netviz

802.11 · WiFi

Open network what you give up

No password, instant join — and every frame you send readable by anyone with an antenna. The open network is the baseline the rest of Wi-Fi security improves on. This plate shows exactly what's missing, so the other plates mean something.

Sequence diagram poster of the WPA2 4-way handshake

Requesting scene from the content service…

2 frames
the whole join
Protected = 0
cleartext on the wire
passive sniffingdeauth floodno RSN, no MFPcaptive portal

What you'll learn

  • Why an open join takes only two formalities — and why no controlled-port quarantine exists without keys.
  • What 'Protected = 0' means on the wire, and what a passive sniffer harvests from it.
  • Why deauth floods devastate open networks specifically (no MFP without RSN).
  • How captive portals add accountability but never encryption.
  • Why Wi-Fi 6E's 6 GHz band bans open networks outright — OWE is the mandatory successor.

The baseline, on purpose

Every other plate in this book — WPA2, WPA3-SAE, OWE — exists to fix something. This plate is the something. A legacy open network performs the shortest join in Wi-Fi: a fossil Open System Authentication (two frames that verify nothing) and an association with no security element at all. Data flows immediately, because there are no keys to wait for and no controlled port to hold it back.

The convenience is genuine and so is the cost: with no RSN, there is no encryption and no protection for management frames. Everything is readable, and a forged disconnect order is indistinguishable from a real one.

Seeing the cost makes the fixes obvious

The plate's failure scenarios are the whole point. A passive sniffer collects every cleartext frame while transmitting nothing — the only attack in this book that leaves no trace. A deauth flood knocks clients offline indefinitely, because the defense (802.11w management-frame protection) requires the very RSN an open network lacks.

Watching this is the fastest way to understand why OWE (the OWE plate) exists: it keeps the no-password convenience and removes the cleartext exposure with no user-visible change. On 6 GHz, regulation already finished the argument — open networks are simply not allowed.

← Previous plate

Sharing the air · CSMA/CA · OFDMA · MU-MIMO

Next plate →

Captive portal (CWA) · Wi-Fi 5

Atlas index