish. Then reconcile: every BSSID observed is on the authorised list, a documented neighbour, or a finding. Hidden SSIDs are not a control — they appear as an unnamed BSSID, and clients reveal the name when they probe.

Phase 3: active enumeration and capture

Now work one access point at a time, deliberately. A command-line sweep is the fastest way to triage a site, a GUI is the fastest way to explain the process to a client looking over your shoulder, and a targeted capture tool is what you reach for when the report needs a clean handshake. Whichever you use, verify the capture before you leave: count the EAPOL frames, confirm channel and BSSID, and rehearse the cracking workflow against a lab access point whose passphrase you already know.

Phase 4: configuration and segmentation testing

This is where the audit earns its fee. For each SSID, record the encryption mode and whether a transition or downgrade mode is enabled, WPS state, PMF state, whether the management interface still uses default credentials and whether it is reachable from the wireless side, and which VLAN and DHCP scope clients land in. Then test reachability from an associated client, with permission: can one guest reach another? Can the IoT SSID reach the corporate file share? Is a management network shared with users? Most wireless compromises are lateral movement across a flat network, not a broken cipher.

Phase 5: the client side and enterprise authentication

Enterprise wireless fails in predictable places. Capture an EAP exchange and look at what the outer identity exposes — often the domain and username format, which feeds straight into password spraying against the VPN. Then test whether the supplicant validates the RADIUS server certificate: stand up an access point with the corporate ESSID and a different certificate, and see whether devices refuse, warn, or silently connect. A warning that users click through is a finding. Per-user credentials with enforced certificate validation beat any shared key.

Worked example

Take a representative single-site engagement: three floors, six access points, three SSIDs (corporate, guest, IoT), 2.4 and 5 GHz enabled, eleven BSSIDs named in scope, deauthentication expressly forbidden.

1. The passive survey logged twenty-one BSSIDs. Ten belonged to neighbouring businesses and were documented as out of scope. Eleven matched the scope list, and one of those eleven was a printer SSID nobody had claimed.
2. The printer access point had WPS enabled and a passphrase straight off the vendor default list. Because deauth was forbidden, the auditor captured the handshake from a test laptop they controlled, then attacked it offline in the lab.
3. Associating to the printer SSID landed the client in the same VLAN as the finance file server. That flat path, not the passphrase, was the headline finding.
4. On the guest SSID, client isolation was off, so two authorised test laptops could reach each other. On the corporate SSID the EAP outer identity leaked the username format, but the supplicant did reject the impostor certificate, so that control was working.
5. The report listed three findings, each with evidence (capture file reference, WPS screenshot, VLAN path), an owner and a re-test date. After the printer access point was removed and guest isolation enabled, the re-test closed two findings; the third, EAP identity privacy, went to the identity team.

The same steps from the defender’s chair

Every phase above has a defensive counterpart, and an audit that does not produce these actions is half finished. Baseline the BSSIDs that should exist and alert on new ones: that is how rogue access points and shadow IT get caught between audits. Disable WPS everywhere and treat hardware that cannot disable it as legacy to be replaced. Enforce protected management frames so deauth floods are harder to run and louder when they happen. Isolate guest and IoT traffic at layer 2 and prove it with a test, not a diagram. Enforce certificate validation on enterprise supplicants by policy, and stop devices from auto-joining open or remembered networks they no longer need. Run the passive survey on a schedule rather than annually — the radio environment changes with every hotspot someone plugs in.

Where people get this wrong

• Treating the crack as the deliverable. A recovered passphrase with no discussion of what it unlocks is trivia. Report the path, the data reachable, and the control that failed.
• Deauthenticating everything in sight. It drops VoIP calls, warehouse scanners, medical telemetry and anything on battery, and it is usually the technique that voids your authorisation. If it is not explicitly permitted, do not do it; even then, target a client you control.
• Believing hidden SSIDs and MAC filtering are controls. Both are visible to anyone with the right adapter and a few minutes.
• Only testing Personal networks. Enterprise client certificate validation is where real environments fail, and it gets skipped because the tooling is less convenient.
• Skipping 5 GHz and 6 GHz. A 2.4 GHz-only survey misses access points, and modern clients prefer the higher bands.
• Not verifying the capture on site. Leaving with hours of frames and no usable handshake is the most common wasted day in wireless testing.
• Unbounded cracking. Agree a wordlist strategy and a stopping rule up front, or you will still be running a GPU job a week later with no report written.
• Poor evidence handling. Captures and EAP logs are sensitive. Store them encrypted, name them per engagement, and delete them on the agreed schedule.
• Attributing a neighbour’s access point to the client. Reconciling BSSIDs against the asset register prevents an embarrassing accusation.
• Assuming WPA3 ends the conversation. Transition modes, client behaviour and segmentation still decide whether an attacker who gets on the wireless reaches anything worth having.
• No re-test. Without it you have an opinion, not an audit.

Where to go next

Work through the cluster in engagement order. Start with reconnaissance and rogue access point detection in Kismet: wireless recon and rogue access point detection, which covers the passive survey phase and how to tell a rogue from a neighbour. Move to Wifite: auditing WPA and WPA2 wireless networks from the command line for the triage sweep — what it automates, what it hides from you, and when to drop to targeted capture. If you prefer a visual workflow, or need to demonstrate the process to someone else, the Fern WiFi Cracker guide to GUI wireless auditing on Kali Linux walks the same phases with a graphical interface. Before you buy hardware, read the guide to WiFi adapters for wireless auditing: chipset and monitor-mode support decide whether any of the above works at all.

Then run the loop again next quarter: scope, survey, capture, segmentation, report, re-test. Keep the BSSID baseline between engagements so the next survey starts from an inventory instead of a blank page.