School Wi-Fi Meltdown at Lesson Change
Northbridge Secondary School has 1,050 students and 120 staff. Three buildings are linked by 1 Gbps fibre, but every wired and wireless device is on a single VLAN using 10.10.0.0/16. DHCP is provided by one server with a scope of 254 addresses. There are 28 access points, all broadcasting the same SSID with a single pre-shared key. At lesson change, about 300 devices disconnect and rejoin within 90 seconds. Teachers report that interactive whiteboards lose their wireless display connection, VoIP calls in the office break up, and the admin system times out. A supplier recommends buying 20 more access points and increasing the DHCP scope to 4,000 addresses. The business manager asks whether this will fix the problem. Measurements show 60% of traffic is broadcast/mDNS, the fibre uplinks peak at 180 Mbps, and the internet link peaks at 95 Mbps of its 100 Mbps capacity.
1. Explain why adding 20 access points and enlarging the DHCP scope may make the lesson-change problem worse rather than better.
Read the worked answer
Enlarging the DHCP scope is necessary because 254 addresses cannot serve 300 devices reconnecting in 90 seconds, but it only fixes address exhaustion. It does not fix the flat network. With every device in one VLAN, the broadcast domain contains all student, staff, VoIP, whiteboard and admin devices. The measurement that 60% of traffic is broadcast/mDNS is the key symptom: more addresses and more clients keep feeding that broadcast load.
Adding 20 access points increases the number of radios and clients in the same broadcast domain. Unless channels and transmit power are planned, the new APs can add co-channel interference and make retries worse. They can also carry more mDNS and broadcast traffic from devices that have just rejoined. Wireless display and VoIP are latency-sensitive, so they lose out when the medium is busy with reconnection and broadcast traffic.
A second design fault is the single pre-shared key and single SSID. Every device, including staff and visitors, shares one security and roaming domain. At lesson change, authentication and DHCP load concentrate on one service. The correct response is to segment by role or building, reduce broadcast/mDNS propagation, use client isolation where appropriate, plan channels, and give VoIP and display traffic priority. More APs alone treat the symptom, not the cause.
2. Propose a VLAN and IPv4 addressing plan for students, staff, VoIP handsets and management devices. Use private addresses, give subnet masks, and explain how DHCP and inter-VLAN traffic should be controlled.
Read the worked answer
Use a private 10.20.0.0/16 block and subdivide it. One workable plan is:
| VLAN | Purpose | Subnet | Usable hosts |
|---|---|---|---|
| 10 | Student devices | 10.20.0.0/21 | 2,046 |
| 20 | Staff devices | 10.20.8.0/23 | 510 |
| 30 | VoIP handsets | 10.20.10.0/25 | 126 |
| 40 | Management (APs, switches) | 10.20.10.128/26 | 62 |
| 50 | Guest | 10.20.12.0/23 | 510 |
The student /21 is large enough for 1,050 students plus some spare capacity, while keeping the broadcast domain smaller than a single flat VLAN. The staff /23 allows for more than one device per staff member. VoIP is deliberately small and separate; management is smaller still. The ranges do not overlap: VoIP ends at 10.20.10.127 and management starts at 10.20.10.128.
DHCP should have a separate scope per VLAN, with relay/ip-helper addresses on the router or Layer 3 switch. Use short leases for students and guests (for example 2 hours) and longer leases for staff. Give static reservations to access points, switches, printers and VoIP handsets, and exclude gateway addresses. Scope size must exceed the maximum concurrent devices, not just the number of people.
Inter-VLAN routing should pass through a firewall or Layer 3 switch with ACLs. Students should reach the internet and approved learning servers but not management or VoIP. Staff should reach file, print and internet services. VoIP should reach only the call server and permitted destinations, with QoS marking. Guest should reach the internet only. Management access should be restricted to admin subnets.
3. The internet link peaks at 95 Mbps of 100 Mbps while the fibre peaks at 180 Mbps of 1 Gbps. Recommend where QoS should be applied and what should be measured before buying more internet bandwidth.
Read the worked answer
The bottleneck is the internet link, not the fibre: 180 Mbps on a 1 Gbps fibre is light, while 95 Mbps on a 100 Mbps internet link is close to saturation. QoS should therefore be applied at the WAN edge on outbound traffic, and if the router supports it, inbound traffic should be shaped or policed rather than merely prioritised. Classify VoIP as the highest priority, interactive whiteboard and remote-teaching traffic next, admin systems next, and bulk updates, backups and guest streaming as best effort.
Before buying more bandwidth, measure what is actually using the link. Collect top talkers by IP and application, peak and 95th-percentile utilisation in each direction, latency, jitter and packet loss, and retransmission rates. Check whether the 95 Mbps is caused by a few large updates, cloud backup, video streaming or the broadcast/mDNS storm crossing the WAN. Also measure Wi-Fi airtime utilisation and retries: a wireless problem can look like a WAN problem because clients retransmit.
If the traffic is mostly avoidable bulk transfer, scheduling, caching and broadcast reduction may remove the peak at lower cost. If VoIP quality is already poor at 95 Mbps, QoS and call admission control should be applied first because extra bandwidth without queueing can still allow a large download to delay voice. Buy more bandwidth only if the measured application mix shows genuine demand that cannot be managed.