Lesson
802.11 Standards and the Association Process
Learning objective
Explain what each major 802.11 amendment changed and how Wi-Fi generation names map to them, the difference between passive and active scanning, the states a client moves through from Unauthenticated/Unassociated to Associated, and how 802.11r/k/v support fast roaming between access points.
Learning objective
Explain what each major 802.11 amendment changed and how Wi-Fi generation names map to them, the difference between passive and active scanning, the states a client moves through from Unauthenticated/Unassociated to Associated, and how 802.11r/k/v support fast roaming between access points.
The 802.11 amendment alphabet
Every Wi-Fi standard traces back to the IEEE 802.11 base standard, extended over the years by lettered amendments. 802.11b (1999) and 802.11a (1999) were the first widely deployed versions, on 2.4 GHz and 5 GHz respectively. 802.11g (2003) brought 802.11a's speeds to the 2.4 GHz band. 802.11n (2009) introduced MIMO (Multiple Input, Multiple Output — using several antennas to carry multiple data streams at once) and worked on both bands. 802.11ac (2013) moved to 5 GHz only and widened channels up to 160 MHz. 802.11ax (2019) added OFDMA (letting an AP serve multiple clients within a single transmission by subdividing the channel) and extended into the new 6 GHz band as 802.11ax-6E. 802.11be (2024), still rolling out, adds Multi-Link Operation — a single client using more than one band simultaneously.
Wi-Fi generation names
Because "802.11ac" means little to most consumers, the Wi-Fi Alliance introduced simpler generation names starting in 2018: Wi-Fi 4 is 802.11n, Wi-Fi 5 is 802.11ac, Wi-Fi 6 is 802.11ax, Wi-Fi 6E is 802.11ax extended into the 6 GHz band, and Wi-Fi 7 is 802.11be. The generation number and the amendment letter refer to exactly the same technology — a device box advertising "Wi-Fi 6" and one advertising "802.11ax" are describing the same standard.
Passive and active scanning
Before a client can join a network, it has to find it. Passive scanning means simply listening: every AP periodically broadcasts a Beacon frame announcing its SSID, supported rates, channel, and security settings, and a client can discover a network just by waiting to overhear one. Active scanning is faster: the client broadcasts a Probe Request (naming a specific SSID, or a wildcard to ask every nearby AP to respond), and any matching AP replies immediately with a Probe Response carrying the same information a Beacon would — without the client having to wait for the next scheduled Beacon.
Authentication and association
Once a client has found an AP, it moves through two more steps before it can exchange data. 802.11 Authentication using the "Open System" algorithm is a two-frame formality dating back to the original 1997 standard — it doesn't actually secure anything; on a modern WPA2/WPA3 network, the real cryptographic authentication happens later, in the 4-way handshake or SAE exchange. Association follows: the client sends an Association Request describing its capabilities and (on a secured network) which security settings it intends to use, and the AP replies with an Association Response assigning the client a unique Association ID (AID) within this BSS.
Interactive the association state machine
Step through a client's complete journey from Unauthenticated and Unassociated to fully Associated — and see exactly why reaching that final state still isn't the same thing as being ready to send data on a secured network.
Fast roaming with 802.11r, k, and v
When a client moves between APs that share the same SSID (an ESS), repeating the full scan-authenticate-associate-handshake sequence from scratch at every AP causes noticeable gaps — unacceptable for a voice or video call. Three amendments address this directly: 802.11r (Fast BSS Transition) lets a client pre-negotiate key material with a candidate AP before it actually roams, cutting the security handshake down to a couple of frames instead of a full exchange. 802.11k (Radio Resource Management) lets an AP hand the client a neighbor report listing nearby APs, so the client doesn't have to scan every channel blindly to find its next hop. 802.11v (Wireless Network Management) lets the network suggest — via BSS Transition Management — that a client move to a specific AP, rather than leaving the roaming decision entirely up to the client's own (often conservative) signal-strength threshold.
Inspect association evidence
A monitor-mode wireless capture during a client joining a network shows the full scan-authenticate-associate sequence as separate, identifiable management frames — useful for confirming exactly where a slow or failed connection attempt is actually stalling.
Basic Wireshark check
Display filter: wlan.fc.type_subtype == 0x0000 || wlan.fc.type_subtype == 0x0001 || wlan.fc.type_subtype == 0x000b
Capture a client joining a Wi-Fi network from a cold start. Identify the Association Request (subtype 0x00), Association Response (subtype 0x01), and Authentication frames (subtype 0x0b), and note the Association ID the AP assigns in the Association Response.
Guided standards practice
Work through why a seemingly simple purchase decision — "which Wi-Fi standard does this device support?" — actually determines real-world behavior on a mixed network. A network has an 802.11ax (Wi-Fi 6) access point serving a mix of Wi-Fi 6 laptops and several older 802.11n (Wi-Fi 4) IoT sensors. Because 802.11 is backward compatible, the older devices can still associate and communicate — but every legacy device on the channel can force the AP to fall back to older, slower protection mechanisms for traffic timing to remain compatible, reducing the effective throughput available even to the Wi-Fi 6 clients sharing the same channel.
Interview scenario
Show answer and reasoning
Troubleshoot association issues
- Distinguish an association failure (the client never reaches State 3 at all — check for an AP client-count limit, a MAC filter, or a band/standard mismatch) from an authentication failure after association (reaches State 3 but the WPA2/WPA3 handshake fails — almost always a wrong password or an incompatible security mode).
- Check the AP's maximum associated-client count before assuming a configuration problem — many consumer APs silently refuse new associations once a client limit is reached, with no obvious error shown to the user.
- If a client repeatedly scans but never even attempts authentication, confirm it actually received a Probe Response or Beacon for that SSID — a hidden SSID (one that suppresses Beacons) requires the client to actively probe for the exact name, and a typo there looks identical to "network not found."
- For a device that works near the AP but fails to associate from farther away, consider that the client's Probe Request or Association Request frame may be too weak for the AP to decode reliably even though the AP's stronger Beacon is still audible to the client — association requires a two-way link budget, not just one-way audibility.
- When roaming misbehaves (a client "sticks" to a weak, distant AP instead of roaming to a strong, nearby one with the same SSID), check whether 802.11k/v are enabled and supported by the client — without them, roaming is entirely the client's own decision, and many clients are deliberately conservative about giving up an existing association.