10 October 2026, 12:41Виталий Лещенко

Networking for beginners. Part 3: Wi-Fi

All parts of the series “Networking for beginners”

In the second part we took Ethernet apart: the frame, MAC addresses, the switch. To the operating system Wi-Fi looks the same: a wlan0 interface with a MAC address, the same IP packets inside, the same MTU of 1500. An access point is a switch some of whose ports are radio. But inside, Wi-Fi works completely differently, and almost all its quirks — "sometimes it's slow", "one neighbour brings down the whole network", "the laptop clings to a distant access point" — follow from the physics of radio. Let's look at how the IEEE 802.11 family of standards copes with that physics.

How radio differs from cable

Three differences from which everything else follows.

The medium is shared and there is only one. With cable, each device has its own wire to the switch, and two pairs can talk at the same time. With radio, on one channel only one device within earshot can transmit at any moment — including the neighbouring flats and other people's networks on the same channel. Wi-Fi went back to the shared coax of the 1980s, only worse: at least a cable does not go through walls.

Half duplex and no way to hear a collision. A radio receiver cannot listen while transmitting: its own signal is millions of times stronger than anyone else's and drowns the receiver completely. So Ethernet's CSMA/CD does not work: a collision cannot be detected while it happens. It can only be prevented and learned about after the fact.

Frames are lost all the time. Interference, attenuation, reflections, the microwave in the kitchen. On a cable, losing a frame is an event; on radio it is the norm: a few percent with a good signal and tens of percent with a bad one. Ethernet silently dropped a frame with a bad CRC and left the problem to the upper layers; for radio that is too expensive.

The first two points gave birth to CSMA/CA, the third to acknowledgements.

CSMA/CA: how the air is shared

CSMA/CA is Carrier Sense Multiple Access with Collision Avoidance. The algorithm for a device that has a frame to send:

Listen to the channel. If the energy on the channel is above a threshold or someone else's 802.11 transmission is heard — busy, wait until it is free.
The channel is free — wait another fixed time, DIFS (around 34–50 µs depending on the standard), and make sure it is still free.
Random backoff. Pick a random number of slots from 0 to CW (the contention window, initially 15), a slot being 9 µs, and count them down while the channel is free. If someone starts transmitting meanwhile — freeze the counter, wait for the other transmission to end plus DIFS, and resume counting from the same place.
The counter reaches zero — send the frame.
Wait for an ACK. Having received a frame with a correct CRC, the receiver replies with an acknowledgement after SIFS (10–16 µs, shorter than DIFS so nobody manages to squeeze in).
ACK arrived — done, CW is reset to 15. It did not — the frame is considered lost (a collision or interference), CW doubles (31, 63, … up to 1023), and it is retried from step 1. After 7–10 attempts the frame is dropped, and the OS learns about it from an error counter.

Thanks to the random backoff, two devices that waited for the channel to free up will very likely start transmitting at different moments. Because SIFS is shorter than DIFS, an ACK always gets through before any new frames. Because of acknowledgements, every data frame on the radio is really two frames and three pauses:

  DIFS  backoff   ┌─────────────┐ SIFS ┌─────┐  DIFS  backoff  ┌──────…
──────┬──────────┬┤ data frame  ├─────┬┤ ACK ├┬──────┬────────┬┤ next
      │          ││             │     ││     ││      │        ││

This is the first reason why "1200 Mbit/s" Wi-Fi delivers 400: the air is occupied by pauses and control frames no less than by data. Modern standards fight this with aggregation: up to 64 frames are glued into one A-MPDU block and acknowledged with a single Block ACK frame containing a bitmap of what was received and what was not. Only the lost ones are retransmitted.

There is also a second line of defence — virtual carrier sense. Every 802.11 frame has a Duration field: how many microseconds the air will be busy, including the ACK. Everyone who heard the frame sets a NAV (Network Allocation Vector) timer and does not try to transmit until it expires, even if they physically hear nothing. RTS/CTS is built on the same thing: before a long frame the sender sends a short Request to Send, the access point replies with Clear to Send, and both frames carry a Duration covering the whole transmission. Why that is needed will become clear in the section on the hidden node.

Channels, bands and why neighbours interfere

Wi-Fi works in unlicensed bands: 2.4 GHz, 5 GHz and, with Wi-Fi 6E, 6 GHz. A band is divided into channels, and there are two important details here.

2.4 GHz: there are 13 channels, but only three non-overlapping ones. Channels 1 to 13 are spaced 5 MHz apart, while a transmission occupies 20 MHz. Channel 1 occupies 2401–2423 MHz, channel 2 2406–2428, and they overlap almost completely. Only 1, 6 and 11 do not overlap. An access point on channel 3 interferes with both the network on channel 1 and the network on channel 6, and it does more harm than if it shared a channel with them: on the same channel CSMA/CA at least sees the other transmission and waits, whereas on an adjacent channel it sees noise and corrupts frames. In an apartment block 2.4 GHz lives badly, but it reaches farther and gets through walls better.

5 GHz: many channels, but some with a catch. Channels 36–64, 100–144, 149–165, spaced 20 MHz apart without overlap. Channels 52–144 are DFS (Dynamic Frequency Selection): weather radars operate in this band, and an access point must listen for a minute before starting to work and leave the channel if it hears a radar. Hence the well-known effect of "the 5 GHz network disappears for a minute".

Channel width. Starting with 802.11n, adjacent 20 MHz channels are bonded into 40, 80 and 160 MHz. Speed grows proportionally, but such a network also interferes with two to four times as many neighbours. In 2.4 GHz, 40 MHz takes up more than half of the whole band, and decent access points do not do it.

A brief history of the standards, so you can read the names on the boxes:

Standard	Name	Band	Maximum per channel	What it added
802.11b (1999)	—	2.4	11 Mbit/s	the first mass-market one
802.11a/g	—	5 / 2.4	54 Mbit/s	OFDM
802.11n	Wi-Fi 4	2.4 and 5	600 Mbit/s	MIMO, 40 MHz, aggregation
802.11ac	Wi-Fi 5	5	6.9 Gbit/s	80/160 MHz, downlink MU-MIMO
802.11ax	Wi-Fi 6/6E	2.4, 5, 6	9.6 Gbit/s	OFDMA, BSS coloring, TWT
802.11be	Wi-Fi 7	2.4, 5, 6	46 Gbit/s	320 MHz, several links at once

The terms from the last column, so as not to leave them unexplained:

OFDM — the channel is split into dozens of narrow subcarriers, each carrying its own slow stream of bits; this way the signal survives reflections off walls that would kill a single fast stream.
MIMO — several antennas at the transmitter and the receiver, through which several independent data streams travel simultaneously on the same frequency (2×2, 4×4 on the boxes is the number of antennas). MU-MIMO — the access point transmits to different clients at the same time, each with its own set of streams.
OFDMA — the subcarriers of one channel are shared among several clients within a single frame: short packets from many devices do not each take up a whole slot.
BSS coloring — a network "colour" is added to the frame header, and a device that hears a weak frame of another colour may transmit over it instead of waiting: neighbouring networks block each other less.
TWT (Target Wake Time) — the access point and the client agree on when the client will wake up, and the rest of the time it does not listen to the air; this saves battery.

The figures in the "maximum" column are the theoretical physical-layer speed for the best case: all antennas, the widest channel, a perfect signal. The actual rate of each frame is chosen separately and depends on signal strength: this is called rate adaptation. A device by the wall in the next room gets frames at 6 Mbit/s and — this is important — occupies the air a hundred times longer than a device next to the access point to transfer the same amount. One distant client slows everyone down: the air is shared by time, not by bytes.

The 802.11 frame

A Wi-Fi frame is more complex than an Ethernet one because it has more problems to solve: whom to physically transmit to over the radio, whom it is actually meant for, in which network, whether it must be acknowledged.

 bytes:   2       2      6      6      6      2      (6)    (2)   0…2304   4
        ┌──────┬──────┬──────┬──────┬──────┬──────┬──────┬──────┬───────┬─────┐
        │Frame │Dura- │Addr  │Addr  │Addr  │Seq   │Addr  │QoS   │data   │ FCS │
        │Ctrl  │tion  │  1   │  2   │  3   │Ctrl  │  4   │Ctrl  │       │     │
        └──────┴──────┴──────┴──────┴──────┴──────┴──────┴──────┴───────┴─────┘

Frame Control — the frame type and flags. There are three types:

management: beacon, probe request/response, authentication, association request/response, deauthentication, disassociation. This is how a client finds a network and joins it. These frames are not encrypted (in WPA3 they are partly protected, more on that below).
control: RTS, CTS, ACK, Block ACK. Short, without data, they govern access to the air.
data: the IP packets themselves, as well as empty Null Data frames with which a client tells the access point it is going into power-saving mode.

Four addresses. Ethernet has two addresses: to whom and from whom. In Wi-Fi, a frame between a client and a server on the wired network passes through the access point, and you need to distinguish who is transmitting over the radio from who the data is actually from. Two flags in Frame Control, To DS and From DS (DS is the distribution system, the wired network behind the access point), define the meaning of the addresses:

Direction	To DS	From DS	Address 1 (radio receiver)	Address 2 (radio transmitter)	Address 3
client → AP	1	0	BSSID (the AP's MAC)	client MAC	final recipient (for example, the router's MAC)
AP → client	0	1	client MAC	BSSID	original sender
client → client without an AP (ad hoc)	0	0	recipient	sender	BSSID
AP → AP (wireless bridge, mesh)	1	1	receiver	transmitter	recipient; address 4 is the sender

When the access point receives a frame from a client, it builds an ordinary Ethernet frame from it: address 3 becomes the destination MAC, address 2 the source MAC. In the other direction, the reverse. That is how Wi-Fi pretends to be Ethernet: the access point is a bridge that moves the contents from one frame format into another.

The BSSID is the MAC address of the access point's radio interface, the identifier of one particular network on one particular access point. The SSID is the network name people see; it lives in beacon and probe frames, not in the header. One access point can have several SSIDs (a guest network), and then each has its own BSSID.

Sequence Control — the frame number and fragment number; the receiver uses them to discard duplicates: if an ACK was lost, the sender will repeat a frame that has already been received.

What is inside. 802.11 has no EtherType field. Instead, the data begins with an eight-byte LLC/SNAP header — the very IEEE 802.3 header format mentioned in the previous part — and its last two bytes are the EtherType: aa aa 03 00 00 00 08 00 means "IPv4 inside". The nesting doll from the first part works here too, just with an extra layer.

The maximum data size in a frame is 2304 bytes, but the interface MTU is set to 1500 so that frames fit into the Ethernet behind the access point without being reworked.

How a client gets onto the network

Every ~100 ms (more precisely, 102.4 ms — 100 "time units" of 1024 µs) the access point broadcasts a beacon: the network name, the channel, supported rates, the country, security parameters and the TIM map — which of the sleeping clients have data waiting. The list of networks on your phone is the list of beacons it has heard.

Connecting takes four stages.

Scanning. Passive: listen for beacons on each channel. Active: send a probe request with a network name (or an empty one) and collect probe responses from everyone who hears it. Active is faster, and that is exactly why a phone with Wi-Fi on constantly sends probe requests — and can be tracked by them: hence the random MAC addresses in modern operating systems.
Authentication at the 802.11 level. For WPA2 it is a vestige: two Open System frames — "let me in" and "come in", with nothing checked. The real check happens at step 4. In WPA3, SAE takes place at this stage; more on it below.
Association. The client sends an association request with its capabilities: rates, channel width, the chosen security parameters. The access point replies with an association response containing a status and an AID — the client's number in its table. From this moment the client is listed on the network but cannot send data yet.
The WPA2/WPA3 four-way handshake, after which encryption is switched on and data starts to flow.

Look at it in tcpdump in monitor mode:

$ sudo iw dev wlan0 interface add mon0 type monitor
$ sudo ip link set mon0 up
$ sudo tcpdump -i mon0 -n -e 'type mgt'
... Beacon (office) [1.0* 2.0* 5.5* 11.0* ...] CH: 6, PRIVACY
... Probe Request (office) [1.0 2.0 5.5 11.0 ...]
... Probe Response (office) [...] CH: 6, PRIVACY
... Authentication (Open System)-1: Successful
... Authentication (Open System)-2:
... Assoc Request (office) [...]
... Assoc Response AID(1) :: Successful

Monitor mode is when the card passes all frames on the channel to the system, not just its own, with a radiotap header carrying the signal level, the frame rate and the channel. Not every card supports it, but most do under Linux.

WPA2: where the keys come from

The Wi-Fi password is not used for encryption directly. The chain goes like this.

The PMK (Pairwise Master Key) is a 256-bit key that the access point and the client have before the handshake begins. Where it comes from depends on the mode.

In home WPA2-Personal it is derived from the password and the network name with the PBKDF2 function: the password and SSID are run through a hash function 4096 times, and the result is the PMK. That is why the same password on networks with different names yields different keys, and why connecting to a new network takes a noticeable number of milliseconds — 4096 hashing iterations on a phone.

In WPA2-Enterprise there is no network password: each user has their own login and password or a certificate. It works through 802.1X — a standard that forbids a port (here, an association) from passing anything except authentication frames until authentication is complete. The authentication itself runs over EAP (Extensible Authentication Protocol): the client and the server exchange requests and responses whose contents depend on the method — password verification inside a protected tunnel (PEAP) or a certificate exchange (EAP-TLS). The access point does not understand the contents and just relays them: over the radio in EAPOL frames (EAP over LAN, EtherType 0x888E), and on the wired network to a RADIUS server, a protocol over UDP with which the access point asks "should this user be let in" and gets an Accept or Reject response. Along with Accept, the server sends the access point the PMK computed during the EAP exchange, and by that point the client has the same PMK. Each user gets their own, and a departing employee is cut off by deleting their account rather than changing the password for the whole office.

The PMK is never used to encrypt traffic. A fresh PTK (Pairwise Transient Key) is derived from it for each connection, and that is what the four-way handshake does: four EAPOL-Key frames, that is, data frames of the same EAPOL format sent before encryption is switched on.

   client                                              AP
     │                                                 │
     │ ◄──── M1: ANonce ───────────────────────────────┤  AP's random number
     │                                                 │
     │ computes PTK = PRF(PMK, ANonce, SNonce,         │
     │                    AP MAC, client MAC)          │
     │                                                 │
     ├───── M2: SNonce + MIC ─────────────────────────►│  client's random number
     │                                                 │  and a signature with a PTK key
     │                                                 │  the AP computes the same PTK,
     │                                                 │  checks the MIC: password is correct
     │ ◄──── M3: GTK (encrypted with PTK) + MIC ───────┤  group key for
     │                                                 │  broadcast
     ├───── M4: confirmation + MIC ───────────────────►│
     │                                                 │
     │ ═══════ all further traffic uses PTK ═══════════│

What matters here:

The password is not transmitted over the radio in any form. Each side proves it knows the PMK by signing the other side's random numbers. The signature is the MIC (Message Integrity Code), a keyed hash of the frame contents using a key from the PTK.
Since the PTK includes two random numbers, the key of every connection is unique, even with the same password.
The GTK is a shared key for broadcast and multicast frames, known to all clients of the network; the access point changes it periodically.
The weak spot of WPA2-Personal: everything needed to guess the password is visible on the air. Having recorded M1 and M2 (ANonce, SNonce, both MACs and the MIC), an attacker tries passwords offline, computing the PMK and checking the MIC. The only defence is a long password, because 4096 PBKDF2 iterations make brute force slow, but not impossible.

WPA3-Personal closes exactly this hole. Instead of Open System, the authentication step performs SAE (Simultaneous Authentication of Equals): both sides use the password to compute a point on an elliptic curve, exchange random values and derive a shared secret in such a way that the PMK cannot be recovered from captured frames and the password cannot be brute-forced offline: each attempt requires a live exchange with the access point, which limits them. After that comes the same four-way handshake, but with the PMK from SAE. A bonus is forward secrecy: compromising the password does not reveal sessions recorded earlier.

What encrypts the frames themselves. In WPA2 it is CCMP: AES with a 128-bit key, each frame encrypted in counter mode with a unique packet number, plus an 8-byte integrity code. In WPA3 it is the same CCMP or GCMP-256 with a longer key. The old schemes are disabled in modern access points: WEP (1999) encrypted with the RC4 stream cipher and a 24-bit counter that repeated after a few hours, and the key can be recovered in minutes; TKIP from first-generation WPA is a crutch on top of the same RC4 with per-frame key mixing, which extended the life of old cards but is broken too.

In WPA2 management frames are not protected: anyone can send a deauthentication on behalf of the access point and kick a client off the network. This is what "jammers" are built on, as is the attack for capturing a handshake: kick the client off and record its reconnection. PMF (802.11w, Protected Management Frames) signs deauth/disassoc with a key from the PTK, so they can no longer be forged; in WPA3 PMF is mandatory.

The hidden node

The situation: laptop A is in one room, laptop C in another, access point B in between. A and C both hear the access point but not each other — there is a wall. CSMA/CA is useless for them: A listens to the channel, the channel is "free", A transmits, at that moment C transmits as well, the two signals overlap at the access point, and both frames are corrupted. Neither A nor C will learn of this except by the missing ACK; they will double their windows and try again. Under heavy load these two will keep clashing all the time.

      A  ))))))))  B  ((((((((  C
         hears        hears
   A can't hear C, C can't hear A

This is exactly what RTS/CTS exists for. Before its frame A sends a short RTS, access point B replies with CTS, and the CTS is heard by everyone who hears the access point, including C. The CTS carries a Duration, C sets its NAV and stays silent. Short RTS frames can also collide, but losing a few bytes is cheaper than losing a full frame. RTS/CTS is usually enabled only for frames longer than a threshold, because for short ones the overhead outweighs the gain.

Roaming

Several access points with the same SSID and the same password form an ESS (Extended Service Set), and a client can move between them without losing its IP address: for the network behind the access points this is one L2 segment in which the client has simply "moved" to another switch port.

The key fact: the client decides when to move, not the access point. The access point cannot say "go to my neighbour". The client itself monitors the signal level, and each OS has its own threshold after which it starts looking for a replacement. Hence "sticky clients": a laptop clings to a distant access point at 6 Mbit/s until the signal drops completely, even though there is another one nearby. Moving means scanning again, authentication, reassociation (an association request with the address of the old access point) and the handshake — 100–500 ms, during which a voice call gurgles.

Three amendments to the standard, collectively called "fast roaming", make this better:

802.11k — on request, the access point gives the client a list of neighbouring access points with their channels, so it does not have to scan every channel in turn.
802.11v — the access point can suggest that the client move to a particular neighbour (BSS transition request), and, if it wishes, disconnect it if it does not comply.
802.11r — the PTK for the new access point is derived in advance from a key shared by all access points, and when moving, a couple of frames are enough instead of a full handshake.

All three must be supported by both the access points and the clients, and old devices sometimes refuse to connect to a network with 802.11r enabled.

Where the megabits go

Let's collect the reasons why "1200 Mbit/s" on the box turns into 300–500 in a speed test:

Half duplex: one channel for both directions and for all clients.
For every frame or burst of frames — DIFS, backoff, SIFS, ACK, the physical-layer preamble. With short frames the overhead time exceeds the useful time.
The speed on the box is for the maximum number of MIMO streams (for example, four antennas on the access point), while a phone has one or two.
Rate adaptation: the actual frame rate depends on the signal, and the air is shared by time, so a slow client eats into the time of fast ones.
Neighbours on the same and adjacent channels.
Retransmissions of lost frames, which always amount to a few percent.

And finally, an observation that will come in handy in the part on TCP: Wi-Fi retransmits frames itself, up to ten times. TCP on top of it hardly sees any losses, but it does see delay with a large variance, and at times mistakes it for network congestion. The layer abstraction leaks.

Seeing it for yourself

Connection status: the access point, the channel, the rate of the latest frames, the signal:

$ iw dev wlan0 link
Connected to d8:47:32:0a:0b:0c (on wlan0)
        SSID: office
        freq: 5180
        RX: 123456789 bytes (98765 packets)
        TX: 12345678 bytes (23456 packets)
        signal: -58 dBm
        rx bitrate: 866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2
        tx bitrate: 650.0 MBit/s VHT-MCS 7 80MHz short GI VHT-NSS 2

freq: 5180 is channel 36; -58 dBm is a good signal (up to −65 is excellent, −75 tolerable, −85 next to nothing); MCS 9, 80MHz, NSS 2 are the modulation scheme, the channel width and the number of streams that together make up the rate.

What is on the air around you:

$ sudo iw dev wlan0 scan | grep -E 'SSID|freq|signal|primary channel'

And on a Linux access point you can see the clients like this: iw dev wlan0 station dump — for each MAC address, the signal, rates and number of retries. Growing tx retries and tx failed for one client mean it is far away or behind a wall.

In Wireshark, a capture from monitor mode shows the radiotap header (signal, channel, rate), then the 802.11 frame with the To DS/From DS flags and the addresses decoded, then LLC/SNAP and then ordinary IP. If you enter the network password in the IEEE 802.11 protocol preferences and capture the handshake, Wireshark will decrypt the data too.

Key takeaways

Radio is a shared medium, half duplex, and a collision cannot be heard. Hence CSMA/CA: carrier sensing, random backoff, an acknowledgement for every frame, doubling the window on loss.
In 2.4 GHz only channels 1, 6 and 11 do not overlap. In 5 GHz there are many channels, some with DFS. A wide channel is faster but interferes with more neighbours.
The 802.11 frame: three or four addresses, the To DS/From DS flags, the EtherType hidden in LLC/SNAP. The access point is a bridge between 802.11 and Ethernet.
Connecting: scanning, authentication, association, the four-way handshake. The password never goes over the radio, the PTK is unique for every connection, the GTK is shared.
WPA2-Personal can be brute-forced offline from a recorded handshake; WPA3 with SAE cannot. In Enterprise, a RADIUS server issues each user a key after EAP.
The air is shared by time: one distant client slows everyone down. Roaming is the client's decision.

Next — Part 4: PPPoE: why ISPs wrap PPP in Ethernet, how a client finds the concentrator (PADI, PADO, PADR, PADS), how LCP, authentication and address assignment via IPCP work, and where the MTU of 1492 comes from.