The Last Hop, Without Wires

Every cloud service ultimately terminates on a device that reaches the network over Wi-Fi or Ethernet. The local access network—the LAN—is where users actually experience the internet, and it has its own set of protocols, security models, and failure modes.

Wi-Fi (IEEE 802.11)

Wi-Fi carries Ethernet frames over radio. Each generation trades coverage, speed, and spectrum:

  • 802.11n (Wi-Fi 4): 2.4/5 GHz, MIMO.
  • 802.11ac (Wi-Fi 5): 5 GHz, wider channels, more spatial streams.
  • 802.11ax (Wi-Fi 6/6E): better performance in dense environments, 6 GHz in 6E.
  • 802.11be (Wi-Fi 7): multi-link operation and very high throughput.

Higher frequencies carry more data but penetrate walls less. This is why 2.4 GHz reaches farther and 5/6 GHz is faster—and why your router advertises two SSIDs.

Channels, Bands, and Interference

Wi-Fi uses channels within a band. In 2.4 GHz only three channels (1, 6, 11) do not overlap. Neighboring networks on overlapping channels interfere, degrading throughput for everyone. In 5 and 6 GHz many more channels are available, and dynamic frequency selection lets access points share the spectrum. Roaming lets a device move between access points under one SSID, though the decision to switch is made by the client, which is why some devices cling to a weak AP far too long.

Access Points vs. Routers

A wireless access point (AP) bridges wireless clients onto a wired LAN. A home "router" bundles several devices: a router, a switch, an AP, a DHCP server, and a firewall/NAT. In enterprises these are separate components, often with a wireless controller that coordinates dozens of APs and manages roaming and channel plans centrally.

Securing Wi-Fi

  • WPA2/WPA3: modern Wi-Fi encryption. WPA3 adds stronger handshakes (SAE) that resist offline dictionary attacks on captured handshakes.
  • Pre-shared key (PSK): everyone shares one password. Simple, but you cannot revoke one user without changing the key for all.
  • 802.1X / WPA-Enterprise: each user authenticates with their own credentials against a RADIUS server. Revoking one account does not disturb others—the standard for corporate Wi-Fi.
  • Hidden SSIDs: not security. Anyone can discover them; treat them as cosmetic.

The Threat Model on a LAN

On an open or subverted LAN, an attacker can: - Sniff broadcast traffic and some unicast traffic on shared media. - ARP-spoof to become the man in the middle (see the Ethernet/ARP lesson). - Evil-twin the SSID and lure clients to a rogue AP.

Because of this, treat the LAN as untrusted. Use HTTPS/TLS for everything, use encrypted DNS, and never rely on network-level trust to protect sensitive data.

DHCP

Most LAN clients get an address dynamically from DHCP: request, offer, request, acknowledgment (DORA). DHCP also hands out the default gateway, DNS servers, and lease duration. A rogue DHCP server can redirect a whole network's traffic—another reason to keep the LAN untrusted and to monitor for unexpected DHCP servers.

Wired vs. Wireless Tradeoffs

Wired Ethernet remains faster, lower-latency, and more reliable than any Wi-Fi generation, with no shared-medium contention. That is why servers, access points, and backbones are wired even when clients are wireless. Wi-Fi wins on convenience and device density. A well-designed LAN uses each where it fits: wire everything stationary that matters, and reserve the airwaves for devices that must move. When troubleshooting end-user "slow internet", establish whether the problem reproduces on a wired connection—that single test separates a Wi-Fi issue from an ISP or application issue faster than any spectrum analyzer.

Designing for Capacity

Wi-Fi capacity is shared per channel, not per access point. Two APs on the same channel split airtime, so adding APs without a channel plan can make things worse. Enterprises use a site survey: measure coverage and interference, assign non-overlapping channels, and size the AP count to the expected concurrent clients. For high-density venues (stadiums, auditoriums), Wi-Fi 6/6E's OFDMA and BSS coloring are specifically designed to keep dense environments usable.