Technician's Field Guide · Wireless
What changes when the wire disappears: a shared, invisible, analog medium where distance, walls, and neighbours all get a vote. How to reason about coverage, capacity, security, roaming — and the tickets that blame the Wi-Fi but aren't.
Wi-Fi is the same networking you already know, running over a medium that fights back. The wire gave every device its own private, full-duplex lane; the air is one shared, half-duplex room where only one device on a channel talks at a time, and walls, distance, microwaves, and the neighbours' network all degrade the signal. Once a frame reaches the access point it's ordinary Ethernet again — so the wireless-specific reasoning is really about the first hop: the air.
Five mental models that account for most "Wi-Fi problems":
The friendly "Wi-Fi N" names map to IEEE 802.11 letters. What actually matters day to day is which bands and features a device supports.
| Name | 802.11 | Bands | Notable |
|---|---|---|---|
| Wi-Fi 4 | n | 2.4 + 5 GHz | MIMO |
| Wi-Fi 5 | ac | 5 GHz only | wider channels, MU-MIMO (down) |
| Wi-Fi 6 | ax | 2.4 + 5 GHz | OFDMA, better in dense areas, 1024-QAM |
| Wi-Fi 6E | ax | + 6 GHz | opens the clean 6 GHz band; WPA3 required there |
| Wi-Fi 7 | be | 2.4 / 5 / 6 GHz | MLO, 320 MHz, 4096-QAM (802.11be-2024) |
Each band trades reach for room. Lower frequency travels farther and through more walls but carries less and is more crowded; higher frequency is faster and cleaner but shorter-range.
Each band is divided into channels. The classic trap lives on 2.4 GHz: it's so narrow that there are only three non-overlapping 20 MHz channels — 1, 6, and 11. Any other choice overlaps two of those and just adds interference.
Channel width is a trade-off. Wider channels (40/80/160/320 MHz) carry more but there are fewer of them, they collide more, and they pull in more noise. On 2.4 GHz, never use 40 MHz — there isn't room. On 5/6 GHz, wider is fine where the airspace is clean, but in dense environments narrower channels reused carefully often beat one fat congested channel. Two other realities: some 5 GHz channels are subject to DFS (the AP must vacate if it hears radar, briefly dropping clients), and co-channel interference (two APs on the same channel politely sharing airtime) is usually worse for throughput than adjacent-channel interference (overlapping channels talking over each other) is for reliability — plan channels to avoid both.
"Bars" hide the two numbers that actually matter. RSSI is received signal strength in dBm — a negative number, closer to zero is stronger. But strength alone doesn't set your speed; the signal-to-noise ratio does.
Bars usually show RSSI only. If the noise floor is high (a crowded band, interference), SNR is low even at strong RSSI, so the client negotiates a slow rate and retransmits a lot. High retry rates and high channel utilization — not the bar count — are what reveal a struggling cell.
Because anyone in range hears the transmission, wireless security is about encrypting the link and authenticating who may join. The lineage, and what each addresses:
| Scheme | What it does | Threat it addresses / leaves open |
|---|---|---|
| WEP | Legacy, broken | Trivially cracked — never use it. |
| WPA / WPA2-PSK | Shared passphrase, 4-way handshake | Encrypts the link; a captured handshake is open to offline guessing, so a weak passphrase falls. (KRACK-class flaws needed patching.) |
| WPA3-SAE | Modern handshake (SAE) | Resists offline guessing and adds forward secrecy; still only as controlled as who has the passphrase. |
| OWE (Enhanced Open) | Encryption on "open" networks | Stops passive eavesdropping on guest/open SSIDs — but authenticates nothing (no protection against a rogue AP). |
| 802.1X / EAP (Enterprise) | Per-user credentials via RADIUS | Individual identity and revocation instead of one shared secret; depends on correct certificate/RADIUS setup. |
WPA3 is mandatory on the 6 GHz band and for Wi-Fi 6E/7 certification; 2.4/5 GHz commonly run a WPA2/WPA3 transition mode so older clients still connect. Turn on Protected Management Frames (PMF / 802.11w) where supported — it blocks the forged deauthentication frames behind the classic "knock everyone off" attack.
Name the threat and the residual risk. Encryption stops the passive eavesdropper on the air, but it doesn't stop a rogue AP / evil twin (a fake SSID your clients trust), a leaked or shared PSK, or an attack on a mis-set RADIUS. WPA3 + PMF + Enterprise auth + rogue-AP detection each close a specific gap; none of them makes the network "safe" on its own.
One name, many radios. The network name is the SSID; each AP radio has its own BSSID (a MAC address). Several APs sharing one SSID look like a single network to the user — but the client decides which BSSID to use and when to switch.
That's the root of most roaming complaints: clients are frequently sticky, clinging to a distant AP at −80 dBm while a strong one sits overhead, because roaming is their decision and many make it badly. Standards help nudge and speed the handoff:
All the same SSID with the same security settings across APs is what makes seamless roaming possible; mismatched settings between APs break it. (Wi-Fi 7's MLO goes further — a client can use links on two bands at once, for resilience and throughput.)
Wi-Fi 7 (802.11be-2024) is shipping. Beyond raw speed, the meaningful additions are:
Wi-Fi 8 (802.11bn, "Ultra High Reliability") is in draft, with finalization expected around 2028 and early hardware appearing sooner. Its focus is consistency and reliability at the edge of coverage, not a new top speed. Treat the timeline and any pre-standard "Wi-Fi 8" hardware claims as changeable — verify against the Wi-Fi Alliance and IEEE before relying on them.
The first fork is the whole game: is this actually an RF problem, or the network behind the AP? Walk the association ladder — the first two rungs are Wi-Fi; everything past them is the same wired troubleshooting you already know.
Hotel, café, and guest networks often put a captive portal in the way: the client associates, but the first web request is intercepted and redirected to a login or terms page before internet is granted. Devices detect this by firing a known plaintext-HTTP probe at a vendor URL and watching for the expected reply; no expected reply means "portal present," which triggers the sign-in popup. That mechanism is also why it breaks: if the probe is cached or the device already "passed" detection, no popup appears (the user thinks they're online but every real request stalls); and because the portal can only intercept plaintext HTTP, a device that speaks only HTTPS/HSTS or uses DNS-over-HTTPS may never get redirected — the fix is often to browse to a plain http:// URL to force the portal, or forget and rejoin the network. MAC randomization can also drop the "already authenticated" state, forcing re-login on each connect. And the security point: a captive portal is acceptance/authentication, not encryption. An open network with a portal is still unencrypted over the air unless it also runs WPA (or OWE / Passpoint) — clicking "I agree" protects nothing about your traffic.
| Belief | Reality | Signal |
|---|---|---|
| "Full bars = good connection" | Bars show RSSI; speed needs SNR and free airtime. | Strong signal but slow → check SNR, retries, channel utilization. |
| "More APs = better Wi-Fi" | Too many APs on overlapping channels create co-channel interference and steal airtime. | Adding APs made it worse → channel plan & power are wrong. |
| "6/5 GHz is always better" | Higher bands are faster but don't travel as far or through walls. | Great near the AP, drops out down the hall → band/coverage, not a fault. |
| "One slow device doesn't affect others" | A slow/legacy client hogs airtime at low rates. | Whole cell slows when one far/old device is active → airtime contention. |
| "Turn the AP power to max for coverage" | The client still has to shout back at its low power — over-powering the AP creates one-way coverage and more interference. | Client sees the AP but can't hold a connection → power asymmetry. |
| "It's the Wi-Fi" | Past association, it's DHCP/DNS/uplink. | Associates fine, "no internet" → §8, not the air. |
Good wireless is designed for the room, then verified in the room — RF is too environmental to plan purely on paper.
Wi-Fi is a two-way conversation between unequal radios. The battery-powered phone transmits far weaker than the wall-powered AP, so coverage is really bounded by the client's ability to be heard — which is why cranking AP power rarely fixes a dead spot and often makes the whole area noisier.
Airtime is shared (one talker per channel) · RF is analog & environmental · coverage ≠ capacity · the client decides · "it's the Wi-Fi" usually isn't.
2.4 = range + congestion, only 1/6/11 · 5 = workhorse (DFS on some) · 6 = cleanest + 320 MHz, WPA3 required. Wider channel = faster but fewer + noisier.
RSSI in dBm, closer to 0 = stronger (−67 good, <−80 unusable — ballparks). SNR sets the rate (~20–25 dB for high rates). Full bars can still be slow — check SNR, retries, utilization.
Never WEP · WPA2-PSK ok with a strong passphrase · prefer WPA3-SAE · OWE encrypts open nets (no auth) · 802.1X for per-user identity · turn on PMF. Nothing is "secure" — name the threat (eavesdrop, offline crack, deauth, evil twin) and residual risk.
Associate → authenticate → DHCP → DNS → gateway → internet. First two rungs = RF; the rest = the network behind the AP. One host vs whole cell splits client-issue from airtime/uplink.
A teaching field guide in the Networking set's style. Standards current as of 2026: Wi-Fi 7 = IEEE 802.11be (802.11be-2024, finalized July 2024, shipping); Wi-Fi 8 = 802.11bn (Ultra High Reliability), in draft with finalization expected around 2028; WPA3 mandatory on 6 GHz and for Wi-Fi 6E/7 certification. Regulatory channel and 6 GHz availability, DFS rules, and Wi-Fi 8 timing vary by country and change — verify against current Wi-Fi Alliance / IEEE and local regulator sources before relying on specifics. Signal-strength figures are ballparks for orientation, not design targets. No wireless configuration is "secure" in the abstract; each control addresses a specific threat and leaves residual risk. Companion to the Networking Field Guide (association hands off to its path bisection), and to Zero Trust and the Firewall guidance for network-side access control.