Wi-Fi carries local network traffic through radio instead of an Ethernet cable. It serves the data-link and physical-layer roles of a local connection, but it does not transmit Ethernet II frames over the air.

IEEE 802.11 defines wireless frame formats, radio access rules, association behavior, acknowledgments, retransmissions, and security capabilities. An access point commonly bridges those wireless frames into an Ethernet network.

The shared radio medium changes the behavior of the link. Devices contend for airtime, cannot normally transmit and receive on the same channel at the same time, adapt their data rates as conditions change, and acknowledge individual unicast frames.

Understanding these link behaviors explains why a device can be associated with Wi-Fi yet lack an IP address, why the displayed PHY rate exceeds application throughput, and why a weak or congested wireless link adds latency before any IP packet reaches a router.

IEEE 802.11 is a family of wireless LAN standards. Wi-Fi is the certification and product name commonly used for interoperable 802.11 equipment.

Several widely deployed generations have consumer-friendly names:

Each generation adds combinations of wider channels, more spatial streams, improved scheduling, denser modulation, and better use of shared airtime. A connection uses features supported by both the client and access point under the current regulatory and radio conditions.

The generation label alone does not determine observed speed. Channel width, signal quality, interference, client hardware, access-point configuration, and the number of competing devices can dominate performance.

An 802.11 client is called a station, or STA. A laptop, phone, printer, and wireless server can each act as a station.

An access point, or AP, coordinates an infrastructure-mode wireless network and connects stations to a distribution system, commonly a wired Ethernet LAN.

One AP radio and its associated stations form a Basic Service Set, or BSS:

The access point provides wireless link access and bridging. Routing is a separate function. A home wireless router often combines an AP, Ethernet switch, IP router, firewall, and other services in one enclosure.

Several APs can advertise the same wireless network and form an Extended Service Set, or ESS. Stations can move between those APs while using the same network name.

The Service Set Identifier, or SSID, is the human-readable wireless network name:

An SSID identifies a configured service, not one physical radio. Several APs can advertise AlgoMaster-Lab to provide coverage across a building.

The Basic Service Set Identifier, or BSSID, identifies one BSS. In infrastructure networks, it is usually a 48-bit address associated with an AP radio:

A station associates with a BSSID, while users normally select an SSID. A dual-band or multi-radio access point can expose several BSSIDs, including multiple BSSIDs for the same SSID.

Access points periodically transmit beacon frames. Beacons advertise information such as the BSSID, SSID, supported rates, security capabilities, and timing parameters.

Suppressing the SSID in beacons does not secure the network. Association and probe traffic can still reveal the name, and encryption does not depend on whether a beacon displays it.

Wi-Fi commonly operates in the 2.4 GHz, 5 GHz, and 6 GHz frequency bands. Available channels, transmit power, and indoor or outdoor use depend on regional regulations.

The 2.4 GHz band provides broad device compatibility and often propagates farther through the same environment. It has limited spectrum and overlaps with Bluetooth, microwave ovens, and other unlicensed-band devices. With 20 MHz channels, 1, 6, and 11 form a common non-overlapping plan in regulatory domains that allow those channels.

The 5 GHz band provides more channel choices and supports wider channels. Some channels require Dynamic Frequency Selection, or DFS, so an access point must detect protected radar activity and move when required.

The 6 GHz band adds substantial spectrum for compatible Wi-Fi 6E and Wi-Fi 7 devices. Older clients cannot use it, and its permitted power and deployment modes depend on local regulation.

A channel has a center frequency and width. Common widths include 20, 40, 80, and 160 MHz, with newer equipment supporting wider operation in suitable spectrum.

Wider channels can carry more data during one transmission, but they consume more spectrum and overlap with more neighboring activity. A narrower channel can provide better reuse and more consistent performance in a crowded environment.

An Ethernet switch gives each full-duplex endpoint link an independent transmit and receive path. Wi-Fi stations associated on the same channel share radio airtime.

Only one ordinary transmission can occupy the same channel and contention area at a time. The access point and its clients take turns. Nearby networks on the same channel also participate in contention when their signals are detectable.

This makes airtime a central resource. A frame sent at a low PHY rate occupies the channel longer than the same number of bytes sent at a high rate. One weak or distant station can therefore consume substantial airtime even when it transfers little data.

Different SSIDs do not create separate radio capacity when they use the same channel. SSIDs separate service configuration, while the stations still contend for the shared medium.

Classic shared Ethernet used collision detection. A wireless transmitter cannot reliably detect another transmission while its own radio signal is much stronger at the local receiver. Wi-Fi therefore uses Carrier Sense Multiple Access with Collision Avoidance, or CSMA/CA.

The basic contention process is:

Carrier sensing has two forms. Physical carrier sensing detects radio energy and recognizable 802.11 transmissions. Virtual carrier sensing uses duration information in frames to maintain a Network Allocation Vector, or NAV, representing reserved airtime.

CSMA/CA reduces collision probability but cannot eliminate collisions. Two stations can select the same backoff slot, interference can corrupt a frame, and stations may be unable to hear one another.

Two stations can both reach an access point while being unable to detect each other's transmissions. This is the hidden-station problem.

A and B can each observe an idle channel and transmit to the AP at the same time, causing a collision at the AP.

The optional Request to Send/Clear to Send, or RTS/CTS, exchange can reserve airtime before a data frame. A sender transmits RTS, the receiver answers with CTS, and stations that hear either control frame defer for the announced duration.

RTS/CTS adds overhead, so networks commonly apply it only above a size threshold or when conditions justify it. It reduces certain hidden-station collisions but cannot remove every source of interference or loss.

The receiver normally acknowledges a successfully received unicast 802.11 frame with a short ACK control frame. The ACK follows after a short interframe interval, which gives it priority over new contenders.

If the sender receives no ACK, it cannot determine whether the data frame or the ACK was lost. It retries the data frame and marks the retry state so a receiver can detect duplicates.

The 802.11 sequence-control fields help a receiver identify retransmitted frames. A retry can therefore deliver the frame once even if a previous ACK was lost.

Broadcast and multicast frames normally receive no per-recipient acknowledgment. The sender cannot know whether every station received them. Networks often transmit these frames at a conservative rate so more stations can decode them, which can make broadcast-heavy traffic consume disproportionate airtime.

Modern 802.11 supports aggregation and block acknowledgments. Aggregation combines multiple data units into a larger transmission, while a Block ACK reports reception for several frames. These mechanisms reduce per-frame contention and acknowledgment overhead.

Wireless retries happen below IP. A TCP connection can see increased latency and jitter without observing IP packet loss when 802.11 retries eventually succeed. Once link retries are exhausted, the IP packet is lost and higher layers decide how to recover.

802.11 defines three broad frame types.

Management frames create and maintain wireless relationships. Examples include beacons, probe requests and responses, authentication, association, reassociation, disassociation, and deauthentication frames.

Control frames coordinate medium access and delivery. ACK, RTS, CTS, and Block ACK are common examples.

Data frames carry higher-layer traffic such as IP packets. Quality-of-service data variants also carry traffic-class information and support modern power-saving and aggregation behavior.

The types use the same radio channel but have different header forms and purposes. A control frame can be much shorter than a data or management frame.

An 802.11 data frame has a variable header. A common three-address data header begins with:

Frame Control identifies the frame type and subtype and contains flags such as To DS, From DS, Retry, Protected Frame, and More Fragments.

Duration/ID helps reserve airtime through virtual carrier sensing or supports special power-saving behavior.

Address fields identify radio transmitters and receivers, the BSSID, and endpoint source or destination roles. The meaning depends on To DS and From DS.

Sequence Control carries sequence and fragment numbers used for ordering and duplicate detection.

Optional fields can include a fourth address, Quality of Service control, and additional control information. The FCS detects transmission errors.

This format differs from Ethernet II, which has one source and one destination address. Wireless forwarding through an AP needs to represent both the immediate radio participants and addresses used beyond the wireless link.

Address 1 always identifies the immediate receiver on the wireless medium. Address 2 identifies the immediate transmitter. The remaining fields represent the BSSID and endpoint roles according to the distribution direction.

For a station sending to a wired server through an AP:

For the return direction:

These roles let the AP bridge traffic without replacing the endpoint MAC identities with its BSSID.

An access point connects an 802.11 BSS to a distribution system. In a common wired deployment, it bridges between 802.11 and Ethernet.

The 802.11 data body commonly uses an LLC/SNAP header to identify the higher-layer protocol. For IPv4, that header carries protocol value 0x0800. When bridging to Ethernet II, the AP maps the protocol value into Ethernet's EtherType field and maps the 802.11 address roles into Ethernet source and destination fields.

For an uplink frame from a station:

For a downlink frame, the AP performs the reverse mapping and sends an 802.11 frame to the associated station.

The IP packet inside the data frame does not change because of the Wi-Fi-to-Ethernet bridge. Link-layer headers change to match each medium.

A station completes several link-layer steps before sending ordinary IP traffic.

Scanning

During passive scanning, the station listens for beacon frames. During active scanning, it sends probe requests and receives probe responses from access points.

The scan results include SSIDs, BSSIDs, channels, signal measurements, security capabilities, and supported features.

Selecting a BSS

The station chooses a BSSID that provides the requested SSID and compatible security and radio capabilities. Client software controls the selection policy.

Authentication and Association

The station exchanges management frames with the AP and requests association. A successful association gives the station membership in the BSS and an association identifier.

The term 802.11 authentication can be confusing. Open System authentication management frames often act as a protocol formality and do not prove a user's identity. WPA and enterprise security perform their own credential and key-establishment procedures.

Establishing Link Security

On a protected network, the station and network establish encryption keys and confirm security policy. The exact exchange depends on Personal or Enterprise mode and the selected WPA generation.

Obtaining Network-Layer Configuration

Association creates a data-link connection. The station still needs valid IP configuration, routes, and name-resolution settings before applications can reach IP services.

The stages form the following conceptual sequence. Authentication, association, and key establishment can overlap or occur in a different order according to the selected security mode.

Failure at each stage produces a different symptom. A visible SSID proves beacon reception. Association proves a link relationship. Neither proves that IP configuration or internet routing works.

Radio transmissions can be received by any nearby compatible radio. Link security protects data frames between a station and the wireless infrastructure.

Open networks provide no ordinary link-layer encryption. Application encryption remains necessary, and nearby observers can capture unprotected traffic and metadata.

WPA2-Personal commonly derives access from a shared passphrase and protects data with AES-CCMP. Every user who knows the passphrase can join unless additional controls apply.

WPA3-Personal uses Simultaneous Authentication of Equals, or SAE, instead of the WPA2 pre-shared-key exchange. SAE improves resistance to passive offline password guessing and provides stronger session-key properties when configured correctly.

Enterprise networks use 802.1X and EAP methods to authenticate users or devices through an authentication service. They can issue per-session key material rather than sharing one network password among all clients.

WEP and WPA configurations based on TKIP are obsolete and should not protect current networks.

Wi-Fi encryption protects the wireless hop. An AP decrypts accepted frames before bridging their contents into the distribution system. End-to-end protocols such as TLS remain necessary when traffic must stay confidential and authenticated beyond the AP.

MAC-address filtering provides weak access control because software can change or imitate a station address. Modern clients also use MAC randomization to reduce tracking across networks.

A Wi-Fi link selects a physical transmission rate based on radio conditions and supported capabilities.

Signal strength describes received signal power. Tools commonly report it in dBm, where values closer to zero represent stronger received power.

Noise and interference reduce the receiver's ability to distinguish the intended symbols. Signal-to-noise ratio, or SNR, measures signal strength relative to the noise floor.

Modulation and coding determine how many bits a transmission carries and how much error protection it uses. Better channel conditions allow denser modulation and less protective coding.

Channel width controls the amount of spectrum used for one channel. Wider channels can raise peak rate but reduce spectrum reuse.

Spatial streams and MIMO use multiple antenna paths to carry more data or improve reception. Both endpoints and the radio environment limit the usable stream count.

Rate adaptation changes modulation, coding, channel use, and stream selection as conditions change. A device can report different transmit and receive rates, and either rate can vary from one moment to the next.

Newer standards also add scheduling features. OFDMA can divide channel resources among multiple stations, while multi-user MIMO can serve several compatible stations during coordinated transmissions. These features still operate within finite shared airtime.

The reported Wi-Fi rate measures a physical-layer transmission mode. Applications receive less useful throughput.

A wireless transmission consumes airtime for:

Traffic also shares airtime with other stations and neighboring networks. The access point's wired uplink, router, internet connection, server, and application can impose additional limits.

Aggregation improves efficiency by carrying more data per contention event. Even with aggregation, the headline PHY rate should not be interpreted as guaranteed TCP or application throughput.

Latency varies for the same reasons. A frame can wait while another device transmits, defer during backoff, retry after loss, or remain buffered for a power-saving station. Wireless links therefore tend to show more latency variation than an uncongested wired full-duplex link.

Several APs can advertise the same SSID with different BSSIDs. The station decides when to leave one BSSID and associate or reassociate with another.

Signal strength influences that decision, but client policy can also consider error rate, channel utilization, band preference, and vendor-specific thresholds. An AP can provide guidance, while the client normally makes the final roaming choice.

Roaming can require scanning, authentication, association, and key setup. These steps can interrupt traffic. IEEE 802.11k, 802.11v, and 802.11r provide mechanisms that can improve neighbor discovery, transition guidance, and authentication speed when clients and infrastructure support them.

If both APs connect the client to the same Layer 2 and IP network, the station can retain its IP address while its BSSID changes. Moving to a different IP network can require new network-layer configuration.

A shared SSID does not guarantee interruption-free roaming. Radio coverage, security configuration, VLAN assignment, client support, and access-point coordination all influence the transition.

On Linux, iw can display the active association:

A result can include:

The BSSID identifies the current AP radio. The frequency identifies the channel placement, the signal value reports received power, and the transmit bitrate reports a current PHY mode rather than application throughput.

Interface and driver statistics can also expose retries, failed transmissions, channel utilization, and negotiated capabilities. Field names vary across drivers and operating systems.

A normal capture on an associated station often shows only the station's data traffic. The operating system or driver may present packets with Ethernet-like link headers after processing 802.11 framing and decryption.

Raw wireless analysis requires monitor mode. A monitor interface can capture 802.11 management, control, and data frames on its configured channel without associating as an ordinary station.

Monitor-mode captures often include a Radiotap header before the 802.11 frame. Radiotap is capture metadata rather than an over-the-air 802.11 field. It can report channel, data rate, antenna, signal level, and other receiver information.

Wireshark display filters include:

Frame type 0 selects management frames, 1 selects control frames, and 2 selects data frames. Type/subtype 0x0008 selects beacons.

A monitor captures only the channel or channel set it observes. It can miss traffic on other channels, frames below its receiver sensitivity, and transmissions corrupted beyond decoding. Protected data frames also remain encrypted unless the analyzer has the required keys and handshake information.

Enabling monitor mode is platform- and adapter-specific and can disconnect the interface from its current network. A separate compatible adapter avoids interrupting the connection under test.

Wi-Fi troubleshooting should separate radio discovery, association, security, link quality, and network-layer configuration.

The SSID Is Not Visible

Confirm that the AP radio is active, the client supports the band and channel, and local regulation permits the channel. Excessive signal loss can also prevent beacon decoding.

Association Fails

Check the selected SSID and BSSID, security mode, credentials, client compatibility, and AP admission policy. A visible beacon confirms discovery but does not establish compatible security.

Association Succeeds but IP Traffic Fails

Confirm IP address assignment, prefix, gateway, name-resolution settings, and VLAN placement. Successful association proves only that the station joined the BSS.

Latency or Loss Is High

Inspect signal strength, noise, retry counts, PHY-rate changes, channel utilization, and neighboring same-channel networks. A high retry rate can add latency before packet loss appears at IP.

Performance Drops for Every Client

Check shared channel utilization, AP uplink capacity, interference, wide-channel overlap, and slow stations consuming airtime. One client speed test cannot identify which shared resource is saturated.

Roaming Causes Interruptions

Compare the old and new BSSID, scan time, authentication exchange, VLAN assignment, and IP continuity. The same SSID can lead to different Layer 2 or IP placement when AP configuration is inconsistent.

Wi-Fi does not transmit Ethernet II frames over radio. It uses 802.11 frames, and an AP can bridge them to Ethernet.

An SSID does not identify one access point. Several BSSIDs can advertise the same SSID.

Association does not guarantee an IP address or internet access. It establishes a wireless link relationship.

CSMA/CA reduces collisions rather than detecting them during transmission. Random backoff and acknowledgments support recovery on the shared medium.

A link-layer ACK does not prove application delivery. It confirms reception of one local unicast frame.

The displayed PHY rate is not application throughput. Shared airtime and protocol overhead reduce useful data rate.

Different SSIDs can still compete for the same channel. Radio contention depends on channel use and signal reachability.

Wi-Fi encryption protects the wireless hop. End-to-end protection still requires an application security protocol.

A hidden SSID is not a security boundary. Other wireless management traffic can reveal the network name.

Wi-Fi uses IEEE 802.11 over a shared radio medium. A station normally selects a service by SSID and associates with an access point's BSSID. One AP radio and its stations form a BSS, while several coordinated BSSs may advertise the same SSID.

Stations share channel airtime through CSMA/CA, random backoff, acknowledgments, and retransmissions. Management frames maintain associations, control frames coordinate delivery, and data frames carry higher-layer traffic. Data frames may contain three or four addresses for the radio participants and endpoints; an AP can bridge them to Ethernet without changing the enclosed IP packet.

Association, link security, and IP configuration are separate stages. WPA2 or WPA3 protects the wireless hop, while end-to-end protocols protect traffic beyond the AP. Signal quality, interference, channel width, spatial streams, rate adaptation, contention, and retries shape performance, so application throughput remains below the PHY rate.

Monitor mode exposes raw 802.11 frames and Radiotap metadata; ordinary host captures may show an Ethernet-like view.

Wi-Fi has its own framing, access control, reliability, and security behavior; treating it as a transparent cable hides many causes of latency and connectivity problems.