Certified Ethical Hacker (CEH) Practice Question

The 802.11i Counter Mode with CBC-MAC Protocol (CCMP) adds an 8-octet CCMP header in front of each encrypted payload. The first 48 bits (6 octets) of that header are the Packet Number (PN) used as part of the AES counter, followed by 2 octets that contain the Key ID and Extended IV (Ext IV) flags. TKIP also carries an extended IV but it is 4 octets long, not 6, and it does not use AES. WEP uses only a 24-bit (3-octet) IV with RC4. GCMP-introduced with WPA3-relies on a similar 8-octet header but normally appears in networks that advertise RSN capabilities containing GCMP suites; those were not observed in the given capture. Therefore, the presence of an AES cipher and the specific 48-bit PN structure point to CCMP.