I have been collecting Android ScanResult.capabilities for a while and have encountered some settings I can't find any description of.
[ESS][SEC80][SECD00] and [WPA2-PSK-CCMP][ESS][SEC80][SECD00]
These were on two different access points scanned by a Samsung Galaxy S5 with Android 5.0.
What is SEC80 and SECD00? They seem to be enabled together. Any link to an explanation for the two Wi-Fi capabilities will be much appreciated.
You're in luck! Several years ago I was thinking about extending some aspects of WPA and wanted to test using my phone. It seemed that you need to add these as flags, so that made me dive in the Android source code, specifically wpa_supplicant.
Then @schroeder posted a link to your question on a private chat room, and it instantly rang a bell. I went back to the wpa_supplicant source code and traced it back a bit until I found references for the flags. If you look at line 89 there, you can see that the scan results entries ordered in the same exact order they appear in scan results console, so from there you can see that they're "flags" and you can go back in the source code to where they're declared.
Anyway, these are called '802.11 Access Point security flags'. Here's the reference list of the flags used in Android. For instance, [SEC80] would be NM_802_11_AP_SEC_GROUP_CCMP. I'm not really sure what [SECD00], but the 802.11-2012 specifications might give you some hints.
Q & A