Wireless Networking

WLAN basics

A wireless local area network (WLAN) is a local network whose devices connect by radio instead of by cable. Almost every WLAN today is built on Wi-Fi: the family of Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards for wireless LANs, and the trademark of the Wi-Fi Alliance, the industry group that tests devices for interoperability. 802.11 describes the physical layer (radio) and the data link layer (frames and media access control (MAC) addresses), which is why a Wi-Fi client looks like any other Ethernet host once it is connected.

In a normal company or home network, clients do not talk to each other directly. They talk to an access point (AP), which bridges the wireless clients onto the wired network (see Network Devices). This is infrastructure mode; direct device-to-device connections (ad hoc mode, Wi-Fi Direct) are the exception.

Radio is a shared medium: on one channel, only one device can transmit at a time, and all of them hear each other. Wi-Fi is therefore half-duplex and uses CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance): listen first, wait a random time if the channel is busy, and let the receiver acknowledge every frame. Much of what goes wrong in Wi-Fi follows from this: too many devices, or neighbors on the same channel, mean waiting.

The 802.11 standards

Each 802.11 amendment added new modulation, wider channels or more simultaneous streams. Since 2018 the Wi-Fi Alliance also uses generation numbers, which are easier to remember.

The rates are theoretical maximums with every feature at its limit: the widest channels and the most spatial streams (802.11n up to 4, 802.11ac, 802.11ax and 802.11be up to 8), which few real clients support. For Wi-Fi 7 that is about 23 Gbit/s with 8 spatial streams in the final 802.11be standard; the often-quoted 46 Gbit/s assumed 16 streams from drafts. A phone with two antennas on a busy network will see a fraction of those numbers, shared with every other client on the same AP radio. Besides raw speed, Wi-Fi 6 mainly improved efficiency with many clients, for example with orthogonal frequency-division multiple access (OFDMA), which lets an AP serve several clients in one transmission.

Frequency bands and channels

2.4, 5 and 6 GHz

A frequency band is a range of radio frequencies set aside for a use; Wi-Fi uses unlicensed bands around 2.4, 5 and 6 GHz. They differ in the same three ways: range, speed and interference.

Higher frequencies lose more energy through walls and over distance, so a 5 or 6 GHz network needs more access points for the same floor. In exchange they offer far more spectrum, and spectrum is what makes Wi-Fi fast. A common design: every AP radiates both 2.4 and 5 GHz (and 6 GHz where available), and capable clients are steered to the higher bands.

Channels

A wireless channel is a specific slice of a band, named by a number, on which an AP and its clients transmit. In the 2.4 GHz band, channel centers lie only 5 MHz apart (channel 1 at 2412 MHz, channel 2 at 2417 MHz …), but a Wi-Fi signal is 20 to 22 MHz wide. Neighboring channel numbers therefore overlap heavily, and only three channels in the range 1 to 11 are far enough apart: 1, 6 and 11.

The arithmetic is easy to check. Channel n in the 2.4 GHz band is centered at 2407 + 5 × n MHz; two channels with a 22 MHz wide signal overlap when their centers are less than 22 MHz apart:

def center_mhz(channel):             # 2.4 GHz band, channels 1 to 13
    return 2407 + 5 * channel

def overlap(a, b, width=22):
    return abs(center_mhz(a) - center_mhz(b)) < width

for channel in [1, 6, 11]:
    print(f"Channel {channel:>2}: {center_mhz(channel)} MHz")

for a, b in [(1, 6), (6, 11), (1, 3), (6, 9)]:
    verdict = "overlap" if overlap(a, b) else "no overlap"
    print(f"{a} and {b}: {abs(center_mhz(a) - center_mhz(b))} MHz apart, {verdict}")

Channel  1: 2412 MHz
Channel  6: 2437 MHz
Channel 11: 2462 MHz
1 and 6: 25 MHz apart, no overlap
6 and 11: 25 MHz apart, no overlap
1 and 3: 10 MHz apart, overlap
6 and 9: 15 MHz apart, overlap

Two kinds of interference follow from channel choice. Co-channel interference: APs on the same channel that hear each other must take turns, as if they were one AP. Adjacent-channel interference: APs on overlapping channels, such as 1 and 3, cannot even coordinate — they just corrupt each other's frames. That is why channel 3 is worse than sharing channel 1.

Channel width is the other lever. In 5 and 6 GHz, neighboring 20 MHz channels can be bonded into 40, 80 or 160 MHz (and 320 MHz with Wi-Fi 7, in 6 GHz only) for higher speed per client. But a wider channel uses up more of the band, leaving fewer separate channels for neighboring APs. In dense offices, 20 or 40 MHz channels often give better total performance than 80 MHz.

SSIDs and how a client connects

SSID and BSSID

The service set identifier (SSID) is the name of a wireless network, up to 32 bytes long, such as Corp-WiFi or Guest. It is what users see in their list of networks. One AP radio can broadcast several SSIDs, usually each mapped to its own VLAN, and many APs broadcast the same SSID so that the network feels like one across a building.

Each of those AP radio–SSID combinations is one basic service set (BSS), identified by a BSSID: a MAC address of the AP radio. So a building with 40 APs has one SSID but dozens of BSSIDs, and a client is always associated with exactly one BSSID. All the BSSs that share an SSID and are connected by the same wired network form an extended service set (ESS). In a ticket, the BSSID tells you which AP a client was really connected to.

Discovery, authentication, association

1. Discovery. APs send a beacon about ten times per second announcing their SSIDs and capabilities (passive scanning); clients can also send probe requests and collect probe responses (active scanning).
2. 802.11 authentication. A short exchange that, despite its name, usually proves nothing ("open system" authentication). With WPA3-Personal, the SAE exchange described below takes place in this step.
3. Association. The client sends an association request to the chosen BSSID; the AP answers and the client joins the BSS.
4. Security. On a protected network, the real authentication follows: 802.1X for Enterprise networks, then the four-way handshake that creates the encryption keys for this client. Only then does normal traffic — DHCP first — flow.

On a Linux laptop, iw shows the BSSID the client is associated with, the frequency, the signal and the current data rates:

iw dev wlp2s0 link

Connected to 00:00:5e:00:53:a1 (on wlp2s0)
	SSID: Corp-WiFi
	freq: 5220.0
	RX: 482113907 bytes (391244 packets)
	TX: 61842210 bytes (104118 packets)
	signal: -58 dBm
	rx bitrate: 866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2
	tx bitrate: 780.0 MBit/s VHT-MCS 8 80MHz short GI VHT-NSS 2

	bss flags:	short-slot-time
	dtim period:	1
	beacon int:	100

5220 MHz is channel 44 in the 5 GHz band; VHT (very high throughput) means 802.11ac, with two spatial streams (NSS 2) on an 80 MHz channel. The beacon interval of 100 is in time units of 1.024 ms, so about ten beacons a second.

Access points and controllers

Autonomous and lightweight APs

An autonomous AP is a complete device on its own: it holds its configuration, SSIDs and security settings, and you manage it individually. That is fine for a home or a small office, but with 200 APs, changing a passphrase or a channel plan one AP at a time is not realistic.

A wireless LAN controller (WLC) manages many lightweight APs centrally. The APs handle the real-time radio work (beacons, acknowledgments, encryption); the controller holds the configuration and makes the decisions for the whole network — SSIDs, security, channel and power assignment, client roaming. This division of labor is called split MAC.

A lightweight AP finds its controller, downloads its configuration and then talks to it through CAPWAP (Control And Provisioning of Wireless Access Points) tunnels: UDP 5246 for control messages, encrypted with Datagram Transport Layer Security (DTLS), and UDP 5247 for client data. By default client traffic is tunneled to the controller and enters the wired network there; in branch offices, APs can instead switch client traffic locally (Cisco calls this FlexConnect) and send only control traffic to a central controller. Cloud-managed APs follow the same idea with the controller running as a cloud service.

Roaming

Roaming is a client moving its association from one AP to another within the same ESS without losing its network connection, as when someone walks down a corridor during a call. Keeping the same SSID, security settings and VLAN (or a controller that handles the move) lets the client keep its IP address. The decision to roam is made by the client, not by the AP. Amendments help it decide and move quickly: 802.11k (the AP gives a list of neighbor APs), 802.11v (the network can suggest a better AP) and 802.11r (fast transition: keys are prepared in advance so voice calls do not drop during roaming).

Signal strength and interference

Wireless signals are measured in dBm: decibels relative to one milliwatt. The scale is logarithmic: every 3 dB is roughly twice or half the power, every 10 dB a factor of ten. An AP may transmit at 20 dBm (100 mW), and by the time the signal reaches a laptop across the office, a ten-billionth of that may be left. Received signal strength is always a negative number; closer to zero is stronger. Devices also show an RSSI (Received Signal Strength Indicator), a vendor-defined value that most tools convert to dBm.

def dbm_to_mw(dbm):
    return 10 ** (dbm / 10)

for dbm in [20, 0, -30, -67, -90]:
    print(f"{dbm:>4} dBm = {dbm_to_mw(dbm):.3g} mW")

signal, noise = -67, -92
print(f"SNR = {signal} - ({noise}) = {signal - noise} dB")
print(f"-64 dBm is {dbm_to_mw(-64) / dbm_to_mw(-67):.2f} times -67 dBm")

  20 dBm = 100 mW
   0 dBm = 1 mW
 -30 dBm = 0.001 mW
 -67 dBm = 2e-07 mW
 -90 dBm = 1e-09 mW
SNR = -67 - (-92) = 25 dB
-64 dBm is 2.00 times -67 dBm

Signal strength alone is not enough: what matters is how far the signal rises above the background noise. The signal-to-noise ratio (SNR) is the difference between the two in dB. Commonly used design targets for offices with voice and video are a signal of about −67 dBm or better and an SNR of at least 25 dB; below about −80 dBm connections become slow and unreliable. These are rules of thumb that vendors and designers adjust, not limits from a standard.

Wireless security

Anyone within range can receive Wi-Fi frames, so encryption and authentication are not optional. The history is short and worth knowing:

Personal and Enterprise

WPA2 and WPA3 each come in two modes, and the difference is how a user proves who they are:

• Personal — one pre-shared key (PSK), a passphrase that every user of the network knows. Simple, but when someone leaves, the passphrase must be changed on every device, and you cannot tell users apart in the logs. With WPA2-Personal, an attacker who captures a handshake can try passphrases offline, as fast as their hardware allows — so short passphrases fall.
• Enterprise — each user or device authenticates individually with 802.1X: the AP (or controller) passes the login through to a RADIUS (Remote Authentication Dial-In User Service) server, which checks it against the user directory or a certificate. Every user gets their own keys, and access can be revoked per person. See Network Security Basics.

WPA3

Wi-Fi Protected Access 3 (WPA3) is the current Wi-Fi security certification. WPA3-Personal replaces the PSK handshake with SAE (Simultaneous Authentication of Equals): each login attempt requires an exchange with the AP, so a captured handshake can no longer be attacked offline, and a passphrase leaked later does not decrypt traffic recorded earlier (forward secrecy). WPA3 also requires Protected Management Frames, which stop attackers from forging "disconnect" frames to kick clients off. WPA3-Enterprise adds an optional 192-bit mode for high-security networks. On 6 GHz, WPA3 (or Enhanced Open for guest networks, which encrypts open networks without a password) is mandatory. Many networks run a WPA2/WPA3 transition mode so that older clients can still connect.

Guest networks

Visitors need internet access, not access to your file servers. A guest network is a separate SSID mapped to its own VLAN, with firewall rules that allow only the internet. Two more settings matter: client isolation (also called peer-to-peer blocking), so guests cannot reach each other's devices, and often a captive portal, a web page where guests accept terms or enter a code before they get access. Bandwidth limits keep one guest from filling the office connection.

Common problems

• Coverage gaps. Dead spots behind concrete, lift shafts or metal cabinets, often in places the original survey did not consider. The fix is a site survey and an extra AP, not more transmit power.
• Too much power. An AP at full power can be heard far away, but a phone transmits much more weakly: the client hears the AP, the AP cannot hear the client. Lower, balanced power and more APs give better cells.
• Channel overlap. APs on overlapping 2.4 GHz channels, or too many APs on the same channel, or channels that are too wide. Stick to 1, 6 and 11, and let the controller plan channels and power.
• Sticky clients. A client that stays associated with a distant AP at −80 dBm while a better one is right above it, because roaming is the client's decision. 802.11k/v and a minimum data rate can help.
• Non-Wi-Fi interference. Microwave ovens, wireless cameras and some Bluetooth devices share 2.4 GHz. A problem that starts every day at lunchtime is a hint.
• Too many SSIDs. Every SSID sends its own beacons, which use airtime on every channel. Three or four SSIDs is a common upper limit.