Wireless Networking

Wireless networks transmit data using radio frequency (RF) electromagnetic waves. Unlike wired Ethernet where signals travel through copper or fiber, wireless signals propagate through air (and walls, floors, furniture — with varying degrees of attenuation). Understanding wireless performance requires understanding the physics of radio propagation.

The Wireless Channel: A Shared, Hostile Medium

Wired Ethernet (full-duplex, point-to-point) gives each device exclusive, dedicated use of the medium. Wireless is fundamentally different: it is a shared broadcast medium. Every device in range can hear every transmission. Multiple simultaneous transmissions on the same channel cause collisions and mutual interference. This is why Wi-Fi performance degrades dramatically in dense environments (stadiums, airports, conference halls).

CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) is Wi-Fi's access control mechanism. Before transmitting, a device listens to see if the medium is busy (carrier sense). If busy, it waits. If the medium is idle for DIFS (Distributed Interframe Space, 34 µs), the device starts a random backoff timer. When the timer expires, it transmits. This avoids collisions by having devices transmit at randomized times — but it also means Wi-Fi is inherently half-duplex: only one device can transmit on a channel at a time (within the collision domain).

Signal Propagation Phenomena

Path loss: Signal strength decreases with distance following the inverse square law (double the distance = quarter the power in free space). In indoor environments with walls and furniture, path loss is typically higher.

Multipath: Radio signals bounce off walls, floors, and objects, creating multiple signal copies that arrive at the receiver at different times. These copies can interfere constructively (stronger signal) or destructively (weaker signal), causing unpredictable signal variation as devices move a few centimeters. MIMO exploits multipath deliberately — using multiple antennas to receive different multipath copies and combine them.

Hidden node problem: Device A and Device B can both reach the AP but cannot hear each other. Both may attempt to transmit simultaneously, causing a collision at the AP that neither device can detect. RTS/CTS (Request to Send/Clear to Send) protocol mitigates this by having the AP explicitly grant transmission rights.

Evolution of Wi-Fi Standards

The IEEE 802.11 family has grown from the original 1997 standard through numerous amendments. The Wi-Fi Alliance introduced marketing names (Wi-Fi 4, Wi-Fi 5, etc.) in 2018 to simplify what had become a confusing alphabet soup of 802.11a/b/g/n/ac/ax.

Key Technical Innovations by Generation

OFDM (Orthogonal Frequency Division Multiplexing)

Introduced in 802.11a/g, OFDM splits the channel into multiple orthogonal subcarriers, each carrying a portion of the data. This dramatically reduces intersymbol interference caused by multipath — shorter symbols on each subcarrier are less affected by multipath delay spreads. Each 20 MHz channel is divided into 64 subcarriers (52 data, 4 pilots, 8 null). 802.11ax (Wi-Fi 6) increased to 256 subcarriers per 20 MHz channel, enabling finer-grained resource allocation.

MIMO — Multiple Input, Multiple Output

MIMO uses multiple antennas at both transmitter and receiver to simultaneously transmit independent data streams (spatial multiplexing) or combine signals for improved range (diversity). An 802.11n 4×4 MIMO AP transmits up to 4 simultaneous streams, multiplying throughput by 4× compared to single-stream. The number of achievable spatial streams is limited by the smaller of the transmit and receive antenna counts.

MU-MIMO — Multi-User MIMO

SU-MIMO (single-user) transmits all streams to one device. MU-MIMO (multi-user) transmits different streams simultaneously to different clients. Wi-Fi 5 Wave 2 introduced downlink MU-MIMO (AP transmits to multiple clients simultaneously). Wi-Fi 6 added uplink MU-MIMO (multiple clients transmit to AP simultaneously). An 8×8 MU-MIMO AP can serve up to 8 clients simultaneously per frequency — critical for high-density deployments.

OFDMA — Orthogonal Frequency Division Multiple Access

Wi-Fi 6's biggest innovation. Classic Wi-Fi allocates the entire channel width to one client per transmission. OFDMA divides the channel into smaller Resource Units (RUs) and assigns different RUs to different clients simultaneously. A 20 MHz channel can be divided into up to 9 RUs for small IoT-type frames. This is transformative for dense environments: instead of 50 clients queuing for their turn, multiple clients transmit simultaneously in different frequency sub-channels.

The efficiency gain is dramatic. In a 100-device wireless classroom, classic Wi-Fi has clients queuing for 50+ milliseconds per transmission. With OFDMA, multiple clients transmit in parallel, reducing latency by 75% and improving capacity significantly.

Wi-Fi 7: Multi-Link Operation (MLO)

MLO is Wi-Fi 7's flagship feature. Instead of a device operating on one band at a time (as with Wi-Fi 6E's band steering), MLO allows a single logical connection to simultaneously use two or three links (e.g., 2.4 GHz + 5 GHz + 6 GHz). The MAC layer aggregates the bandwidth of all active links, and the protocol can dynamically shift traffic between links based on congestion. This provides both higher throughput and better reliability — if one link is congested, traffic automatically shifts to another.

The 2.4 GHz Band

The 2.4 GHz band spans 2.400–2.4835 GHz, providing 83.5 MHz of total spectrum. In the US, channels 1–11 are available; in Europe, channels 1–13; in Japan, channels 1–14. Each 20 MHz channel is spaced 5 MHz apart, meaning adjacent channels overlap significantly.

Only channels 1, 6, and 11 are non-overlapping in a 20 MHz configuration. All other channels overlap with at least one of these three. In practice, this means a 2.4 GHz deployment has a maximum of 3 non-interfering channels — regardless of how many APs are deployed. This is the fundamental scalability limitation of 2.4 GHz for high-density environments.

The 5 GHz Band

The 5 GHz band (5.150–5.850 GHz in the US) provides 25 non-overlapping 20 MHz channels — dramatically better than 2.4 GHz's 3 channels. Channels are organized into UNII (Unlicensed National Information Infrastructure) sub-bands:

UNII-1 (36–48): Indoor-only, no DFS required. Best for dense deployments.

UNII-2A (52–64) and UNII-2C (100–144): Require DFS (Dynamic Frequency Selection) — the AP must scan for radar signals (weather radar, military) before using and must vacate the channel within 10 seconds if radar is detected. DFS adds up to 60-second channel startup delay and occasional forced channel changes.

UNII-3 (149–165): No DFS, no power limits beyond standard. Preferred for high-throughput outdoor links.

The 6 GHz Band (Wi-Fi 6E/7)

The 6 GHz band (5.925–7.125 GHz) opened in the US in 2020 by FCC ruling provides 1.2 GHz of new spectrum — more than the 2.4 GHz and 5 GHz bands combined. It offers 59 non-overlapping 20 MHz channels (7 at 160 MHz width, 14 at 80 MHz, 29 at 40 MHz). Crucially, the 6 GHz band has essentially no legacy devices — no 2.4 GHz or 5 GHz devices can use it, so there is no legacy interference. This creates a clean, high-capacity band perfect for Wi-Fi 6E and Wi-Fi 7 deployments.

Channel Width Trade-offs

Wider channels provide higher throughput per connection by fitting more OFDM subcarriers. A 160 MHz channel carries 8× as many subcarriers as a 20 MHz channel. But wider channels reduce the number of non-overlapping channels available, increasing the chance of co-channel interference from neighboring APs. The optimal channel width depends on environment density.

In high-density environments (stadium, conference hall): use 20 MHz channels to maximize the number of non-overlapping channels and minimize co-channel interference. In low-density environments (warehouse, home): use 80–160 MHz to maximize per-client throughput.

Basic Service Set (BSS)

A BSS (Basic Service Set) is the fundamental Wi-Fi cell — one AP and the clients associated to it. The AP transmits management frames (Beacons, Probe Responses) advertising the SSID and capabilities. The BSSID (BSS Identifier) is the AP's MAC address, uniquely identifying the BSS. An IBSS (Independent BSS) is an ad-hoc network with no AP — devices communicate directly peer-to-peer.

Extended Service Set (ESS)

An ESS (Extended Service Set) is multiple BSSs sharing the same SSID connected via a distribution system (typically wired Ethernet). Clients see a single network name (SSID) but can roam between APs seamlessly. The distribution system handles MAC frame forwarding between APs and to the upstream network.

Autonomous vs. Controller-Based Architecture

Autonomous APs are self-contained — each AP manages its own RF settings, client associations, QoS policies, and VLAN configuration independently. Managing hundreds of autonomous APs requires SSHing into each one individually. Changes are error-prone and time-consuming.

Controller-based (Lightweight) APs offload management intelligence to a central Wireless LAN Controller (WLC). The lightweight AP (LWAP) uses the CAPWAP (Control and Provisioning of Wireless Access Points) protocol to tunnel all management and sometimes data traffic to the WLC. Configuration changes are made once on the WLC and pushed to all APs. The WLC also performs RF management (automatic channel selection, power adjustment), client load balancing, and seamless Layer 2/3 roaming.

Cloud-Managed Wi-Fi

Cisco Meraki, Aruba Central, and similar solutions use cloud-based controllers. The AP establishes a secure tunnel to the cloud controller for management traffic, while data plane traffic (client internet access) is forwarded locally. This simplifies management for distributed deployments (retail chains, branch offices) without requiring on-premises controllers, but creates a cloud dependency for management functions.

Wi-Fi Roaming: 802.11r, 802.11k, 802.11v

When a client moves between APs in an ESS, it needs to roam — disconnect from the current AP and reassociate to a better one. Standard roaming requires full re-authentication (which can take 500ms–2s for 802.1X/RADIUS), causing noticeable interruption for voice and video.

802.11r (Fast BSS Transition) caches key material to speed re-authentication to under 50ms. 802.11k (Radio Resource Management) lets APs provide clients with neighbor lists — clients can pre-scan candidate APs before roaming instead of scanning all channels. 802.11v (BSS Transition Management) allows APs to suggest roaming targets to clients (steering clients away from overloaded APs). Together, these three standards are often called "Fast, Safe Roaming" (FSR).

Wi-Fi frames are divided into three types: Management frames (connection establishment and maintenance), Control frames (medium access control), and Data frames (payload).

The Association Process

1. Beacons: The AP broadcasts beacon frames every 102.4 ms (default) advertising the SSID, BSSID, supported rates, capabilities (HT/VHT/HE), and security parameters. Passive scanning: clients listen for beacons.

2. Probe Request/Response: Active scanning: the client sends a Probe Request (with SSID or wildcard). APs respond with Probe Responses containing their capabilities. This is faster than waiting for beacons but generates RF traffic.

3. Authentication: The client sends an Authentication Request to the selected AP. For Open System authentication (precursor to WPA2/3), the AP responds with Authentication Response (success). This step is almost vestigial in modern WPA2/3 — actual authentication happens during association.

4. Association Request/Response: The client requests association, advertising its capabilities (supported rates, MIMO streams, HT/VHT/HE capabilities). The AP assigns an Association ID (AID) and responds with the final negotiated parameters.

5. 4-Way Handshake (WPA2/3): After association, WPA2 performs a 4-way handshake to establish the Per-Station Key (PTK) for encrypting unicast traffic and derive the Group Temporal Key (GTK) for broadcast/multicast traffic. The 4-way handshake uses the PMK (Pairwise Master Key) derived from the PSK or EAP authentication.

Management Frame Protection (802.11w)

Management frames (Beacons, Probe Responses, Disassociation, Deauthentication) were historically unencrypted and unauthenticated in Wi-Fi. An attacker could send spoofed Deauthentication frames to disconnect any client from an AP — this is the basis of Wi-Fi deauthentication attacks used in WPA2-handshake-capture exploits.

802.11w (Management Frame Protection, MFP) adds cryptographic protection to management frames. WPA3 mandates 802.11w — spoofed deauthentication attacks are no longer possible against WPA3-only networks.

WEP: Completely Broken

WEP (Wired Equivalent Privacy) used 40-bit or 104-bit RC4 with a static PSK. The 24-bit IV was too short — after ~5,000 frames, IVs begin to repeat, allowing passive traffic analysis to recover the key. The FMS attack (2001) and subsequent tools like Aircrack-ng reduced WEP cracking to minutes on a consumer laptop. WEP was deprecated by IEEE in 2004. If you see a WEP network, assume it is entirely compromised.

WPA/WPA2: The Era of AES

WPA (Wi-Fi Protected Access) was a 2003 emergency fix using TKIP (Temporal Key Integrity Protocol) over RC4 — designed to run on existing WEP hardware. TKIP added per-packet key mixing and a message integrity check (MIC), addressing WEP's IV reuse flaw. WPA2 (802.11i, 2004) replaced TKIP with AES-CCMP — 128-bit AES in Counter Mode with CBC-MAC (CCMP). This is fundamentally secure encryption.

WPA2 remains secure against brute force if a strong passphrase is used, but WPA2-Personal (PSK) is vulnerable to offline dictionary attacks: an attacker who captures the 4-way handshake can attempt to brute force the PSK offline at billions of guesses per second using GPU cracking tools.

WPA3: Closing the Gaps

WPA3-Personal replaces PSK with SAE (Simultaneous Authentication of Equals), based on the Dragonfly key exchange (a variant of Diffie-Hellman). SAE requires interactive computation with the AP for each authentication attempt — offline brute-force attacks are impossible. SAE also provides forward secrecy: past session keys cannot be compromised even if the passphrase is later discovered.

WPA3-Enterprise adds optional 192-bit security mode (GCMP-256 encryption, HMAC-SHA-384 authentication, ECDH/ECDSA-384 key exchange). This meets NSA Suite B requirements for protecting classified data.

802.1X / EAP for Enterprise Wi-Fi

802.1X provides port-based network access control. When a client connects to an 802.1X-enabled network, the AP (authenticator) blocks all traffic except EAP authentication messages until the RADIUS server (authentication server) grants access. The client (supplicant) authenticates using an EAP method:

EAP-TLS: mutual certificate authentication — both client and server present X.509 certificates. Most secure, requires client certificate infrastructure (PKI). Zero reliance on passwords.

PEAP (Protected EAP): creates a TLS tunnel to the server (server certificate only), then authenticates the user inside the tunnel with MSCHAPv2 (username/password). Most common in enterprise deployments — integrates with Active Directory.

EAP-TTLS: similar to PEAP but more flexible inner authentication methods. Supports MSCHAPv2, PAP, CHAP.

High-Density Design Principles

1. More APs, lower power: In high-density deployments, use more APs at lower transmit power rather than fewer APs at higher power. This creates smaller cells with better signal-to-interference ratio, reduces the client-to-AP ratio, and allows more aggressive channel reuse.

2. 5 GHz preferred, 2.4 GHz minimized: Disable 2.4 GHz or use it only for coverage extension (IoT devices, wearables). The 3-channel limitation of 2.4 GHz makes it useless for high-density — adjacent APs will always co-channel interfere.

3. Narrow channel widths: Use 20 MHz channels in dense environments. 80 MHz channels in a stadium would reduce available non-overlapping channels from 25 to ~5, causing severe interference.

4. Band steering and load balancing: Configure APs to steer capable clients to 5 GHz or 6 GHz and distribute clients across APs. An AP with 100 clients performs far worse than 10 APs with 10 clients each.

5. Disable low data rates: Slow clients transmit slower (lower modulation rate), occupying the channel longer and reducing throughput for all clients on that AP. Disabling rates below 12 or 24 Mbps forces clients to either connect at higher rates or not connect at all — improving aggregate performance.

RF Survey and Planning

A site survey involves physically walking the coverage area with a laptop running RF survey software (Ekahau, AirMagnet) to measure signal levels, interference, and channel utilization. Predictive RF planning uses building blueprints and material RF attenuation models to plan AP placement before deployment, validated with a post-deployment validation survey.

The Five Most Common Wi-Fi Issues

1. Co-channel interference. Symptom: good signal strength but poor throughput, high retry rates. Diagnosis: use iwlist scan (Linux) or Wireless Diagnostics (macOS) to identify APs on the same channel in range. Fix: re-plan channel assignments to maximize separation between co-channel APs. Use Ekahau or similar for systematic planning.

2. Poor roaming. Symptom: connectivity drops when moving between areas, voice calls break. Client clings to a distant AP with -75 dBm signal when a nearby AP at -55 dBm is available. Fix: enable 802.11r/k/v for fast roaming; adjust AP transmit power so the client has less reason to hold onto a distant AP; configure BSS Transition Management to suggest better APs.

3. Authentication failures. Symptom: client repeatedly associates but can't complete authentication. Check: RADIUS server logs (for 802.1X), PSK mismatch (for WPA2-Personal), certificate expiry (for EAP-TLS), RADIUS shared secret mismatch between AP and server.

4. Hidden SSID misconception. Hiding the SSID does not provide security — clients still send Probe Requests advertising the hidden SSID name when roaming, revealing it. It only breaks legitimate client connectivity (clients can't discover the network automatically) while providing zero additional security.

5. Slow legacy devices. A single 802.11b/g device associating to a modern AP forces the AP to periodically send protection frames (CTS-to-self or RTS/CTS), reducing throughput for all other clients. Disabling 802.11b/g support on the AP (requiring 802.11n minimum) eliminates this penalty.

Key Diagnostic Tools

# macOS — wireless diagnostics from menu bar
# Hold Option key + click Wi-Fi icon → Open Wireless Diagnostics

# Linux — scan nearby networks and see signal/channel
iwlist wlan0 scan | grep -E "ESSID|Channel|Signal"

# Linux — monitor mode capture for frame analysis
iw dev wlan0 set monitor none
tcpdump -i wlan0 -w wifi-capture.pcap

# macOS — show current association details
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I

# Show Wi-Fi stats on Linux
iw dev wlan0 station dump

# Check for 802.11 retransmissions (high = interference/poor signal)
iw dev wlan0 station dump | grep retry

Wi-Fi 6E: The 6 GHz Revolution

The 6 GHz band's regulatory opening was arguably the most significant spectrum policy decision of the decade. The United States (2020), UK (2021), Brazil, Saudi Arabia, and over 65 countries have opened 6 GHz for unlicensed Wi-Fi use. The impact:

59 non-overlapping 20 MHz channels (vs. 3 in 2.4 GHz and 25 in 5 GHz). 7 non-overlapping 160 MHz channels — enabling peak Wi-Fi 6E speeds in deployments where no adjacent channel conflict exists. No legacy interference — the 6 GHz band is exclusive to Wi-Fi 6E/7 capable devices. No DFS requirement in the US Low Power Indoor (LPI) category.

The 6 GHz band has higher atmospheric attenuation than 5 GHz — signals don't travel as far through walls, which is actually beneficial for high-density deployments (smaller cells, less interference between floors and sections).

Wi-Fi 7: 46 Gbps Theoretical Peak

802.11be achieves its headline 46 Gbps through several compounding improvements: 4096-QAM (vs. 1024-QAM in Wi-Fi 6) encodes 12 bits per symbol (vs. 10), a 20% increase per stream. 320 MHz channel width (vs. 160 MHz max in Wi-Fi 6) — available in the 6 GHz band which has sufficient contiguous spectrum. 16×16 MU-MIMO (vs. 8×8) doubles the maximum simultaneous spatial streams. Multi-Link Operation (MLO) aggregates multiple bands simultaneously.

Wi-Fi is increasingly deployed in environments far removed from the corporate office: factory floors, hospitals, warehouses, and outdoor campuses. These environments introduce challenges that consumer-grade Wi-Fi design doesn't account for.

Industrial Wi-Fi Considerations

RF interference: Industrial environments often have motors, arc welding, variable frequency drives, and metallic equipment that generate significant RF noise. The 2.4 GHz band is particularly susceptible. 5 GHz and 6 GHz bands with their shorter range are less affected by distant interference sources.

Metal and reflections: Dense metal structures (server racks, machinery) create complex multipath environments. MIMO systems that exploit multipath can actually perform better in these environments than in open spaces, but unpredictable dead zones can occur.

Real-time requirements: Automated guided vehicles (AGVs), robotic systems, and safety-critical wireless controls require deterministic, low-latency Wi-Fi. 802.11ax (Wi-Fi 6) with OFDMA reduces latency in congested environments. TSN (Time-Sensitive Networking) profiles for Wi-Fi are being standardized for industrial control applications.

Wi-Fi 6 for IoT: Target Wake Time (TWT)

TWT (Target Wake Time) is a Wi-Fi 6 feature designed for battery-powered IoT devices. The AP negotiates wake schedules with each IoT device — the device sleeps (radio off) until its scheduled wake time, transmits its data, and returns to sleep. This enables IoT devices to achieve months of battery life on small batteries while still maintaining Wi-Fi connectivity. A smart sensor might transmit once every 30 seconds, spending 99.9% of the time in deep sleep.

Enterprise AP Configuration (Cisco WLC)

# Cisco WLC CLI — WLAN configuration
(Cisco Controller) > config wlan create 1 CorpWiFi CorpWiFi
(Cisco Controller) > config wlan security wpa enable 1
(Cisco Controller) > config wlan security wpa akm 802.1x enable 1
(Cisco Controller) > config wlan radius_server auth add 1 192.168.99.10 1812 shared_secret
(Cisco Controller) > config wlan band-select enable 1
(Cisco Controller) > config wlan enable 1

# RF management — automatic channel and power
(Cisco Controller) > config 802.11a channel global auto
(Cisco Controller) > config 802.11a txpower global auto

# Guest WLAN with captive portal
(Cisco Controller) > config wlan create 2 GuestWiFi GuestWiFi
(Cisco Controller) > config wlan security web-auth enable 2
(Cisco Controller) > config wlan interface 2 guest-vlan-interface

Linux hostapd — Software Access Point

# /etc/hostapd/hostapd.conf — WPA3-Personal (SAE)
interface=wlan0
driver=nl80211
ssid=MyNetwork
hw_mode=a
channel=36
ieee80211n=1
ieee80211ac=1
ieee80211ax=1

# WPA3 SAE
wpa=2
wpa_key_mgmt=SAE
rsn_pairwise=CCMP
sae_password=StrongPassphrase
ieee80211w=2      # MFP required (mandatory for WPA3)

# Enable WPA3-Enterprise (802.1X)
# auth_algs=1
# wpa_key_mgmt=WPA-EAP
# eap_server=0
# auth_server_addr=192.168.1.10
# auth_server_port=1812
# auth_server_shared_secret=radius_secret

Modulation and Coding Scheme (MCS)

Wi-Fi adapts its data rate based on signal quality using MCS (Modulation and Coding Scheme) indices. Wi-Fi 6 supports MCS 0–11. Higher MCS = higher modulation order + less error correction. MCS 11 (1024-QAM, 5/6 coding rate) requires very high SNR (>35 dB). MCS 0 (BPSK, 1/2 coding rate) works down to -82 dBm signal. The AP and client negotiate the highest MCS both can support given current signal conditions — this negotiation happens continuously.

When you see Wi-Fi advertised at "up to 9.6 Gbps," that is the highest MCS (11) with all streams active. In practice, most clients are at MCS 7–9 due to realistic signal conditions and fewer than the maximum antenna count.

Airtime Fairness

Without Airtime Fairness, a slow client (802.11g at 24 Mbps) associated to a modern AP degrades performance for all other clients. Since the slow client takes much longer to transmit the same amount of data, it occupies the channel disproportionately. Airtime Fairness allocates equal airtime (not equal bandwidth) to each client. A fast client gets the same time slot as a slow client — but delivers far more data in that time. This prevents legacy clients from monopolizing the medium.