Wireless and mobile networks

More devices now reach the internet over radio than over cables: phones, laptops, watches, cars, drones and countless sensors. Wireless links bring new problems that the wired protocols in earlier lessons did not have to face. Signal strength falls rapidly with distance and walls; interference and fading cause frequent errors; stations may not hear each other; and the spectrum is a shared, regulated and scarce resource. Mobility adds another layer: a device that moves between access points or cell towers wants to keep its connections alive even though its point of attachment, and perhaps its IP address, changes. This lesson covers the characteristics of wireless links, Wi-Fi's medium access protocol, cellular networks from 4G to 5G, and how networks handle mobility. CISSP-113 lesson 6 covers wireless security; ROB-460 covers communication links for field robots.

Characteristics of wireless links

A wireless link differs from a wire in several ways. Signal strength decreases with distance even in free space, and much faster through walls, floors and foliage; higher frequencies generally suffer more. Signals from other transmitters, including microwave ovens in the 2.4 GHz band and other networks on the same channel, interfere. And signals reach the receiver along several paths, reflecting off buildings and objects, so that copies arrive at slightly different times and can cancel each other out, multipath fading, which changes as people and devices move. The result is a bit error rate many orders of magnitude higher than on fibre, which varies from moment to moment.

What matters to the receiver is the signal-to-noise ratio (SNR), the ratio of received signal power to noise power, usually expressed in decibels. A higher SNR allows a denser modulation scheme that packs more bits into each symbol: modern Wi-Fi uses up to 4096-QAM, 12 bits per symbol, but only at very high SNR. Shannon's theorem sets the ultimate limit: a channel of bandwidth \(B\) hertz with signal-to-noise ratio SNR can carry at most \(B \log_2(1 + \text{SNR})\) bits per second. Wireless devices therefore adapt their rate continuously, dropping to more robust modulations as SNR falls. The program below combines free-space path loss with Shannon's limit to show how capacity falls with distance and frequency. Real indoor losses are much larger than free space.

import math
# Free-space path loss and Shannon capacity for a Wi-Fi link
def fspl_db(d_m, f_hz):
    c = 3e8
    return 20 * math.log10(4 * math.pi * d_m * f_hz / c)
tx_dbm, gains, noise_dbm, bw = 20, 4, -90, 80e6          # 100 mW, antenna gains, noise floor, 80 MHz channel
for f, name in ((2.4e9, "2.4 GHz"), (5.5e9, "5 GHz"), (6.5e9, "6 GHz")):
    for d in (5, 20, 50):
        rx = tx_dbm + gains - fspl_db(d, f)
        snr_db = rx - noise_dbm
        cap = bw * math.log2(1 + 10 ** (snr_db / 10))
        print(f"{name:7s} {d:3d} m: loss {fspl_db(d, f):5.1f} dB, received {rx:6.1f} dBm, SNR {snr_db:5.1f} dB, Shannon limit {cap/1e6:6.0f} Mbit/s")

2.4 GHz   5 m: loss  54.0 dB, received  -30.0 dBm, SNR  60.0 dB, Shannon limit   1594 Mbit/s
2.4 GHz  20 m: loss  66.1 dB, received  -42.1 dBm, SNR  47.9 dB, Shannon limit   1274 Mbit/s
2.4 GHz  50 m: loss  74.0 dB, received  -50.0 dBm, SNR  40.0 dB, Shannon limit   1062 Mbit/s
5 GHz     5 m: loss  61.2 dB, received  -37.2 dBm, SNR  52.8 dB, Shannon limit   1402 Mbit/s
5 GHz    20 m: loss  73.3 dB, received  -49.3 dBm, SNR  40.7 dB, Shannon limit   1082 Mbit/s
5 GHz    50 m: loss  81.2 dB, received  -57.2 dBm, SNR  32.8 dB, Shannon limit    871 Mbit/s
6 GHz     5 m: loss  62.7 dB, received  -38.7 dBm, SNR  51.3 dB, Shannon limit   1364 Mbit/s
6 GHz    20 m: loss  74.7 dB, received  -50.7 dBm, SNR  39.3 dB, Shannon limit   1044 Mbit/s
6 GHz    50 m: loss  82.7 dB, received  -58.7 dBm, SNR  31.3 dB, Shannon limit    832 Mbit/s

Two more phenomena shape wireless protocol design. In the hidden terminal problem, stations A and C can both reach access point B, but an obstacle or distance prevents A and C from hearing each other, so carrier sensing fails and their transmissions collide at B. And collision detection is impractical: a radio's own transmission is millions of times stronger at its antenna than a faint distant signal, so it cannot listen for collisions while sending. Wi-Fi must therefore avoid collisions rather than detect them.

Spectrum and its regulation

Radio spectrum is a public resource managed by national regulators. In Canada, Innovation, Science and Economic Development Canada (ISED) assigns spectrum, auctions licences for cellular bands, and sets the rules for licence-exempt devices such as Wi-Fi under its Radio Standards Specifications. ISED opened 1,200 MHz of the 6 GHz band (5,925 to 7,125 MHz) to licence-exempt use in 2021, allowing Wi-Fi 6E and Wi-Fi 7 devices to use wide, uncrowded channels. Licensed bands for 4G and 5G, such as the 3,500 MHz band auctioned in 2021, cost operators billions of dollars, and ISED attaches conditions on deployment and, increasingly, on competition.

Licence-exempt bands are free to use but shared with everyone, subject to power limits; licensed bands give an operator exclusive use and therefore predictable performance. Some newer schemes share spectrum dynamically, letting commercial users access bands when incumbents such as radar are not using them.

Wi-Fi: IEEE 802.11

Wi-Fi is the family of IEEE 802.11 standards for wireless LANs. Successive generations, renamed by the Wi-Fi Alliance as Wi-Fi 4 (802.11n), Wi-Fi 5 (802.11ac), Wi-Fi 6 and 6E (802.11ax) and Wi-Fi 7 (802.11be, certified from 2024), have raised peak rates from tens of megabits to several gigabits per second through wider channels (up to 320 MHz in Wi-Fi 7), denser modulation, multiple antennas carrying several spatial streams at once (MIMO), and OFDMA, which divides a channel among several users in the same transmission. The basic architecture is unchanged: stations associate with an access point (AP), which is connected to a wired network, and a group of stations with their AP forms a basic service set identified by a network name (SSID). Stations discover APs by listening for beacon frames that APs broadcast about ten times a second, or by sending probe requests.

CSMA/CA: avoiding collisions

Since a Wi-Fi station cannot detect collisions, 802.11 uses carrier sense multiple access with collision avoidance (CSMA/CA) and link-layer acknowledgements. A station with a frame to send listens to the channel. If the channel is idle for a short period called the DIFS, the station counts down a random backoff, chosen from a contention window, pausing the countdown whenever the channel becomes busy; when the counter reaches zero, it transmits the whole frame. The receiver checks the CRC and, after a shorter interval called the SIFS, sends an ACK. Because the SIFS is shorter than the DIFS, the ACK always goes before any new transmission. If no ACK arrives, the sender assumes a collision or corruption, doubles its contention window, and tries again. Unlike Ethernet, Wi-Fi thus provides reliable delivery at the link layer, because losses on radio links are too frequent to leave to TCP.

To deal with hidden terminals, a station may first send a short request-to-send (RTS) frame; the AP replies with a clear-to-send (CTS) frame that every station in range of the AP hears, and all of them stay silent for the announced duration. Collisions can still happen, but only between short RTS frames, not between long data frames. RTS/CTS costs extra airtime, so it is usually used only for frames above a size threshold.

import random
# Hidden terminals: A and C both reach the access point B but cannot hear each other
def run(rts_cts, frames=20_000, p=0.04, frame_slots=10, seed=5):
    rnd = random.Random(seed)
    t = ok = lost = 0
    while ok + lost < frames:
        a, c = rnd.random() < p, rnd.random() < p      # does each station start in this slot?
        if a and c:
            if rts_cts:
                t += 1                                 # only short RTS frames collide; retry quickly
            else:
                lost += 2; t += frame_slots            # two whole data frames are wasted
        elif a or c:
            # without RTS/CTS the other station may start mid-frame because it cannot hear
            if not rts_cts and rnd.random() < 1 - (1 - p) ** (frame_slots - 1):
                lost += 2; t += frame_slots
            else:
                ok += 1; t += frame_slots + (2 if rts_cts else 0)   # RTS/CTS adds a little overhead
        else:
            t += 1
    return ok / (ok + lost), ok * frame_slots / t
for mode in (False, True):
    success, util = run(mode)
    print(f"RTS/CTS {'on ' if mode else 'off'}: {success:5.1%} of frames delivered, channel carrying data {util:5.1%} of the time")

RTS/CTS off: 51.5% of frames delivered, channel carrying data 31.3% of the time
RTS/CTS on : 100.0% of frames delivered, channel carrying data 41.6% of the time

In this toy model, about half of all data frames are destroyed without RTS/CTS, because each station often starts transmitting in the middle of the other's frame. With RTS/CTS, only the short reservation frames ever collide, every data frame gets through, and the channel carries useful data a larger share of the time despite the extra control frames. Real behaviour depends on traffic load and frame sizes, which is why RTS/CTS is a configurable threshold rather than always on.

Even without collisions, all of these gaps, backoffs, preambles and acknowledgements mean that a Wi-Fi network delivers well below its advertised physical rate. The overhead is fixed per transmission, so small frames suffer most, which is why modern Wi-Fi aggregates many packets into one long transmission with a single block acknowledgement.

# Why Wi-Fi delivers well below its nominal rate: CSMA/CA overhead for one frame
slot, sifs = 9e-6, 16e-6
difs = sifs + 2 * slot                   # 34 microseconds
preamble = 40e-6                         # PHY preamble and header (order of magnitude, 802.11ax)
mean_backoff = 7.5 * slot                # contention window of 15 slots, on average half
rate = 600e6                             # nominal PHY data rate
for payload in (64, 1500, 64_000):       # bytes; the last one is an aggregated frame (A-MPDU)
    data = preamble + payload * 8 / rate
    ack = preamble + 14 * 8 / 24e6       # ACK sent at a basic rate
    cycle = difs + mean_backoff + data + sifs + ack
    print(f"payload {payload:6d} B: airtime {cycle*1e6:7.1f} us, throughput {payload*8/cycle/1e6:6.1f} Mbit/s "
          f"({payload*8/cycle/rate:5.1%} of the PHY rate)")

payload     64 B: airtime   203.0 us, throughput    2.5 Mbit/s ( 0.4% of the PHY rate)
payload   1500 B: airtime   222.2 us, throughput   54.0 Mbit/s ( 9.0% of the PHY rate)
payload  64000 B: airtime  1055.5 us, throughput  485.1 Mbit/s (80.8% of the PHY rate)

Wi-Fi also handles mobility within a network. When a laptop moves from one AP to another in the same subnet, it reassociates with the new AP, which tells the switches where the laptop now is, often by sending a frame from the laptop's MAC address so the self-learning switches of lesson 10 update their tables. The IP address stays the same, so connections survive. Moving to a different subnet requires a new address, unless the network uses tunnelling or the application, like QUIC, can migrate.

Cellular networks

Cellular networks provide wide-area wireless access across whole countries. The area is divided into cells, each served by a base station (an eNodeB in 4G LTE, a gNodeB in 5G), and frequencies are reused in cells far enough apart. A device is identified by a subscriber identity stored on its SIM, and it authenticates to its home operator using keys shared with the SIM. The radio link in 4G and 5G uses OFDMA on the downlink: the base station schedules small blocks of frequency and time, resource blocks, among devices every millisecond or less, giving each device a share that depends on its signal quality and the operator's policy. Unlike Wi-Fi's random access, cellular access is centrally scheduled by the base station.

Behind the radio network is the core network. In 4G LTE, the Evolved Packet Core contains a mobility management entity that handles authentication and tracks which cell a device is in, and gateways that carry the device's IP traffic in tunnels to the operator's connection to the internet. Data from a phone is not routed by its IP address inside the operator's network; it travels in a tunnel from the base station to the gateway, which is why a phone keeps the same IP address as it moves between cells. 5G's core, standardized by 3GPP from Release 15 in 2018 onward, reorganizes these functions into software services running on general-purpose servers, supports network slicing, which gives different applications virtual networks with different guarantees, and can place gateways close to users for low-latency edge computing. 5G radios use wider channels, including millimetre-wave bands above 24 GHz with very high rates but short range, and promise latencies of a few milliseconds over the radio link.

Mobility management

Mobility raises a fundamental question: if a device's IP address identifies where it is attached, how can others reach it when it moves? One answer is to let routing handle it: the device keeps its address and advertises its new location to routers, which would require global routing tables to track millions of moving devices and does not scale. Practical answers use a home network and indirection. The device has a permanent home address in its home network, where a home agent keeps track of its current location. In indirect routing, a correspondent sends packets to the home address; the home agent intercepts them and tunnels them to the device's current location, from which replies can go directly back. This works without the correspondent knowing anything about mobility, but adds the detour through the home network, triangle routing. Direct routing lets the correspondent learn the current location and send there directly, at the cost of more complexity.

# Mobile IP style indirect routing versus direct routing
home_to_corr = 5          # ms one way between correspondent and home network
corr_to_visit = 40        # ms one way, correspondent directly to the visited network (Tokyo to Vancouver)
home_to_visit = 45        # ms one way, home agent (Toronto) to the visited network
indirect = home_to_corr + home_to_visit       # correspondent -> home agent -> mobile
direct = corr_to_visit
print(f"indirect (triangle) routing: {indirect} ms one way; direct routing: {direct} ms")
print(f"triangle routing adds {indirect - direct} ms each way ({(indirect - direct) * 2} ms per round trip)")

indirect (triangle) routing: 50 ms one way; direct routing: 40 ms
triangle routing adds 10 ms each way (20 ms per round trip)

Mobile IP (RFC 5944 for IPv4, RFC 6275 for IPv6) standardized this approach but saw little deployment. Cellular networks use the same ideas internally: when you travel abroad, your phone may connect through a visited network but tunnel its traffic back to your home operator's gateway, which is why roaming traffic often has noticeably higher delay. Within one operator, handovers between base stations are coordinated by the network and keep the tunnel endpoint fixed, so connections survive. Higher layers help too: QUIC's connection IDs let a connection move from Wi-Fi to cellular even though the device's IP address changes, and applications such as messaging and video calls simply reconnect quickly.

Wireless links also confuse TCP. A loss caused by radio interference looks to TCP like congestion, so TCP slows down unnecessarily. Link-layer retransmission, as in Wi-Fi and cellular networks, hides most radio losses from TCP; congestion control algorithms such as BBR that do not treat every loss as congestion cope better; and large cellular buffers can cause bufferbloat (lesson 1) that hurts interactive traffic.