WPA_CLI: what does [WPA2-PSK-CCMP][ESS] UTStarcom imply?

Question

00:1b:57:fd:50:bb       2462    -84     [WPA2-PSK-CCMP][ESS]    UTStarcom
6c:19:8f:0b:7e:60       2417    -84     [WPA-PSK-TKIP+CCMP][WPA2-PSK-TKIP+CCMP][WPS][ESS]       Dlink

if it's -PSK and -CCMP what is he running? and what does ESS imply in this context? (Extended Service Set is used to advertise multiple access points under a common SSID so how would authentication take place).

c0:8a:de:5f:8a:f8       2412    -79     [ESS]   XYZWiFiZone

Here, it's just ESS? What do the +/- sign imply. I assumed +CCMP implies CCMP is enabled (info is passed as part of the handshake) but if it's -CCMP -PSK and ESS.. what are they using to auth?

Solution

Those aren't minuses, they're connector hyphens.

UTStarcom is running WPA2-PSK (a.k.a WPA2-Personal).

It's using AES-CCMP as its confidentiality cipher. The other network has both TKIP and AES-CCMP enabled, so the ciphers are shown as a list connected with +'s.

I presume from context that [ESS] just means it's in normal AP mode, as opposed to this network being an IBSS (ad hoc network). ESS does not imply a multiple-AP roaming network. it just implies that the AP is a point of access to some kind of DS (Distribution System; could be a wired Ethernet LAN or a DSL or DOCSIS link or anything for that matter).