10 Wireless LAN Fundamentals · CCNA

Exam topics covered

1.11 Describe wireless principles

1.11.a Nonoverlapping Wi-Fi channels
1.11.b SSID
1.11.c RF
1.11.d Encryption

Foundation. Most users never plug in a cable: laptops, phones, scanners and IoT sensors reach the network over Wi-Fi. A wireless LAN (WLAN) replaces copper with radio frequency (RF) energy, and that changes almost everything. The medium is shared and half duplex, signals fade and bounce, neighbouring networks interfere, and anyone within range can listen. This chapter builds the foundation you need before Chapter 18 (wireless architectures and WLC configuration) and Chapter 32 (wireless security): the IEEE 802.11 standards, the 2.4, 5 and 6 GHz bands and their nonoverlapping channels, RF behaviour and signal measurements, the building blocks of a WLAN (BSS, ESS, SSID, BSSID), how stations share the air with CSMA/CA, how a client joins a WLAN, and an introduction to WLAN encryption.

10.1 Wireless LANs and the 802.11 Standards

A WLAN is defined by the IEEE 802.11 family of standards. The Wi-Fi Alliance, an industry group, tests products for interoperability and certifies them with the familiar “Wi-Fi” logo; it also introduced the simple generation names Wi-Fi 4, 5, 6 and 7. An 802.11 network operates at Layers 1 and 2, just like Ethernet, and carries the same IP packets. The key device is the access point (AP), which bridges wireless clients (called stations, or STAs) onto the wired Ethernet network, as shown in Figure 10-1.

Server SW1
Ethernet
AP

Sta

Wired: full duplex, switched

Wireless: shared, half-duplex RF cell

Figure 10-1 An access point bridges 802.11 wireless stations onto the wired Ethernet LAN.

The 802.11 standard has been amended many times, each amendment adding faster modulation, wider channels, more antennas or new bands. Table 10-1 lists the amendments you should know. The data rates are the maximum theoretical rates; real throughput is typically half or less, because the medium is shared and half duplex and because of protocol overhead.

Table 10-1 IEEE 802.11 amendments

Twt

Exam alert

Memorize which bands each amendment uses: b, g = 2.4 GHz only; a, ac = 5 GHz only; n, ax = 2.4 and 5 GHz; Wi-Fi 6E = 802.11ax extended into 6 GHz; be = all three. Also remember that Wi-Fi 4/5/6/7 are the Wi-Fi Alliance names for n/ac/ax/be.

10.2 RF Bands and Channels

Radio waves are described by their frequency, the number of cycles per second measured in hertz (Hz), and their wavelength, the physical distance of one cycle. Higher frequencies have shorter wavelengths, which pass through walls less well and lose more energy over distance. The amplitude is the strength of the wave. Wi-Fi uses unlicensed bands, which anyone may use without a licence as long as they obey the regulator's power and channel rules (FCC in the USA, ETSI in Europe). Each band is divided into channels, each with a centre frequency and a width.

Table 10-2 The three Wi-Fi bands compared

The 2.4 GHz band has 14 channel numbers (1–11 in North America, 1–13 in most of Europe, 14 only in Japan for 802.11b). The centre frequencies are only 5 MHz apart (channel 1 = 2.412 GHz, channel 2 = 2.417 GHz, and so on), but each transmission is about 22 MHz wide (20 MHz for OFDM). Adjacent channel numbers therefore overlap heavily. Two APs on overlapping channels corrupt each other's transmissions (adjacent-channel interference), which is worse than sharing the same channel. The only set of three channels that do not overlap in North America is 1, 6 and 11, shown in Figure 10-2.

overlapping each other.

Dashed: channels 2–5 and 7–10

Figure 10-2 2.4 GHz channels: each is about 22 MHz wide but centres are 5 MHz apart, leaving only channels 1, 6 and 11 nonoverlapping.

When you deploy several APs, you assign channels so that neighbouring cells never use the same or overlapping channels: a honeycomb pattern of 1, 6 and 11, as in Figure 10-3. Each AP's coverage area (its cell) overlaps its neighbours by roughly 15–20% so clients can roam without dropping, but adjacent cells are on different channels. In practice, a controller's Radio Resource Management (RRM) assigns channels and power automatically.

Figure 10-3 A 2.4 GHz channel reuse plan using only channels 1, 6 and 11.

10.2.2 The 5 GHz and 6 GHz bands

The 5 GHz band is divided into several U-NII (Unlicensed National Information Infrastructure) segments: U-NII-1 (channels 36–48), U-NII-2 (52–64), U-NII-2 Extended (100–144) and U-NII-3 (149–165). Channel numbers go up in steps of 4 because each 20 MHz channel spans four 5 MHz “slots”; channels 36, 40, 44 and so on do not overlap. Channels in U-NII-2 and 2e require Dynamic Frequency Selection (DFS), which makes the AP leave a channel if it detects radar. With about 25 nonoverlapping 20 MHz channels, 5 GHz allows channel bonding: 802.11n bonds two channels into 40 MHz, 802.11ac uses 80 or 160 MHz. Wider channels mean higher throughput but fewer nonoverlapping channels to work with.

The 6 GHz band, opened for unlicensed use in 2020 in the USA, adds 1200 MHz of clean spectrum: 59 channels of 20 MHz, 29 of 40 MHz, 14 of 80 MHz, 7 of 160 MHz or 3 of 320 MHz (Wi-Fi 7). Only Wi-Fi 6E and Wi-Fi 7 devices can use it, so there are no slow legacy clients, and WPA3 is mandatory on 6 GHz.

Tip

A handy rule: on 2.4 GHz you have exactly three nonoverlapping channels (1, 6, 11), so use 20 MHz channels only. Save channel bonding for 5 and 6 GHz, where there are enough channels to bond without creating co-channel interference.

10.3 RF Behaviour and Signal Measurement

An RF signal does not travel neatly from AP to client. As it passes through a building it meets walls, people, furniture, glass and water, and each interaction changes it. You should be able to name and recognise the following behaviours, illustrated in Figure 10-4. Absorption – a material absorbs the energy and converts it to heat, weakening the signal. Water, human bodies, concrete and brick absorb heavily; that is why a crowded auditorium has worse coverage than an empty one.

Reflection – the signal bounces off a smooth, dense surface such as metal, mirrors or a lift shaft. Reflections cause multipath: copies of the signal arrive at slightly different times. Older radios suffered from it; MIMO radios exploit it.

Refraction – the signal bends as it passes between media of different density, such as from air into glass or through layers of air at different temperatures, changing its direction.

Scattering – the signal hits an uneven or rough surface (dust, gravel, chain-link fencing, foliage) and is reflected in many directions, weakening it.

Diffraction – the signal bends around an obstacle, leaving an RF “shadow” behind it. Interference – other signals on the same or overlapping frequencies (co-channel and adjacent-channel interference from other APs, or non-Wi-Fi sources such as microwave ovens and Bluetooth in 2.4 GHz) raise the noise and corrupt frames.

Figure 10-4 Four ways objects change an RF signal: absorption, reflection, refraction and scattering.

10.3.1 Measuring signal strength: dBm, RSSI and SNR

Transmit power and received signal are tiny and span a huge range, so they are expressed on the logarithmic decibel scale. dBm is power relative to 1 milliwatt: 0 dBm = 1 mW, 10 dBm = 10 mW, 20 dBm = 100 mW. Two rules of thumb cover most calculations: +3 dB doubles the power and +10 dB multiplies it by 10 (and −3 dB halves it). A typical AP transmits at 14–20 dBm; by the time the signal reaches a client it is usually between −30 and −80 dBm, a negative number because it is far less than 1 mW.

RSSI (Received Signal Strength Indicator) is the received signal level, usually shown in dBm. Closer to zero is stronger: −50 dBm is better than −75 dBm. Cisco recommends at least −67 dBm for voice and real-time applications.

The noise floor is the background RF energy from all other sources, typically around −90 to −95 dBm.

SNR (signal-to-noise ratio) is the difference between the signal and the noise floor, in dB. A higher SNR allows faster modulation and data rates. Aim for 20 dB or more for data and 25 dB or more for voice.

Figure 10-5 RSSI and SNR: the same noise floor with three received signal levels. SNR = RSSI − noise floor.

Exam alert

RSSI values are negative; the one closer to zero is stronger. SNR is a ratio expressed in dB: with RSSI −65 dBm and noise −92 dBm, SNR = 27 dB. A low SNR, not just a low RSSI, is what forces a client to drop to lower data rates.

10.4 WLAN Building Blocks: BSS, ESS, SSID and BSSID

802.11 defines a small vocabulary for how stations and APs are organised. You will see these terms in configuration screens, in packet captures and on the exam.

10.4.1 Basic service set (BSS)

A basic service set is one AP and the clients associated with it. The area the AP's signal covers is the basic service area (BSA), or cell. All traffic in a BSS flows through the AP, even between two clients in the same cell. Each BSS is identified by a BSSID, the MAC address of the AP's radio for that WLAN, so clients can tell different APs apart. The human-readable network name is the SSID (service set identifier), a string of up to 32 characters that the AP advertises in beacon frames. One AP can offer several SSIDs (for example Corp , Guest and IoT ); each SSID on each radio uses its own BSSID, typically derived from the radio's base MAC address.

10.4.2 Distribution system and extended service set (ESS)

The AP connects its BSS to the wired network, called the distribution system (DS). Each SSID is usually mapped to a VLAN on the wired side, so wireless users land in the right subnet. When you need more coverage, you add APs that advertise the same SSID and connect to the same DS. Together they form an extended service set (ESS). Each AP still has its own BSSID and channel, but users see one network name. A client moving from one cell to another roams: it reassociates with the new AP, ideally without the user noticing. Cells must overlap (about 15–20%) so that the client finds the next AP before losing the current one. Distribution system (wired, VLAN 10)

AP1 AP2

roaming

BSS 1 · channel 1 · BSSID 00:3a:9a:11:22:30 BSS 2 · channel 6 · BSSID 00:3a:9a:44:55:60 ESS: both APs advertise SSID “Corp”

Figure 10-6 Two BSSs on different channels, with different BSSIDs but the same SSID, form an ESS joined by the wired distribution system.

10.4.3 Independent BSS and other topologies

An independent BSS (IBSS), or ad hoc network, has no AP: two or more clients talk directly to each other. It is rarely used in enterprises. Other AP roles you may meet include a repeater (an AP that retransmits another AP's signal to extend coverage, halving throughput), a workgroup bridge (a device that connects a wired-only device to a WLAN as a client), an outdoor bridge (point-to-point or point-to-multipoint links between buildings with directional antennas) and a mesh network (APs that link to each other wirelessly, with only some APs, called root APs, wired to the network).

Figure 10-7 An independent BSS (left) and an AP extending coverage over a wireless backhaul link (right).

10.5 Sharing the Medium: CSMA/CA

Classic shared Ethernet used CSMA/CD (carrier sense multiple access with collision detection): a station transmitted, listened for a collision while sending, and if one occurred, sent a jam signal and backed off. Wireless radios cannot do this, because a radio cannot listen while it transmits (its own signal drowns everything else) and because two stations may not even hear each other (the hidden node problem). 802.11 therefore uses CSMA/CA, carrier sense multiple access with collision avoidance:

1. Listen before transmitting. The channel must be idle according to both physical carrier sense (the radio hears no energy) and virtual carrier sense (the Network Allocation Vector, a timer set from the Duration field of frames overheard from others).
2. Wait a fixed interframe space (DIFS), then a random backoff time. If the channel becomes busy during the countdown, freeze the timer and resume later.
3. Transmit the frame.
4. Wait for an ACK. The receiver replies with an acknowledgement after a short interframe space (SIFS). No ACK means the frame was lost (probably a collision), so the sender retransmits after a longer backoff.

Optionally, a station sends a Request to Send (RTS) and waits for a Clear to Send (CTS) before a large frame. Every station that hears the CTS sets its NAV, which helps with hidden nodes.

Sender
Receiver
medium busy DIFS random backoff DATA frame

Sifs ack

success

time →

Figure 10-8 CSMA/CA: wait DIFS plus a random backoff, transmit, and expect an ACK after SIFS.

Table 10-3 CSMA/CD versus CSMA/CA

Csma/cd csma/ca

Used by Half-duplex (hub-based) Ethernet; disabled
on full-duplex links
802.11 WLANs (always half
duplex)

Approach Detect collisions after they occur Avoid collisions before they occur Mechanism Listen while sending, jam signal, backoff Listen, random backoff, NAV, optional RTS/CTS

Delivery
confirmation
None at Layer 2 Every unicast frame is ACKed
10.6 802.11 Frames and Joining a WLAN

An 802.11 frame differs from an Ethernet frame. Its header can carry up to four MAC addresses, because a wireless frame may need to identify the transmitter, the receiver, the original source and the final destination separately (for example, a frame from a client goes to the AP's BSSID but is ultimately destined for a server MAC on the wired side). The AP translates between 802.11 and 802.3 framing as traffic enters or leaves the wired network.

Frame
Control Duration Address 1 Address 2 Address 3
Seq
Ctrl Address 4 QoS HT Frame body FCS
2 2 6 6 6 2 6 2 4 variable 4

802.11 MAC frame (field sizes in bytes; Address 4, QoS and HT Control present only when needed) Frame Control holds the type (management, control, data) and subtype, plus To DS / From DS flags

Figure 10-9 The general 802.11 MAC frame format.

The Frame Control field identifies one of three frame types, each with many subtypes:

Table 10-4 802.11 frame types

Type Purpose Common subtypes

Management Discover, join and leave a

Bss

Beacon, probe request/response, authentication,
association request/response, reassociation,
disassociation, deauthentication
Control Help deliver frames and
control access to the
medium
ACK, RTS, CTS, PS-Poll (power save), block ACK
Data Carry user payload (IP
packets)
Data, QoS data, null (power management signalling)
10.6.1 How a client joins a WLAN

Before a client can send data, it goes through a short state machine: discover the network, authenticate, then associate. Discovery can be passive, listening for beacons that APs send about ten times per second (every 102.4 ms by default), or active, sending a probe request (to a specific SSID or a wildcard) and waiting for probe responses. Figure 10-10 shows the complete process.

Figure 10-10 The 802.11 join process: discovery (beacon or probe), open authentication, association, then the security handshake.

The 802.11 authentication step is almost always open system: the AP simply accepts the request. Real security happens afterwards, when WPA2 or WPA3 authenticates the user or device (with a pre-shared key or 802.1X) and derives encryption keys in the 4-way handshake. During association the client and AP agree on capabilities (data rates, channel width, QoS) and the AP assigns an association identifier (AID). When a client moves to another AP in the same ESS, it sends a reassociation request instead.

10.7 Introduction to Wireless Encryption

Because RF travels through walls and into car parks, anyone nearby can capture WLAN frames. A secure WLAN must therefore provide authentication (only authorised users and devices join), encryption (captured frames are unreadable) and integrity (frames cannot be altered undetected). Encryption has evolved through four generations, summarised in Table 10-5. Chapter 32 covers authentication methods, 802.1X, PSK and SAE, and the WLC security settings in detail.

Table 10-5 Evolution of WLAN security

Standard Introduced Encryption / integrity Status

WEP 1997 (802.11) RC4 with 40- or 104-bit static key; CRC-32

Icv

Broken in minutes;
never use
WPA 2003 (Wi-Fi
Alliance)

TKIP (still RC4, per-packet keys) with MIC Interim fix; deprecated WPA2 2004 (802.11i) AES-CCMP (128-bit) Widely used; still

WPA, WPA2 and WPA3 each come in two flavours. Personal mode uses a shared passphrase (PSK in WPA2, SAE in WPA3), suitable for homes and small offices. Enterprise mode uses 802.1X with an EAP method and a RADIUS server, giving every user individual credentials and unique keys. For open guest networks, WPA3 offers Enhanced Open (OWE), which encrypts traffic without a password.

Watch out

Hiding the SSID (disabling it in beacons) and MAC address filtering are not security features. The SSID still appears in probe and association frames, and MAC addresses are trivial to spoof. Real protection comes from WPA2 or WPA3 encryption and authentication.

Exam alert

Associate each generation with its cipher: WEP = RC4, WPA = TKIP, WPA2 = AES-CCMP, WPA3 = SAE plus AES (GCMP-256 in WPA3-Enterprise 192-bit mode) and mandatory PMF. Know that Personal uses a passphrase and Enterprise uses 802.1X/RADIUS.

Chapter review

Key terms

Ieee 802.11

Wi-Fi Alliance
access point (AP)
station (STA)
nonoverlapping channel
channel bonding

Dfs

absorption
reflection
refraction
scattering

Rssi

Snr

noise floor

dBm

Bss

Bssid

Ssid

Ess

Ibss

distribution system

roaming

Csma/ca

beacon

association

1. Which three 2.4 GHz channels are nonoverlapping in North America?

A. 1, 5, 9
B. 1, 6, 11
C. 2, 7, 12
D. 1, 7, 13

2. Which two 802.11 amendments operate only in the 5 GHz band? (Choose two.)

A. 802.11a
B. 802.11b
C. 802.11g
D. 802.11ac
E. 802.11n

3. What is the Wi-Fi Alliance name for 802.11ax operating in the 6 GHz band?

A. Wi-Fi 5
B. Wi-Fi 6
C. Wi-Fi 6E
D. Wi-Fi 7

4. What uniquely identifies a BSS?

A. The SSID
B. The channel number
C. The BSSID, the MAC address of the AP radio
D. The VLAN ID

5. A user walks from one AP's coverage area to another with the same SSID. Which two terms describe this? (Choose two.)

A. IBSS
B. ESS
C. Roaming
D. Ad hoc
E. Workgroup bridge

6. A signal bounces off a metal filing cabinet. What RF behaviour is this?

A. Absorption
B. Reflection
C. Refraction
D. Scattering

7. An AP's signal is received at −68 dBm and the noise floor is −93 dBm. What is the SNR?

A. −25 dB
B. 25 dB
C. 68 dB
D. 161 dB

8. Which received signal is strongest?

A. −82 dBm
B. −71 dBm
C. −64 dBm
D. −48 dBm

9. Why do 802.11 networks use CSMA/CA rather than CSMA/CD?

A. Wireless is full duplex.
B. A radio cannot reliably detect collisions while transmitting.
C. CSMA/CA is faster than CSMA/CD.
D. APs act as switches.

10. Which 802.11 frame type includes beacons and probe requests?

A. Control
B. Data
C. Management
D. Extension

11. Which two statements about the SSID are true? (Choose two.)

A. It can be up to 32 characters.
B. It is the AP's MAC address.
C. Several APs can advertise the same SSID.
D. Hiding it secures the WLAN.
E. It must match the VLAN name.

12. Which encryption method does WPA2 use?

A. RC4
B. TKIP
C. AES-CCMP
D. 3DES

13. Which WPA3 feature replaces the WPA2 pre-shared key exchange?

A. SAE
B. TKIP
C. EAP-TLS
D. OWE

Answers

1. B. With 5 MHz spacing and ~22 MHz width, only 1, 6 and 11 avoid overlap.
2. A, D. 802.11a and 802.11ac are 5 GHz only; b and g are 2.4 GHz only; n uses both.
3. C. Wi-Fi 6E is 802.11ax extended into 6 GHz. Wi-Fi 7 is 802.11be.
4. C. The BSSID (the AP radio MAC for that WLAN) identifies a BSS. Many BSSs can share an

Ssid.

5. B, C. Multiple APs with one SSID form an ESS, and moving between them is roaming.
6. B. Smooth, dense surfaces such as metal reflect RF.
7. B. SNR = −68 − (−93) = 25 dB.
8. D. The value closest to zero (−48 dBm) is strongest.
9. B. A transmitting radio cannot hear collisions, and hidden nodes cannot hear each other, so 802.11 avoids collisions and uses ACKs.
10. C. Beacons, probes, authentication and association are management frames.
11. A, C. An SSID is up to 32 characters and is shared by all APs in an ESS. Hiding it is not security.
12. C. WPA2 uses AES-CCMP. RC4 is WEP; TKIP is WPA.
13. A. Simultaneous Authentication of Equals (SAE) replaces PSK in WPA3-Personal.