Tracking sequence numbers and flags in Wireshark

When Wi-Fi performance suddenly deteriorates, interference is often the first culprit to be suspected and, when this (interference) enters the conversation, attention tends to turn immediately toward neighboring Wi-Fi networks. “Someone must have installed another AP.” “The office next door is probably using our channel.” “There are too many SSIDs around here.” Sometimes, this diagnosis is exactly right, but RF interference has a much larger cast of characters than just neighboring APs. In fact, some of the most frustrating wireless problems occur when the interfering device isn’t speaking 802.11 at all! The spectrum doesn’t particularly care whether the energy occupying it came from an enterprise AP, a Bluetooth headset, a microwave oven, or something considerably stranger. To a Wi-Fi radio trying to communicate, unwanted RF energy is simply unwanted RF energy. Wi-Fi Has to Share the Neighborhood The 2.4 GHz band has always been something of an RF “community center”. Wi-Fi operates alongside Bluetooth, Zigbee and other technologies, while various consumer, industrial, medical, and electronic devices may also generate energy within or around the same spectrum. Microwave ovens are perhaps the most famous example. Their emissions can interfere with 2.4 GHz Wi-Fi, particularly when clients are operating nearby. Bluetooth devices, cordless equipment, wireless cameras, sensors, and other transmitters can also contribute RF energy. Some interferers transmit continuously. Others appear periodically. Some hop frequencies. Others produce wideband noise. That last category can be particularly entertaining to troubleshoot... in the very specific sense of “entertaining” that wireless engineers use when they have been staring at spectrum analysis for three hours! The important point is that interference doesn’t need to understand Wi-Fi to disrupt it.

There is something wonderfully reassuring about seeing a row of green APs on a wireless dashboard: APs connected; radios operational; no obvious alarms; everything green. Excellent! The Wi-Fi must be fine... Except, of course, the users are complaining that Teams calls are breaking up, handheld scanners keep disconnecting, authentication takes forever, and someone in Accounting has discovered that turning Wi-Fi off and back on again temporarily fixes everything. Welcome to one of the more persistent myths in enterprise wireless: if the AP is up, the Wi-Fi must be working. An operational AP tells us something useful... but it tells us surprisingly little about the experience of the clients actually using the network. “Up” is an Infrastructure State When a monitoring platform reports that an AP is up, it usually means the infrastructure can communicate with it. It tells us: - the AP has power - its Ethernet connection is functioning - it may have established its management or CAPWAP connection - its radios are probably operational - it hasn't disappeared into the networking equivalent of a “black hole” ...all good things. But none of those things proves that a client can successfully use an application. Consider what still has to happen after the AP proudly announces its existence. A client must: discover the WLAN associate authenticate obtain the appropriate network configuration reach its default gateway resolve DNS access the required network resources, and maintain sufficient RF performance to exchange data reliably. Depending on the environment, that journey may involve: 802.1X RADIUS DHCP DNS VLANs ACLs firewalls roaming mechanisms upstream switching WAN connectivity cloud services ...and several other systems waiting for their opportunity to make your afternoon more “interesting”. ;-) The AP actually being operational is merely one part of that chain!