When you press the wireless connection button on your smartphone or laptop, you don't see what's going on "under the hood." At that moment, a complex digital dialogue unfolds between your device and the router, which engineers call handshakeThis is not just an exchange of greetings, but a critical process of authentication and encryption key generation, without which data transfer is impossible.
This process is visually hidden from the user, but its "picture" can be seen in specialized sniffer programs like Wireshark, where it appears as a sequence of Management Frames. The speed and success of these stages determines how quickly the Wi-Fi icon appears and how quickly pages load. If the process is interrupted, you see an endless "Obtaining IP Address" screen or an "Unable to Connect" error.
Understanding what it looks like 4-way handshake (four-way handshake) is essential for anyone looking to properly configure a home network or troubleshoot an unstable connection. In this article, we'll examine the anatomy of a connection, examine the data packets flying through the air, and discover why older devices can slow down the entire network.
Anatomy of a Connection: What Happens in the Ether
The process of connecting to a hotspot begins long before you enter a password. First, your device (Station or STA) must find the network by scanning the air. Router (Access Point or AP) constantly sends out special beacons - Beacon frames, which contain the network name (SSID) and supported security standards. Your device listens for these signals and decides whether to initiate a connection.
Once you've selected a network, the association phase begins. The device sends an association request, and the router acknowledges it, allocating resources to the new client. However, the data isn't yet encrypted. At this stage, capabilities are exchanged: the devices agree on speeds and protocols (802.11ac, 802.11ax) they support. Only after successful association does the most important stage begin—authentication.
This is where the mechanism comes into play WPA2/WPA3, which requires confirming knowledge of the password without transmitting it in cleartext. This process consists of a series of four frames circulating between the client and the router. If even one packet is lost or rejected, the connection fails, and the process must be restarted.
⚠️ Note: If you have a router with complex security settings (for example, Enterprise mode with a Radius server), the handshake process may take longer due to additional requests to the authorization server.
Four Steps of Security: 4-Way Handshake
The heart of the connection process is the protocol 4-Way HandshakeIts purpose is to confirm that both parties know the shared secret (password) and generate temporary encryption keys for the session. The first step begins with the access point generating a random number (ANonce) and sending it to the client. This number is needed to create a unique key.
Upon receiving the ANonce, the client device generates its own random number (SNonce) and, using both numbers plus the known password, calculates a temporary key. It then sends the SNonce and the checksum back to the router. The router, knowing the password and having both random numbers, performs the same calculations. If the results match, the password is correct.
In the third and fourth stages, final synchronization occurs. The router sends an acknowledgement to the client and sets a key re-rotation timer. The client responds with a final acknowledgement frame. At this point, the channel is considered secure, and user data transmission begins. This entire exchange appears to the sniffer as a chain of EAPOL (Extensible Authentication Protocol over LAN) frames.
What are PMK and PTK?
The PMK (Pairwise Master Key) is a key derived from the password and SSID. The PTK (Pairwise Transient Key) is a temporary key generated for each session. Even if a hacker intercepts the handshake, without the PMK, they won't be able to decrypt the traffic, as the PTK is generated dynamically using random numbers.
It's important to understand that this dance repeats every time you reconnect (for example, after waking up from sleep mode). Modern standards try to speed up this process, but the fundamental logic remains the same. Any delay in any of the four steps results in the perception of a "slow connection."
Process visualization: what the sniffer sees
If you open a traffic analysis program, such as Wireshark, and initiate a connection, you'll see a stream of control frames. These don't contain any useful data (such as website text), but they do carry service information. In the list, you'll notice frames labeled "Authentication," "Association Request/Response," and "EAPOL-Key."
EAPOL-Key frames are the visual representation of the handshake. There are usually four of them, but sometimes, if a packet is lost in the air, there may be more due to retransmissions. In the protocol column, you'll see 802.11, and in the frame details, the Key MIC and Key Replay Counter fields. These fields are critical for protecting against replay of old packets by attackers.
This information may seem complex to the average user, but it can help diagnose problems. For example, if you see hundreds of Deauthentication frames immediately after Association, it means the router is forcibly disconnecting. If you only see Beacon frames but no Association requests, it means the device isn't even attempting to connect, possibly due to a hidden SSID or driver issues.
| Frame type | Direction | Purpose | Contains keys? |
|---|---|---|---|
| Beacon | AP → Client | Network announcement | No |
| Auth Request | Client → AP | Access request | No |
| EAPOL-Key (1/4) | AP → Client | ANonce transfer | No |
| EAPOL-Key (2/4) | Client → AP | SNonce + MIC Transfer | Yes (MIC) |
| Data Frame | Both | Data transfer | Encrypted |
By analyzing the timestamps between these frames, you can determine where the delay is occurring. If the delay between the first and second packets is significant, the problem may be client-side (a weak processor or driver). If it's between the third and fourth, the connection channel or the router itself may be overloaded.
Connection problems and delays
One of the most common problems is a handshake that takes too long. The user sees the network "connecting" for several seconds before internet access is available. The culprit is often the PMK caching (or Pre-authentication). If it doesn't work correctly, the device is forced to go through a full authentication cycle every time, even if it has recently connected to the network.
Another common cause is incompatible encryption standards. If the router is configured for mixed mode WPA/WPA2, and the device is trying to use WPA3 (or vice versa), the handshake process can be repeated multiple times until a timeout interrupts the attempt. Distance also plays a role: with a weak signal, EAPOL packets are lost, and devices waste time resending them.
In corporate networks with multiple access points, roaming issues can arise. When you move from one AP's range to another, the handshake should occur instantly (Fast Roaming / 802.11r). If the 802.11r standard is not supported or configured incorrectly, you will experience connection drops while walking around the office.
⚠️ Please note: Router settings interfaces are constantly being updated. The names of features such as "Fast Roaming" or "PMKID" may differ depending on the firmware version. Always consult the official documentation for your device model.
The Impact of Safety Standards on Speed
The choice of security protocol directly affects the appearance and duration of a handshake. The old standard WEP (which is now strictly forbidden to use) had a primitive handshake that could be hacked in seconds. WPA2 implemented a robust 4-way key exchange, which added latency but provided security.
The latest standard WPA3 changed the mechanics of the process, implementing protection against brute-force password attacks (SAE – Simultaneous Authentication of Equals). In WPA3, the handshake is different: it protects against hash interception even if the password is weak. However, on older devices, WPA3 support can cause conflicts and increase connection times due to attempts to negotiate the protocol.
Using complex passwords doesn't slow down the handshake itself, as the math operations are performed quickly. However, if you use external authentication servers (RADIUS), the latency depends on the server's response speed. For a home user, the difference in connection speed between WPA2 and WPA3 will be imperceptible on modern equipment.
☑️ Diagnosing connection issues
Optimizing and accelerating your connection
To ensure the fastest possible handshake, it's essential to ensure a clear airwave. Using a 20 MHz channel in the 2.4 GHz band often provides a more stable and faster connection than 40 MHz, as it reduces errors and retransmissions of control packets. In the 5 GHz band, 80 MHz is a safe bet.
Also worth paying attention to is the function Group Key Update Interval in the router settings. This is the interval at which group keys are changed. Changing them too frequently (for example, every 30 seconds) can create unnecessary load and micro-delays, although this is beneficial for security. The optimal value is 3600 seconds (1 hour).
If you have many smart home devices that are constantly reconnecting, they can create a handshaking storm, overloading the router's processor. Separating these devices into a separate guest network will help isolate their traffic and speed up the connection of your main devices.
Don't forget that hardware matters too. Cheap routers with weak processors can take a long time to process encryption requests, especially if additional features like parental controls or antivirus software are enabled. In such cases, the handshake acts as a queue of tasks that the processor can't process immediately.
Frequently Asked Questions (FAQ)
Is it possible to intercept a Wi-Fi password during a handshake?
The password itself cannot be intercepted, as it is not transmitted in cleartext. However, attackers can intercept hashes (handshakes) and attempt to brute-force the password offline. This is why it is so important to use complex passwords that cannot be easily guessed.
Why does my phone take a long time to connect to Wi-Fi after waking up from sleep mode?
This happens because the device must re-associate and handshake with the access point. If the power saving feature is enabled, the Wi-Fi module may have completely shut down, requiring a full connection cycle rather than simply reestablishing the session.
Does the number of connected devices affect the speed of a handshake?
Yes, it does. Each new device requires the router's processor to process authentication frames. If many clients connect simultaneously, the processing queue grows, and the response time for handshake requests increases, leading to delays in network access.
What is PMKID and how does it relate to a handshake?
The PMKID is the master key identifier of the pair. Modern attacks and diagnostics often use the PMKID, which the router sometimes outputs in the first Beacon or Response frame, allowing one to attempt to brute-force the password without having to wait for the client to fully connect (a full 4-way handshake).