CWNA cheat sheet

Wavelength in meters equals 300 divided by frequency in MHz: about 12.5 cm at 2.4 GHz and about 6 cm at 5 GHz.

Free space path loss in dB = 32.44 + 20log10(distance in km) + 20log10(frequency in MHz); loss rises 6 dB for every doubling of distance or frequency.

Decibel power rules: +3 dB doubles power, +10 dB multiplies by ten, -3 dB halves power, -10 dB divides by ten.

dBm references: 0 dBm = 1 mW, 10 dBm = 10 mW, 20 dBm = 100 mW, 30 dBm = 1 W.

First Fresnel zone radius r(m) = 8.657 x square root of (distance in km / frequency in GHz); at least 60% clearance is required for a stable link.

2.4 GHz penetrates building materials better than 5 GHz; 5 GHz suffers higher free-space and absorption loss but offers far more non-overlapping channels.

Multipath creates fading, nulls, and delay spread; diversity antennas and OFDM modulation mitigate its effects.

About 25 dB SNR is required for the highest 802.11 data rates; a rising noise floor reduces SNR even when RSSI is unchanged.

EIRP = transmit power (dBm) + antenna gain (dBi) - cable and connector loss (dB).

The isotropic radiator is a theoretical 0 dBi reference; a half-wave dipole has 2.15 dBi gain.

Antenna gain adds no transmit power: it reshapes RF into a narrower pattern, trading coverage angle for distance.

Higher gain produces a narrower 3 dB beamwidth and a flatter vertical pattern, so coverage extends farther but covers less area.

EIRP = radio power + antenna gain - cable loss; regulatory limits apply to EIRP, not to the radio's configured power alone.

VSWR below 2:1 is acceptable and below 1.5:1 is preferred; high VSWR reflects power back into the radio and degrades throughput.

Polarization mismatch between endpoints can cost 20 dB or more; circular polarization suits moving or randomly oriented clients.

Sector and panel antennas use downtilt to aim coverage; excessive downtilt creates coverage holes at the cell edge.

FCC limits: 2.4 GHz point-to-multipoint EIRP of 36 dBm (4 W); 5 GHz bands are typically capped near 30 dBm EIRP depending on the sub-band.

Point-to-point links use high-gain directional antennas (grid, dish, Yagi) with at least 60% first Fresnel zone clearance.

PoE budgets: 802.3af supplies 15.4 W at the PSE and 12.95 W at the PD; 802.3at (PoE+) supplies 30 W and 25.5 W; 802.3bt supplies 60 W or 90 W at the PSE.

CAPWAP uses UDP 5246 for control and UDP 5247 for data; DTLS protects control traffic and optionally data traffic.

Split MAC architecture: the AP handles real-time functions (beacons, ACKs, encryption) while the controller handles association, roaming, and policy.

AP discovery options: DHCP option 43, DNS resolution, Layer 2 or Layer 3 broadcast, and static controller configuration; the controller may also initiate discovery.

Controller logical interfaces include management, AP-manager, virtual, service port, and dynamic interfaces mapped to client VLANs.

Autonomous APs are configured individually; lightweight APs receive configuration from a WLC over CAPWAP or from a cloud controller.

Workgroup bridges, repeaters, and mesh APs extend coverage without cabling, but each wireless hop roughly halves available throughput.

802.11ac Wave 2 added downlink MU-MIMO and four spatial streams; 802.11ax adds uplink MU-MIMO, OFDMA, and 1024-QAM.

In North America only channels 1, 6, and 11 are non-overlapping in 2.4 GHz, because channels are about 20-22 MHz wide with only 5 MHz spacing.

5 GHz offers up to 25 non-overlapping 20 MHz channels; UNII-2 and UNII-2 Extended require DFS and TPC.

Design targets: about -67 dBm RSSI at the cell edge for voice, -70 dBm for data, with at least 25 dB SNR.

Cell overlap of 15-20% suits data and 15-25% suits voice, giving roaming hysteresis without excessive co-channel interference.

Coverage design uses few APs at high power; capacity design uses many APs at lower power with smaller cells and denser channel reuse.

Each SSID maps to a VLAN; AP switch ports are trunk ports carrying the management VLAN and all client VLANs.

Wider channels (40/80/160 MHz) raise per-client throughput but reduce the number of reusable channels and shrink effective range.

Mount APs below or on the ceiling, clear of metal, elevator shafts, and HVAC ducts, and confirm switch PoE budget before installation.

Controller features that shape design: band steering, load balancing, and RRM or self-healing channel and power adjustment.

802.11-1997 defined 1 and 2 Mbps; 802.11b reaches 11 Mbps in 2.4 GHz; 802.11a reaches 54 Mbps in 5 GHz; 802.11g reaches 54 Mbps in 2.4 GHz.

802.11n reaches 600 Mbps with 4x4 MIMO and 40 MHz channels; 802.11ac reaches 6.93 Gbps in 5 GHz; 802.11ax reaches 9.6 Gbps.

802.11i defines RSN/WPA2; 802.11w adds protected management frames; 802.11e defines WMM quality of service.

802.11k provides neighbor reports, 802.11v provides BSS transition management, and 802.11r provides fast BSS transition for roaming.

802.11h adds DFS and TPC for 5 GHz; 802.11d supplies country and regulatory information elements.

The IEEE writes the 802.11 standards; the Wi-Fi Alliance certifies interoperability and brands Wi-Fi CERTIFIED, WPA2, WPA3, and Wi-Fi 6/6E/7.

Regulatory bodies: FCC (United States), ISED (Canada), ETSI (Europe), and MIC (Japan) set channel, power, and DFS rules.

802.3af/at/bt define PoE; 802.1X defines port-based access control; RADIUS is an IETF protocol carried over UDP.

A BSS is one AP plus its associated clients; the BSSID is that AP radio's 48-bit MAC address; an ESS is multiple BSSs sharing one SSID.

An IBSS (ad hoc) has no access point; stations communicate directly and share a common BSSID.

Frame classes: management (beacon, probe, authentication, association), control (RTS, CTS, ACK), and data.

Client join sequence: probe request/response, authentication (open or SAE), association request/response, then 802.1X/EAP if enterprise security is used.

Default beacon interval is 100 time units (102.4 ms); the DTIM period sets how often buffered broadcast and multicast frames are announced.

CSMA/CA: wait a DIFS interval, choose a random backoff, transmit, and wait for an ACK; the default RTS threshold is 2347 bytes, effectively disabling RTS/CTS.

Power save clients sleep and retrieve buffered frames using PS-Poll or WMM U-APSD (WMM power save).

802.11ax features include OFDMA, BSS coloring, spatial reuse, TWT, and 1024-QAM.

WEP uses RC4 with a 40- or 104-bit key and a 24-bit IV and is trivially broken; it must never be deployed.

WPA uses TKIP/RC4 with a MIC; WPA2 uses CCMP/AES-128 under 802.11i; WPA3 uses SAE, GCMP-256, and mandatory PMF.

The 4-way handshake derives the PTK from the PMK, ANonce, SNonce, and both MAC addresses, then installs keys and delivers the GTK for broadcast traffic.

802.1X roles: supplicant (client), authenticator (AP or WLC), and authentication server (RADIUS over UDP 1812 for authentication and 1813 for accounting).

EAP-TLS requires certificates on client and server; PEAP and EAP-TTLS use a server certificate plus an inner method such as MSCHAPv2.

PSK is exposed to offline dictionary attacks on captured handshakes; WPA3 SAE resists them and provides forward secrecy.

802.11w protected management frames defend against spoofed deauthentication and disassociation frames used in evil-twin and DoS attacks.

Mitigations include guest VLAN isolation, client isolation, WIPS/WIDS, NAC, a separate management VLAN, and 20+ character passphrases.

Disable WPS and change default AP/WLC credentials; manage devices over HTTPS or SSH on a restricted management network.

Check Layer 1 first: cable category and length, PoE budget, connector condition, AP LED state, and switch port error counters.

Low RSSI indicates a coverage problem; strong RSSI with low SNR indicates interference or co-channel contention.

Retry rates above roughly 10-15%, or rising CRC/FCS errors, point to RF corruption or cabling faults rather than simple congestion.

High channel utilization with low retry counts is a capacity problem: add APs, shrink cells, and move clients to 5 GHz.

Hidden node shows as high retries at moderate RSSI; enable RTS/CTS or reduce cell size to mitigate.

Sticky clients remain associated to a distant AP; address with 802.11k/v, minimum RSSI thresholds, and band steering.

Common non-802.11 interferers include microwave ovens, cordless phones, Bluetooth, wireless cameras, and analog video; identify them with a spectrum analyzer.

When clients associate but receive no address, check DHCP scope, trunk VLAN tagging toward the AP, and RADIUS reachability.

Monitor-mode captures expose deauthentication and disassociation reason codes (for example 7 and 15) and retry patterns for root-cause analysis.

Survey sequence: gather requirements, run a spectrum analysis, perform a predictive or planning survey, deploy, then run a validation survey.

A predictive survey uses a floor plan plus attenuation values to simulate AP placement and power before any hardware is installed.

A passive survey records beacons and noise without associating; an active survey associates and measures real throughput and roaming behavior.

AP-on-a-stick places a temporary AP at candidate locations to verify coverage, SNR, and roaming before permanent mounting.

Typical acceptance criteria: at least -67 dBm RSSI, at least 25 dB SNR, 15-20% cell overlap, and secondary coverage near -75 dBm.

Requirements gathering must capture client types, applications (voice, video, data), capacity per area, security needs, and physical constraints.

Approximate attenuation values: drywall about 3 dB, concrete about 10-15 dB, metal or reinforced concrete 20 dB or more, varying by frequency.

Validate voice by testing call quality at cell edges, across roaming boundaries, and during peak channel utilization.

Re-survey after structural changes, firmware or AP changes, and whenever a high-density area is added.