Wireless fundamentals: the network with no cable to blame

Every improvement switching made over twenty years — a private collision domain per port, full duplex, guaranteed bandwidth — wireless gives straight back. A radio channel is a shared medium, a device cannot listen while it transmits, and the walls move. Understanding Wi-Fi is mostly a matter of accepting that you are back on a hub, in public, with weather.

The map

Read this first when short on time. Every branch is a section below.

Radio puts you back on a hub

A wireless channel is one shared medium. Every device tuned to it — yours, your colleague's, and the café downstairs — takes turns. Only one can transmit at a time within earshot, and a radio cannot receive while it transmits, so Wi-Fi is half duplex at heart.

Wired Ethernet handled sharing with CSMA/CD: transmit, and if you detect a collision, back off. A radio cannot do that, because its own transmission drowns out everything else it might hear. So 802.11 uses CSMA/CA — collision avoidance:

1. Listen. If the channel is busy, wait.
2. When it goes quiet, wait a further random backoff interval, so two waiting devices do not start together.
3. Transmit the frame.
4. Wait for an acknowledgement. No acknowledgement means the frame was lost, so retransmit.

Every unicast frame being acknowledged is the big structural difference from Ethernet, and it explains a lot. A Wi-Fi network advertised at 1 Gbps delivers perhaps half that in practice, because backoff intervals and acknowledgements consume airtime that carries no data. It also explains why a weak client slows everyone: a device at the edge of coverage transmits at a low data rate, so its frames occupy the channel for far longer, and every other device on that channel simply waits.

The hidden node problem

Two clients on opposite sides of an access point can both hear the access point and not each other. Each listens, hears silence, transmits, and their frames collide at the access point. Neither can detect it.

The remedy is RTS/CTS: a client asks the access point for permission to send (request to send), and the access point broadcasts a clear-to-send that everyone in its range hears, reserving the air for a stated duration. It costs two extra frames per transmission, so it is usually enabled only above a frame-size threshold.

Bands, channels, and the number three

Wi-Fi operates in unlicensed bands: anyone may transmit, subject to power limits, which is why your neighbours' networks are your problem.

The 2.4 GHz situation is worth being precise about. The band has fourteen numbered channels (fewer in some regions), but each is 22 MHz wide and they are spaced only 5 MHz apart — so adjacent channels overlap heavily. Only 1, 6 and 11 are far enough apart not to interfere. Every other choice is actively worse than picking one of those three, because partially overlapping signals cannot take turns politely; they just add noise.

Channel width is the other lever. A wider channel carries more data — 20, 40, 80 or 160 MHz — but consumes more of the band. At 2.4 GHz, bonding two channels into 40 MHz leaves essentially no room for anyone else and is close to antisocial. At 5 GHz, 80 MHz channels are normal in a home and often a mistake in a dense office, where more non-overlapping channels matter more than each one's peak speed.

Some 5 GHz channels are shared with weather and military radar and require DFS, dynamic frequency selection: the access point must listen for radar and vacate the channel within seconds if it hears any. It works, and it produces the occasional mysterious few-second outage near an airport.

Standards, and what each one actually changed

Two cautions about those numbers. They are aggregate rates for the whole cell shared among all clients, not per-device speeds. And they assume the best possible signal, the widest channel, and the maximum number of antennas at both ends — a phone with two antennas standing in a corridor will not get close.

The genuinely interesting shift is at Wi-Fi 6. Earlier generations chased peak speed; 802.11ax was designed for density. OFDMA divides a channel into smaller resource units so one transmission can carry data for several clients simultaneously, which suits the real traffic pattern — many devices sending small frames — far better than giving each one the whole channel in turn.

The words: SSID, BSS, BSSID, ESS

Four terms that are used loosely in conversation and precisely in exams.

The relationship that clears up most confusion: one access point broadcasting three SSIDs on two radios presents six BSSIDs. The SSID is the name people see; the BSSID is what a client actually associates with; the ESS is the illusion of one network stitched together from many cells.

How a client joins

sequenceDiagram
  autonumber
  participant C as Client
  participant A as Access point
  A-->>C: Beacon every 100 ms, SSID and capabilities
  C->>A: Probe request, is anyone here
  A-->>C: Probe response
  C->>A: Authentication request
  A-->>C: Authentication response
  C->>A: Association request
  A-->>C: Association response, here is your association ID
  Note over C: now the key exchange, then DHCP as on any wired network

Access points send beacons roughly ten times a second, announcing the SSID and what the network supports. Clients also send probe requests rather than waiting. Hiding an SSID suppresses the name in beacons but not in the probe exchange, and clients configured for a hidden network broadcast its name wherever they go — so hiding an SSID reduces security slightly and reliability noticeably. It is not a control.

Architectures: one access point or three hundred

An autonomous access point holds its own configuration and works alone. For a small office with three of them this is entirely reasonable. At thirty it becomes a chore, and at three hundred it is unmanageable — every SSID change, every firmware update and every channel adjustment is a separate login.

The alternative is the split-MAC model, which divides the work between the access point and a wireless LAN controller.

The split falls exactly where you would expect: work with microsecond deadlines stays on the radio, work needing knowledge of the whole site moves to the controller. The two are joined by a CAPWAP tunnel — control and provisioning of wireless access points — which carries a control channel on UDP 5246 and a data channel on UDP 5247.

flowchart TD
  C1["Client"] -->|"802.11"| AP["Access point<br/>radio, beacons, encryption"]
  AP -->|"CAPWAP tunnel<br/>over the wired network"| WLC["Wireless controller<br/>config, RF plan, authentication"]
  WLC -->|"client traffic, untunnelled"| SW["Switched network"]
  WLC -->|"authentication"| RAD["RADIUS server"]

Whether client data goes through the tunnel is a design choice. Central switching sends everything to the controller, which simplifies policy and makes the controller a bottleneck. Local switching — Cisco calls it FlexConnect — keeps data on the local switch and tunnels only control traffic, which is what branch offices with slow WAN links need. Sending a branch's internet traffic across a WAN to a controller in head office and back is a classic and painful mistake.

Deployment options in practice: a hardware appliance such as the Catalyst 9800, a controller embedded in a switch or an access point for small sites, or a cloud-managed model where configuration lives in a vendor's service and access points fetch it. Meraki popularised the last one, and the trade is the usual one — much less to run, and a dependency on somebody else's service.

Security: a short history of getting it wrong

Wireless security matters more than wired security for the obvious reason: an attacker does not need to get into the building.

Each scheme comes in two flavours, and the distinction matters more than the version number:

• Personal — one pre-shared key that everybody types. Simple, and it means every device shares one secret; changing it means changing it everywhere, so in practice it never changes.
• Enterprise — 802.1X authentication against a RADIUS server, so each user or device has its own credential. Access can be revoked individually, and the VLAN and policy can be assigned per user at the moment they connect.

WPA3's main advance is the SAE handshake, sometimes called Dragonfly, which replaces WPA2's four-way handshake. Under WPA2, an attacker who captures a handshake can guess passwords offline at billions of attempts per second on borrowed hardware. SAE makes each guess require a fresh interaction with the network, which reduces an offline attack to an online one and makes a weak password survivable rather than fatal.

WPA3 also mandates protected management frames. Beacons, deauthentication and disassociation frames were historically unauthenticated, so anyone could forge a deauthentication and knock a client off the network — the basis of most Wi-Fi denial-of-service tools and of evil-twin attacks that force a client onto a fake access point. Signing those frames closes it.

Designing for a real building

Two questions look alike and lead to opposite designs. Coverage asks whether there is signal everywhere. Capacity asks whether there is enough airtime for the number of devices in one place. A warehouse is a coverage problem — few devices, large area, so fewer access points at higher power. A lecture theatre is a capacity problem — two hundred devices in one room, so many access points at lower power, each serving a small cell.

Turning power up is the instinctive fix and usually the wrong one. Higher power makes the access point audible further away, but the client's transmitter has not changed, so it produces cells where devices can hear the network and not be heard by it. It also increases the overlap between access points, so more devices contend for the same channel.

Channel reuse is the discipline that follows: neighbouring access points must be on different channels, with the same channel reused only far enough apart that the two cells cannot hear each other. With three channels at 2.4 GHz this is genuinely hard, which is another reason modern designs push clients to 5 and 6 GHz.

Finally, the client decides when to roam, not the network. An access point cannot force a device to move; it can only make itself less attractive. This is why a laptop walks across a building still clinging to the access point it started with, transmitting at the lowest possible rate and slowing everyone in that cell. Enterprise controllers nudge clients — by refusing association below a signal threshold, or by steering dual-band clients to 5 GHz — but the final decision belongs to a driver written by somebody else.

CSMA/CA

Carrier sense multiple access with collision avoidance. Listen, back off randomly, transmit, and wait for an acknowledgement.

BSSID

The MAC address of an access point radio, identifying one cell. Distinct from the SSID, which names the network.

CAPWAP

The tunnel protocol between a lightweight access point and its controller: UDP 5246 for control and 5247 for data.

802.1X

Port-based authentication using a RADIUS server, giving every user or device its own credential rather than a shared key.

DFS

Dynamic frequency selection: the requirement that an access point vacate certain 5 GHz channels if it detects radar.

Recap