Wi-Fi

How Wi-Fi works from the radio up: access points and networks, the generations and their real numbers, bands and channels, how a device joins, how dozens of devices share one channel, OFDMA and MU-MIMO, why the speed on the box never shows up, roaming and mesh systems, security, and how to plan, build and debug a network. Radio basics (frequency, antennas, modulation, why walls absorb signals) are in Radio fundamentals; the cable side of a LAN is in Wired networks; what Wi-Fi latency means to a web app is in Wireless and mobile.

What Wi-Fi is

Wi-Fi is a wireless local area network (WLAN) built on the IEEE 802.11 standards: an Ethernet-style LAN where the cable is replaced by radio. Devices still send frames addressed by MAC address, as on Ethernet, but over the air, inside a few meters to a few dozen meters of an access point. The IEEE writes the standards; the Wi-Fi Alliance, an industry group, certifies products and owns the "Wi-Fi" name and the generation numbers (Wi-Fi 6, Wi-Fi 7).

Two facts explain most Wi-Fi behavior:

• The air is shared. On one channel, one transmitter talks at a time (Wi-Fi 6 relaxes this a bit, below). Every device on the channel, including the neighbors' networks, splits the same airtime.
• It is half-duplex. A radio either sends or listens; it can't hear a collision while it transmits, so Wi-Fi avoids collisions instead of detecting them.

Without an AP, devices can also talk directly: Wi-Fi Direct (screen casting, printers) and the older ad hoc mode.

Generations

• The Wi-Fi Alliance introduced the numbered names in 2018; 1 to 3 were never official.
• Max PHY rate assumes every stream, the widest channel, the best modulation and a short guard interval, all at once. Most phones and laptops have 2 streams: a Wi-Fi 6 phone on an 80 MHz channel tops out at ≈ 1.2 Gbit/s, a Wi-Fi 7 phone on 320 MHz at ≈ 5.8 Gbit/s.
• Older Wi-Fi 7 marketing quotes 46 Gbit/s: that assumed 16 streams, which were dropped from the final standard.
• A spatial stream is an independent data stream sent from its own antenna over its own radio path (MIMO, multiple-input multiple-output); a link can't use more streams than the side with fewer antennas has.
• QAM order is how many bits each symbol carries: 64-QAM = 6, 256 = 8, 1024 = 10, 4096 = 12. Each step needs a cleaner signal, so the top orders only work close to the AP. See Radio fundamentals for how modulation works.

Bands and channels

Wi-Fi uses unlicensed bands: anyone may transmit without a license, within power limits set by each country's regulator. That is why Wi-Fi is cheap, and why it competes with neighbors, Bluetooth, baby monitors and microwave ovens.

2.4 GHz: use 1, 6 or 11

Channel numbers are 5 MHz apart, but each transmission is about 20 MHz wide, so neighboring numbers overlap. Overlap is worse than sharing: two networks on the same channel hear each other and take turns politely; two networks on overlapping channels see each other only as noise and corrupt each other's frames.

Keep 2.4 GHz at 20 MHz: a 40 MHz channel uses most of the band. In Europe, 1, 5, 9 and 13 also fit when every device in range is OFDM (802.11g or newer).

5 GHz and DFS

Most 5 GHz channels are shared with radar (weather, military, airports). On those DFS (dynamic frequency selection) channels, 52–64 and 100–144, an AP must listen for radar for at least a minute before using the channel (up to 10 minutes on some European weather-radar channels), and when it detects a radar pulse it must stop within seconds and move; clients briefly lose the network. In the US, 36–48 and 149–165 need no DFS.

Doubling the width doubles the peak rate, but halves the number of separate channels and adds ≈ 3 dB of noise (the receiver listens to twice the spectrum), so wide channels help only near the AP and where the neighbors aren't on the same spectrum.

6 GHz

New and empty: only Wi-Fi 6E and 7 devices can use it, there are no slow legacy clients, and the rules require WPA3 (or OWE for open networks). Indoor APs run at low power without coordination; higher standard power, allowed in some countries, requires checking an online automated frequency coordination (AFC) database so fixed microwave links in the band aren't disturbed. Clients scan a subset of preferred scanning channels (every fourth 20 MHz channel) to find APs quickly.

How a device joins

• Passive scanning listens for beacons on each channel; active scanning sends probe requests. Each SSID on each radio sends its own beacons at a slow basic rate, so every extra SSID costs airtime. Hiding the SSID doesn't hide the network: clients reveal it in their probes.
• Keys. Everything starts from a PMK (pairwise master key). With WPA2-Personal it is derived from the passphrase and the SSID; with WPA3 it comes out of SAE; with Enterprise, from the 802.1X login that runs between association and the handshake. The 4-way handshake turns the PMK into a PTK (pairwise transient key) for this session and delivers the GTK (group key) for broadcast frames. The MIC (message integrity code) on messages 2 and 3 proves each side holds the PMK without revealing it.
• After DHCP the phone usually fetches a known URL to detect a captive portal (a hotel or café login page) before declaring the network online. IPv6 addresses come from router advertisements instead of, or as well as, DHCP.

WPA2-Personal: PMK = PBKDF2(HMAC-SHA1, passphrase, SSID, 4096 iterations, 256 bits)
4-way handshake: PTK = PRF(PMK, AP MAC, client MAC, ANonce, SNonce)

Sharing the air: CSMA/CA

Wi-Fi's medium access is CSMA/CA, carrier-sense multiple access with collision avoidance: listen before talking, and if the channel is busy, wait a random time so two waiting stations are unlikely to start together.

1. Carrier sense. A station checks the channel two ways: physically (is there energy, a Wi-Fi preamble?) and virtually: every frame carries a Duration field, and listeners set a timer, the NAV (network allocation vector), and stay quiet until it runs out.
2. Backoff. When the channel has been idle for DIFS, the station picks a random number of slots from 0 to CW (contention window) and counts down while the channel stays idle, pausing whenever someone else transmits.
3. Transmit when the count reaches zero.
4. ACK. The receiver answers after SIFS, a gap shorter than DIFS, so nobody else can jump in before the acknowledgment.
5. No ACK means a collision or a corrupted frame: the sender doubles CW (15, 31, 63 … 1023 slots) and retries, up to a retry limit.

• QoS (WMM). Traffic is sorted into voice, video, best effort and background. By default voice waits 2 slots before counting down, with a contention window of 3 to 7 slots; background waits 7, with a window of 15 to 1023, so calls usually win.
• Aggregation and block ACK. Sending one frame per contention wastes most of the airtime on gaps, preambles and ACKs, so stations send dozens or hundreds of frames as one burst (A-MPDU) and the receiver acknowledges them all with one block ACK.
• Airtime, not bandwidth, is the shared resource. A slow client far from the AP needs far more airtime per megabyte than a fast one, so one old or distant device slows everyone on the channel.
• BSS coloring (Wi-Fi 6): each BSS tags its frames with a color number; a station hearing a weak frame of another color may transmit anyway instead of deferring, which helps dense buildings.

Hidden nodes and RTS/CTS

Carrier sense only works if stations can hear each other. Two stations on opposite sides of an AP may both reach the AP but not each other: each senses an idle channel and transmits, and the frames collide at the AP.

RTS/CTS (request to send, clear to send) fixes it at the cost of two extra short frames: the sender asks, the AP answers with a CTS that every station in its range hears, and the Duration field in the CTS silences them for the whole exchange. Stations use it for large frames or after repeated failures; most leave it off otherwise.

OFDM, OFDMA and MU-MIMO

• OFDM (orthogonal frequency-division multiplexing) splits a channel into many narrow subcarriers, each carrying its own slow stream of QAM symbols. Slow symbols with a short guard interval between them shrug off echoes from walls (multipath). Wi-Fi 4 and 5 use 64 subcarriers per 20 MHz, 312.5 kHz apart; Wi-Fi 6 and 7 use 256 per 20 MHz, 78.125 kHz apart, with symbols four times longer, which cuts overhead and handles echoes in large rooms better.
• MCS (modulation and coding scheme) is the index for one combination of QAM order and error correction. Rate adaptation picks an MCS for every frame from recent success; walk away from the AP and the MCS, and with it the PHY rate, steps down.
• Beamforming: an AP with several antennas adjusts the phase of each so their signals add up at one client, after measuring the channel with a short sounding exchange.
• OFDMA (Wi-Fi 6 and 7) lets the AP split one transmission into resource units (RUs), groups of subcarriers, and give each to a different client. It doesn't raise peak speed; it cuts the wait for many small transmissions (voice, games, sensors). Uplink OFDMA works by the AP sending a trigger frame that tells each client which RU to answer in.

• MU-MIMO (multi-user MIMO) sends different streams to different clients at the same time on the same frequencies, separated by beamforming. Downlink only, up to 4 clients, in Wi-Fi 5 Wave 2; downlink and uplink, up to 8 clients, in Wi-Fi 6. It needs clients far enough apart and a fresh channel measurement, so real gains are smaller than the spec sheets suggest.
• Multi-Link Operation (Wi-Fi 7): a device holds links on 2.4, 5 and 6 GHz at the same time and sends on whichever is free (or on several at once), which mostly cuts latency spikes when one band is busy.
• Target Wake Time (Wi-Fi 6): the AP and a battery device agree when it will wake, so it can sleep between appointments.

Range and throughput in practice

Walls add their own loss on top, and it grows with frequency. Rough figures, which vary a lot with the material:

Every 3 dB halves the power and every 10 dB divides it by ten, so two concrete walls can cost more than the whole distance across a house.

Why the speed on the box never shows up:

• Class names such as AX3000 or BE9300 add up the top PHY rates of every band; one device uses one band (or a few links with Wi-Fi 7 MLO).
• The top rate assumes 4 or more streams and the widest channel; your phone has 2 streams and the channel may be narrower.
• PHY rate is not throughput: preambles, headers, gaps, backoff, ACKs and retries take their share; a good link delivers roughly half to two-thirds of its PHY rate as TCP throughput.
• The channel is shared and half-duplex: every device, and every neighbor network on the same channel, takes turns with you.
• The rate falls with each wall and meter as the MCS steps down.
• Often the internet connection, not the Wi-Fi, is the bottleneck. Test the Wi-Fi alone with iperf3 between two local machines (see Try it).

Roaming and mesh Wi-Fi

Roaming is a station moving from one AP to another in the same ESS. The client decides, not the network: it stays with its AP until the signal falls below its own threshold, then scans, picks a new BSSID, reassociates and redoes the key handshake. Clients that hang on to a distant AP too long are sticky clients. Keeping the same SSID, security and VLAN on every AP means the device keeps its IP address and open connections.

Band steering nudges dual-band clients from 2.4 to 5 GHz by delaying 2.4 GHz probe responses; client steering does the same between APs.

Mesh Wi-Fi systems are several nodes that work as one ESS; satellites far from the main router connect back to it over Wi-Fi (wireless backhaul) when there is no cable. The catch is airtime: if the backhaul shares a radio and channel with everything else, each wireless hop has to take turns.

• Tri-band mesh nodes keep one radio (often 5 or 6 GHz) for backhaul only.
• Ethernet backhaul (a cable between nodes, sometimes powerline or coax adapters) is best: nodes then behave like a set of wired APs.
• Place a wireless satellite where it still gets a good signal from the main node, about halfway to the dead zone, not in it.
• Range extenders (repeaters) have the same halving problem and often create a second network name.
• EasyMesh is the Wi-Fi Alliance standard for mixing vendors; most home mesh systems still use their own protocols. IEEE 802.11s is a separate mesh standard, used mainly in open-source and community networks. Machine mesh networks such as Thread and Zigbee are in Mesh & IoT networks.

Security

• WPA2-Personal (PSK, pre-shared key): anyone who records a client's 4-way handshake can test password guesses offline at GPU speed. Use a long random passphrase, or WPA3.
• WPA3-Personal (SAE, simultaneous authentication of equals, also called Dragonfly) is a password-authenticated key exchange: each guess needs a live exchange with the AP, so recorded traffic can't be cracked offline, and traffic recorded today stays safe even if the password leaks later (forward secrecy). Mixed WPA2/WPA3 transition mode helps old devices but lets an attacker push clients down to WPA2.
• Enterprise (802.1X): each user or device logs in separately. The AP passes EAP messages between the client and a RADIUS server, which checks a certificate (EAP-TLS) or a username and password inside a TLS tunnel (PEAP, EAP-TTLS). Every user gets their own keys, and revoking one account changes nothing for anyone else. Clients must verify the RADIUS server's certificate, or a fake AP can collect passwords. Campus roaming services such as eduroam work this way.
• OWE (opportunistic wireless encryption, sold as Wi-Fi Certified Enhanced Open) encrypts open networks such as cafés: each client runs a Diffie–Hellman key exchange with the AP, no password. It stops passive eavesdropping, not an impostor AP with the same name.
• Protected management frames (802.11w) stop attackers from forging "deauthenticate" frames to kick clients off; WPA3 requires them.
• Guest networks are a separate SSID on their own VLAN or subnet, with client isolation so guests can't reach each other or your LAN. Put cheap IoT devices on one too.
• Turn off WPS (the 8-digit PIN can be brute-forced). Hidden SSIDs and MAC address filters aren't security. Phones use a private (randomized) MAC address per network by default, so an allowlist of MACs breaks anyway.
• Keep AP and client firmware updated: the 2017 KRACK attacks on WPA2's handshake and the 2019 Dragonblood flaws in early WPA3 code were fixed in software.

Building a Wi-Fi network

1. Start from the requirements. Where are the devices, how many per room, and what do they run (calls and video need steady −67 dBm or better; sensors need little)? Offices are planned for capacity (clients per AP) as much as coverage.
2. Place APs where the devices are. Ceiling or high on a wall, central in the area they serve, not in a closet, a metal cabinet, behind a TV or next to a fridge. Several APs at modest power beat one at full power: smaller cells mean higher rates and fewer sticky clients, and a phone's weak transmitter can't answer a shouting AP anyway.
3. Wire the backhaul. Run Ethernet to each AP and power it with PoE (power over Ethernet) from the switch. Fast Wi-Fi 6E and 7 APs may need 2.5 Gbit/s ports and higher PoE classes; check the data sheet.
4. Plan channels. 2.4 GHz: 1, 6, 11 at 20 MHz. 5 GHz: 20–40 MHz in dense offices, 80 MHz at home, with neighboring APs on different channels. 6 GHz: 80–160 MHz. Most systems automate channel and power choices, which works if you check the result.
5. Keep SSIDs few. One main SSID across bands, plus guest and perhaps IoT, each on its own VLAN; every extra SSID costs beacon airtime on every channel.
6. Manage them as one system. Standalone APs are configured one by one. Business systems (for example Cisco, HPE Aruba, Juniper Mist, Ubiquiti UniFi, TP-Link Omada) use a controller, on site or in the cloud, for shared configuration, roaming keys, automatic channel and power plans, and monitoring. Home mesh systems do the same in an app.
7. Survey. A predictive survey on a floor plan (tools such as Ekahau or Hamina) places APs before installation; a walk-through measurement afterward checks coverage, overlap between cells (≈ 10–20% for roaming) and co-channel interference.

Whole-network design (VLANs, switches, firewalls, home vs office vs campus) is in Building networks.

Troubleshooting

Try it

# Wi-Fi interfaces (often wlan0 or wlp2s0)
iw dev
# Current link: BSSID, SSID, frequency, signal, MCS
iw dev wlan0 link
# Counters for this AP: retries, failures, bitrates
iw dev wlan0 station dump
# Nearby networks: channel, rate, signal, security
nmcli -f IN-USE,SSID,BSSID,CHAN,RATE,SIGNAL,SECURITY \
  dev wifi list
# Allowed channels and power for this country
iw reg get

# Current link: RSSI, noise, tx rate, PHY mode, channel
sudo wdutil info
# Full diagnostics bundle, written under /var/tmp
sudo wdutil diagnose
# Interface details and nearby networks
system_profiler SPAirPortDataType

# Current link: SSID, BSSID, radio type, channel, rates
netsh wlan show interfaces
# Nearby networks, every BSSID with channel and signal
netsh wlan show networks mode=bssid
# What the adapter supports: radio types, WPA3, bands
netsh wlan show drivers
# HTML report of recent Wi-Fi sessions (run as admin)
netsh wlan show wlanreport

Example iw dev wlan0 link output on a Wi-Fi 6 link (yours will differ):

Connected to 9c:53:22:aa:bb:cc (on wlan0)
	SSID: home
	freq: 5180.0
	signal: -54 dBm
	rx bitrate: 1201.0 MBit/s 80MHz HE-MCS 11 HE-NSS 2 HE-GI 0 HE-DCM 0
	tx bitrate: 960.7 MBit/s 80MHz HE-MCS 9 HE-NSS 2 HE-GI 0 HE-DCM 0

freq: 5180 is channel 36; HE means Wi-Fi 6 (high efficiency; Wi-Fi 7 shows EHT); NSS 2 is two spatial streams; MCS 11 is 1024-QAM. Then measure what the Wi-Fi actually carries, independent of the internet connection:

# On a wired machine on the same LAN
iperf3 -s
# On the Wi-Fi device: upload, then download (-R)
iperf3 -c 192.168.1.10
iperf3 -c 192.168.1.10 -R

References

• IEEE 802.11 Working Group (opens in a new tab): the standards body, with task group status pages (802.11bn and others)
• Wi-Fi CERTIFIED 7 (opens in a new tab): the Wi-Fi Alliance overview of Wi-Fi 7 features
• Wi-Fi Alliance: Security (opens in a new tab): WPA3, Enhanced Open and certification requirements
• Wi-Fi EasyMesh (opens in a new tab): the multi-vendor mesh standard
• IEEE 802.11 (Wikipedia) (opens in a new tab): amendments, data rate tables and history
• List of WLAN channels (Wikipedia) (opens in a new tab): channel numbers, frequencies and per-country rules for 2.4, 5 and 6 GHz
• Wi-Fi Protected Access (Wikipedia) (opens in a new tab): WPA, WPA2, WPA3 and their known attacks
• RFC 8110: Opportunistic Wireless Encryption (opens in a new tab): the protocol behind Enhanced Open
• KRACK attacks (opens in a new tab): the 2017 key reinstallation attacks on WPA2, explained by their discoverer
• iw documentation (opens in a new tab): the Linux wireless configuration tool
• nmcli reference (opens in a new tab): NetworkManager's command-line client
• netsh wlan (opens in a new tab): the Windows Wi-Fi commands
• Analyze the wireless environment on Mac (opens in a new tab): Apple's Wireless Diagnostics guide