Wireless networking: 802.11, bands, WPA3, APs

The four choices every wireless question hides

Almost every wireless question on Network+ and the CCNA reduces to four decisions: which standard, which band, which security mode and which management model. The rule of thumb is that range and speed trade against each other (lower frequency goes farther, higher frequency carries more), and that security is chosen by who needs to log in (one shared passphrase versus individual accounts). This guide takes the four decisions in turn, with a table for each.

Decision 1: the standard

The IEEE names amendments (802.11n, 802.11ac) and the Wi-Fi Alliance gives the newer ones generation numbers. When it introduced the names in 2018, the Wi-Fi Alliance assigned Wi-Fi 4 to 802.11n, Wi-Fi 5 to 802.11ac and Wi-Fi 6 to 802.11ax; Wi-Fi 7 (certified since 2024) is based on 802.11be. Older standards get no generation number.

Standard	Generation	Bands	Exam hook
802.11b	none	2.4 GHz	Oldest, slowest
802.11a	none	5 GHz	First 5 GHz standard
802.11g	none	2.4 GHz	Backward compatible with b
802.11n	Wi-Fi 4	2.4 and 5 GHz	Introduced MIMO, dual band
802.11ac	Wi-Fi 5	5 GHz	Multi-user MIMO on the downlink
802.11ax	Wi-Fi 6 (6E adds 6 GHz)	2.4, 5 and 6 GHz	OFDMA, target wake time, high-density
802.11be	Wi-Fi 7	2.4, 5 and 6 GHz	Newest generation: 320 MHz channels in 6 GHz, multi-link operation

Questions rarely ask for maximum data rates. They ask which standard supports a band (“a 5 GHz-only client” cannot use 802.11b/g) or which feature fits a crowded venue (OFDMA in 802.11ax, which the Wi-Fi Alliance describes as sharing channels between many clients for Wi-Fi 6).

Decision 2: the band

Band	Strength	Weakness
2.4 GHz	Longest range, best through walls	Crowded; only channels 1, 6 and 11 avoid overlap in the US; microwaves and Bluetooth interfere
5 GHz	More channels, less interference	Shorter range
6 GHz	Newest, uncongested, many wide channels	Shortest range; needs a Wi-Fi 6E or Wi-Fi 7 device

A worked case: a warehouse with metal shelving and a few old scanners that only speak 2.4 GHz needs range and legacy support, so 2.4 GHz stays on at lower density. A new office with laptops that all support Wi-Fi 6 should push clients to 5 GHz and 6 GHz for capacity. Channel planning means neighbouring access points use different channels, because two APs on the same channel share airtime (co-channel interference), and partly overlapping channels corrupt each other (adjacent-channel interference).

SSID, BSSID and the roaming vocabulary

The SSID is the network name users see. The BSSID is the MAC address of one access point radio serving that network. Several APs broadcasting the same SSID form an ESS (extended service set); a client roams between their BSSIDs while keeping one SSID. A single AP on its own is a BSS. If a question gives you two identifiers and asks which is unique per AP, it is the BSSID.

Decision 3: security mode

Mode	Use	Notes
WEP, original WPA	Never	Obsolete; exam answer is to replace them
WPA2-Personal (PSK)	Home and small office	One shared passphrase; AES-based encryption
WPA2-Enterprise	Business	802.1X with a RADIUS server, individual credentials
WPA3-Personal	Home and small office	Uses SAE instead of the PSK handshake, which resists offline password guessing
WPA3-Enterprise	Business	802.1X with stronger protocols
Enhanced Open (OWE)	Guest or public networks	Encrypts traffic without a password

The Wi-Fi Alliance states that WPA3 networks require Protected Management Frames, which stops attackers from forging deauthentication frames. Choose Enterprise whenever the scenario mentions individual accounts, revoking one user or RADIUS; choose Personal when it says shared passphrase or home. RADIUS runs on UDP 1812 and 1813 (authentication and accounting), listed in the ports cheat sheet, and a per-user wireless login is the same idea as the federated sign-in in SSO, SAML and OAuth: the access point trusts a central authority instead of holding passwords itself.

Decision 4: controller or autonomous

An autonomous AP carries its own configuration and is managed one by one; it suits a small site. In a controller-based design, lightweight APs are managed by a wireless LAN controller (WLC). The AP and controller use the CAPWAP tunnel (RFC 5415), with control on UDP 5246 and data on UDP 5247 (IANA). The controller pushes configuration, handles roaming and radio tuning. Cisco’s Catalyst 9800 documentation also lists AP operating modes such as FlexConnect, monitor, sniffer and mesh; FlexConnect lets a branch AP keep switching client traffic locally when the controller is far away or unreachable. Cloud-managed designs move the controller function to a vendor cloud service.

Symptom to cause

Symptom	Likely cause
Strong signal, slow throughput	Co-channel interference or too many clients on one band
Drops in one corner only	Dead spot, placement or obstruction
Old device cannot join after an upgrade	The network now requires WPA3 or a 5 GHz-only SSID
Clients join but get no address	DHCP is unreachable for that SSID’s VLAN; see DHCP and DNS
Users land on a lookalike network	Evil twin or rogue AP

Which exams test this

Exam	How it appears	Where on this site
N10-009	Network Implementation, objective 2.3: channels and channel width, 2.4/5/6 GHz and band steering, SSID/BSSID/ESSID, WPA2 and WPA3, PSK versus Enterprise, antennas, autonomous versus lightweight APs; 802.11 standards also appear in Networking Concepts (1.5)	Network implementation
N10-009	Network Security, objective 4.2: rogue AP and evil twin attacks; Network Troubleshooting, objective 5.4: channel overlap, coverage and roaming problems	Network security
200-301	v1.1 (until Feb 2, 2027): Network Fundamentals 1.11, wireless principles (non-overlapping channels, SSID, RF, encryption); Security Fundamentals 5.9, WPA, WPA2 and WPA3; Network Access 2.6, wireless architectures and AP modes. v2.0 (from Feb 3, 2027): Network Infrastructure and Connectivity 1.5, band and channel selection, RF, security protocols and interference; the WLC architecture items are dropped	Network infrastructure

How questions are built around it

The trap is mixing range and capacity: “more coverage” means a lower band, “more capacity” means a higher band. Another is the overlap rule: channels 1, 6 and 11 are the non-overlapping set only in 2.4 GHz. A client that sees an SSID but cannot connect after a security change is often a WPA2-only device meeting a WPA3-only network. An unexpected AP with your SSID is an evil twin, a rogue AP broadcasting a lookalike network. Related background: the VLANs guide explains how an SSID maps to a VLAN, and Zero Trust explains why corporate Wi-Fi is not treated as trusted by itself.

Question 1. A conference hall hosts hundreds of phones and laptops. Users report slow connections although signal strength is strong. Most devices support 5 GHz and 6 GHz. Which action best improves capacity?

A. Raise the transmit power on every access point
B. Switch the network to WEP to reduce overhead
C. Steer capable clients to 5 GHz and 6 GHz and plan channels so neighbouring APs do not share one
D. Disable encryption on the network

Show answer

Answer: C

Strong signal with slow throughput points to congestion on a crowded band. Steering capable clients to 5 GHz and 6 GHz uses the extra channels and avoids the crowded 2.4 GHz band, and a channel plan keeps neighbouring APs from sharing airtime. Raising transmit power makes co-channel overlap worse, and disabling encryption does not add capacity. Moving to WEP is obsolete and insecure, and WEP-only networks are limited to legacy data rates.

Question 2. A company wants each employee to authenticate with their own credentials on Wi-Fi, so that one leaver can be blocked without changing anything for others. Which design meets this?

A. WPA3-Enterprise with 802.1X and a RADIUS server
B. WPA3-Personal with a long shared passphrase
C. WPA2-Personal with a hidden SSID
D. An open network with MAC address filtering