Day 25/365: Wireless Networking -- Reading What Your Wi-Fi Security Actually Is

A teammate forwards a classic small-office report: the Wi-Fi is slow, and the router shows a device nobody recognizes. The temptation is to jump straight to "we've been hacked." The professional move is to answer a quieter question first: what authentication and cipher is this network actually using? Because "connected" tells you nothing about safety. WEP, WPA2, and WPA3 all look identical from the status bar and could not be further apart in practice.

This is a defensive walkthrough. No cracking tools, no handshake capture, no attack recipe -- just the built-in commands that let you read and verify your own wireless security on Windows.

Read the live connection

The single most useful command here is netsh wlan show interfaces. It reports the live association and, crucially, the negotiated authentication and cipher.

C:\> netsh wlan show interfaces

    SSID                   : SmallOfficeNet
    BSSID                  : 02:1a:2b:3c:4d:5e
    Radio type             : 802.11ac
    Authentication         : WPA2-Personal
    Cipher                 : CCMP
    Channel                : 44
    Signal                 : 78%

WPA2-Personal plus CCMP is WPA2 with a pre-shared key using AES -- the acceptable floor. If Authentication read WEP, or Cipher read TKIP, the network would be broken by design. Read those two fields together; the signal percentage tells you about range, never about security.

Confirm the saved profile and its key state

Once the live link checks out, verify the stored profile so you know what the machine will reconnect to automatically. Inspecting a profile shows the security configuration, and key=clear is the supported, built-in way to confirm the passphrase is actually set the way you expect when you are the legitimate administrator of that device.

C:\> netsh wlan show profile name="SmallOfficeNet" key=clear

    Authentication         : WPA2-Personal
    Cipher                 : CCMP
    Security key           : Present
    Key Content            : <your-configured-passphrase>

    Connection mode        : Connect automatically
    Cost                   : Unrestricted

The point of this view is to confirm two things on a device you own: the network is on an acceptable cipher, and Connection mode is what you intend. An auto-connecting profile for a weak network is a liability, because it will silently rejoin a network of that name without asking.

The standards ladder

The reason all of the above matters comes down to the ladder:

• WEP -- broken. Key recovery is a solved problem. Treat any WEP network as open.
• WPA2-PSK with AES-CCMP -- the workable floor. Sound cipher, but the four-way handshake can be captured passively and the passphrase attacked offline with unlimited attempts. A long, random passphrase is the only thing protecting it.
• WPA3-SAE -- the upgrade. Its Simultaneous Authentication of Equals handshake resists offline dictionary attacks, because each guess requires a fresh, rate-limited interaction with the network instead of grinding a captured handshake on private hardware.

That is the whole reason WPA3 exists from a defender's view: it removes the offline-guessing shortcut that WPA2 leaves open.

The slowness was the band

The report started with "slow," and slow is usually a band story. The 2.4 GHz band has only three non-overlapping channels (1, 6, 11) and is saturated in dense areas; 5 GHz has far more room. The interface above showed channel 44 -- 5 GHz, healthy. Had it been 2.4 GHz channel 6 in a crowded block, congestion alone would explain the complaint with no intruder involved.

What I handed back

WPA2-Personal with CCMP, a strong passphrase, the "unknown" device traced to the manager's own tablet, and a recommendation to move to WPA3 when the last incompatible device is replaced. The deliverable was not a verdict, it was the rerunnable trail: netsh wlan show interfaces for the live cipher, netsh wlan show profile name=... key=clear to confirm the stored config on your own device, and the ladder to explain why connected is never the same as secure.