How Wi-Fi actually works

Three bands, three trade-offs

Wi-Fi uses unlicensed spectrum — bands anyone may transmit in, provided they obey power limits. There are three, and they behave very differently. Lower frequencies travel further and bend around walls; higher frequencies carry more data but die quickly indoors.

Channel width: more lanes, but noisier ones

A channel can be 20, 40, 80 or 160 MHz wide. Doubling the width roughly doubles the headline speed — and also doubles the noise the receiver takes in, so the usable range shrinks, and you collide with more neighbours. In a detached house, 80 MHz on 5 GHz is usually the sweet spot. In a block of flats, 40 MHz often measures faster than 160 MHz, because the airtime is not being wasted on collisions.

What the bars on your phone actually measure

Signal strength is measured in dBm — a negative number, where closer to zero is stronger. What matters more is the gap between your signal and the background noise: the signal-to-noise ratio. A strong signal in a noisy room performs worse than a moderate signal in a quiet one.

The access point never shuts up

Roughly ten times a second — every 102.4 ms by default — each access point radio broadcasts a beacon frame. It is a small advertisement containing the network name (SSID), the radio's own MAC address (the BSSID), the channel, the supported data rates, the security it demands, and a note about any buffered traffic for sleeping devices.

SSID and BSSID are not the same thing

The SSID is the human name — Office-WiFi. The BSSID is the MAC address of one specific radio in one specific access point. A mesh system or an office with twelve APs has one SSID and dozens of BSSIDs. You choose the name; your device quietly chooses which radio to talk to, and re-chooses as you move. Almost every “the Wi-Fi is bad in that corner” complaint is really a question about which BSSID the device picked and whether it is willing to let go.

Hiding the name is not security

A “hidden” network simply omits the SSID from its beacons. The beacons still go out, the BSSID is still visible, and any client that connects has to shout the name in a probe request — including when it is sitting in your bag in a coffee shop. Hidden SSIDs make devices noisier and roaming slower while stopping nobody.

SSID

the network name

BSSID

one radio's MAC address

Beacon

the AP's advert

Probe

the client's question

Authentication here means almost nothing

The “authentication” exchange is a leftover from the 1990s. On a modern WPA2 network it is Open System authentication: the client asks, the AP says yes, no credentials involved. The real security check happens one step later. (WPA3 does put genuine work here — its SAE exchange replaces these two frames with a password-proving handshake.)

Association is the real introduction

In the association request the client lists what it can do — data rates, channel widths, spatial streams, power-save behaviour — and, crucially, states which security suite it intends to use. The AP checks that against its own configuration and replies with a status code and an association ID, a small number identifying this client for the rest of the session.

A non-zero status code is where a lot of real-world “it just won't connect” lives: status 17 means the AP has no capacity, status 18 means the client's supported rates do not include something the AP requires, status 12 often points at a band-steering or access-control rule quietly turning the device away.

What each message is really for

• Prove mutual knowledge. The MIC in M2 can only be computed by someone holding the PMK. If the passphrase is wrong, the check fails here.
• Generate fresh keys. The nonces make every session's encryption key different, even for the same device on the same network ten minutes later.
• Deliver the group key. Unicast traffic uses your personal PTK; broadcasts use the shared GTK, handed over in M3.
• Confirm nothing was tampered with. M3 repeats the security parameters from step 3, so an attacker cannot silently downgrade the cipher.

The wrong-password loop

This is why a mistyped passphrase produces that maddening “authentication problem” cycle rather than a clear error. The AP has no way to say “wrong password” — it simply never gets a valid M2, retries a few times, then deauthenticates the client, which tries again from the top.

WPA3 changes the first move

WPA2-Personal has a real weakness: capture a handshake and you can grind through password guesses offline, at whatever speed your hardware allows. WPA3 replaces the opening exchange with SAE (a Dragonfly key exchange), which makes each guess cost an interaction with the real AP. It also gives forward secrecy — recording today's traffic and learning the password next year gets an attacker nothing — and it requires Protected Management Frames, which stop the trivial deauthentication attacks that plagued WPA2.

On a corporate network the same handshake runs, but the PMK comes from an 802.1X/EAP exchange with a RADIUS server instead of a shared passphrase — which is why every user can have their own credential and be revoked individually.

Four settings, four jobs

• The address identifies your device on this local network.
• The subnet mask (/24) tells it which addresses are neighbours it can reach directly, and which are “somewhere else”.
• The gateway is where to send anything that is somewhere else — your router.
• The DNS server turns names into addresses. Without it, the internet works perfectly and nothing you type resolves.

Two more conversations before any traffic moves

With an address in hand the device still has to find the gateway's MAC address using ARP — “who has 192.168.1.1?” — because Ethernet and Wi-Fi frames are addressed by hardware address, not IP. Then it asks DNS for the address of whatever you typed. Only then does the first real packet leave. All of this normally takes a few tens of milliseconds.

Reading the failures

Polite radios: listen, wait, count, talk

Wired Ethernet can detect a collision while transmitting. A radio cannot — it is deaf while it shouts. So Wi-Fi avoids collisions instead: every device listens first, waits a fixed gap, then counts down a random number of slots before transmitting. If two devices pick the same number, they collide, both double their random range and try again.

Airtime, not bandwidth, is the thing you run out of

Two devices downloading the same file do not each get half the speed by agreement — they each get a share of time. A device far away, negotiating a slow data rate, needs vastly more airtime to move the same bytes. While it talks, everyone else is silent.

The hidden node problem

Two devices at opposite ends of the house may both hear the access point perfectly and not hear each other at all. Neither can tell the other is mid-transmission, so they collide at the AP, repeatedly. The fix is RTS/CTS: a device asks permission first, the AP broadcasts a “clear to send” that everyone hears, and the air is reserved for the duration. It costs overhead, which is why it is normally only used for larger frames.

What modern Wi-Fi does about it

Wi-Fi 6 added OFDMA, which slices the channel into smaller resource units so the AP can serve several devices inside one transmission — hugely more efficient for the small, frequent packets that dominate real networks. MU-MIMO sends to multiple devices simultaneously using separate spatial streams, and BSS colouring lets a radio ignore a neighbour's traffic on the same channel instead of politely waiting for it.

What actually goes over the air

Where the headline speed comes from

“Wi-Fi 6, 1,200 Mbps” is not a promise, it is a multiplication. Four ingredients decide the rate for each individual transmission, and the radios renegotiate it constantly — hundreds of times a second — as conditions change.

Roaming is a client decision, and that is the problem

The access points cannot drag a device across. All they can do is make the choice obvious. Each client vendor has its own threshold and its own hysteresis, which is why an iPhone, a Windows laptop and a warehouse scanner will behave completely differently in the same building. A device that only looks for somewhere better at −75 dBm has already spent minutes on a link that is retrying constantly.

The three standards that help

• 802.11k — the AP hands the client a neighbour report, so it knows exactly which channels to check instead of scanning all of them.
• 802.11v — the AP can politely suggest a move: “AP-2 is better for you, go there.” Well-behaved clients take the hint.
• 802.11r — fast transition. The key material is pre-shared between APs, so the full handshake from step 4 does not have to run again. This takes a roam from a few hundred milliseconds down to tens — the difference between a call that glitches and one that does not.

Mesh, and why a cable always wins

A mesh node without a cable has to talk to your devices and relay everything back to the main router, usually on the same radio. That halves the usable throughput at every hop, and the second hop halves it again. Mesh is an excellent answer to “I cannot run a cable there”. It is a poor answer to “I want this to be fast”. If you can get Ethernet or even a decent powerline link to the second node, you roughly double what it can deliver.

Band steering and sleep

Most systems advertise one SSID across all bands and try to nudge capable devices onto 5 or 6 GHz by delaying their 2.4 GHz replies. It usually works. When it does not, you get a device that connects, drops, and reconnects in a loop — one of the few cases where splitting the SSID per band is genuinely the right fix.

Meanwhile, idle devices are not really listening. They sleep between beacons and wake to check the traffic map for their own buffered data. Wi-Fi 6 formalises this as Target Wake Time, where a sensor can agree to wake once an hour — the reason a modern battery-powered device can last years on Wi-Fi at all.

Symptom to cause

The single most common mistake

On 2.4 GHz there are only three channels that do not overlap. Pick anything else and your network and your neighbours' corrupt each other's transmissions rather than politely taking turns — which is far worse than sharing a channel.

A sensible order to work through

• Establish where the problem is. Run a speed test from a device on a cable. If that is slow too, Wi-Fi was never the issue.
• Look at signal and noise, in the room that is bad. Below −70 dBm, fix coverage before anything else.
• Check channel utilisation. If the air is busy, more power and wider channels make things worse, not better.
• Narrow the channel width before you buy anything. 40 MHz on a crowded 5 GHz band often beats 80 or 160.
• Add an access point rather than turning one up. Power only helps in one direction — your phone cannot shout back any louder.
• Wire what you can. Every mesh hop you remove gives the rest of the network its airtime back.