Physical layer: About WIFI

14 min readMar 19, 2026

Understanding Wi-Fi: IEEE 802.11, Mobility, MAC, Frame Structure, Bluetooth, and Zigbee

Wireless networking has become one of the most important access technologies in modern life. From homes and offices to schools, cafés, and airports, wireless LANs are everywhere. Among many wireless LAN technologies, the most dominant standard today is IEEE 802.11, commonly known as Wi-Fi.

In this post, I will summarize the core ideas behind 802.11 wireless LANs, including:

IEEE 802.11 standards
802.11 architecture
Channels and association
Passive and active scanning
The 802.11 MAC protocol: CSMA/CA
Hidden terminals and RTS/CTS
The 802.11 frame format
Mobility within the same IP subnet
Advanced features such as rate adaptation and power management
A brief comparison with Bluetooth and Zigbee

1. Overview of IEEE 802.11 Wireless LANs

Wireless LANs are now one of the most widely used Internet access technologies. Although many wireless LAN standards were developed over time, IEEE 802.11 has clearly emerged as the dominant one.

Different 802.11 standards share several common characteristics:

They all use the same medium access protocol, CSMA/CA
They use a similar link-layer frame structure
They can reduce transmission rates to reach longer distances
They are designed with backward compatibility in mind

This means that even older Wi-Fi devices may still be able to communicate with newer access points under certain conditions.

2. Major IEEE 802.11 Standards

The main 802.11 standards can be summarized as follows:

StandardFrequency RangeData Rate802.11b2.4 GHzup to 11 Mbps802.11a5 GHzup to 54 Mbps802.11g2.4 GHzup to 54 Mbps802.11n2.4 GHz and 5 GHzup to 450 Mbps802.11ac5 GHzup to 1300 Mbps

Frequency bands

802.11 devices mainly operate in two frequency ranges:

2.4 GHz
5 GHz

The 2.4 GHz band is unlicensed, so Wi-Fi devices often compete with other devices such as cordless phones and microwave ovens. The 5 GHz band generally supports higher speeds, but it usually has a shorter transmission range and can be more affected by propagation conditions.

MIMO and newer standards

More recent standards such as 802.11n and 802.11ac use MIMO (Multiple Input Multiple Output) technology. With multiple antennas on both the sending and receiving sides, they can improve throughput and communication efficiency.

802.11ac also supports techniques such as:

multiple simultaneous transmissions
beamforming
higher physical-layer transmission rates

However, the data rates listed in standard tables are idealized values. In real environments, actual throughput depends on distance, interference, obstacles, and network congestion.

3. 802.11 Architecture

The fundamental building block of 802.11 architecture is the BSS (Basic Service Set).

A BSS consists of:

one or more wireless stations
one central base station

In 802.11 terminology, that central base station is called an access point (AP).

In a typical home network, there is usually one AP and one router, and in many cases they are integrated into a single device.

Infrastructure wireless LAN

When APs are connected to a wired Ethernet infrastructure and a router, the network is called an infrastructure wireless LAN. This is the most common Wi-Fi deployment model.

Ad hoc wireless network

802.11 devices can also form an ad hoc network, which has:

no central AP
no fixed infrastructure
direct communication among nearby devices

This type of network may be formed temporarily, for example when devices need to communicate in a location without existing network infrastructure.

4. Channels and Association

Before a wireless station can send or receive network-layer data, it must first associate with an AP.

SSID

Each AP is assigned a Service Set Identifier (SSID), which is the Wi-Fi network name users see on their phones or laptops.

Channel assignment

An AP must also be assigned a channel number. In the 2.4 GHz band, 802.11 defines multiple partially overlapping channels. In practice, channels 1, 6, and 11 are the most commonly used non-overlapping set.

Because of this, a network administrator can reduce interference by assigning nearby APs to channels 1, 6, and 11 instead of placing them on overlapping channels.

5. Finding an Access Point: Passive and Active Scanning

A wireless device must first discover nearby APs before it can associate with one.

Passive scanning

In passive scanning, APs periodically send beacon frames. These beacon frames contain information such as:

the AP’s SSID
the AP’s MAC address
other network parameters

A wireless device listens across channels and collects beacon frames to learn which APs are available. After selecting one AP, it sends an association request, and the AP replies with an association response.

Active scanning

In active scanning, the wireless device takes the initiative. It broadcasts a probe request frame, and APs in range respond with probe response frames. The device then selects one AP and proceeds with the association process.

How a device chooses an AP

The 802.11 standard does not define a specific algorithm for selecting the “best” AP. In many cases, the device chooses the AP with the strongest received signal. However, signal strength alone is not always the best criterion. The selected AP may be overloaded, while a slightly weaker AP may actually provide better performance.

6. After Association: IP Addressing and Authentication

Once a device associates with an AP, it typically obtains an IP address using DHCP. From that point on, the rest of the network sees it as a normal host in the subnet.

In some networks, the device may also need to authenticate before full access is granted. Common approaches include:

MAC address-based access control
username/password-based access
centralized authentication using servers such as RADIUS

So joining a Wi-Fi network usually involves more than simply detecting a signal. It often includes:

AP discovery
AP selection
association
authentication
IP address acquisition

7. The 802.11 MAC Protocol: CSMA/CA

Once devices are associated with an AP, they still need to share the wireless medium. Since multiple wireless devices may want to transmit on the same channel, 802.11 requires a multiple access protocol.

802.11 uses CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance).

Why not CSMA/CD?

Ethernet traditionally uses CSMA/CD (Collision Detection). In Ethernet, a host can detect a collision while transmitting and stop immediately.

802.11 does not use collision detection. Instead, it uses collision avoidance.

There are two main reasons for this:

A wireless device cannot easily send and receive at the same time in order to detect a collision.
Even if it could, not all collisions would be detectable due to issues like hidden terminals and fading.

Because collision detection is not practical in wireless environments, 802.11 tries to reduce the chance of collisions before they happen.

8. Link-Layer ACK and Retransmission

Wireless channels are more error-prone than wired channels. For this reason, 802.11 includes a link-layer acknowledgment and retransmission mechanism.

Basic process

A sender transmits a frame
The receiver checks the frame using CRC
If the frame is received correctly, the receiver sends an ACK
If the sender does not receive an ACK within a certain time, it assumes an error occurred
The sender retransmits the frame

If repeated retransmissions fail, the frame is eventually discarded.

This gives 802.11 a built-in link-layer ARQ mechanism for improving reliability.

9. How CSMA/CA Works

The 802.11 CSMA/CA process can be summarized as follows:

A station senses the channel.
If the channel is idle, the station waits for a short time called DIFS (Distributed Inter-Frame Space) and then transmits.
If the channel is busy, the station chooses a random backoff value.
The backoff counter decreases only while the channel remains idle.
If the channel becomes busy again, the counter freezes.
When the counter reaches zero, the station transmits the entire frame.
After transmission, the station waits for an ACK.
If no ACK is received, the station assumes failure and retries using a larger contention window.

Why backoff matters

In Ethernet, transmitting immediately after the channel becomes idle is acceptable because collisions can be detected and the transmission can be aborted. In 802.11, collisions cannot be detected in the same way, and once a frame transmission begins, the station usually sends the entire frame. That makes collisions more expensive. Random backoff helps reduce this risk.

10. Hidden Terminal Problem and RTS/CTS

One of the classic problems in wireless networking is the hidden terminal problem.

Imagine two wireless stations, H1 and H2:

both are within range of the AP
but they are not within range of each other

In that case, H2 may not hear H1’s transmission and may assume the channel is idle. If both transmit at the same time, their frames collide at the AP.

RTS/CTS mechanism

To reduce this problem, 802.11 can use an optional reservation mechanism based on:

RTS (Request To Send)
CTS (Clear To Send)

The sequence works like this:

The sender transmits an RTS frame
The AP replies with a CTS frame
Other nearby stations hear the CTS and remain silent for the reserved period
The sender transmits the DATA frame
The receiver sends an ACK

Benefits of RTS/CTS

It helps mitigate the hidden terminal problem
It reduces the chance that long DATA frames will collide
Since RTS and CTS frames are short, even if they collide, the wasted time is limited

Cost of RTS/CTS

RTS/CTS also introduces overhead:

additional delay
extra control frames
lower efficiency for short data transmissions

For this reason, it is usually used only for longer frames or in environments where hidden terminals are a significant issue.

11. Using 802.11 as a Point-to-Point Link

Although 802.11 is mainly used in a shared wireless LAN environment, it can also be used as a point-to-point link. If two nodes use directional antennas and point them at each other, 802.11 can provide relatively inexpensive wireless connectivity over long distances.

12. The 802.11 Frame Format

Although the 802.11 frame is similar to an Ethernet frame in some ways, it also includes several fields specifically designed for wireless communication.

A simplified 802.11 frame structure is:

Frame Control (2 bytes)
Duration (2 bytes)
Address 1 (6 bytes)
Address 2 (6 bytes)
Address 3 (6 bytes)
Sequence Control (2 bytes)
Address 4 (6 bytes)
Payload (0–2312 bytes)
CRC (4 bytes)

Frame control field

The frame control field contains subfields such as:

protocol version
type
subtype
To AP
From AP
More fragment
Retry
Power management
More data
WEP
Reserved

These subfields indicate what kind of frame it is and how it should be interpreted.

13. Payload and CRC

Payload

The payload usually contains an IP datagram or an ARP packet. Although the payload can be as large as 2,312 bytes, in practice it is often smaller.

CRC

Like Ethernet, 802.11 uses a CRC field so that the receiver can detect bit errors. Since wireless links are more error-prone than wired links, CRC is especially important in Wi-Fi networks.

14. Why Does 802.11 Have Four Address Fields?

One of the most striking differences between Ethernet and 802.11 is that 802.11 frames can contain four MAC address fields.

Get White’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Why so many?

Because wireless stations often communicate through an AP, and that AP may be connected to a wired LAN. The frame therefore needs enough information to support internetworking between wireless and wired components.

In infrastructure mode, the first three address fields are especially important.

Address 1

The MAC address of the device that should directly receive the frame.

If a wireless station sends the frame, Address 1 is typically the AP’s MAC address
If an AP sends the frame, Address 1 is typically the wireless station’s MAC address

Address 2

The MAC address of the device that is directly transmitting the frame.

If a station sends the frame, Address 2 is the station’s MAC
If an AP sends the frame, Address 2 is the AP’s MAC

Address 3

The MAC address of the router interface connected to the subnet.

This field is important when frames move between the wireless LAN and the wired Ethernet network.

Address 4

This field is used in more specialized cases, such as certain ad hoc or bridging scenarios, and is less important in basic infrastructure mode.

15. Why Address 3 Matters

Address 3 plays a key role in linking the wireless BSS with the wired LAN.

Suppose a router interface R1 sends a packet to wireless host H1:

The router determines H1’s MAC address
It sends an Ethernet frame toward the AP
The AP converts the Ethernet frame into an 802.11 frame
In that 802.11 frame:

Address 1 = H1’s MAC
Address 2 = AP’s MAC
Address 3 = R1’s MAC

Similarly, when H1 replies, Address 3 helps the AP determine the correct destination MAC address when converting the frame back into Ethernet format.

In short, Address 3 is essential for internetworking between a wireless LAN and a wired LAN.

16. Sequence Number, Duration, and Frame Control

Sequence number

Since ACKs can be lost, the sender may retransmit a frame that was actually received successfully. The sequence number helps the receiver distinguish a new frame from a retransmission of an earlier one.

Duration

The duration field indicates how long the medium is expected to be reserved. It is used for data frames as well as RTS and CTS frames.

Frame control

As discussed earlier, the frame control field carries important control information such as frame type, direction, retry status, and encryption usage.

17. Mobility Within the Same IP Subnet

To increase physical coverage, companies and universities often deploy multiple BSSs within the same IP subnet. This raises an important question: how can a wireless station move from one BSS to another while maintaining ongoing TCP sessions?

Same subnet, simpler mobility

If two BSSs are connected by a switch rather than a router, then all stations and APs belong to the same IP subnet.

In that case, when a host moves from BSS1 to BSS2, it can:

keep the same IP address
maintain ongoing TCP connections

If the interconnection device were a router instead, the host would need a new IP address in the new subnet, which would disrupt ongoing TCP sessions.

What happens during handoff?

As a host moves away from AP1, it notices the signal getting weaker and starts scanning for a stronger AP. It then receives beacon frames from AP2, disassociates from AP1, and associates with AP2.

Because both APs belong to the same subnet, the host can keep its IP address and preserve existing TCP connections.

What about the switch?

The switch must also learn that the host is now reachable through AP2 rather than AP1.

One practical solution is for AP2, immediately after the new association, to send a broadcast Ethernet frame with the host’s source MAC address. When the switch receives it, it updates its forwarding table and learns that the host is now reachable via AP2.

This is a useful example of how Ethernet’s self-learning behavior can support Wi-Fi mobility within the same subnet.

VLAN case

This same principle can also apply when multiple LAN segments are connected into one large virtual LAN using VLANs.

18. Advanced Features in 802.11

In addition to basic wireless access, 802.11 implementations often support advanced capabilities. Two important examples are:

rate adaptation
power management

19. Rate Adaptation

As a wireless user moves farther from the AP, the signal-to-noise ratio tends to decrease. If the sender keeps using a high transmission rate under poor channel conditions, the bit error rate may become unacceptably high.

To handle this, some 802.11 implementations use rate adaptation, which dynamically chooses an appropriate physical-layer transmission rate based on current or recent channel conditions.

Typical idea

If frames are being acknowledged successfully, the sender may increase the transmission rate
If ACKs are not received, the sender may reduce the transmission rate

For example:

if two frames in a row are sent without receiving an ACK, the sender may fall back to the next lower rate
if ten frames in a row are acknowledged, the sender may increase the transmission rate

This logic is similar to TCP congestion control:

probe upward when conditions are good
back off when signs of trouble appear

20. Power Management

Battery power is a precious resource in mobile devices. For this reason, 802.11 includes mechanisms that allow a device to alternate between sleep and awake states.

Basic idea

A station indicates to the AP that it is going to sleep by setting the power management bit in the 802.11 frame header.

Once the AP knows the station is sleeping, it:

avoids sending frames immediately to that station
buffers frames destined for the sleeping node

Beacon-based wakeup

An AP typically sends beacon frames every 100 milliseconds. A sleeping node wakes up shortly before the beacon is transmitted.

The beacon tells the node whether the AP has buffered frames waiting for it.

If no buffered frames are waiting, the node can go back to sleep
If frames are waiting, the node can request them from the AP

Because wakeup can be very brief, a node with no traffic to send or receive can spend most of its time asleep, resulting in significant energy savings.

21. Personal Area Networks: Bluetooth and Zigbee

Wi-Fi is designed mainly for communication over tens of meters, often up to around 100 meters. However, other IEEE wireless technologies target shorter range, lower power, and lower cost scenarios.

Two important examples are:

Bluetooth (IEEE 802.15.1)
Zigbee (IEEE 802.15.4)

These are often used in wireless personal area networks (WPANs) rather than traditional LAN-style Internet access.

22. Bluetooth

Bluetooth is a short-range, low-power, low-cost wireless technology. It is often viewed as a cable replacement technology for connecting:

keyboards
mice
speakers
headphones
phones
other peripheral devices

Compared with Wi-Fi, Bluetooth is lower power, shorter range, and generally lower rate.

Key characteristics

operates in the 2.4 GHz unlicensed band
uses frequency-hopping spread spectrum (FHSS)
supports data rates up to about 4 Mbps

Bluetooth devices hop across 79 channels in a pseudo-random pattern. This helps spread transmissions across the spectrum over time.

Piconet structure

Bluetooth networks are ad hoc in nature and do not require infrastructure such as an access point.

The basic unit is a piconet, which can contain:

up to 8 active devices
1 master
the remaining devices as slaves

The master controls the timing in the piconet. Slaves can transmit only according to the master’s communication pattern. Additional devices may remain parked and inactive until the master changes their status.

23. Zigbee

Zigbee is another IEEE personal area network technology, standardized as IEEE 802.15.4.

While Bluetooth provides cable-replacement style communication at relatively higher rates, Zigbee is designed for:

lower power
lower data rate
lower duty cycle
lower cost

This makes it well suited for simple devices such as:

temperature sensors
light sensors
security devices
wall-mounted switches
home automation components

Data rates

Zigbee supports different channel rates depending on the operating frequency, including:

20 Kbps
40 Kbps
100 Kbps
250 Kbps

This is much slower than Wi-Fi and generally slower than Bluetooth, but it is sufficient for many sensor and control applications.

Device types

Zigbee nodes come in two main types:

Reduced-function devices

These act like simple slave devices under the control of a more capable node.

Full-function devices

These can act as controllers, coordinate with multiple reduced-function devices, and in some cases participate in routing.

Multiple full-function devices can also be configured into a mesh network, allowing devices to forward frames among themselves.

Superframe structure

In one common Zigbee configuration, time is divided into recurring superframes, each beginning with a beacon frame.

Each superframe includes:

an active period, during which devices may transmit
an inactive period, during which devices may sleep to save power

The active period is divided into 16 time slots. Some slots are used for CSMA/CA random access, while others may be allocated by the controller to specific devices, providing guaranteed access.

This design reflects Zigbee’s focus on both low power consumption and efficient channel sharing.

24. Wi-Fi vs Bluetooth vs Zigbee

FeatureWi-Fi (802.11)Bluetooth (802.15.1)Zigbee (802.15.4)Main purposeInternet access, WLANPeripheral connectivitySensors and controlRangeMediumShortShortPower consumptionRelatively highLowVery lowData rateHighModerateLowTypical use casesAP-based wireless networkingHeadphones, keyboards, miceSmart home, IoT sensorsNetwork styleBSS / AP-centeredPiconetStar / mesh / controller-based

25. Final Thoughts

Although Wi-Fi often feels simple from a user’s point of view, the technology behind it is quite sophisticated.

A few key takeaways are:

802.11 Wi-Fi is the dominant wireless LAN standard
A BSS with an AP is the fundamental architectural unit
Devices discover APs through beacons or probe exchanges
802.11 uses CSMA/CA instead of CSMA/CD because collision detection is difficult in wireless environments
Reliability is improved through link-layer ACKs and retransmissions
RTS/CTS can reduce hidden terminal problems
The 802.11 frame format includes up to four address fields to support wireless-to-wired internetworking
Mobility within the same subnet can be handled without changing the host’s IP address
Rate adaptation and power management are important practical enhancements
Bluetooth and Zigbee address different wireless use cases, especially short-range and low-power scenarios

Together, these technologies show that wireless networking is not just about connectivity. It is also about medium sharing, mobility, reliability, power efficiency, and choosing the right protocol for the right environment.

White