Describe wireless principles

Wi-Fi replaces the cable with radio, and radio behaves very differently from copper. This objective covers the physics and vocabulary you need before the wireless architecture (Domain 2) and wireless security (Domain 5) sections.

Wireless LANs are defined by the IEEE 802.11 family of standards. The Wi-Fi Alliance certifies interoperability and now gives each generation a friendly number:

Unlike a switched Ethernet port, a wireless channel is a shared, half-duplex medium: only one device on a channel can transmit at a time, and a radio cannot hear collisions while it is transmitting. 802.11 therefore uses CSMA/CA (Collision Avoidance): listen, wait a random backoff, transmit, and require an acknowledgment frame for every unicast frame. The AP and all of its clients share the airtime, so more clients means less throughput for each.

1.11.a Nonoverlapping Wi-Fi channels

Each band is divided into numbered channels, each a slice of frequency. Two APs in range of each other on the same or overlapping channels interfere with each other (co-channel and adjacent-channel interference), so the goal of any wireless design is to give neighboring APs channels that do not overlap.

2.4 GHz band (2.400 to 2.4835 GHz). There are 14 channels defined, spaced only 5 MHz apart, but each 802.11 signal is about 22 MHz wide (20 MHz in 802.11n/ax terms). A channel therefore overlaps with the four channels on either side of it. In North America channels 1 through 11 are permitted, and the only set of channels that do not overlap each other is 1, 6, and 11. (Europe allows 1 through 13, and channel 14 is Japan-only for 802.11b.) With just three usable channels, dense 2.4 GHz deployments inevitably suffer interference, and the band is also crowded by microwave ovens, Bluetooth, cordless phones, and baby monitors. Its advantage is range: lower frequencies travel farther and penetrate walls better.

5 GHz band (roughly 5.150 to 5.850 GHz). Channels here are spaced 20 MHz apart and are 20 MHz wide, so every channel is nonoverlapping: 36, 40, 44, 48, 52, 56, 60, 64, 100 through 144, and 149 through 165. Depending on the country there are around 24 or 25 nonoverlapping 20 MHz channels. Many of them (52 to 144) are DFS (Dynamic Frequency Selection) channels shared with weather and military radar; an AP must listen for radar and vacate the channel if it hears any. 5 GHz has shorter range but far more capacity and far less interference.

Channel bonding. 802.11n and later can combine adjacent 20 MHz channels into 40, 80, or 160 MHz channels for higher throughput. Wider channels mean fewer nonoverlapping channels: in 5 GHz, about 12 at 40 MHz, 6 at 80 MHz, and 2 at 160 MHz. Bonding in 2.4 GHz is discouraged because a single 40 MHz channel uses most of the band.

6 GHz band (5.925 to 7.125 GHz, Wi-Fi 6E and Wi-Fi 7). This adds 1,200 MHz of spectrum in the United States: 59 nonoverlapping 20 MHz channels, 29 at 40 MHz, 14 at 80 MHz, and 7 at 160 MHz, with no DFS and no legacy devices. Only Wi-Fi 6E and 7 clients can use it, and WPA3 is mandatory in 6 GHz.

Good design places adjacent APs on different nonoverlapping channels in a repeating pattern (a “honeycomb” of 1, 6, 11 in 2.4 GHz) so that every AP’s neighbors are on different channels, and reduces transmit power so cells do not bleed too far into each other. Wireless LAN controllers automate this with Radio Resource Management (RRM), choosing channels (DCA) and power levels (TPC) dynamically.

1.11.b SSID

The SSID (Service Set Identifier) is the name of a wireless network, a case-sensitive string of up to 32 characters (bytes) that clients use to find and join it. An AP advertises its SSIDs in periodic beacon frames (by default about every 100 ms), and clients can also send probe request frames asking which SSIDs are available. “Hiding” an SSID only removes it from beacons; it is still visible in probe responses and association frames, so it is not a security measure.

The related terms:

• BSS (Basic Service Set): one AP and the clients associated to it. The coverage area of a BSS is the BSA (Basic Service Area) or cell.
• BSSID (BSS Identifier): the unique identifier of a BSS, which is the MAC address of the AP’s radio for that SSID. An AP broadcasting three SSIDs on one radio uses three BSSIDs, typically consecutive MAC addresses. Clients see the SSID; the network works on the BSSID.
• ESS (Extended Service Set): multiple APs advertising the same SSID and connected to the same wired network (the distribution system, DS), so that a client can roam from one AP to another without changing networks. The shared SSID is sometimes called the ESSID.
• IBSS (Independent BSS) or ad hoc: clients talking directly to each other with no AP.
• Association: the process by which a client joins a BSS (probe, authentication, association). A client can be associated with only one BSS at a time.

A single AP typically advertises several SSIDs (corporate, guest, IoT), each mapped to a different VLAN on its wired uplink, which is why the AP-to-switch link is usually a trunk (Domain 2).

1.11.c RF

RF (radio frequency) is electromagnetic energy used to carry the signal. The key concepts:

• Frequency is the number of wave cycles per second, measured in hertz (Hz). Wi-Fi uses 2.4 GHz, 5 GHz, and 6 GHz (billions of cycles per second).
• Wavelength is the physical distance of one cycle and is inversely proportional to frequency. A 2.4 GHz wave is about 12.5 cm long; a 5 GHz wave about 6 cm. Longer wavelengths pass through and around obstacles better, which is why 2.4 GHz has more range and 5 and 6 GHz less.
• Amplitude is the strength (height) of the wave; transmitting at higher power increases amplitude.
• Bandwidth in RF means the width of frequency a channel occupies (20 MHz, 40 MHz); more bandwidth carries more data.
• Modulation is how data is encoded onto the wave by varying its amplitude, frequency, or phase. Newer standards use denser modulation (256-QAM in Wi-Fi 5, 1024-QAM in Wi-Fi 6, 4096-QAM in Wi-Fi 7), which needs a cleaner signal.

Signal strength is measured in dBm (decibels relative to 1 milliwatt), a logarithmic scale. 0 dBm = 1 mW; every +3 dB doubles power and every +10 dB multiplies it by ten. A typical AP transmits at around +20 dBm (100 mW); a client receives at around -30 dBm (excellent) to -90 dBm (unusable). RSSI (Received Signal Strength Indicator) is the client’s measurement of the received signal; -67 dBm or better is a common target for voice and video. The noise floor is the background RF energy (say -95 dBm), and SNR (Signal-to-Noise Ratio) is the difference between RSSI and noise, in dB; an SNR of 25 dB or more is considered good. Plain dB expresses a ratio or a change (gain or loss); dBm expresses an absolute level. Antenna gain is given in dBi (relative to an ideal isotropic antenna).

As a signal travels it weakens through free space path loss, which grows with distance and with frequency, and it interacts with the environment:

Interference is unwanted RF on the channel from other Wi-Fi networks (co-channel interference), non-Wi-Fi devices (microwaves, Bluetooth, wireless cameras), or overlapping adjacent channels. A site survey with a spectrum analyzer identifies interference and dead spots before an AP deployment. MIMO (Multiple Input Multiple Output) uses several antennas and spatial streams to send multiple data streams at once; MU-MIMO (Wi-Fi 5 and 6) serves several clients simultaneously; OFDMA (Wi-Fi 6) subdivides a channel so small packets from many clients share one transmission.

1.11.d Encryption

Because anyone within range can receive wireless frames, Wi-Fi must authenticate clients (prove who they are) and encrypt data (scramble it so eavesdroppers cannot read it), and it must guarantee integrity (detect tampering). The 802.11 security standards, in order of age:

Each WPA generation has two modes. Personal mode uses a pre-shared key (PSK): everyone types the same passphrase, suitable for homes and small offices. WPA3-Personal replaces the WPA2 four-way handshake’s vulnerability to offline dictionary attacks with SAE (Simultaneous Authentication of Equals), which provides forward secrecy. Enterprise mode uses 802.1X with EAP to authenticate each user individually against a RADIUS server (UDP 1812), so every user has unique credentials and unique keys; this is the standard for corporate networks. WPA3 also adds OWE (Opportunistic Wireless Encryption, “Enhanced Open”) to encrypt open guest networks without a password, and mandates Protected Management Frames (PMF).

Domain 5 (objectives 5.9 and 5.10) covers WPA, WPA2, and WPA3 in the detail the exam needs, including the GUI configuration of a WPA2-PSK WLAN. For this objective, know that WEP and WPA are insecure, WPA2 uses AES-CCMP, WPA3 uses GCMP and SAE, and that personal means PSK while enterprise means 802.1X/RADIUS.