Wireless Networking & LAN

The Last Hop, Without Wires#

Every cloud service ends at a device that reaches the network over Wi-Fi or Ethernet. The local area network (LAN) is where users actually experience the internet, and it is where many "the internet is slow" complaints really originate. It has its own protocols (802.11, DHCP, ARP), its own security model, and failure modes that look nothing like problems in a data centre.

Wi-Fi Generations and Bands#

Wi-Fi (IEEE 802.11) carries Ethernet-style frames over radio. The generations you will meet:

Higher frequencies carry more data but pass through walls and floors less well. The practical rule: 2.4 GHz reaches further and is crowded, 5 GHz is the everyday workhorse, and 6 GHz is fast, clean, and short-range, usually best in the same room as the access point.

Advertised speeds are not throughput. The link rate a device reports is the raw PHY rate for its current conditions. Real TCP throughput is typically around half of it or less, because Wi-Fi is half-duplex (only one device on a channel transmits at a time), every frame carries protocol overhead, and all clients share the airtime.

Channels and Interference#

In 2.4 GHz, channels are 5 MHz apart but each 20 MHz transmission spans about four neighbours, so only 1, 6, and 11 do not overlap (in most regions). A network on channel 3 interferes with networks on both 1 and 6. Two networks on the same channel share airtime politely, taking turns; networks on overlapping channels hear each other as noise and corrupt each other's frames, which is worse.

5 and 6 GHz offer many more channels, but wider channels consume several of them: an 80 MHz channel uses four 20 MHz channels, so in a busy office, narrower channels with less overlap often beat wide ones. Some 5 GHz channels require DFS (dynamic frequency selection): the AP must listen for radar and move off the channel if it detects any, which shows up as brief, unexplained disconnects.

Measuring What Your Radio Sees#

Signal strength is reported in dBm, a logarithmic scale where values closer to zero are stronger. Every 3 dB is roughly a doubling or halving of power. Common rules of thumb:

To check the current link:

# Linux
iw dev wlan0 link                      # signal in dBm, tx bitrate, frequency
nmcli -f SSID,CHAN,RATE,SIGNAL,SECURITY device wifi list

# Windows
netsh wlan show interfaces             # signal %, channel, receive/transmit rate

To pick a 2.4 GHz channel for your own access point, list nearby networks and add up how much of each non-overlapping channel is already in use. This script uses NetworkManager's terse output, where colons inside SSIDs are escaped as \::

import re
import subprocess
from collections import defaultdict

MY_SSID = "HomeNet"   # leave your own network out of the count

def scan():
    out = subprocess.run(
        ["nmcli", "-t", "-f", "SSID,CHAN,SIGNAL", "device", "wifi", "list", "--rescan", "yes"],
        capture_output=True, text=True, check=True).stdout
    for line in out.splitlines():
        ssid, chan, signal = re.split(r"(?<!\\):", line)   # split on unescaped colons only
        yield ssid.replace("\\:", ":") or "<hidden>", int(chan), int(signal)

def score_24ghz(networks):
    # A 20 MHz transmission overlaps channels up to 4 away in 2.4 GHz
    load = defaultdict(int)
    for ssid, chan, signal in networks:
        if chan <= 14 and ssid != MY_SSID:
            for candidate in (1, 6, 11):
                if abs(candidate - chan) < 5:
                    load[candidate] += signal
    return {c: load[c] for c in (1, 6, 11)}

networks = list(scan())
for ssid, chan, signal in sorted(networks, key=lambda n: -n[2]):
    print(f"{signal:>3}%  ch {chan:<3} {ssid}")
print("2.4 GHz interference score (lower is better):", score_24ghz(networks))

 82%  ch 6   HomeNet
 70%  ch 36  Office5G
 55%  ch 3   Neighbour
 40%  ch 1   Cafe:Guest
 30%  ch 11  <hidden>
2.4 GHz interference score (lower is better): {1: 95, 6: 55, 11: 30}

Here channel 11 is the quietest choice. The neighbour on channel 3 counts against both 1 and 6, which is exactly why off-grid channels are harmful. A scan is only a snapshot: networks change channel and neighbours come and go, so repeat it at different times of day before deciding.

Access Points, Routers, and Roaming#

A wireless access point (AP) bridges wireless clients onto a wired LAN. A home "router" bundles a router, a small switch, an AP, a DHCP server, a DNS forwarder, and a NAT firewall in one box (see NAT and port forwarding). In offices these are separate devices, and a wireless controller or cloud dashboard coordinates dozens of APs: channel plans, transmit power, and roaming.

Roaming is decided by the client, not the network. Many devices hold on to a weak AP long after a stronger one is available (the "sticky client" problem). Standards such as 802.11k (neighbour reports), 802.11v (the network suggesting a better AP), and 802.11r (fast re-authentication) help, but client support varies. Turning AP transmit power down often improves roaming, because clients stop clinging to a distant AP they can still hear.

Securing Wi-Fi#

• WPA2-Personal (PSK): one shared password. Anyone who captures a client's four-way handshake can try passwords offline at high speed, so the password must be long and random. You cannot revoke one user without changing it for everyone.
• WPA3-Personal (SAE): replaces the PSK handshake with one that resists offline dictionary attacks, and requires Protected Management Frames, which stops attackers from forging the deauthentication frames used to kick clients off.
• WPA2/WPA3-Enterprise (802.1X): each user or device authenticates with its own credentials or certificate against a RADIUS server. Revoking one account affects nobody else. Standard for corporate networks.
• Hidden SSIDs and MAC filtering: not security. SSIDs leak in probe requests, and MAC addresses are trivial to copy.

Segment the network so that a compromised device has limited reach: guest and IoT SSIDs mapped to their own VLANs, with client isolation so guests cannot reach each other. The Ethernet, ARP and switching lesson explains VLANs.

The Threat Model on a LAN#

On a shared or hostile LAN, an attacker can:

• ARP-spoof the gateway to sit in the middle of other hosts' traffic.
• Run an evil twin: a rogue AP with the same SSID, luring clients that auto-join.
• Run a rogue DHCP server that hands out itself as gateway and DNS server.

The defences live in switches and endpoints: DHCP snooping (switches only accept DHCP offers from trusted ports), dynamic ARP inspection, 802.1X for wired ports, and above all TLS for every application protocol so that intercepted traffic is useless. Treat any LAN you do not control as untrusted. The network security lesson covers the wider set of controls.

DHCP: How Clients Get an Address#

A new client broadcasts to get its configuration in four steps, DORA: Discover, Offer, Request, Acknowledge, over UDP ports 67 (server) and 68 (client). The lease gives the client an IP address, subnet mask, default gateway, DNS servers, and a lease time.

Useful diagnostics:

ip addr show wlan0                # Linux: current address and prefix
ipconfig /all                     # Windows: address, gateway, DNS, DHCP server, lease
sudo nmap --script broadcast-dhcp-discover   # lists every DHCP server that answers

Run that nmap script on a network you administer: more than one responder, when you expect one, means a misconfigured device or a rogue server. An address in 169.254.0.0/16 (link-local, "APIPA" on Windows) means the client never got a DHCP answer at all, which points at the DHCP server, the VLAN, or the wireless association, not at DNS or the ISP.

Troubleshooting "The Wi-Fi Is Slow"#

Work from the bottom up, and let each step rule out a layer:

1. Plug in a cable. If wired is fine, the problem is the wireless link; if wired is also slow, look at the ISP, router, or application.
2. Check signal and rate. Below about -70 dBm or a low link rate, the fix is AP placement or another AP, not a faster internet plan.
3. Check the channel. Heavy overlap or many networks on the same channel means contention. Move to a cleaner channel or band.
4. Check the address. A 169.254.x.x address or a missing gateway is a DHCP problem.
5. Ping the gateway, then a public IP, then a hostname. Loss to the gateway is local radio trouble; loss that starts further out is upstream; failure only on hostnames is DNS.

The network troubleshooting lesson covers the tools for steps 5 and beyond.

Designing for Capacity#

Wi-Fi capacity is shared per channel, not per AP. Two APs on the same channel split airtime, so adding APs without a channel plan can make things worse. Offices do a site survey: measure coverage and interference, assign channels so adjacent APs do not overlap, reduce transmit power so each AP covers a smaller "cell", and size the AP count for expected concurrent clients, not floor area. One slow, distant legacy client can use a disproportionate share of airtime, because sending the same data at a low rate takes longer, so some deployments set minimum data rates to push such clients towards a closer AP. Wire everything that does not move: desktops, TVs, printers, and the APs themselves.