CWEng cheat sheet

Free-space path loss: FSPL(dB) = 32.44 + 20log10(d in km) + 20log10(f in MHz); the model assumes no obstructions and predicts loss from distance and frequency only.

Power math: +3 dB doubles milliwatts, +10 dB multiplies by ten; 0 dBm = 1 mW, 10 dBm = 10 mW, 20 dBm = 100 mW, 30 dBm = 1 W.

EIRP = transmitter power (dBm) + antenna gain (dBi) - cable and connector loss (dB); EIRP is what the regulator limits, not radio output alone.

First Fresnel zone radius at a point: r(m) = 17.32 x square root of [d(km) / (4 x f(GHz))]; point-to-point links need at least 60 percent of the first zone clear of obstructions.

2.4 GHz provides only three non-overlapping 20 MHz channels (1, 6, 11) because each channel occupies roughly 22 MHz across 5 MHz channel numbering.

5250-5350 MHz (UNII-2) and 5470-5725 MHz (UNII-2e) require DFS radar detection and TPC; a radar hit forces the AP off-channel and disconnects clients.

Propagation mechanisms: absorption (attenuation by material), reflection (large smooth surfaces), diffraction (edges), scattering (small or rough objects), and refraction (change of medium).

SNR(dB) = RSSI(dBm) - noise floor(dBm); a clean channel typically shows about -95 dBm noise floor at 2.4 GHz and -100 dBm at 5 GHz.

Distance rule: doubling distance adds roughly 6 dB of loss in free space, while indoor path-loss exponents of 3 to 4 produce about 9 to 12 dB per doubling.

Design targets at the cell edge: -67 dBm RSSI with 25 dB SNR for voice and real-time applications, -72 dBm or better for data-only coverage.

Adjacent AP cells should overlap about 15-20 percent so clients can roam before SNR degrades; in 2.4 GHz plans keep co-channel cells at least three channel numbers apart.

Survey types: predictive (simulated from floor plans and wall attenuation), passive (listen-only beacon and SNR mapping), active (associate and measure throughput, loss, retries), and AP-on-a-stick validation.

Typical 2.4/5 GHz attenuation: drywall 3-4 dB, brick about 10 dB, concrete 12-15 dB, metal 20 dB or more, tinted or low-E glass 20-35 dB.

Capacity planning: budget roughly 30-50 actively transmitting clients per radio per band, and widen channels to 40/80 MHz only where 5 GHz channel reuse allows.

Channel supply: the US 5 GHz band yields about 25 non-overlapping 20 MHz channels, and 6 GHz adds 59 twenty-MHz channels plus seven 160 MHz channels.

Disabling 1, 2, 5.5, and 11 Mb/s rates removes legacy protection overhead, shrinks the effective cell, and pushes clients toward higher MCS rates.

Place APs on a grid along circulation paths rather than in corners, and avoid mounting against metal, inside dense ductwork, or behind low-E glass.

A post-deployment validation survey is required even after a predictive design; verify RSSI, SNR, retry rate, and channel airtime at representative locations.

RSN/WPA2 four-way handshake: PMK plus ANonce, SNonce, and both MAC addresses derive the PTK; the AP delivers the GTK in message three, encrypted with the PTK.

PSK-to-PMK derivation: PBKDF2-SHA1 over the 8-63 character passphrase with the SSID as salt and 4096 iterations yields the 256-bit PMK.

CCMP (AES counter mode with CBC-MAC) is mandatory in RSN; TKIP is deprecated and is not permitted in WPA3 or Wi-Fi 6 certified equipment.

802.1X roles: supplicant (client), authenticator (AP or controller), authentication server (RADIUS); RADIUS uses UDP 1812 for authentication and UDP 1813 for accounting.

EAP comparison: EAP-TLS uses mutual certificates and is strongest; PEAPv0/MSCHAPv2 uses a server certificate with password-based inner authentication; EAP-TTLS and EAP-FAST tunnel other methods.

WPA3-Personal uses SAE (Dragonfly) providing forward secrecy and resistance to offline dictionary attacks; WPA3-Enterprise offers an optional 192-bit suite with GCMP-256 and SHA-384.

802.11w management frame protection signs deauthentication, disassociation, and action frames with a BIP integrity check; it is mandatory for WPA3 and 6 GHz operation.

Threats to plan for: rogue AP and evil twin, spoofed deauth denial of service, KRACK key reinstallation, PMKID capture leading to offline PSK cracking; counter with WIPS, PMF, and long passphrases.

Guest architecture: separate SSID mapped to its own VLAN, client isolation enabled, captive portal and rate limits applied, and no bridging of guest traffic into internal subnets.

SNR thresholds: about 25 dB or better supports 64-QAM (MCS 7-9), 15-20 dB supports 16-QAM mid-MCS rates, and below 10 dB only basic rates survive.

A retry rate above roughly 10-15 percent of frames, or rising CRC and decrypt errors, points to low SNR, co-channel interference, non-Wi-Fi noise, or a hidden node.

Co-channel interference comes from separate APs on the same channel; adjacent-channel interference comes from partially overlapping channels such as 1 and 2 in 2.4 GHz and is often worse than CCI.

Channel airtime utilization above about 50 percent degrades latency-sensitive traffic; identify top talkers, low-rate frames, and management overhead before adding APs.

Sticky client remedies: minimum-RSSI or band steering, 802.11k neighbor reports, 802.11v BSS transition requests, and reduced transmit power to create natural roaming boundaries.

Troubleshooting order: physical layer (cable, PoE budget, link LED, AP uptime), then RF (channel, SNR, interference), then L2 (VLAN, DHCP), then security (RADIUS, certificates), then DNS and application.

Hidden node: two clients that cannot hear each other but both reach the AP collide at the AP; mitigate with RTS/CTS, smaller cells, or lower data rates disabled.

Common non-Wi-Fi interferers: microwave ovens and 2.4 GHz cordless phones (2.4 GHz), Bluetooth and Zigbee, wireless cameras, and LTE-LAA or weather radar in 5 GHz.

Roaming tools: 802.11r fast BSS transition cuts handoff to roughly 50 ms or less, 802.11k supplies neighbor reports, and 802.11v steers clients away from congested APs.

802.11 frame classes: management (beacon, probe request/response, authentication, association, action), control (RTS, CTS, ACK, BlockAck, PS-Poll), and data frames.

Beacon interval defaults to 102.4 ms and carries the SSID, supported rates, and security parameters; the DTIM period sets how often buffered broadcast and multicast frames are announced.

Standards map: 802.11a 5 GHz OFDM 54 Mb/s; b 2.4 GHz DSSS 11 Mb/s; g 2.4 GHz OFDM 54 Mb/s; n MIMO 40 MHz 600 Mb/s; ac 5 GHz 80/160 MHz and DL MU-MIMO; ax adds OFDMA, TWT, and BSS coloring.

802.11e/WMM defines four access categories - voice, video, best effort, background - differentiated by AIFS, CWmin, and TXOP rather than by a fixed priority queue in the frame.

Medium access is CSMA/CA with DCF; the RTS/CTS threshold determines when RTS/CTS reserves the medium, and the fragmentation threshold splits frames to reduce retransmission cost.

Fast roaming stack: 802.11k neighbor reports, 802.11v BSS transition management, 802.11r fast BSS transition over the air or over the distribution system.

CAPWAP splits control (UDP 5246) from data (UDP 5247); AP discovery uses DHCP option 43, DNS resolution of the controller name, or local broadcast.

6 GHz (5925-7125 MHz) mandates WPA3 and PMF, excludes 802.11a/b/g legacy devices, and its 20 MHz channels do not overlap with 2.4 or 5 GHz operation.

Regulatory operation: DFS and TPC apply in the UNII-2 and UNII-2e bands, and 802.11h defines those mechanisms for 5 GHz deployments.