CWTS cheat sheet

802.11n operates in 2.4 GHz and 5 GHz with up to 4 spatial streams and 40 MHz channels; 802.11ac is 5 GHz only with up to 8 streams and 80/160 MHz channels; 802.11ax (Wi-Fi 6) adds OFDMA, 1024-QAM, BSS coloring, and target wake time.

Legacy 802.11b/g use 20 MHz channels in 2.4 GHz; HR-DSSS (b) peaks at 11 Mbps and ERP-OFDM (g) at 54 Mbps. 802.11a is 5 GHz OFDM at up to 54 Mbps.

802.11ax PHY rates scale with MCS, spatial streams, and channel width; a 2-stream 80 MHz MCS 11 HE link yields roughly 1.2 Gbps PHY rate, with real throughput typically 50-65% of PHY.

WMM defines four access categories (voice, video, best effort, background) mapped to 802.1D priorities; EDCA contention windows shrink for higher-priority ACs to give them faster channel access.

802.11k provides neighbor reports for roaming, 802.11v provides BSS transition management, and 802.11r enables fast BSS transition (FT) with pre-authentication to cut roaming time.

WPA2 uses AES-CCMP; WPA3-Personal replaces PSK with SAE to resist offline dictionary attacks, and WPA3-Enterprise offers 192-bit mode. WEP and TKIP are deprecated and must not be deployed.

PoE per 802.3af delivers up to 15.4 W at the PSE (12.95 W at the PD); 802.3at (PoE+) delivers 30 W at the PSE (25.5 W at the PD); 802.3bt Type 3/4 reach 60 W and 90 W at the PSE.

Certification tracks: CWTS is entry-level theory, CWNA covers RF and 802.11 fundamentals, CWSP covers security, CWDP covers design, and CWAP covers protocol analysis; CWNP issues all of them.

An access point's radio chain count limits spatial streams: a 4x4:4 AP can serve up to 4 spatial streams in a single frame, but a 2x2 client still caps at 2 streams.

AP transmit power is set in dBm; every 3 dB change doubles or halves EIRP, and EIRP = AP power (dBm) + antenna gain (dBi) - cable/connector loss (dB).

Controller-based (WLC) architectures centralize configuration and roaming decisions; cloud-managed and controller-less (virtual controller) designs push config to APs directly and scale without a hardware WLC.

A WLAN controller's CAPWAP tunnel carries control traffic on UDP 5246 and data on UDP 5247; firewall rules must permit both for AP join and client data.

Passive PoE injectors and midspans must match the AP's class; undersized injectors cause AP reboots or radio disable when both radios draw peak current.

Site survey software (e.g., predictive and passive tools) uses the adapter's reported RSSI and SNR; adapter calibration against a known AP power is required for accurate passive survey readings.

Firmware and channel-plan changes should be staged: validate in a pilot area, then roll out, because a bad radio firmware can degrade an entire floor before monitoring flags it.

AP mounting hardware matters: ceiling tile clips, T-bar hangers, and outdoor NEMA enclosures change antenna pattern and must keep the AP's antennas vertical for proper polarization.

Free-space path loss (dB) = 32.44 + 20log10(f in MHz) + 20log10(d in km); doubling distance adds about 6 dB of loss, and doubling frequency adds about 6 dB.

RSSI is the received signal level in dBm; SNR = RSSI - noise floor. A -65 dBm signal over a -95 dBm noise floor gives 30 dB SNR, adequate for high MCS rates.

The 2.4 GHz band spans 2.400-2.4835 GHz; only channels 1, 6, and 11 are non-overlapping in North America, each 20 MHz wide with 5 MHz channel spacing.

The 5 GHz band offers 25 non-overlapping 20 MHz channels in the US (more with DFS); UNII-1 is 5.15-5.25 GHz, UNII-2A 5.25-5.35, UNII-2C 5.47-5.725, and UNII-3 5.725-5.850 GHz.

Fresnel zone radius at midpoint (m) = 17.32 * sqrt(d_km / (4 * f_GHz)); at least 60% of the first Fresnel zone must be clear for a reliable point-to-point link.

Multipath causes fading and intersymbol interference; diversity antennas, MIMO, and OFDM guard intervals mitigate it. Delay spread greater than the guard interval breaks OFDM orthogonality.

Antenna gain is passive and directional: a 9 dBi panel focuses energy, extending range in one direction while reducing coverage behind it; it does not add transmit power.

EIRP limits vary by regulator: FCC allows 36 dBm EIRP in 2.4 GHz point-to-multipoint, while ETSI caps at 20 dBm EIRP (100 mW) for 2.4 GHz and 30 dBm for 5 GHz in many bands.

Predictive surveys use floor plans and attenuation values (drywall ~3 dB, concrete ~10-15 dB, metal ~20+ dB) to model coverage before installation; validate with a passive or AP-on-a-stick survey afterward.

AP-on-a-stick places one AP at candidate locations and measures RSSI/SNR at test points; the goal is typically -67 dBm or better RSSI and 25 dB or better SNR for voice-grade coverage.

Capacity planning uses client count per AP and per-radio airtime: a common target is 20-30 active clients per radio for data, fewer for voice or high-throughput apps.

Co-channel interference (CCI) occurs when APs on the same channel hear each other; adjacent-channel interference (ACI) occurs on overlapping channels and is worse in 2.4 GHz because of 5 MHz spacing.

Channel reuse plans in 2.4 GHz should assign 1/6/11 in a staggered pattern; in 5 GHz use 20 MHz channels and stagger across UNII bands to avoid DFS collisions where radar is present.

Mount APs below the ceiling or on the ceiling with antennas downward; mounting above a suspended ceiling or against metal ductwork distorts the pattern and should be avoided.

Post-install validation includes a passive survey walk, throughput tests at cell edges, roaming tests between APs, and verification of channel/power settings against the design document.

Documentation deliverables include the bill of materials, AP placement map, channel/power plan, survey heat maps, and as-built cable/PoE records for future troubleshooting.

Troubleshooting order: verify physical/PoE, then Layer 2 association (auth/association frames), then Layer 3 (DHCP, ARP, gateway), then application. Isolate by comparing a wired client on the same VLAN.

Common causes of slow Wi-Fi: low SNR, co-channel interference, retries, legacy 802.11b/g clients consuming airtime, and excessive client count per AP; check retry rate and airtime utilization first.

A client that associates but gets no IP usually has a VLAN mismatch, DHCP scope exhaustion, or a blocked DHCP relay; capture the 4-way DHCP exchange to confirm.

Roaming problems often stem from sticky clients or mismatched power settings; ensure AP power is balanced so clients roam at cell edges rather than clinging to a distant AP.

Hidden node problems occur when two clients can hear the AP but not each other; RTS/CTS can mitigate but adds overhead, and a denser AP layout is usually better.

Packet capture on a monitor-mode adapter with a channel filter is the primary tool for analyzing management frames (beacons, probes, auth, association, deauth) and EAPOL exchanges.

Throughput testing should use multiple parallel TCP streams to fill the link; a single-stream iperf test understates 802.11n/ac capacity because of per-stream overhead.

Escalation data to collect: AP model and firmware, client OS/adapter driver, RSSI/SNR at the failure point, channel and width, authentication type, and exact failure timestamp.

WEP uses RC4 with a 24-bit IV and is broken; TKIP patches WEP with per-packet keys but is deprecated. CCMP (AES) is the only acceptable pairwise cipher for WPA2/WPA3.

WPA2-Personal uses a 256-bit PSK derived from a passphrase via PBKDF2; the 4-way handshake derives PTK/GTK. WPA3-Personal uses SAE (Dragonfly) to prevent offline guessing.

802.1X/EAP components: supplicant (client), authenticator (AP/controller), authentication server (RADIUS). EAP-TLS uses certificates on both sides; PEAP/MSCHAPv2 uses server cert plus credentials.

RADIUS runs on UDP 1812 (authentication) and 1813 (accounting); shared secrets must match between the controller and the RADIUS server, and mismatches cause silent auth failures.

Management frame protection (802.11w) protects deauth/disassoc frames against spoofing; enable PMF (optional or required) to stop trivial deauth attacks.

Rogue AP detection compares APs heard over the air against the authorized list; classify by BSSID, SSID, and radio, and contain only after confirming the device is unauthorized.

PCI DSS requires strong encryption (WPA2/WPA3) and segmentation of cardholder data; HIPAA requires access controls and audit logging for ePHI transmitted over wireless.

Guest networks should be isolated via separate VLANs and firewall rules, with client isolation enabled to prevent guest-to-guest traffic, and bandwidth limits to protect production traffic.