easures are invoked. These countermeasures consist of resetting keys, increasing the rate at which keys are updated, and sending an alert to the network manager. MIC also includes an optional countermeasure, which will deauthenticate all stations and shutdown the BSS for any new association for one minute, if an access point receives a series of altered packets in quick succession. The complete WPA encryption and integrity checking process is shown in Figure 8-4. 802.1x Authentication Framework IEEE 802.1x is an access control protocol that provides protection for networks by authenticating users. After successful authentication, a virtual port is opened on the access point for network access, while communications are blocked if authentication fails. 802.1x authentication defines three elements; The Supplicant - software running on the wireless station that is seeking authentication The Authenticator - the wireless access point that requests authentication on behalf of the supplicant and The Authentication Server - the server, running an authentication protocol such as RADIUS or Kerberos, that provides centralised Wireless LAN Security authentication and access control using an authentication database. The standard defines how the extensible authentication protocol (EAP) is used by the Data Link layer to pass authentication information between the supplicant and the authentication server. The actual authentication process is defined and handled depending on the specific EAP type used, and the access point, acting as an authenticator, is simply a go-between, enabling the supplicant and the authentication server to communicate. Authentication Servers (RADIUS) The application of 802. 1x authentication in an enterprise WLAN, requires the presence of an authentication server within the network, which can authenticate users against a stored list of the names and credentials of authorised users. The most commonly used authentication protocol is the remote authentication dial-in user service (RADIUS), which is supported 