___ ____ __ _ ___ ___ ___ ______ / _ \/ / /___/ /______ ( )___ ( _ )/ _ \|_ | < < / / // /_ _/ _ / __/ _ \|/(_-< / _ / // / __/_ / // / \___/ /_/ \_,_/\__/\___/ /___/ \___/\___/____(_)_//_/ _ _ _ _ _ ___ _ __ | |_(_)_ __ ___ (_)___ __ _| |_(_) ___ _ __ / _ \| '_ \| __| | '_ ` _ \| / __|/ _` | __| |/ _ \| '_ \ | (_) | |_) | |_| | | | | | | \__ \ (_| | |_| | (_) | | | | \___/| .__/ \__|_|_| |_| |_|_|___/\__,_|\__|_|\___/|_| |_| |_| _ _ __ _ _ _(_) __| | ___ / _` | | | | |/ _` |/ _ \ | (_| | |_| | | (_| | __/ \__, |\__,_|_|\__,_|\___| |___/ === 04dco 802.11 optimisation guide === This guide is a general rule of thumb and does not need to be copied verbatim. Wireless configuration depends heavily on what you want to do and the surrounding environment, but remember, there is always a way. Last updated: 2022-12-29 1. SSID (0-32 char string) The Extended Set Service Identifier (SSID) is your network's name as it appears on client devices. Set it to something recognisable but not overly personal. Changing it from the factory one is strongly recommended, particularly on older ISP modems/routers because their default password could be guessed from the default SSID and Wi-Fi MAC address using a common algorithm. Using a 0 char/hidden SSID is not recommended as it does not protect against any remotely skilled attackers and might reduce airtime efficiency and therefore throughput. Append _optout_nomap to the end of the SSID to opt the network out from location services that use Wi-Fi to improve GPS fix time (Google calls this Location Services, wigle.net maintains a public database of SSIDs and their locations gathered through wardriving and such). Set the same SSID on all APs to make the client treat them as one big network and in some cases seamlessly roam between them, this way you don't need to add multiple network with the same password on client devices. 2. Encryption/Authentication For a PSK auth (shared password), always use WPA3-SAE or WPA2-PSK with AES where possible, only use WPA2 with TKIP or WPA if you need to be compatible with really old clients like Windows XP. Never use WEP if possible as it is very easy to attack and it has only marginally better security than no encryption (open). For an enterprise (EAP) network, TLS or TTLS authentication is usually best unless there are specific requirements or criteria that need to be met in the deployment. 3. Password (8-63 char string) The password is the main way WEP, WPA and WPA2 protect a network from unauthorized access. It should be at least 12 characters, with length mattering more than complexity. Do not set it the same as the SSID or a common pattern like 12345678, password, dogsname2019, etc. Always change the default password as they are usually weak, 8 characters and sometimes can be calculated from the default SSID and MAC address (see 1. SSID, 1st paragraph). Changing the password is inconvenient as it must be re-entered on all client devices, for temporary access create a 2nd network (usually called guest) with a different password and delete it after you're done. 4. Channel (int, total 11 or 13 on 2.4 GHz, 5-196 with gaps on 5 GHz, 41 standard and 59 if low power indoor on 6 GHz) The channel is important to prevent interference between other networks, since Wi-Fi is a shared medium on an unlicensed band, every network gets their turn to transmit and every network must wait their turn before transmitting. In most cases this should be set to auto. If for whatever reason the AP chooses a channel with external interference that is not also Wi-Fi, you may choose one manually. Prefer channels 1, 5 and 11 (2.4 GHz) as they are non overlapping and are subject to less interference from nearby networks. The number of available channels differs by region, for example for the 2.4 GHz ISM band, America (governed by the FCC) gets 11 channels, Europe (governed by ETSI) gets 13 and Japan gets 14, however channel 14 is only usable in 802.11b networks. On 5GHz avoid dynamic frequency selection (DFS) channels as they are frequencies shared with weather radar and to avoid interference, the AP waits 60 seconds before it starts broadcasting its network initially, then, periodically listens for weather radar and stops the network from transmitting if it is detected. For a detailed list of current Wi-Fi channels for every region, check either the Linux wireless CRDA regdb from master or https://en.wikipedia.org/wiki/List_of_WLAN_channels 5. Mode (802.11a/b/g/n/ac/ax etc.) Pretty much all APs and clients today support at least 802.11n-2009, operating on the ISM 2.4 GHz band. 802.11b/g are older, slower, more inefficient modes used in the past on old Wi-Fi gear (modern devices still support them). In general setting your 2.4 GHz network as 802.11n-only and 5 GHz network as 802.11ac-only (or n+ax/ac+ax if supported) is the most efficient unless you need to support old clients. The higher the frequency, naturally the lower the range if there are obstacles in the way. In the bands are usually used as follows: 2.4 GHz for range or older/cheaper devices 5 GHz for better throughput and worse range 6 GHz for even better throughput (only supported by Wi-Fi 6E devices) Higher frequency bands have more channels and as such less interference. 6. Channel width (5/10/20/40 MHz on 2.4 GHz, 20/40/80/160 MHz on 5 and 6 GHz) Since the 2.4 GHz spectrum is generally very crowded, especially in urban environments, the channel width should be always set at 20 MHz unless you are in the middle of nowhere and need extra throughput. The larger the channel width, the less non-overlapping channels can be used. On the 5 and 6 Ghz spectrum, generally 20 MHz should be used as it provides enough bandwidth and is much more efficient on spectrum usage. 160 MHz may only be useful for an AP to AP wireless backhaul. More APs with narrower channels will always have better throughput than less APs and wider channels, especially in crowded environments. 7. WMM (bool) Wireless MultiMedia extensions is a QoS system that allows automatic prioritisation of traffic. It should always be enabled as modern clients are slowed to at most 54 Mbps if this is disabled. 8. Polarisation/antenna orientation (vertical/horizontal) Polarisation is important in many radio environments, including 802.11. Radio waves are most efficient when both the sender and receiver have their antennas polarised the same. Polarisation can either be horizontal or vertical. Most consumer APs have a vertical polarisation (antennas pointed at the sky). For maximum efficiency, point at least one antenna horizontally to account for antenna polarization in mobile devices. For example, most laptops have horizontally polarized antennas present in the top of the lid. | | | ____________ ,__T_______T__. | | `-------------' 9. Regulatory Domain/Country Code (ISO 3166-1 alpha-2 two-letter contry codes) This should always be set to the country the network is operating in as it restricts it to the right channels and transmit power for legal operation. Some APs have this setting locked to the country it was bought in or made for. 10. Transmit power (from 1 mW up to 4 W in some regions on some bands) This should be set to the minimum necessary power for the network to operate as it reduces interference from nearby network if there are many. It can be augmented with a more dense distribution of APs as more APs with low transmit power are better than less APs with more transmit power. In Europe it is usually limited to 20 dBm (100 mW) with exceptions for some 5 and 6 GHz frequencies. In the US is is limited to at most 30 dBm (1000 mW). In general this should not be set over the legal limit as defined by the regdomain as it could cause overheating, hardware issues, excess noise or making the local neighbors, WISPs or telecom regulator angry. 11. Basic data rates/Coverage cell density (int 1-3) This defines the minimum negociated bandwidth with the AP, higher settings make the minimum bandwidth requirement higher. This can boost throughput at the cost of some range and support for some older devices. 12. RTS/CTS threshold (int 1-2346 in bytes) The Request to Send/Clear to Send threshold is used to solve the hidden node problem and to help with crowded spectrum, if used on a clear spectrum it can add significant overhead. Setting this to 2346 bytes effectively disables it. A common value where RTS/CTS is needed is 500 bytes. 13. Fragmentation threshold (int 256-2346 bytes) The fragmentation threshold limits the size of packets transmitted over the Wireless network. If a packet exceeds the fragmentation threshold, it is sent as multiple 802.11 frames. Like RTS/CTS, it is only useful if there is heavy interference in the area and can cause overhead if enabled with a clear spectrum. Setting this to 2346 bytes effectively disables it. 14. DTIM interval (int 1-255) The delivery traffic information message interval is a frame sent every X beacon frames which causes the radio in the client to wake up to receive packets. The lower the value, the less time the client radio spends sleeping thus the more power it uses but the lower the network latency. Typical values are as follows: 1 for specialized hardware audio/video devices 2 for voice data like VoLTE 3-4 for most networks By default this value is either 1 or 2, Apple permits a minimum value of 3 to be set by the network. 15. Beacon interval (int 15-65535 ms) The beacon interval determines the time between beacon frames which broadcast the SSID to the surrounding clients. It is commonly set by default at 100 ms and should not be changed unless there are very good reasons to do so. 16. Preamble (bool, short/long) The preamble is used to communicate to the receiver that data is on its way. It allows the receiver to acquire the wireless signal and synchronize itself with the transmitter. In general this should be set to short unless you need compatibility witn 802.11b clients. 17. WPS (bool) Wi-Fi Protected Setup is an easy pairing method between the network and client. It has two operating modes: PIN and push-button configuration (PBC). It is strongly recommended to disable WPS or at the very least set the PBC mode. The PIN has a fixed length of 8 digits can be guessed in a few hours with tools such as reaver leading to the attacker finding the network password. 18. MAC filter (array) The Media Access Control filter is a way to filter clients that can connect to the network based on their Wi-Fi MAC address. Every wireless adapter should have a unique MAC address in the format of XX:XX:XX:YY:YY:YY where XX defines the MAC vendor/manufacturer and YY defines a random part for uniqueness. There are online "OUI" databases that can look up vendors based on MAC address. MAC filtering is a weak protection method because it can easily bypassed by changing the client adapter's MAC address, it only keeps out script kiddies and honest people. You can incorporate it together with other protection methods but should not rely solely on it. 19. Band steering (bool) Band steering is a setting on some commercial APs with proprietary firmware that tries to get the client to use a better band such as 5 GHz when both 2.4 and 5 GHz are available. It is not standardized and every vendor implements it differently. Turn this off if your clients have problems roaming between APs or connecting. It can be implemented in OpenWrt via Decentralized Wifi Controller (DAWN). 20. Client isolation This setting prevents wireless clients from communicating with each other but still allows communication with the default gateway. It is useful mostly for guest or restricted networks. 21. 802.11w management frame protection Keeps this at required unless some devices refuse to connect, in that case set it to optional. It protects from malicious frames injected into the data stream as part of a deauthentication or other attack. This can make capturing the 4 way handshake (which can be used to crack the network password) more tedious. 22. 802.11r fast BSS transition This standard permits continuous connectivity among devices that roam between APs, similar to a GSM mobile network. Enabling this will advertise it in the APs beacons but can make capturing a suitable file for cracking easier using the PMKID. 23. 802.11k neighbor reports Complements 802.11r in providing information to discover the best available AP for the client to connect to. 24. 802.11v BSS transition management frames It provides clients with spectrum information which drastically reduces the time wasted scanning the spectrum for other APs, improves data throughput, saves battery life and makes real time applications like voice calls drop less packets. Like 802.11r and 802.11k, it assist with roaming. 25. GTK rekey interval The group rekey interval specifies how often the AP changes the group temporal key, which is a cryptographic key that is used to encrypt all broadcast and multicast traffic between APs and clients. Default is 3600 seconds, do not change unless absolutely necessary. 26. Guard interval This is used to ensure that distinct transmissions do not interfere with one another, introducing immunity to propagation delays, echoes and reflections. The standard guard interval is 0.8 usec, 802.11n added a 0.4 usec mode to increase data throughput by 11%. Shorter guard interval means higher packet error rate. 27. 802.11n Greenfield mode Also called N-only, this increases available bandwidth significantly but should not be used in environments with b/g devices and may also decrease range since N modulation is too complex to decode reliably at low signal levels so clients may fall back to b/g. 28. 802.11d country IE This standard adds support for additional regulatory domains, the base standard only defining Americas (FCC), Europe (ETSI), Japan, China, Israel, Singapore and Taiwan. == Other great resources == * QCA wireless settings from the DD-WRT wiki, do note that most are DD-WRT specific. https://wiki.dd-wrt.com/wiki/index.php/QCA_wireless_settings * Wikipedia for more in-depth explanations and history * NIST Special Publication 800-63B: Digital Identity Guidelines: Authentication and Lifecycle Management https://csrc.nist.gov/publications/detail/sp/800-63b/final * Wi-Fi throughput in relation to channel widths https://divdyn.com/wi-fi-throughput/ * Does a wireless-N (802.11n) network have poor performance when in b/g "mixed" mode? https://superuser.com/questions/430185/does-a-wireless-n-802-11n-network-have-poor-performance-when-in-b-g-mixed-mo