Skip to content

Terms for a wired background

The words of Wi-Fi the app and these pages use, in the terms of switching and routing. The exact definitions the engine uses are in how the engine counts.

Term What it is
AP, radio, BSS, BSSID, SSID An access point has two to four radios, one per band (2.4, 5 and 6 GHz). Each radio serves a BSS, one cell: a broadcast domain on the air, identified by its BSSID (the radio's MAC address). The SSID is the network name that many BSSs share, as a VLAN name is shared by the ports of many switches.
Beacon, IE The radio's periodic hello, ten times a second, that announces the network and its capabilities as information elements (IEs): TLVs, as in LLDP. The sensor reads the channel, width, security and load of every AP from them.
Channel, width, band The frequency a BSS uses, 20 to 320 MHz wide. A sensor radio listens on one channel at a time, at the width of the BSS, as a SPAN session mirrors one port at its speed.
Association, 4-way handshake, EAPOL Joining a BSS: authentication and association are the port coming up; the 4-way handshake (messages M1 to M4, carried in EAPOL frames) derives the session keys, as IKE does after authentication. A wrong password shows as M2 without an M3.
PSK, SAE, 802.1X, EAP, RADIUS How a client proves itself: a shared password (PSK, WPA2), WPA3's password exchange (SAE), or a login through the AP to a RADIUS server (802.1X with EAP), the same path as a wired 802.1X port. eduroam is 802.1X.
PMF Protected management frames: management frames authenticated and, to the client, encrypted, as TCP-AO protects a BGP session. With it the sensor cannot read why an AP disconnected a client or whether it told the client to move; Mist has the reason of the disconnect. WPA3 and 6 GHz always have it.
Deauthentication, disassociation, reason code The link going down with a cause, from either side, as a BGP notification carries a code. The sensor reads the code unless PMF encrypts it. The meaning of each code is fixed, the choice of one is the vendor's, so who ended the link comes from the order of the frames first (reason codes).
Roam, 802.11r (FT), 802.11v (BTM), 802.11k The client moving to another AP: a MAC move between access switches, with the difference that the client decides when. FT carries the keys along so the RADIUS round trip is skipped. BTM is the AP suggesting a move, a redirect. 802.11k is the AP's neighbor list for the client.
Data frame, A-MPDU, Block Ack (BA) Data goes in bursts of aggregated frames (an A-MPDU), acknowledged in one Block Ack with a bitmap of which frames arrived, as TCP SACK does. The sensor reads those bitmaps: BA success is the share of frames that arrived the first time, the error rate of the air as the receiver reports it. The bitmap from the AP tells how the client's frames fared (uplink), the one from the client how the AP's fared (downlink).
Retry bit A frame sent again carries a flag. A secondary measure: the sensor misses frames, and a missed frame followed by a retry looks like a retry alone.
RTS, CTS, TXOP, NAV A reservation before a burst: request to send, clear to send, then the transmit opportunity; the NAV is the reservation time every station honors. An RTS left unanswered is a receiver that is busy, asleep or out of reach.
MCS, NSS, GI The rate of one frame: the modulation (MCS 0 to 13, as a link choosing 1G or 25G per packet), the number of spatial streams (parallel lanes), the guard interval between symbols. A low rate at a strong signal is a client or an AP holding back.
RSSI, SNR, dBm Signal level in dBm, as an optical power budget: −50 dBm is strong, −75 dBm weak. The sensor sits next to the client, so the AP's level at the sensor is about what the client sees; the client's level at the AP is what Mist reports.
QBSS load, co-channel The utilization counter the AP puts in its beacons, like an interface counter. Several APs on one channel share the airtime, as hosts on a hub share the wire: a second AP on the channel slows everyone.
Power save, PM bit A client sleeps between bursts and tells the AP so with a bit; the AP buffers and sends a burst at each wake. Phones do this constantly. Losses right after wakes are a power-save effect, not the air.
OFDMA, trigger frame, AID, Multi-STA Block Ack Wi-Fi 6 and 7 let the AP schedule several clients in one transmission, in sub-channels (frequency slots). The AP's trigger frame names the stations by AID, a short index the AP gave at association, as a port number local to one switch. The AP acknowledges them all in one Multi-STA Block Ack. The sensor cannot decode the clients' scheduled uplink frames, only the trigger and the acknowledgement.
MLO, MLD, eMLSR (Wi-Fi 7) One client with several links on different bands at once, as a LAG across two switches. The client has an MLD address (the LAG's) and a link MAC per link (the member ports'). Over the air only link MACs appear; Mist shows the MLD address. eMLSR is a client that listens on all links but uses one at a time.
6 GHz, PSC, RNR, FILS Discovery The new band, channels 1 to 93. Clients scan it on the preferred scanning channels (PSC). APs on 2.4 and 5 GHz announce their 6 GHz BSSs in a Reduced Neighbor Report, and 6 GHz-only APs send FILS Discovery frames, so clients find them without scanning every channel.
Monitor mode, the focus filter A radio that receives everything on its channel and transmits nothing: a SPAN port on the air. The sensor is a passive tap. The focus filter keeps the client's frames and the AP's management and control frames, as a capture filter on the tap.
Capture share, drops Capture share: of the frames that were delivered, the share the sensor decoded; a tap that misses the fastest frames, since its own signal is weaker than the client's and the AP beamforms toward the client, not the sensor. Drops: frames the Pi received but could not hand on, a tap with an oversubscribed uplink. Both are capture quality, not loss.
Reference client A second device of our own at the same place on the same AP, measured at the same time: the known-good host on the same switch. A loss the reference client does not have is the client's.
Mist The cloud controller of the campus APs. Its API gives the AP's side: the client's signal at the AP, the AP's retries, and events the air does not show (DHCP, ARP, DNS, the reason of an encrypted disconnect, roam types).
Outcome The verdict's fixed set: AP side, client side, RF environment, upstream / not Wi-Fi, measurement limit, undecided. A hint is one rule's finding; the first with a side decides.