Audit a network you own and separate the real controls from the theatre

short · 35 min · Objective 2.1

Task

Inspect the wireless configuration of a network you own, classify every security-related setting as effective or theatre with a reason, and configure a guest network with isolation. The classification is the exercise, because two of the most commonly recommended settings are worth nothing and being able to say why is genuinely useful.

Steps

  1. Record the current configuration in lab/wifi/current.csv with header setting,value,effective_or_theatre,why covering the security mode, the protocol generation, whether the network name is broadcast, whether address filtering is on, and whether the quick-setup feature is enabled.
  2. Write lab/wifi/generations.csv with header protocol,what_broke,accept_today covering the four generations.
  3. Configure a guest network with client isolation if your equipment supports it, and record what you set in lab/wifi/guest.csv with header setting,value,what_it_prevents. If the equipment cannot, record that instead and state what you would need.
  4. Write lab/wifi/theatre.md explaining, for the hidden network name and for address filtering, exactly why each fails and what it costs in administration and user friction.
  5. Write lab/wifi/plan.md listing the changes you would make in priority order, with the client compatibility risk of each.

Verify

awk -F, 'NR>1 && NF>=4 {n++} END {print n" setting(s) classified"}' lab/wifi/current.csv
awk -F, 'NR>1 && $3 ~ /theatre/ {n++} END {print n" setting(s) called theatre"}' lab/wifi/current.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" generation(s)"}' lab/wifi/generations.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" guest setting(s)"}' lab/wifi/guest.csv
grep -Eic 'probe|clear|changed in software|seconds' lab/wifi/theatre.md
grep -Ec '^[-*0-9]' lab/wifi/plan.md

Five settings classified, four generations compared, and a theatre note explaining the actual mechanism of failure rather than asserting it. "It does not work" is an opinion; "the name appears in every client probe request" is a reason.

Notes

Client isolation on the guest network is the setting worth the most and the one most often left off. On a home network it breaks printing and casting, which is why it is not a default -- but on the guest network there is nothing to break.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.