Wireless › Module 9 › Lesson 1
WPA3 and PMF
WPA3-SAE and Protected Management Frames — upgrade path for YOUR lab AP.
Visual · t15_wpa3_pmf
WPA3 + PMF = modern Wi-Fi hardening. Original Cyberlium.
Opening
Defense wins when the protocol stops offline guessing and frame tampering.
WPA3 personal uses SAE (Dragonfly) to resist offline dictionary attacks on captured handshakes compared to WPA2-PSK. Protected Management Frames (802.11w PMF) sign deauth/disassoc frames — reducing deauth-DoS and some twin tricks when required. Configure YOUR lab AP to WPA3 or WPA2/WPA3 transition for testing; document client compatibility. Enterprise uses WPA3-Enterprise with proper EAP — next lesson.
1. WPA3-SAE benefits
Forward secrecy session keys; improved resistance to offline PSK guessing.
Transition mode may allow WPA2 clients — know downgrade risk window.
Command guide
Try these commands — WPA3-SAE benefits
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
WPA3-PMF — https://www.wi-fi.org/discover-wi-fi/security AP hardening — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager sudo apt install iw
macOS: Use airport / System Settings Prefer Linux lab VM for iw
Windows: Use netsh wlan (built-in) Use Kali VM / WSL with iw
═══ LINUX / macOS ═══
Command — copy this
nmcli -f SSID,SECURITY device wifi list 2>/dev/null | grep -iE 'wpa3|pmf' | head -5 || nmcli device wifi list 2>/dev/null | head -8 iw phy 2>/dev/null | grep -i pmf | head -3 || true
Primary tools to practice this lesson: nmcli, iw. Reference sites: WPA3-PMF (https://www.wi-fi.org/discover-wi-fi/security); AP hardening (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. PMF (802.11w)
Required in WPA3; optional/required modes in WPA2 enterprise configs.
Blocks unsigned deauth/disassoc on supporting clients.
3. Lab apply
Enable WPA3/PMF on $LAB_SSID; test YOUR clients connect.
Document which legacy devices fail — plan replacement, not neighbor 'tests.'
4. What you ship: WPA3 + PMF summary
SAE benefit + PMF deauth protection + lab AP config note.
5. What you record before the next lesson
WPA3/PMF paragraph.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable PMF on office AP without change ticket to 'test deauth.'
Right
WPA3/PMF explained. Next: EAP hardening.
Mission: WPA3 PMF notes
1) Write SAE vs WPA2-PSK risk contrast. 2) Write PMF purpose. 3) Note $LAB_SSID WPA3/PMF setting.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Transition mode downgrade risk?”
Knowledge Check
APPLY: WPA3-SAE improves:
Multiple choice
Knowledge Check
APPLY: True or False: PMF signs management frames.
True or False
Knowledge Check
APPLY: PMF helps reduce:
Multiple choice