• Is there an overview of errata in the Sybex CWAP Study Guide? 
    Found some at:,miniSiteCd-SYBEX.html

    Also in the CWNP forum lot of mentions concerning errors in the study guide and CD; but no complete overview. 

    Like some others also curious if there will be a new version in the near future.

  • Hans,

    Try this link on the CWNP forums for CWAP errata:

  • By hr_wifi - edited: January 29, 2014

    Thank you, very helpfull!

    Still a lot of questionmarks. I would like to see some kind of approval/acknowledgement from CWNP/Authors. Below a list of the found errors on the thread:

    P xxvi: Reading the intro of the Official CWAP Study Guide, it mentions the PW0-300 exam for the CWNE certification. My heart skipped a beat and I double-checked the website -- the PW0-300 exam has been replaced with a rigorous list of requirements and an application process.This book was published after the Official CWDP Study Guide, which (correctly) does not mention the PW0-300 exam.
    P 67/70 Chapter 2 Question 7: answer should be A,C,E
    P 85 Fig 3.13: Timing and size of second client PS-Poll is off
    Not sure, but aren't the 3rd PS-Poll and the following ACK, shown just before the "client dozing" section superfluous? It's not shown in the bottom part of 3.13.
    P 97, Figure 3.26: From DS is set to 0, it should be 1.
    P 103, Fig 3.32: The diagram is incorrect, but the explanation above it is correct.
    P 105 last paragraph, "The traffic indicator (TID) subfield...." ... it should be the traffic identifier
    P 106: Chapter 3, QoS Control Field section,
    It states that a TXOP limit of 1 restricts transmission during a TXOP to a single MPDU.
    It should say that a TXOP limit of 0 restricts transmission during a TXOP to a single MPDU.

    P 109, second line under Fig 3.35: Formula for G(x) ends with a "+" sign. It should end "+ x + 1"
    P 112, Chapter 3 Question 1: Destination shows last Octet of "DS". "S" is not a valid hex character.
    P 115, Chapter 3 Question 13, Hex value of Fragment Number shown as 0x0000. Should be 0x0002.
    P 145-146 Exercise 4.1 No "Product Evals" folder or ch04_capture1.PCAP file on CD
    P 150 Chapter 4 Short Slot Time Subfield: typo -- vendor-dependant should be vendor-dependent
    P 151, under Listen Interval, The second pargraph starts talking about authentication numbers. This line is out of place, as there is no mention of authentication numbers anywhere else in this section.
    I would suggest replacing this orphan statement with a discussion of how conflicts between DTIM Counts and Listen Intervals are handled in the Infrastructure, or the problems that can occur should they not be managed correctly.

    P 168 Dependant Station Enablement[DSE] should be Dependent Station Enablement[DSE]

    P 171 second paragraph, second sentence :

    "Measurement request is indicated by a 1 in the Action value field, and measurement report is indicated by a 2 in the Action Value field" ... it should say: 'Measurement request is indicated by a 0 in the Action value field, and measurement report is indicated by a 1 in the Action Value field'
    That is according to Table 4.10
    P 174 vendor dependant should be vendor dependent
    P 214 answer to question 12 is indicated as A, D but D is " Block Ack cannot be used with QoS Data"
    Also, in the same Chapter 5 practices questions and relative answers, can anybody explain me why the Duration/ID in an RTS frame does not include its own transmission time in addition to the CTS, DATA, ACK and three SIFS?
    P 245 near the top, it says "energy detection level varies... according to the chart shown in fig. 7.2."
    There is no chart shown for fig. 7.2, and neither the figure itself, nor the remainder of the text on that page lists any "energy detect levels".
    Two microsecond timeout values are discussed, but no energy levels.
    P 262, Chapter 7, review question 4:
    "When an 802.11n station begins the arbitration process after a failed frame transmission, which IFS is used?"
    The answer is given as AIFS although AIFS is used only for QoS.
    Page 252 states: "Corrupted frames cause the arbitration process to change only slightly.... EIFS is used in place of a DIFS during the arbitration process"

    P 334 Exercise 9.4
    Step 21 EAP_TTLS.PCAP missing
    Step 24 EAP_TTLS.PCAP should be EAP_TLS.PCAP

    P 343 Figure 9-36 where is the ANonce? Diagram just looks wrong.

    P 344 Figure 9-37 Step 4 Where's PMK-R1?

    P 364 Ch.10:
    802.11a and 802.11g radios use 20 MHz OFDM channels. Each 20 MHz OFDM channel
    contains 62 subcarriers.
    ...should be
    802.11a and 802.11g radios use 20 MHz OFDM channels. Each 20 MHz OFDM channel
    contains 64 subcarriers.
    P 380, Fig 10.16, right hand set of blocks:
    "Data+RGB" should read "Data+RDG"
    "Destination = STA" in top right block should read "Destination = STA 1"
    "Duration ID"; perhaps a better way to show this would be "Duration/ID"
    Duration values of 11 and 12 given may cause confusion, assuming that the end of the diagram illustrates the end of the TXOP initiated by the RD initiator.

    P 382 Table 10.8 HT Capabilities Element ID should be 45

    P 383 Under the heading "HT Capabilities Element", 4th and 5th lines down:
    Perhaps change "The HT Capabilities Element is 28 octets long and contains 8 fields used by the HT STA to advertise the optional HT capabilities it supports"
    "The HT Capabilities Element is 28 octets long and contains 8 fields, six of which are used by the HT STA to advertise the optional HT capabilities it supports"
    The first two fields ( Element ID and Length ) are common to all IEs and don't actually advertise any optional HT capabilities.
    P 384 Figure 10.19:
    Perhaps a note about Figure 10.19 having the ratified 802.11n HT Capabilities layout, re bit 13 ( reserved ), and Figure 10.20 showing a ( probably draft implementation ) where bit 13 is used for PSMP support indication.
    In the IEEE802.11n-2009 document, bit numbering usually begins at zero. The SM Power Save subfield actually contains two bits ( bits B2 and B3 in the ratified document ). Only one bit is shown in the diagram.
    We can see the two bits in the protocol decode of Figure 10.20, with "11..Spatial Multiplexing Enabled"
    P 387 Lines 2 through 4 under "Static SM Power Save" heading:
    " setting the SM Power Save subfield in HT Cpabilities field of the HT Capabilities Element to 2...."
    should read " 0...", per Table 10.9
    P 388 Figure 10.23:
    Table 7.24 of the .11n-2007 spec gives the category code value of 7 for HT ( as per the protocol decode of Figure 10.24 ).
    Figure 10.23 shows a value of 16
    Under the "Action" field, it may be helpful to change "1= PS Power Save" to "1=SM Power Save" , per Table 7.57n of the spec
    P388, Figure 10.25, third block from left:
    I would imagine that the wording “Static Mode disabled” should read something like “SM Power Save Mode disabled”, as the STA now wishes to power up its remaining radios, as indicated by the multiple data streams indication in the fourth and last block.
    P398, 7 lines down: 2 = 36 K should read 2 = 32 K
    P 401, second from last line:"PCO Transmission Time subfield" should read "PCO Transition Time subfield"
    P 402, 7th line down under the "MCS Feedback" header:
    In keeping with the terminology used with reference to subfields, it may be more appropriate to change the term "MRQ subfield") to something like:
    "using the MCS request ( MRQ ) capabilities of the MAI subfield".
    This is due to the fact that the actual MAI subfield can provide one of two functions:
    MCS request
    ASEL indicator mode
    We might also say "using the MCS request ( MRQ ) capabilities of the MAI subfield of the Link Adaptation Control subfield of the HT Control field" .......... as the Link Adaptation Control subfield is in fact itself a subfield of the HT Control field,
    P405, description third from bottom: TxBM should read TxBF
    P408, Figure 10.43 Protocol Decode
    Perhaps a note to explain the occurrence of the entry “MCS Request Sequence Indentifier” in the protocol decode ( 4th line up from last line of decode );
    When the MAI sub field is set to something other than 1110 ( 14 ), it indicates that the sub field should be interpreted as containing two sub-fields of its own:
    1. A single bit MRQ subfield
    2. A three bit MSI ( MCS Request Sequence Identifier ) subfield ( the subfield shown in the decode )
    P 410, Figure 10.47:“Calibration possession” should read “Calibration position”
    P 411 section 2, lines 5 and 6:
    "Upon receipt of this sounding PPDU, the calibration responder can estimate the MIMO channel"
    should read
    "Upon receipt of this sounding PPDU, the calibration initiator can estimate the MIMO channel"

    P 413, First/second lines of second paragraph under “ASEL Capabilities” header:
    Instead of “..using the ASEL Control subfield of the HT Control field in the MAC header”, it may be more accurate to say:
    “using the ASEL Control subfield ( MFB/ASELC ) of the Link Adaptation Control subfield of the HT Control field in the MAC header”

    P415, 3rd and 4th lines down from section 2 of "Transmit ASEL", give 0/6 for ASEL command subfield.
    Figure 10.52 gives 0/1 under "Tx ASEL sounding indication" headers
    P 416, Figure 10.52: TXASSL should read TXASSI
    P 416 Figure 10.52, bottom left:"Transit ASEL responder" should read "Transmit ASEL responder"
    P 418 text block under figure, second line down:"reaming" should read "remaining"

    P423 second last paragraph, last line: Suggest changing "use" to "using"

    P427, Fig 10.61:
    40 Mhz operation mode shown at far right of diagram ( after dual CF-End )
    Should show 20 Mhz operation mode ( primary/secondary )
    P 427, Fig 10.61:
    "Beginning/End" of the lines of the NAV timelines need to be adjusted slightly relative to the "blocks" above.
    P442 Note "You should reference Appendix B, "WLAN Vendor List”" No Appendix B in book.
    P 446 Second last paragraph, six lines down:
    “If you double the distance, the amount of energy of the wave will be one quarter of its starting energy”.
    We have to be very careful with one, as in the format above, that is not true. In a perfect vacuum with no obstacles , an electromagnetic signal will never lose any energy, no matter how far it travels. The nearest we can come to this is in outer space. A small amount of energy is lost ( absolutely tiny ) due to small amounts of “space dust” etc when we consider a signal being sent from ( say ) NASAs Deep Space Network to one of the Mars Rovers.
    If outer space had no planets, no space dust etc, and we had no atmosphere on Earth, then a signal transmitted from earth to space would not lose any energy. In other words, if we had an RF scoop that could “pick up” every “last fraction” of the RF signal, then we would collect exactly the same amount of energy as was transmitted.
    In a pond or in the sea, a small amount of energy is lost due to friction etc.
    If we consider a “unit area” of say one square meter, and we measure the energy content at various distances away from the scource, then we can make statements about the amount of energy having dropped ( per unit area ).
    Its just the way it has been worded, as the paragraph starts off by mentioning part of the area issue.
    P454, first paragraph, second line:
    Suggest changing ".....they needed new technical protocol...." to ".......they needed new technical protocols.."
    P 484 last paragraph. Six lines down. "Figure 11.40" should read Figure 11.39
    P 535 Exercise 12-1 refers to two packet captures on the CD: EAPauth1.apc and EAPauth1.apc. The CD contains the files EAPauth1.apc and LEAPauth2.apc. Since both files demonstrate LEAP (CKIP), perhaps they should both reflect that in the name. Either way, the book and CD names should match.
    DISCLAIMER: the rest of this post is no longer errata, but expression of my opinion. In general, the layout of the CD for this book is a bit confusing. There are a bunch of capture files and screenshots in the root, and a bunch of other stuff is hidden around in subfolders. A more logical layout would be helpful.

    P544 Chapter 12, Section "Reporting Capabilities" under Figure 12-24 (sorry, reading the Kindle edition):
    Second bullet describing capture methods:
    "By only recoding the statistics..." should obviously be "By only recording the statistics..."
    The next sentence has the same error:
    "...the statistics about all packets are still recoded from..." should say
    "...the statistics about all packets are still recorded from..."
    P 572 Chapter 12, Review Question 10:
    Option D says:
    "Uses SMNP to monitor wireless infrastructure" -- should be
    "Uses SNMP to monitor wireless infrastructure"
    P 578: The Appendix points to some shareware and freeware programs on the CD. But on the CD no programs are available.
    Do you know if the CD can be replaced by Sybex?

    Figs. 11.37 and 11.38 missing on CD are now downloadable from Sybex

    Companion CD Flashcards:
    Cards 74 - 77 are kind of Jeopardy style: question and answer fields are switched, but the answer shown in the question field matches the question in the answer field of the previous question. Confused yet? Me, too!
    Card 85 question is prepended with an out of place "Content Free Burst (CFB)" before the real question. Kind of ironic that a contention free burst collided with the question, no?
    Card 112 question field contains a question, and answer, and another question.

    Companion CD Assessment Test
    Question 18
    Options A and E are identical. Based on the surrounding options and the answer, I believe that option E should say that individual MPDUs in the A-MPDU are encrypted individually.
    Question 29
    The last word of the sentence should be A-MPDU, not A-MPD.
    Companion CD Practice Exam 1
    Question 4 typo
    Option B "DSSS-OFMD" should probably be "DSSS-OFDM", unless you're really throwing a curveball here.
    Question 6 typo
    "muse by OFDM" should be
    "used by OFDM"
    Question 8 typo
    "what is the most likely said of the WLAN environment" should be something like
    "what is the most likely WLAN environment"
    Question 49
    Options B and D are Voice and Video, and are the correct answers. However, the test says A and D are correct.

    Companion CD Practice Exam 2
    Question 7
    Seems that options C and D are both correct, since both Non-HT Legacy and HT-Mixed PPDUs contain the L-SFT, L-LTF, and L-SIG fields, enabling Non-HT stations to detect the PPDU and acquire the carrier frequency and timing.
    Question 13
    The answer says that QoS-related action frames are always category 1, but it indicates that A. (which says category 0) is the correct answer.
    Question 14
    "FH Hoping Pattern" -- should be "FH Hopping Pattern"
    Question 18
    All options that should say "ACK" instead say "AC".
    CWNP texts say that 802.11 STAs do not detect collisions, but they do identify corrupted frames. Perhaps this question's answer options need to be reworded.
    Question 28
    Option C says
    "Enough to full a single TXOP" -- should be
    "Enough to fill a single TXOP"
    Question 38 -- Requires multiple answers (checkbox) but only allows one answer (radio buttons).

    SYBEX Errata
    Chapter Page Details Date Print Run
    CD CD Flashcard corrections
    Due to a formatting error, several of the flashcards on the CD that shipped with the first printing of the book have incorrect questions and answers.

    Flashcard 74:
    Question: What data frames do carry data?
    Answer: Data, Data+CF-Ack, Data+CF-Poll, Data+CF-Ack+CF-Poll, Qos Data, Qos Data+CF-Ack, Qos Data+CF-Poll, QoS Data+CF-Ack+CF-Poll

    Flashcard 75:
    Question: How many address fields are in an 802.11 frame?
    Answer: Three, sometimes four

    Flashcard 76:
    Question: What are the names of the 4 802.11 address fields?
    Answer: Address1, Address2, Address3, Address4

    Flascard 77:
    Question: What are the five logical uses of the address fields?
    Answer: Source address, destination address, transmitter address, receiver address, basic service set identifier (BSSID) 4/28/11 1st
    1 24 White Papers missing from CD: Wi-Fi Alliance and Wi-Fi CERTIFIED
    In the sidebar titled ?Wi-Fi Alliance and Wi-Fi CERTIFIED? there is reference to a number of White Papers included on the CD. These White Papers were mistakenly left off the first printing CD. They can be downloaded from this book?s Resources & Downloads page. 4/22/11 1st
    2 52 Omission in Figure 2.11
    ISM Channel 165, referred to in the preceeding paragraph, was left out of the figure. The center frequency of Channel 165 is 5.825 GHz. 11/4/11 1st
    4 145-6 Correction to Exercises 4.1 and 4.2: instructions for downloading and installing Wireshark
    The Wireshark application is not included on the CD as indicated in the book. For the explanation and steps 1-4 of Exercise 4.1,Viewing an Association Sequence, on pages 145-146, please replace the text in the book with the following:

    In this exercise, you will use a protocol analyzer to view 802.11 data frames encrypted with CCMP. The following directions should assist you with locating, downloading, and install- ing Wireshark. If you are familiar with another protocol analyzing software, feel free to use it to perform this lab. If you have already installed Wireshark, you can skip steps 1?4.
    1. In your web browser, go to the Wireshark
    2. Click the Download Wireshark button to locate the installation file, and download the file that is appropriate for your operating system.
    3. After downloading the file, double-click it to proceed with the installation, and follow the installation directions. 4/19/11 1st
    4 146 Missing files on the CD: Exercise 4.1
    In step 4 of Exercise 4.1, reference is made to the following file on the companion CD: ch04_capture1.PCAP. The file was mistakenly left off the CD, and can be found at this book?s Resources and Downloads page. 4/22/11 1st
    4 152 Missing files on the CD: Exercise 4.2
    In step 4 of Exercise 4.2, reference is made to the following file on the companion CD: ch04_capture2.PCAP. The file was mistakenly left off the CD, and can be found at this book?s Resources and Downloads page. 4/22/11 1st
    9 295-7 Missing PCAP Files: Exercise 9.1
    In Exercise 9.1, there is mention of a number of PCAP files on the companion CD: OPEN_SYSTEM_AUTHENTICATION.PCAP, SHARED_KEY_AUTHENTICATION_ENCRYPTED.PCAP, and SHARED_KEY_AUTHENTICATION_DECRYPTED.PCAP. These files were mistakenly left off the CD, and can be found at this book?s Resources and Downloads page. 4/25/11 1st
    11 441 Images missing from files on CD
    On page 441, there is mention of color images of spectrum analyzers included on the CD. Those images were mistakenly left off the first printing's CD. The can be found on this book's Resources and Downloads page. 3/31/11 1st
    12 535 Correction to Exercise 12.1: instructions for downloading OmniPeak Enterprise
    In Exercise 12.1, there is a reference to a demo version of OmniPeak Enterprise included on the CD. Due to permission issues, OmniPeak Enterprise cannot be included on the demo. Users are asked to download the software from WildPackets? website at Follow these steps:
    1. Open your web browser and go to WildPacket's website
    2. On the home page, click on the Download OmniPeak Now link and follow the instructions. 4/22/11 1st
    12 536 Text correction: Incorrectly named file in Exercise 12.1
    In step 13 of Exercise 12.1, there is a reference to a file called EAPauth2.apc. That file should actually be called LEAPauth2.apc. 4/22/11 1st

  • Nice conglomeration of the 7 pages from gcate's link.

    It's hard to tell because there are so many, but did you find any more errors ?

  • By hr_wifi - edited: January 15, 2014

    Nope. The errors I noticed so far are also mentioned in the thread.

    (Update: Noticed another missing file + typo. Included in the conglomeration)

  • By Brad - edited: January 17, 2014

    This is amazing feedback.  I have notified the publisher and he will verify your findings with the authors and post the errata to the Wiley Sybex website.  
    He also asked me to post the following:
    "Can you also mention that if a reader feels they found an error in the book to send an email to, and be sure to include the book’s title and ISBN, as well as as much detail regarding  the possible error."
    As for the next version of the CWAP Study Guide it is currently scheduled for next year.  With all this feedback we will look at pulling it in.
    Thank you very much!

    Brad Crump

  • Brad,

    I think you need to use your own search functions a little more.   All of this was already on your site.  

    You might look for your other cert books too.

  • By Brad - edited: January 19, 2014

    Hi Howard,

    Point taken.  To be clear CWNP produced content is updated regularly.  That information is available on our website and in coursebooks for Authorized Learning Partner (ALP) classes.  Wiley Sybex publishes the Official CWNP Study Guides.  To get them to print hard copies CWNP grants a license to be the official study guide.  CWNP does not get a royalty or fee of any kind.  Nor does CWNP edit the books before print.  That would a huge job.  CWNP does get input on selecting the authors and we get to purchase printed copies at a discount for resale.  Our Wiley Sybex rep told me that he will check the forums regularly from now on and he will notify the authors of any issues.  The following is an updated response from the publisher:

    "Per any errata, we have to pass it on to the authors to verify. If indeed the reader is correct, and there are errors, we will post them to the book’s errata page, and also make any corrections to the book if it goes into a reprint. You can let him know that Sybex is following up with the authors, and will have a response as soon as possible."


  • P 112, Chapter 3 Question 1: Destination shows last Octet of "DS". "S" is not a valid hex character.

    Change the S to a 5 and it will be correct.

  • p41 figure 2.3 Speed of Preamble typo BDPSK. Should be DBPSK

Page 1 of 2