Networking: Wireless & Mobile

Networking » Wireless & Mobile

Most internet traffic now begins or ends on a wireless link. A radio channel is fundamentally different from a copper or fiber link: it is shared, half-duplex by nature, lossy, and its capacity rises and falls with distance, interference, and the number of devices competing for airtime. This page covers the two dominant wireless access technologies — Wi-Fi (IEEE 802.11) for local-area access and cellular (4G LTE, 5G, and 5G-Advanced) for wide-area mobility — plus the physics of spectrum and modulation they share, the security that protects them, the mobility management that lets a connection survive as you walk, drive, or roam between networks, and the low-power radios used by IoT devices.

Where this fits in the stack: wireless technologies live at the physical and data-link layers (Layers & Addressing). They replace the bottom of the stack while TCP/IP, routing, and applications above them (Transport & Application Protocols) stay unchanged — which is exactly why the same browser works over Wi-Fi, fiber, or 5G.

The Shared-Medium Problem

A cable gives each link its own private wire. Radio gives every nearby device the same slice of spectrum, so the central engineering problem of all wireless is multiple access: how do many transmitters share one medium without turning it into noise?

Three families of answers recur throughout this page:

Wi-Fi historically chose contention (cheap, decentralized, no licensed spectrum needed); cellular chose scheduling (a base station with exclusive licensed spectrum can centrally allocate resources for guaranteed quality). Modern standards blur the line — Wi-Fi 6 adds OFDMA scheduling, and 5G adds unlicensed operation.

Spectrum & Modulation Basics

Everything wireless rests on turning bits into radio waves and back. Three quantities dominate: bandwidth (how much spectrum), modulation (how many bits per symbol), and signal-to-noise ratio (how reliably symbols are recovered).

The Shannon Limit

The theoretical ceiling on a channel’s capacity is the Shannon–Hartley theorem, which is the single most important equation in wireless engineering:

where $C$ is capacity in bits per second, $B$ is bandwidth in hertz, and $S/N$ is the linear signal-to-noise ratio. Two levers raise throughput: more bandwidth $B$ (why 5G chases wide millimeter-wave channels) and higher SNR (why you get faster rates standing next to the access point). Because capacity grows only logarithmically with SNR but linearly with bandwidth, bandwidth is the more powerful lever — doubling spectrum doubles capacity, while doubling SNR adds barely one bit per symbol.

SNR is usually quoted in decibels; converting to the linear ratio Shannon needs:

So a 30 dB link has a linear SNR of 1000, giving roughly $\log_2(1001) \approx 10$ bits/s per hertz of bandwidth — close to the densest practical modulations.

Modulation: Bits per Symbol

Modulation encodes bits onto a carrier wave by varying its amplitude and phase. Quadrature Amplitude Modulation (QAM) places symbols on a 2D constellation of amplitude × phase; an $M$-point constellation carries $\log_2 M$ bits per symbol.

Each doubling of constellation size adds one bit per symbol but needs roughly 3 dB more SNR, so the gains diminish quickly. Denser constellations pack more bits per symbol but place points closer together, so a small amount of noise flips a symbol to its neighbor. This is why your phone adapts: near the access point it uses 1024- or 4096-QAM, and as you walk away and SNR drops it falls back to 64-QAM, then QPSK — trading rate for robustness. This continuous trade-off is adaptive modulation and coding (AMC).

OFDM: The Workhorse Waveform

A single wideband carrier suffers from multipath: reflections off walls and buildings arrive at slightly different times, smearing symbols together (inter-symbol interference). Orthogonal Frequency-Division Multiplexing (OFDM) sidesteps this by splitting the wide channel into many narrow, orthogonal subcarriers, each carrying a slow, robust stream:

flowchart LR
    BITS["High-rate bit stream"] --> SP["Serial → parallel"]
    SP --> S1["Subcarrier 1 (QAM)"]
    SP --> S2["Subcarrier 2 (QAM)"]
    SP --> S3["Subcarrier ... (QAM)"]
    S1 --> IFFT["IFFT combine"]
    S2 --> IFFT
    S3 --> IFFT
    IFFT --> CP["+ cyclic prefix"]
    CP --> TX(["Radio signal"])

Each subcarrier is narrow enough that multipath delay is small relative to the symbol time, and a cyclic prefix (a short copy of the symbol’s tail prepended to its front) absorbs the residual echo. OFDM is the physical-layer foundation of Wi-Fi (since 802.11a/g), LTE, and 5G NR.

OFDMA extends OFDM into a multiple-access scheme: instead of giving the whole set of subcarriers to one user per symbol, the scheduler hands different groups of subcarriers (called resource blocks in cellular, resource units in Wi-Fi 6) to different users simultaneously. This is the key efficiency gain in both 5G and Wi-Fi 6 — many small clients (IoT sensors, phones) can be served in one transmission instead of each waiting its turn.

Frequency Bands and the Range/Capacity Trade-off

A fundamental physics trade-off governs band choice: lower frequencies travel farther and penetrate walls but carry less bandwidth; higher frequencies offer huge bandwidth but are blocked by almost anything.

This is why a single tower or AP cannot do everything: carriers layer low-band for coverage, mid-band for the capacity/coverage sweet spot, and mmWave for dense hotspots (stadiums, downtowns).

Wi-Fi: IEEE 802.11

Wi-Fi is the brand name for the IEEE 802.11 family of wireless-LAN standards. It connects devices to a local network over short range, typically through an access point (AP) that bridges the radio link to wired Ethernet.

The 802.11 Standard Generations

The Wi-Fi Alliance rebranded the cryptic IEEE names (802.11ax) as generation numbers (Wi-Fi 6) starting in 2018. Years below are the Wi-Fi Alliance certification launch or IEEE approval, whichever came first:

Note that the headline “max PHY rate” is an aggregate across all spatial streams and the widest channel — a real single client sees a fraction of it. The practical advances that users actually feel are MIMO (multiple antennas), OFDMA (serving many clients at once), 6 GHz spectrum (Wi-Fi 6E and later: up to 1,200 MHz of clean spectrum in countries that opened the whole band, free of legacy devices), and in Wi-Fi 7 Multi-Link Operation (MLO), which lets one client associate over several bands at once and send each frame on whichever link is free — cutting latency and jitter more than it raises peak throughput.

Channel width is the other big lever, straight from Shannon: Wi-Fi channels are 20 MHz wide and can be bonded to 40, 80, 160, and (in Wi-Fi 7, 6 GHz only) 320 MHz. Wider channels multiply peak rate but there are fewer of them, so dense deployments (offices, apartment blocks) often get better aggregate performance from narrower channels that neighbouring APs do not share.

Wi-Fi 8 (802.11bn, “Ultra High Reliability”) changes direction: rather than raising peak rates again, it targets roughly 25% better throughput, latency, and packet loss at the tail, mainly through coordination between neighbouring APs (coordinated spatial reuse and beamforming) and a seamless roaming domain that removes re-association on AP changes. IEEE approval is projected for 2028, with certification expected to begin earlier.

How Wi-Fi Shares the Air: CSMA/CA

Wi-Fi has no central scheduler in its classic mode, so devices coordinate themselves with Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA). Unlike wired Ethernet, a radio cannot reliably detect a collision while transmitting (its own signal drowns out everyone else), so Wi-Fi avoids collisions rather than detecting them:

sequenceDiagram
    participant A as Station A
    participant AP as Access Point
    participant B as Station B
    A->>A: Sense channel (DIFS idle?)
    A->>A: Pick random backoff, count down
    A->>AP: Frame
    AP-->>A: ACK
    Note over B: B sensed channel busy, deferred,<br/>froze its backoff counter
    B->>B: Resume countdown after channel clears
    B->>AP: Frame
    AP-->>B: ACK

1. Carrier sense: a station listens; if the channel is idle for a fixed interval (DIFS), it may proceed.
2. Random backoff: it picks a random number of slots from a contention window and counts down only while the channel stays idle, freezing the counter when someone else transmits. This randomization makes simultaneous starts unlikely.
3. Transmit and acknowledge: because the sender cannot hear collisions, every successful unicast frame is confirmed by an explicit ACK. No ACK means assume a collision and retry with a doubled contention window (binary exponential backoff).

An optional RTS/CTS handshake (Request To Send / Clear To Send) addresses the hidden-node problem: two stations that can both hear the AP but not each other. The AP’s CTS, heard by both, reserves the medium and silences the hidden node.

The cost of contention is airtime overhead — backoff, inter-frame spaces, and ACKs mean Wi-Fi’s real-world throughput is often 50–60% of the nominal PHY rate, and it degrades sharply as more devices contend. This overhead is precisely what OFDMA in Wi-Fi 6 attacks by serving many clients in a single scheduled transmission.

MIMO and Spatial Streams

Multiple-Input Multiple-Output (MIMO) uses several antennas at each end to send independent data streams over the same frequency at the same time, exploiting the fact that multipath reflections give each stream a distinguishable spatial signature. An $N \times N$ MIMO system can, in ideal conditions, multiply capacity by $N$ without using more spectrum. A Wi-Fi configuration written as “4×4:4” means 4 transmit antennas, 4 receive antennas, and 4 spatial streams.

MU-MIMO (Multi-User MIMO) goes further: using beamforming, the AP shapes separate spatial beams toward several clients at once, transmitting distinct data to each simultaneously. Beamforming works by adjusting the phase of the signal at each antenna so the waves add constructively at the target client and cancel elsewhere.

Wi-Fi Security: WPA2 and WPA3

An open radio link is trivially eavesdropped, so Wi-Fi encryption is mandatory in practice. The standards have a long and instructive history of broken predecessors.

WPA2 and the 4-Way Handshake

WPA2 uses AES-CCMP for strong, fast encryption — that part remains sound. Its job is to derive a fresh per-session encryption key without sending it over the air. In WPA2-Personal (PSK), every device shares one passphrase from which a Pairwise Master Key (PMK) is derived; the 4-way handshake then mixes the PMK with two random nonces (one from the client, one from the AP) to produce a unique Pairwise Transient Key (PTK) per session:

sequenceDiagram
    participant C as Client (Supplicant)
    participant AP as Access Point (Authenticator)
    Note over C,AP: Both already share the PMK (from the passphrase)
    AP->>C: 1. ANonce (AP's random number)
    C->>C: Derive PTK from PMK + ANonce + SNonce
    C->>AP: 2. SNonce + MIC (integrity check)
    AP->>AP: Derive the same PTK
    AP->>C: 3. Install key (+ group key GTK)
    C->>AP: 4. ACK — key installed
    Note over C,AP: Encrypted traffic flows with the PTK

Two weaknesses motivated WPA3. First, WPA2-Personal is offline-crackable: an attacker who captures the handshake can brute-force a weak passphrase against the captured nonces without ever touching the network. Second, the KRACK attack (2017) showed that forcing reinstallation of an already-used key (by replaying handshake message 3) could reset nonces and expose traffic — a flaw in the handshake’s state machine, since patched but architecturally fragile.

WPA2-Enterprise replaces the shared passphrase with 802.1X / EAP authentication against a RADIUS server, so every user has individual credentials and a unique PMK — no shared secret to crack, and revocable per user. This is the standard for corporate and campus networks.

WPA3 and SAE

WPA3-Personal replaces the PSK handshake with Simultaneous Authentication of Equals (SAE), a password-authenticated key exchange based on the Dragonfly protocol. SAE provides two properties WPA2 lacks:

• Resistance to offline dictionary attacks. SAE is a zero-knowledge exchange: a captured handshake reveals nothing useful for brute-forcing. Each password guess requires a fresh, live interaction with the network, so attackers cannot grind millions of guesses offline.
• Forward secrecy. Each session derives an ephemeral key, so compromising the password later does not decrypt previously recorded sessions.

SAE had its own teething problems: the 2019 Dragonblood research showed timing and cache side channels in the original password-to-curve-point conversion, and downgrade attacks against WPA3 transition mode (which accepts both WPA2 and WPA3 clients on one network, so an attacker can simply offer WPA2). The fix is the hash-to-element (H2E) method, which is mandatory on 6 GHz; transition mode should be treated as a migration aid, not a security level. Wi-Fi 6E and Wi-Fi 7 devices on 6 GHz must use WPA3 or OWE — WPA2 is not permitted there at all.

WPA3 also adds Protected Management Frames (PMF), mandatory in WPA3, which authenticate deauthentication/disassociation frames and so block the trivial “deauth” denial-of-service that plagued WPA2. WPA3-Enterprise offers an optional 192-bit suite for high-security environments, and OWE (Opportunistic Wireless Encryption) brings encryption even to “open” passwordless networks (cafés, airports) so nearby devices cannot passively sniff each other.

For the broader security context — threat models, VPNs, and zero-trust — see Cybersecurity and the security section of Performance, QoS & Security.

Cellular Evolution: From 1G to 5G

Cellular networks divide a coverage area into cells, each served by a base station, and reuse frequencies across non-adjacent cells to serve a whole country with limited spectrum. Each generation roughly defined a decade and a new capability:

The decisive break came at 4G LTE, which made the network all-IP: even voice became packets (VoLTE — Voice over LTE), eliminating the separate circuit-switched voice network that defined every prior generation. 5G builds on that all-IP foundation rather than replacing it.

Cellular standards are written by 3GPP in numbered releases: Release 15 (2018) was the first 5G specification, and Releases 18 (frozen 2024) and 19 (completed December 2025) form 5G-Advanced, adding machine learning for beam management and positioning, network energy saving, extended reality support, and improved satellite access. Release 20 begins the formal 6G study work, with the first 6G specifications expected to follow in Release 21 toward commercial service around 2030.

The Three 5G Use-Case Pillars

5G is defined less by a single speed number and more by three deliberately different service profiles, standardized by the ITU as IMT-2020:

• eMBB (enhanced Mobile Broadband): the obvious one — multi-gigabit peak rates for video, AR/VR, and fixed wireless access.
• URLLC (Ultra-Reliable Low-Latency Communication): a 1 ms user-plane latency target with 99.999% reliability for factory automation, remote control of machinery, and vehicle coordination.
• mMTC (massive Machine-Type Communication): up to a million low-power devices per square kilometer for IoT sensors.

No single configuration optimizes all three at once — eMBB wants huge throughput, URLLC wants minimal latency and jitter, mMTC wants density and battery life. Network slicing (below) is how one physical 5G network serves all three simultaneously.

How 5G Achieves Its Gains

• Wider spectrum, including mmWave. Carriers up to 100 MHz wide in the sub-7 GHz range (FR1) and 400 MHz in mmWave (FR2), versus 20 MHz in LTE, directly multiply Shannon capacity. mmWave’s short range is mitigated by dense small cells.
• Massive MIMO. Base stations with 64–256 antenna elements form many narrow beams, spatially multiplexing dozens of users on the same frequency (beamforming + MU-MIMO at scale).
• Flexible numerology. Unlike LTE’s fixed subcarrier spacing, 5G NR supports multiple subcarrier spacings; wider spacing shortens the symbol time, cutting latency for URLLC.
• Cloud-native, disaggregated core. The 5G core is a set of software functions (below), enabling slicing and edge deployment.
• Disaggregated RAN. The base station (gNB) is split into a Radio Unit (RU) at the antenna, a Distributed Unit (DU) handling real-time lower-layer processing, and a Centralized Unit (CU) for higher layers. The O-RAN initiative standardises open interfaces between these parts so operators can mix vendors and run the DU/CU as software on general-purpose servers.

Non-Standalone vs. Standalone 5G

Most early 5G networks were Non-Standalone (NSA): a 5G radio added to an existing LTE network, with the LTE base station as the control anchor and the LTE core (EPC) handling everything behind it (a mode called EN-DC). NSA delivered faster radio links quickly but none of the new core features. Standalone (SA) 5G pairs the 5G radio with the 5G core described below, and is what enables network slicing, the lower-latency user plane, and features such as RedCap devices. Operators have been migrating from NSA to SA through the mid-2020s.

flowchart LR
    subgraph NSA["Non-Standalone (EN-DC)"]
        UE1["Device"] --> ENB["LTE eNB<br/>(control anchor)"]
        UE1 -.->|extra capacity| GNB1["5G gNB"]
        ENB --> EPC["4G core (EPC)"]
        GNB1 --> EPC
    end
    subgraph SA["Standalone"]
        UE2["Device"] --> GNB2["5G gNB"]
        GNB2 --> C5G["5G core (5GC)"]
    end

The 5G Core (5GC) and Service-Based Architecture

The 5G core is a clean break from LTE’s monolithic Evolved Packet Core. It is cloud-native and built on a Service-Based Architecture (SBA): network functions are independent software services that expose RESTful APIs and discover one another through a registry, exactly like microservices in a modern application.

flowchart TD
    UE["UE (phone/device)"] --> RAN["gNB (5G RAN)"]
    RAN --> AMF["AMF — access & mobility mgmt"]
    RAN --> UPF["UPF — user-plane forwarding"]
    AMF --> SMF["SMF — session mgmt"]
    SMF --> UPF
    AMF --> AUSF["AUSF — authentication"]
    AMF --> UDM["UDM — subscriber data"]
    AMF --> PCF["PCF — policy control"]
    AMF --> NRF["NRF — function registry"]
    UPF --> DN(["Data Network / Internet"])

The architecture’s defining trait is control-plane / user-plane separation (CUPS). The user plane (the UPF, which actually forwards packets) is decoupled from the control plane (everything else, which manages sessions and policy). This lets operators push UPFs out to the network edge — close to users for low latency — while keeping control functions centralized.

Network Slicing

Because the core is software-defined, an operator can carve one physical network into multiple isolated virtual networks (slices), each tuned to a different SLA:

flowchart LR
    PHYS["One physical 5G network"] --> S1["Slice A — eMBB<br/>(high throughput)"]
    PHYS --> S2["Slice B — URLLC<br/>(ultra-low latency)"]
    PHYS --> S3["Slice C — mMTC<br/>(massive IoT)"]

A factory’s robots get a URLLC slice with guaranteed latency, the public gets an eMBB broadband slice, and a fleet of sensors gets an mMTC slice — all sharing the same towers and core hardware but logically isolated with independent policy and resources. Slicing leans directly on the SDN/NFV concepts covered in Modern & Future Networking.

Mobility Management

The defining feature of mobile networks is that a device keeps its connection alive while moving. This requires two distinct mechanisms — one for finding a moving device, one for handing it off between cells without dropping the session.

Handover

As a device moves out of one cell’s coverage and into another’s, the network must transfer the active session to the new base station — a handover (or handoff) — fast enough that the user never notices.

sequenceDiagram
    participant UE as Device
    participant S as Source cell
    participant T as Target cell
    participant Core as Core (AMF/UPF)
    UE->>S: Measurement report (target signal stronger)
    S->>T: Handover request
    T-->>S: Handover acknowledge
    S->>UE: Handover command (switch to target)
    UE->>T: Connect to target cell
    T->>Core: Path switch (redirect data to target)
    Note over UE,Core: Session continues uninterrupted

5G primarily uses hard handover (“break-before-make”: disconnect from source, then connect to target), keeping the gap to tens of milliseconds. Release 16 added two refinements: Conditional Handover (CHO), where the network prepares target cells in advance and the device switches itself when a condition is met (making handover robust when the source link degrades too fast to deliver a command), and Dual Active Protocol Stack (DAPS) handover, which keeps both links alive briefly to achieve near-zero interruption (“make-before-break”). The device continuously measures neighboring cells’ signal strength and reports back; the network decides when to trigger the switch, balancing signal quality against the cost of switching too often (“ping-ponging” between two cells of similar strength).

Locating an Idle Device: Tracking Areas and Paging

A device that is connected but idle (to save battery) does not report its exact cell. The network groups cells into tracking areas and only needs to know which area an idle device is in. When traffic arrives for it, the network pages every cell in that area to wake the device, which then re-establishes a connection. This trades a small wake-up latency for a large saving in signaling and battery — a device updates its location only when it crosses a tracking-area boundary, not on every cell change.

Roaming

When a subscriber leaves their home operator’s coverage (e.g., traveling abroad), roaming lets a visited network serve them. The visited network’s control functions query the home network’s subscriber database (the UDM/HSS) to authenticate the device and retrieve its service profile, then provide service while accounting back to the home operator. Roaming is the cellular analogue of Wi-Fi’s enterprise authentication — your identity lives in one place, but you can be served anywhere.

Wi-Fi Roaming

Wi-Fi has its own (simpler) mobility story for moving between APs on the same network. Standards reduce the re-authentication delay that would otherwise break a voice or video call:

• 802.11r (Fast BSS Transition): pre-computes keys so re-association with the next AP skips the full handshake (sub-50 ms handoff).
• 802.11k (Neighbor Reports): the AP tells the client which neighboring APs to consider, so it doesn’t waste time scanning all channels.
• 802.11v (BSS Transition Management): lets the network gently steer a client toward a better AP.

Together these enable seamless “mesh” and enterprise Wi-Fi where you walk across a building on a continuous call.

Satellite and Non-Terrestrial Networks

Low-Earth-orbit (LEO) constellations have made satellite a mainstream access technology. Two distinct models exist:

• Dedicated satellite broadband (Starlink, Amazon’s Project Kuiper, OneWeb) uses its own terminals with phased-array antennas; LEO orbits at roughly 500–1,200 km give round-trip latencies of a few tens of milliseconds, compared with about 600 ms for geostationary satellites.
• Direct-to-device (direct-to-cell) service reaches unmodified phones. 3GPP added Non-Terrestrial Network (NTN) support in Release 17, and commercial services launched in the mid-2020s — for example T-Mobile’s T-Satellite service with Starlink in the United States (2025), initially for text messaging and a limited set of apps. Capacity per cell is small, so these services fill coverage gaps rather than competing with terrestrial networks.

Satellite links combine long RTTs with variable loss, which is hard on loss-based TCP congestion control (Transport & Application Protocols); operators commonly use performance-enhancing proxies or rely on QUIC with BBR-style congestion control.

Edge & IoT Considerations

Wireless access is the natural front door for two adjacent trends — edge computing and the Internet of Things — and both reshape how the network is designed.

Edge Computing

Pushing computation close to the radio (Multi-access Edge Computing, MEC) is what makes 5G’s URLLC promise physically achievable: the speed of light alone makes sub-millisecond round trips to a distant cloud impossible, so the application server must sit at the edge. The 5G core’s UPF is deliberately deployable at the edge precisely to enable this. Typical edge workloads include AR/VR rendering, real-time video analytics, autonomous-vehicle coordination, and industrial control.

Edge computing and MEC are explored further in Modern & Future Networking; their cloud-side counterparts (CDNs, regional compute) appear in AWS.

IoT Connectivity Trade-offs

IoT devices invert the usual priorities: they need years of battery life and long range, but only trickle amounts of data. This birthed a family of Low-Power Wide-Area Network (LPWAN) technologies:

The two cellular options matter for 5G’s mMTC pillar: NB-IoT (narrowband, deep-coverage, ultra-low-power for static meters) and LTE-M (higher rate, supports mobility and voice for trackers and wearables) reuse licensed spectrum and existing towers, giving carrier-grade reliability and security that unlicensed LPWANs cannot match. Their design philosophy is the opposite of eMBB: minimize power and signaling, accept low rates, and let a device sleep for hours between brief reports. Between these and full 5G sits RedCap (Reduced Capability NR, Release 17, extended as eRedCap in Release 18): 5G devices with fewer antennas and narrower bandwidth for wearables, industrial sensors, and video cameras that need more than LTE-M but far less than a smartphone.

In the smart home, Matter (an application-layer standard from the Connectivity Standards Alliance, 2022) runs over IP on Wi-Fi, Ethernet, or Thread (an IPv6 mesh on 802.15.4 radios), replacing a patchwork of vendor-specific hubs; Bluetooth LE is used only for commissioning new devices.

See Also

• Networking — overview and navigation hub.
• Layers & Addressing — the stack that wireless replaces at Layers 1-2.
• Transport & Application Protocols — what runs unchanged on top of any radio link.
• Modern & Future Networking — SDN/NFV behind slicing, edge computing, and 6G/terahertz research.
• Performance, QoS & Security — QoS, VPNs, and the security context for WPA.
• Cybersecurity — threat models and zero-trust beyond the Wi-Fi handshake.
• AWS — cloud networking and the data-center side of edge.