Wireless › Module 9 › Lesson 4
Defense Lab
Apply WPA3/PMF and AP checklist on $LAB_SSID — verify settings and client connect.
Visual · t15_defense_lab
Lab: harden $LAB_SSID AP. Original Cyberlium.
Opening
Turn the checklist into screenshots of settings — not scans of the neighborhood.
Walk AP hardening checklist on YOUR lab AP: firmware version recorded, WPS off, WPA3/PMF enabled, admin password rotated, segmentation verified with ping tests from lab client to management net (should fail). Document before/after. Optional: enable AP logs and associate once — note log entry. No deauth tests against foreign BSSIDs.
1. Before audit
Export or screenshot current wireless settings redacted.
Note weak items honestly.
Command guide
Try these commands — Before audit
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Defense lab — https://www.wi-fi.org/discover-wi-fi/security Wireless best practices — https://www.cisecurity.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager sudo apt install tcpdump
macOS: Use airport / System Settings
Windows: Use netsh wlan (built-in) Use Wireshark or install via WSL
═══ LINUX / macOS ═══
Command — copy this
nmcli -f SSID,BSSID,SECURITY,SIGNAL device wifi list 2>/dev/null | head -15 sudo tcpdump -i any -c 8 -n 2>/dev/null || echo 'Baseline capture on YOUR machine'
Primary tools to practice this lesson: nmcli, tcpdump. Reference sites: Defense lab (https://www.wi-fi.org/discover-wi-fi/security); Wireless best practices (https://www.cisecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Apply checklist
Enable WPA3/PMF, disable WPS, rotate admin cred.
Verify lab client still connects.
3. Segmentation test
From lab client, confirm cannot reach management IPs.
Save evidence; chmod 600.
4. What you ship: defense lab evidence
Checklist walk + redacted settings + segmentation test result.
5. What you record before the next lesson
Defense lab notes path.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Test deauth defense by attacking neighbor AP.
Right
Hardened $LAB_SSID AP. Next: quiz.
Mission: defense lab
1) Before/after settings on $LAB_SSID. 2) Apply checklist items. 3) Segmentation ping test documented.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “PMF required vs capable?”
Knowledge Check
APPLY: Defense lab target:
Multiple choice
Knowledge Check
APPLY: True or False: Neighbor deauth tests are defense lab.
True or False
Knowledge Check
APPLY: Segmentation test proves:
Multiple choice