Wireless Networking

Wireless networking uses radio frequency (RF) electromagnetic waves to carry data. The fundamental Properties of an RF wave are:

• Frequency ($f$): Number of complete wave cycles per second, measured in Hertz (Hz). Wi-Fi operates in the 2.4 GHz ($2.4 \times 10^9$ Hz) and 5 GHz ($5 \times 10^9$ Hz) bands.
• Wavelength ($\lambda$): The physical distance between two consecutive wave peaks. Related to frequency by the speed of light:

Where $c = 3 \times 10^8$ m/s (speed of light in a vacuum).

For 2.4 GHz Wi-Fi: \lambda = \frac{3 \times 10^8}{2.4 \times 10^9} = 0.125\mathrm{ m = 12.5\mathrm{ cm

For 5 GHz Wi-Fi: \lambda = \frac{3 \times 10^8}{5 \times 10^9} = 0.06\mathrm{ m = 6\mathrm{ cm

• Amplitude: The strength or height of the wave. Higher amplitude corresponds to a stronger signal.
• Phase: The position of a wave in its cycle relative to a reference point. Phase shifts are critical in MIMO systems, where multiple signals must be combined coherently.

RF engineers use the decibel (dB) scale because it makes calculations involving very large or very Small numbers more manageable. The decibel is a logarithmic ratio:

Common dBm values:

Free Space Path Loss (FSPL): The signal attenuation over distance in free space:

For a simplified calculation at common Wi-Fi frequencies:

Where $d$ is the distance in meters.

Signal-to-Noise Ratio (SNR) is the difference between the received signal power and the noise Floor:

A higher SNR means better signal quality. Typical Wi-Fi requirements:

Signal-to-Interference-plus-Noise Ratio (SINR) adds interference from other wireless devices to The noise floor. In dense environments, interference often dominates over thermal noise.

802.11n (Wi-Fi 4): Introduced MIMO (Multiple Input Multiple Output), channel bonding (40 MHz), And frame aggregation (A-MPDU, A-MSDU). These dramatically improved throughput and efficiency.

802.11ac (Wi-Fi 5): Added wider channels (80/160 MHz), MU-MIMO (Multi-User MIMO) for downlink Only, 256-QAM modulation (8 bits per symbol), and explicit beamforming.

802.11ax (Wi-Fi 6/6E): Introduced OFDMA (Orthogonal Frequency Division Multiple Access) for Efficient multi-user operation in both directions, BSS Coloring to reduce co-channel interference, 1024-QAM, Target Wake Time (TWT) for IoT battery savings, and 6 GHz band support (Wi-Fi 6E).

802.11be (Wi-Fi 7): Adds Multi-Link Operation (MLO) for simultaneous use of multiple bands, 4096-QAM (12 bits per symbol), wider channels up to 320 MHz, and multi-resource units (MRU) for Flexible OFDMA scheduling.

The PHY rate in the table above is the raw physical layer rate. Actual application-layer throughput Is significantly lower due to:

• 802.11 overhead: interframe spacing, ACKs, headers
• Half-duplex nature: only one station transmits at a time
• MAC-layer contention: CSMA/CA backoff
• Protocol overhead: TCP/IP headers, application framing

A rough rule of thumb: actual throughput is approximately 50-70% of the PHY rate for TCP traffic.

• Basic Service Set (BSS): The fundamental building block. A BSS consists of a single access point (AP) and all wireless clients associated with it. The BSS has a unique identifier called the BSSID, which is the MAC address of the AP”s wireless interface.
• Extended Service Set (ESS): Multiple BSSs connected by a Distribution System (DS) — a wired Ethernet backbone. All BSSs in an ESS share the same SSID (network name) and appear as a single network to clients.
• Distribution System (DS): The wired (or wireless) backbone that connects APs within an ESS. It carries traffic between APs and to the network infrastructure (routers, switches, servers).

Infrastructure mode: Clients communicate through an AP. This is the standard mode for virtually All enterprise and home Wi-Fi deployments. The AP manages the BSS, handles authentication, and Bridges traffic between wireless clients and the wired network.

Ad-hoc mode (IBSS — Independent BSS): Clients communicate directly with each other without an AP. Ad-hoc networks are rare in production. They are used for temporary file sharing, gaming, or Emergency communication. No central management, no roaming support, and limited scalability.

Fat AP (Autonomous AP): The AP runs the full wireless protocol stack, handles all management Functions (authentication, roaming, RF management), and makes independent decisions. Configuration Is done on each AP individually. Scaling beyond a few APs becomes operationally burdensome.

Thin AP (Lightweight AP): The AP handles only the real-time 802.11 MAC layer functions. All Management, configuration, and policy decisions are made by a Wireless LAN Controller (WLC). The AP Communicates with the controller using CAPWAP (Control and Provisioning of Wireless Access Points) Or the older LWAPP protocol.

Advantages of thin AP architecture:

1. Centralized management. Configure hundreds of APs from a single controller.
2. Consistent policy. All APs enforce the same security, QoS, and configuration.
3. Seamless roaming. The controller coordinates client handoffs between APs.
4. Simplified firmware updates. Update all APs from the controller.
5. RF management. The controller can adjust power levels and channels to optimize coverage and minimize interference.

CAPWAP (RFC 5415) defines the protocol between a WLC and its APs. It runs over UDP:

• Control channel: UDP port 5246 — carries management messages (configuration, firmware updates, statistics).
• Data channel: UDP port 5247 — carries encapsulated client data frames.

CAPWAP can operate in native (Layer 2) or tunnel (Layer 3) mode. In Layer 3 mode, the CAPWAP packets Are routed through the IP network, allowing the controller to be anywhere on the network, not just On the same subnet as the APs.

802.11 defines three frame types, each identified by the Type and Subtype fields in the Frame Control:

Management frames are used for joining and leaving wireless networks. They are always sent at the Lowest mandatory data rate to ensure all stations can receive them.

Beacon frames are sent by the AP at a configurable interval (default: 100 ms, or 10 TUs — Time Units, where 1 TU = 1024 microseconds). Beacons contain:

• SSID (may be hidden)
• BSSID
• Supported data rates
• PHY parameters
• TIM (Traffic Indication Map) — indicates buffered frames for sleeping clients
• Channel information

Control frames assist in the delivery of data frames. They do not carry upper-layer data.

RTS/CTS is used to mitigate the hidden node problem. Before transmitting a data frame, the sender Broadcasts an RTS. The receiver responds with a CTS. All stations hearing the CTS defer transmission For the duration specified in the CTS, even if they did not hear the RTS.

Data frames carry higher-layer (Layer 3+) payloads. They are the most common frame type on a busy Network.

QoS Data frames include a QoS Control field that carries the Traffic Identifier (TID), UP (User Priority), and other QoS parameters. WMM (Wi-Fi Multimedia) maps the 8 User Priority values to 4 Access categories: Voice, Video, Best Effort, and Background.

WEP was the original 802.11 security standard. It is catastrophically broken and must never be used.

• Key length: 40-bit or 104-bit (the “64-bit” and “128-bit” labels include the 24-bit IV)
• Encryption: RC4 stream cipher
• Integrity: CRC-32 (not a cryptographic MAC)

Flaws:

1. The 24-bit IV is too short. On a busy network, IVs repeat within hours, allowing statistical attacks (FMS, PTW).
2. CRC-32 is linear — an attacker can flip bits in the ciphertext and adjust the CRC to match, enabling undetected modification.
3. The key scheduling algorithm of RC4 has known weaknesses that leak key bits.

An attacker with a tool like Aircrack-ng can recover a WEP key from captured traffic in under a Minute.

WPA was an interim solution designed to address WEP”s weaknesses before 802.11i was finalized.

• Encryption: TKIP (Temporal Key Integrity Protocol) — still uses RC4, but adds a per-packet key mixing function, a 48-bit IV, and a cryptographic MIC (Michael).
• Authentication: WPA-Personal (PSK) or WPA-Enterprise (802.1X/RADIUS)
• Key derivation: PBKDF2 with 4096 iterations, HMAC-SHA1

WPA is also broken. TKIP’s Michael MIC can be forged, and the Beck-Tews attack (2009) can recover The keystream and inject packets within 12-15 minutes.

WPA2 is the current minimum standard for Wi-Fi security.

• Encryption: AES-CCMP (Counter Mode with CBC-MAC Protocol). AES block cipher in CCM mode provides both confidentiality (counter mode encryption) and integrity/authenticity (CBC-MAC).
• Key lengths: 128-bit or 256-bit
• Authentication:
• WPA2-Personal (PSK): Pre-shared key. The PSK is derived from a passphrase using PBKDF2 with 4096 iterations of HMAC-SHA1: \mathrm{PMK = \mathrm{PBKDF2-HMAC-SHA1(\mathrm{passphrase, \mathrm{SSID, 4096, 256\mathrm{ bits)
• WPA2-Enterprise (802.1X): Uses a RADIUS server for per-user authentication. Supports EAP methods like EAP-TLS (certificate-based), PEAP-MSCHAPv2, and EAP-TTLS.

4-way handshake: WPA2 uses a 4-message handshake between the AP (authenticator) and the client (supplicant) to derive the Pairwise Transient Key (PTK) and install the encryption keys:

1. ANonce (AP -> Client): AP sends a random nonce.
2. SNonce + MIC (Client -> AP): Client sends its random nonce and a MIC.
3. GTK + MIC (AP -> Client): AP sends the Group Temporal Key and confirms installation.
4. ACK (Client -> AP): Client confirms key installation.

WPA3 addresses several weaknesses in WPA2:

SAE (Simultaneous Authentication of Equals): WPA3-Personal replaces the PSK 4-way handshake with SAE, a dragonfly key exchange (RFC 7664). SAE is resistant to offline dictionary attacks because the Handshake does not expose enough information for an offline attacker to test password guesses. Both Sides prove knowledge of the password without revealing it.

OWE (Opportunistic Wireless Encryption): Provides unauthenticated encryption on open (public) Networks. The client and AP perform an unauthenticated Diffie-Hellman key exchange, establishing an Encrypted link that protects against passive eavesdropping but does not authenticate either party.

802.1X provides port-based network access control. The three components are:

1. Supplicant: The wireless client requesting access.
2. Authenticator: The AP (or switch) that enforces access control. It does not perform authentication itself — it passes credentials to the backend.
3. Authentication Server: A RADIUS server (e.g., FreeRADIUS, Microsoft NPS, ISE) that validates the supplicant’s credentials.

The EAP (Extensible Authentication Protocol) runs between the supplicant and the authentication Server, encapsulated in EAPOL (EAP over LAN) between the supplicant and authenticator, and RADIUS Between the authenticator and the authentication server.

Common EAP methods:

The 2.4 GHz ISM band spans 2400 — 2483.5 MHz, providing 83.5 MHz of spectrum. Wi-Fi channels are 22 MHz wide (for DSSS/CCK in 802.11b) or 20 MHz (for OFDM in 802.11g/n/ax). Due to the overlap between Adjacent channels, only three non-overlapping channels are available:

• Channel 1: 2412 MHz (center)
• Channel 6: 2437 MHz (center)
• Channel 11: 2462 MHz (center)

In the United States, channels 1-11 are available. In Europe and most other regions, channels 1-13 Are available. Channel 14 (2484 MHz) is available only in Japan.

Using overlapping channels (e.g., channels 1, 2, 3) causes co-channel interference and severely Degrades performance. Always use channels 1, 6, and 11 in a 2.4 GHz deployment.

The 5 GHz band provides significantly more spectrum and non-overlapping channels. Channel Availability varies by regulatory domain:

UNII-1 (5.150 — 5.250 GHz): Indoor only. Channels 36, 40, 44, 48. (DFS not required in most Regions.)

UNII-2A (5.250 — 5.350 GHz): Indoor/outdoor, DFS required. Channels 52, 56, 60, 64.

UNII-2C (5.470 — 5.725 GHz): Indoor/outdoor, DFS required. Channels 100-144.

UNII-3 (5.725 — 5.850 GHz): Outdoor/point-to-point. Channels 149, 153, 157, 161, 165.

DFS is required in the 5 GHz band to avoid interference with radar systems (weather, military, Aviation). When an AP operates on a DFS channel, it must:

1. Listen for radar signals for at least 60 seconds (Channel Availability Check) before using the channel.
2. Continuously monitor for radar while transmitting.
3. If radar is detected, vacate the channel within 10 seconds and move clients to a non-DFS channel.
4. Not return to the vacated channel for 30 minutes.

DFS channels provide valuable additional spectrum but add complexity and potential service Disruption. Use DFS channels for capacity, not for critical primary coverage.

Channel bonding combines adjacent 20 MHz channels into wider channels for higher throughput:

In the 2.4 GHz band, bonding 40 MHz consumes the entire available spectrum, leaving no room for Other channels. In the 5 GHz band, 80 MHz bonding is common but requires careful channel planning. In the 6 GHz band (Wi-Fi 6E/7), 160 MHz and even 320 MHz channels are practical due to the vast Available spectrum.

Wi-Fi signal strength is measured in dBm (decibels relative to 1 milliwatt). Typical thresholds:

Co-channel interference (CCI): Two APs on the same channel. Their transmissions contend for Airtime on the same frequency. The CSMA/CA mechanism causes both APs to defer to each other, Reducing effective throughput for all clients. This is the most common type of interference in Enterprise deployments.

Mitigation: Reduce transmit power to minimize overlap between APs on the same channel. Use smaller Cells (more APs with lower power) rather than fewer APs with high power.

Adjacent-channel interference (ACI): Two APs on overlapping but non-identical channels (e.g., Channels 1 and 2 in 2.4 GHz, or channels 36 and 40 in 5 GHz with 20 MHz spacing). The out-of-band Emissions from one channel bleed into the adjacent channel, raising the noise floor.

Mitigation: Use non-overlapping channels. In 5 GHz, maintain at least one empty channel between Active channels (e.g., use 36, 44, 52, 60 rather than 36, 40, 44, 48).

Non-Wi-Fi interference: Microwave ovens (2.4 GHz), Bluetooth devices, baby monitors, cordless Phones, radar (5 GHz DFS channels), and medical equipment. These sources raise the noise floor and Cause frame retransmissions.

Mitigation: Use spectrum analysis to identify non-Wi-Fi interferers. Relocate APs or switch to 5 GHz Where non-Wi-Fi interference is less prevalent.

# Linux -- signal strength and quality
iwconfig wlan0
iw dev wlan0 station dump

# Linux -- scan for available networks
iw dev wlan0 scan | grep -E "SSID|signal|freq"

# macOS -- current connection details
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I

# Windows
netsh wlan show interfaces
netsh wlan show networks mode=bssid

# Spectrum analysis (professional tools)
MetaGeek Chanalyzer, Ekahau Spectrum Analyzer, Cisco CleanAir

1. Client stickiness. A client remains associated with a distant AP even when a closer AP is available. This happens because the client’s roaming algorithm is vendor-specific and often suboptimal. Solution: Enable 802.11r (Fast BSS Transition) and 802.11k/v on the APs, and set minimum RSSI thresholds to force clients to roam.

2. Band steering. Dual-band clients sometimes prefer 2.4 GHz because of its stronger signal at distance. Solution: Enable band steering on the AP to nudge dual-band clients to 5 GHz.

3. Hidden SSID is not security. Disabling SSID broadcasting (hidden SSID) does not improve security. Probe requests from clients reveal the SSID anyway. It can cause connectivity issues because some clients have trouble connecting to hidden networks.

Wireless mesh networks extend coverage without running Ethernet cables to every AP. Mesh APs Communicate with each other wirelessly using a backhaul link, forming a multi-hop network.

• Root AP: Connected to the wired network via Ethernet.
• Mesh AP: Connected wirelessly to the root AP (directly or through other mesh APs).
• Backhaul: The wireless link between mesh APs. Can use the same radio as client access (single- radio mesh) or a dedicated radio (dual-radio/tri-radio mesh).

Every mesh hop halves the available bandwidth for that path (in single-radio mesh). With dual-radio Mesh (one radio for backhaul, one for client access), the backhaul capacity is dedicated but still Shared among all downstream mesh APs.

Root AP (wired) --- Mesh AP 1 --- Mesh AP 2 --- Mesh AP 3
     100 Mbps           ~50 Mbps       ~25 Mbps       ~12.5 Mbps

This is approximate for single-radio mesh. Dual-radio mesh improves this significantly but does not Eliminate the penalty.

When deciding between mesh and wired backhaul, consider the total cost of ownership. A wired Connection costs approximately $200-500 per drop (cable, labor, switches) but provides full, Dedicated bandwidth. A mesh AP costs$300-800 and shares bandwidth across hops. For a deployment Requiring more than 2 mesh hops, the cost of running cable is lower than the cost of Additional mesh APs needed to compensate for throughput degradation.

Wireless bridging (point-to-point or point-to-multipoint) using dedicated directional antennas is a Middle ground. A 5 GHz point-to-point bridge can achieve 1+ Gbps over distances of several Kilometers with proper line-of-sight, providing near-wired performance without trenching cable.

Mesh is appropriate when:

• Running Ethernet to every AP location is impractical (old buildings, outdoor areas, temporary deployments)
• Coverage extension is needed in areas where wiring is cost-prohibitive
• The number of hops is limited (ideally 1-2 hops maximum)

Mesh is not appropriate for high-density environments or when consistent high throughput is Required. Wired backhaul is always preferable when possible.

A proper site survey follows these phases:

1. Requirements gathering. Define the applications (data, voice, video, IoT), expected client density, minimum data rates, coverage areas, and building constraints.
2. Predictive survey. Use software (Ekahau Pro, iBwave Wi-Fi) to model RF propagation based on floor plans, wall materials, and AP specifications. This produces an initial AP placement plan.
3. Active survey (on-site). Place APs at the predicted locations and measure actual signal strength, SNR, and throughput using a survey adapter. Adjust AP placement, power levels, and channels based on measurements.
4. Validation survey. After deployment, verify that the design meets the requirements. Test in all coverage areas, during peak usage hours if possible.
5. Post-deployment monitoring. Continuously monitor the wireless environment for changes in interference, coverage gaps, and capacity issues.

• Site survey: Always perform a predictive or on-site survey before deployment. Predictive surveys use software (Ekahau, iBwave) to model RF propagation. On-site surveys use actual measurements.
• Coverage vs capacity: For voice and video, plan for capacity (more APs, smaller cells) rather than just coverage. For basic data, coverage planning is sufficient.
• Mounting height: Ceiling-mounted APs provide more uniform coverage than wall-mounted APs. Typical height: 2.5-3.5 m for indoor deployments.
• Antenna selection: Omnidirectional antennas for general coverage. Directional antennas for corridors, outdoor point-to-point, and specific coverage areas.

Approximate AP density guidelines:

Most enterprise APs require PoE:

Wi-Fi 6/6E/7 APs with multiple radios require PoE+ (30 W) or PoE++ (60 W). Verify power Requirements before deployment.

Note that PoE power is delivered over Cat5e or better cable at distances up to 100 meters. Power Dissipation in the cable increases with distance, so an AP at 100 meters receives less usable power Than one at 30 meters. The IEEE standards specify the minimum power guaranteed at the powered device (PD): 12.95 W for 802.3af, 25.5 W for 802.3at, 51 W for Type 3, and 73 W for Type 4.

Client roaming between APs is critical for applications like VoIP and video conferencing. Without Optimization, a client may remain associated with a distant AP long after a closer AP would provide Better service.

Key roaming technologies:

• 802.11k (Neighbor Report): The current AP provides the client with a list of neighboring APs and their channels, speeds up scanning.
• 802.11r (Fast BSS Transition): Reduces the time required for a client to authenticate and associate with a new AP by caching the security context. Reduces roaming time from ~100 ms to ~20 ms.
• 802.11v (BSS Transition Management): The AP can actively instruct clients to roam to a better AP using BSS Transition Management Request frames. This is called “directed roam.”
• OKC (Opportunistic Key Caching): A Cisco-proprietary alternative to 802.11r that caches PMK keys across APs.

For VoIP deployments, 802.11r is essential. VoIP requires roaming handoffs under 50 ms to avoid Audible gaps. Without 802.11r, the full 4-way handshake must complete during each roam, which can Take 100-200 ms.

Using channels 1, 2, 3 instead of 1, 6, 11 is one of the most common Wi-Fi deployment errors. The Interference degrades throughput by 50% or more for affected clients.

Each mesh hop without a dedicated backhaul radio cuts throughput roughly in half. A 3-hop mesh chain Delivers only about 12.5% of the root AP’s wired throughput. If you need more than 2 hops, run a Cable.

Many consumer devices default to 2.4 GHz because the signal appears stronger. If you do not actively Steer dual-band clients to 5 GHz, the 2.4 GHz band becomes congested while the 5 GHz band is Underutilized.

Using PEAP-MSCHAPv2 without properly validating the server certificate means clients are vulnerable To evil twin attacks. An attacker can set up a rogue AP with a self-signed certificate and capture User credentials.

If all your APs are on DFS channels, a radar detection event forces all clients to relocate Simultaneously. Always reserve some non-DFS channels for critical coverage areas.

A 5 GHz access point transmits at 23 dBm with a 3 dBi antenna. A client is 50 meters away with a 2 DBi antenna. Calculate the received power and determine if the signal is sufficient for reliable Data throughput.

You are deploying Wi-Fi in a multi-floor office building. Each floor has 4 APs, and there are 3 Floors. You are using 5 GHz channels. Design a channel plan that minimizes co-channel interference.

Available non-DFS channels: 36, 40, 44, 48, 149, 153, 157, 161, 165.

A WPA2-Personal network has SSID “OfficeNet” and passphrase “MyP@ssw0rd!”. Calculate the number of PBKDF2 iterations used to derive the PMK.

A mesh network has a root AP connected at 1 Gbps. Two mesh APs are connected in a chain: Root -> Mesh1 -> Mesh2. Each wireless hop uses 802.11ac with a PHY rate of 866 Mbps (single-radio mesh, Sharing airtime with clients).

Estimate the maximum throughput available to a client connected to Mesh2.

Two APs are on the same 5 GHz channel (channel 36). Each AP has 5 associated clients, and all Clients are actively transmitting. If the channel utilization is at 80% (meaning 80% of the airtime Is occupied), estimate the per-client throughput assuming each client’s traffic is symmetric (equal Upload and download) and the PHY rate is 300 Mbps.

An AP is configured with a beacon interval of 100 TUs. How many beacons does the AP transmit per Second? (1 TU = 1024 microseconds.)

This topic covers the essential concepts and techniques related to wireless networking, including key principles and practical applications.

Key concepts include:

• core concepts and definitions
• key principles and frameworks
• practical applications
• common techniques and methods
• evaluation and critical analysis

A thorough understanding of these concepts, combined with regular practice and review, is essential for mastery of this topic.

Worked examples demonstrating the application of key concepts are covered in the detailed sub-pages linked above.