Wireless Networking Fundamentals
Learn 802.11 standards, 2.4GHz vs 5GHz tradeoffs, SSID/BSSID, WPA2/WPA3, and channel planning — the non-attack foundation for the Ethical Hacking roadmap's wireless attacks.
Learning Objectives
- → Explain the 802.11 standard family and how Wi-Fi generations (a/b/g/n/ac/ax) relate
- → Distinguish 2.4GHz and 5GHz bands by range, speed, and interference tradeoffs
- → Explain SSID, BSSID, and the role of an access point in a wireless LAN
- → Compare WEP, WPA, WPA2, and WPA3 at a conceptual security level
- → Explain channel selection and overlap, and why it matters for wireless performance
The 802.11 Standard Family
Wi-Fi is defined by the IEEE 802.11 family of standards. Each generation trades off speed, range, and frequency band differently:
| Standard | Marketing name | Band | Max theoretical speed |
|---|---|---|---|
| 802.11b | — | 2.4 GHz | 11 Mbps |
| 802.11g | — | 2.4 GHz | 54 Mbps |
| 802.11n | Wi-Fi 4 | 2.4/5 GHz | 600 Mbps |
| 802.11ac | Wi-Fi 5 | 5 GHz | ~3.5 Gbps |
| 802.11ax | Wi-Fi 6/6E | 2.4/5/6 GHz | ~9.6 Gbps |
2.4GHz vs 5GHz: The Core Tradeoff
| Band | Range | Speed | Interference |
|---|---|---|---|
| 2.4 GHz | Longer, penetrates walls better | Slower | More crowded — shared with Bluetooth, microwaves, cordless phones |
| 5 GHz | Shorter | Faster | Less crowded, more available channels |
There's no universally "better" band — a security assessment or site survey has to account for both when mapping wireless coverage and rogue access points.
SSID, BSSID, and Access Points
- SSID (Service Set Identifier) — the human-readable network name (e.g. "CorpWiFi")
- BSSID — the actual MAC address of the specific access point radio broadcasting that SSID; one SSID can be broadcast by many BSSIDs (e.g. every AP in an office)
- An access point (AP) bridges wireless clients onto the wired network
Multiple APs broadcasting the same SSID but different BSSIDs is completely normal (roaming); an unexpected extra BSSID broadcasting a trusted SSID is a classic evil-twin indicator, covered from the offensive side in the Ethical Hacking roadmap's "Wireless Security & Attacks" lesson.
Wi-Fi Security Protocols: WEP → WPA3
| Protocol | Status |
|---|---|
| WEP | Broken — crackable in minutes, should never be used |
| WPA | Legacy fix for WEP, itself now considered weak |
| WPA2 | Current baseline for most networks (AES-CCMP encryption) |
| WPA3 | Modern standard — adds forward secrecy and resistance to offline dictionary attacks via SAE (Simultaneous Authentication of Equals) |
Channels and Overlap
The 2.4GHz band has 11-14 channels (region-dependent), but only channels 1, 6, and 11 don't overlap with each other in most regulatory domains — using any other channel guarantees interference with a neighboring channel's traffic. 5GHz offers dramatically more non-overlapping channels, one reason enterprise deployments increasingly prefer it.
Common Pitfalls
- Assuming WPA2 is inherently insecure just because WEP/WPA are broken — WPA2 with a strong passphrase remains reasonable for most networks
- Deploying access points on overlapping 2.4GHz channels without planning, causing self-inflicted interference
- Confusing SSID hiding with actual security — a hidden SSID is trivially discoverable and provides no meaningful protection
2.4GHz and 5GHz trade range for speed in opposite directions, with different interference profiles.
Which frequency band typically offers longer range but more interference and lower speed?
A single network name can be broadcast from many different physical radios across a building.
What does BSSID actually identify?
Each generation of Wi-Fi security protocol addressed a specific weakness in its predecessor.
Which Wi-Fi security protocol adds forward secrecy and resistance to offline dictionary attacks via SAE?
💪 Exercises & Challenges
Wireless Networking Fundamentals MCQ
Test your understanding of Wireless Networking Fundamentals.
Plan a Non-Overlapping Wireless Deployment
You're deploying 3 access points on the 2.4GHz band in adjacent areas of a small office (Reception, Open Floor, Conference Room), where signals from each AP reach the neighboring ones. Assign each AP
Identify the Rogue Access Point
A wireless site survey finds: the trusted SSID 'CorpWiFi-5G' is broadcast by 4 known BSSIDs (matching IT's inventory of deployed APs) — plus one unexpected 5th BSSID broadcasting the exact same SSID,