Wireless - WiFi, Bluetooth, Cellular and GPS

31.0 What this chapter gives you#

1. You will be able to explain what a radio wave is and why an antenna has the length it has, and work out the wavelength of any band in your head.
2. You will be able to explain how information is put onto a wave, from simple on-off keying up to the 4096-QAM used by WiFi 7.
3. You will be able to explain OFDM properly, and say why the same idea sits under WiFi, 4G LTE, 5G and digital television.
4. You will be able to name every WiFi standard from 1997 to 2024 with its year, its band and its top speed, and say what each one added.
5. You will be able to walk through what happens on the air and in software from the moment you click a network name to the moment data flows.
6. You will be able to explain Bluetooth classic and Bluetooth Low Energy as two different protocols that share a brand name, and say why.
7. You will be able to explain how a phone attaches to a cellular network, what the SIM card actually holds, and what each generation changed.
8. You will be able to explain how GPS works, including why four satellites are needed and why the satellites need a relativity correction.

31.1 Radio from first principles#

PLAIN31.1.1 in simple words#

1. Push electricity back and forth along a piece of metal and it makes a wave that flies away into space. That is all radio is.
2. Electricity in a wire has two side effects. It makes a magnetic push around the wire, and an electric push along it.
3. If the electricity is steady, those pushes just sit there. If it changes, they change too.
4. A changing magnetic push creates an electric push, and a changing electric push creates a magnetic push. Each one keeps making the other.
5. So the pair can let go of the wire and keep going on their own, forever, at the speed of light.
6. That travelling pair is a radio wave. The metal that launches it is an antenna.
7. A second piece of metal far away feels the wave arrive, and the wave pushes electricity back and forth in it, very weakly. That wiggle is the signal.
8. Frequency is how many times per second the push reverses, measured in hertz. WiFi at 2.4 GHz reverses 2,400,000,000 times per second.
9. Wavelength is how far the wave travels during one full reversal. At 2.4 GHz that is about 12.3 centimetres.

PLAIN31.1.2 a picture in your head#

1. Think of a long rope tied to a post at the far end of a field.
2. You hold your end and flick your wrist. A bump travels to the post. You did not send the rope. You sent a disturbance in the rope.
3. Flick faster and the bumps are closer together. The bump’s travel speed does not change, only the spacing.
4. That is exactly frequency and wavelength. Speed is fixed. Faster wiggling means shorter waves.

Where this comparison breaks: a rope needs to exist. A radio wave needs nothing. It crosses empty space with no material carrying it, and the Michelson-Morley experiment of 1887 found no carrying substance at all. Also, a rope wave is one wiggle. A radio wave is two wiggles at right angles, electric and magnetic, locked together.

PLAIN31.1.3 a worked example#

1. The rule is: speed equals frequency times wavelength, so lambda = c / f.
2. The speed of light, written c, is 299,792,458 metres per second.
3. WiFi channel 6 sits at 2.437 GHz. lambda = 299,792,458 / 2,437,000,000 = 0.1230 metres, about 12.3 cm.
4. WiFi channel 36 sits at 5.180 GHz. lambda = 0.0579 metres, about 5.8 cm.

5. A wire radiates best when it is a simple fraction of the wavelength, usually one half or one quarter.
6. At 2.4 GHz a quarter wave is 3.1 cm, which is why the metal strip inside a router aerial is about three centimetres long.

PLAIN31.1.4 what is really happening inside#

1. Feed alternating current into the middle of a straight wire. Electrons pile up at one end, rush to the other, and back, at the frequency you feed in.
2. Very close to the wire the fields slosh back and forth and return their energy to the wire. This is the near field.
3. Further out, the field cannot get back before the wire has reversed. The loop pinches off and is stranded.
4. A stranded loop is a wave, and it must travel outwards at the speed of light. This is the far field.
5. The boundary is roughly one sixth of a wavelength, about 2 cm at 2.4 GHz. Inside, energy is stored. Outside, energy is radiated.
6. Length matters because the current wave bounces off each end of the wire.
7. If the wire is a half wavelength long, the reflection arrives back in step with the next push, and the wire rings like a tuning fork.
8. If the length is wrong, the reflection fights the next push, most power bounces back into the transmitter, and little is radiated.
9. That is why a broken aerial makes a radio go quiet and the transmitter run hot.

TECHNICAL31.1.5 the engineer’s version#

1. Radio propagation is described by Maxwell’s equations, published by James Clerk Maxwell in 1865. Heinrich Hertz demonstrated generation and detection of the waves between 1886 and 1888, which is why the unit is the hertz.
2. Radio waves and visible light are the same phenomenon at different frequencies. There is no physical boundary in the spectrum, only naming.
3. Photon energy is E = h x f, with h = 6.626 x 10^-34 joule seconds. At 2.4 GHz that is 1.59 x 10^-24 J, or 9.9 microelectronvolts.
4. Visible light photons carry about 2 electronvolts, roughly 200,000 times more, and breaking a chemical bond needs several electronvolts.
5. That is the physics behind calling radio non-ionizing: a 2.4 GHz photon cannot break a bond at any power level, only heat.

6. Gain is focusing, not amplification. A 3 dBi antenna sends twice the power one way by sending less elsewhere.
7. Tools: a vector network analyser measures VSWR and impedance. In software, iw dev wlan0 link on Linux and wdutil info on macOS 13 and later report the received level of a live link.

WORDS31.1.6 remember these#

1. Wavelength — how long one wiggle is in space — lambda = c / f in metres.
2. Near field — the zone next to the antenna where energy sloshes — the reactive region within lambda / 2pi.
3. Far field — the zone where the wave has left and is travelling — the radiating region beyond 2 D^2 / lambda.
4. Non-ionizing — too weak per photon to break molecules — photon energy far below chemical bond energies, so only thermal effects.

31.2 Carrying information on a wave#

PLAIN31.2.1 in simple words#

1. A plain wave with nothing done to it carries no information. It is a tone.
2. To carry information you must change the wave in a way the receiver can notice and undo. Changing it is called modulation.
3. There are only three things about a wave you can change: its height, called amplitude; its wiggle rate, called frequency; and its timing offset, called phase.
4. Each jump lands the wave in one of a fixed set of states. One state is a symbol.
5. Four possible states means each symbol carries two bits. Sixteen states means four bits, but sixteen states are harder to tell apart.
6. That trade, more bits per symbol against needing a cleaner signal, is the single most important idea in modern wireless.

PLAIN31.2.2 a picture in your head#

1. Imagine signalling to a friend across a valley with a lamp at night.
2. Brighter and dimmer is amplitude modulation. Swapping a red lamp for a green one is frequency modulation, because colour is the frequency of light.
3. Now agree four brightness levels: off, dim, medium, bright. Each flash carries two bits.

Where this comparison breaks: a lamp has one dimension, brightness. A radio symbol has two dimensions at once, because the in-phase and out-of-phase parts vary independently. That two-dimensional space is what makes QAM possible. Also, real receivers use error-correcting codes that fix a certain number of wrong guesses per block, so failure is a cliff, not a slow fade.

PLAIN31.2.3 a worked example#

1. Here are the three classic modulations drawn as waves, reading the bits 1, 0, 1 from left to right.

Carrier alone (no information)
  /\  /\  /\  /\  /\  /\  /\  /\  /\
 /  \/  \/  \/  \/  \/  \/  \/  \/  \

AM / ASK : height changes, spacing fixed
  /\  /\   __  __   /\  /\
 /  \/  \  \/  \/  /  \/  \
   bit 1     bit 0    bit 1

FM / FSK : spacing changes, height fixed
  /\/\/\/   /  \  /  \   /\/\/\/
  \/\/\/\   \  /  \  /   \/\/\/\
   bit 1      bit 0        bit 1

PSK : height and spacing fixed, wave jumps in time
  /\  /\  |\/  \/  |\  /\
 /  \/  \ |  \/  \ | \/  \
          ^ flip    ^ flip

2. ASK, amplitude shift keying: two brightness levels. Morse code by radio is ASK.
3. FSK, frequency shift keying: two tones. Old dial-up modems and the Bluetooth radio use it.
4. PSK, phase shift keying: in step or half a cycle out of step. Two states, one bit per symbol. That case is BPSK.
5. QPSK uses four phase positions a quarter turn apart, two bits per symbol.
6. QAM varies phase and amplitude together, giving a grid of states.

7. A constellation diagram pictures those states. The sideways axis is the in-phase part, the up axis is the out-of-phase part, and each allowed state is a dot.
8. BPSK is two dots, left and right. QPSK is four, one per corner. 16-QAM is a four-by-four grid, 256-QAM is sixteen by sixteen, 4096-QAM is sixty-four by sixty-four.
9. With noise, each received dot lands in a fuzzy cloud instead of exactly on its spot.
10. On a four-by-four grid the clouds have room. On a sixty-four by sixty-four grid they overlap and the receiver picks the wrong dot.

PLAIN31.2.4 what is really happening inside#

1. Symbol rate is how many states per second you send, limited by how much spectrum you may occupy.
2. Bit rate is symbol rate times bits per symbol, reduced by the error-correcting overhead.
3. So there are only two ways to go faster: more symbols per second, needing more spectrum, or more bits per symbol, needing a cleaner signal. There is no third way.
4. Spread spectrum looks like the opposite of going faster.
5. In frequency hopping spread spectrum, FHSS, the transmitter jumps between small channels many times a second in a pattern the receiver knows. Jamming one channel costs only the hops that landed there.
6. In direct sequence spread spectrum, DSSS, each bit is replaced by a fixed longer pattern of faster pulses called chips.
7. Sending eleven chips per bit spreads the signal over eleven times the bandwidth, so it looks weaker and wider.
8. The receiver multiplies by the same known pattern. The wanted signal adds up; noise, being unrelated, cancels. That gain is why GPS can be received from orbit despite arriving weaker than the background noise.
9. Now OFDM, which solves echo. Indoors a signal arrives several times: direct, off a wall, off the floor, late by tens of nanoseconds.
10. OFDM makes each symbol much longer, four microseconds instead of fifty nanoseconds, so an echo overlaps only a tiny fraction of it.
11. Long symbols mean a slow symbol rate, so OFDM sends many symbols at once, side by side, on many narrow subcarriers.
12. The subcarriers are spaced so that at the exact centre of each, every other one passes through zero. That is what orthogonal means here, and it lets them overlap in frequency without interfering.
13. Each symbol is sent with a copy of its own tail glued to the front, the guard interval or cyclic prefix. Echoes land in the copy, which is thrown away.

TECHNICAL31.2.5 the engineer’s version#

1. Frequency hopping was patented by Hedy Lamarr, filed under her legal name Hedy Kiesler Markey, with the composer George Antheil. US Patent 2,292,387, “Secret Communication System”, was granted on 11 August 1942.
2. The mechanism used a punched roll like a player piano to step a torpedo guidance link through frequencies so it could not be jammed.
3. The US Navy rejected it as too bulky, and the patent expired before similar systems entered service around 1962.
4. It is honest to say Lamarr and Antheil did not invent WiFi. They patented one idea, decades before the electronics existed to do it cheaply.
5. Shannon’s capacity theorem, published by Claude Shannon in 1948, sets the ceiling: C = B x log2(1 + S/N).
6. Worked example: a 20 MHz channel at 25 dB SNR. 25 dB is a ratio of 316. C = 20,000,000 x log2(317) = 166 Mbit/s.
7. That is why one 20 MHz stream cannot exceed roughly 170 Mbit/s; real 802.11ax tops out at 143.4 Mbit/s.
8. 802.11b DSSS: 1 and 2 Mbit/s use an 11-chip Barker sequence at 11 Mchip/s. 5.5 and 11 Mbit/s use Complementary Code Keying with 8-chip codewords.

9. Check the top rate: 48 subcarriers x 6 bits (64-QAM) x 3/4 coding = 216 bits per symbol, divided by 4.0 microseconds = 54 Mbit/s exactly.
10. 802.11ax quadrupled the symbol: 78.125 kHz spacing, 256-point FFT for 20 MHz, 234 data subcarriers, 12.8 us symbol plus a 0.8, 1.6 or 3.2 us guard.
11. The longer symbol tolerates longer echoes, which is why 802.11ax works better outdoors and in large halls.

12. Those SNR values are typical receiver sensitivity figures published by chip vendors, not values written into the standard.

WORDS31.2.6 remember these#

1. Modulation — changing a wave so it carries information — varying amplitude, frequency or phase of a carrier according to a message.
2. QAM — packing bits by changing both strength and timing — quadrature amplitude modulation with independent I and Q levels.
3. Spread spectrum — deliberately using more bandwidth than needed — trading bandwidth for processing gain and jam resistance.
4. DSSS — every bit sent as a longer known pattern — direct sequence spreading by a chip code such as the 11-chip Barker sequence.
5. FHSS — jumping between channels on a shared schedule — frequency hopping, 1600 hops per second in Bluetooth.
6. OFDM — many slow narrow signals instead of one fast wide one — orthogonal frequency division multiplexing with IFFT/FFT and a cyclic prefix.

31.3 The realities of radio#

PLAIN31.3.1 in simple words#

1. A radio link is a shouting match across a noisy room. Three things decide whether it works: how loud you shout, how much the journey swallows, and how noisy the room already is.
2. Radio power is measured in dBm. 0 dBm means one milliwatt. Every 10 dBm added multiplies power by ten; every 10 dBm removed divides by ten.
3. A router transmits at about +20 dBm, which is 100 milliwatts. Your laptop hears it at about -50 dBm, one hundred billionth of a milliwatt.
4. The room is never silent. There is always a hiss from heat in the electronics and from the universe. That hiss is the noise floor.
5. What matters is not how loud your signal is, but how far above the hiss it is. That gap is the signal-to-noise ratio.
6. Signal also arrives more than once, bouncing off walls. The copies can add up or cancel out. That is multipath.
7. Lower frequencies bend around obstacles and pass through walls better, while higher ones carry more data but are stopped more easily.
8. That is the whole 2.4 versus 5 GHz story: 2.4 goes further, 5 goes faster.

PLAIN31.3.2 a picture in your head#

1. Imagine a party. Your voice loudness is the transmit power. The distance and the bodies between you are the path loss. Everyone else talking is the noise floor.
2. Add echo. Your voice arrives directly and again off the wall behind them. A short echo is unnoticed; a long one smears words together.
3. Now imagine you and a friend speaking at once from different places, each saying half a sentence. The listener has two ears and can separate you by direction. That is MIMO.

Where this comparison breaks: at a party, two people talking at once is always worse. In radio, two transmitters and two receivers with enough echo in the room can genuinely double the data, because the echoes make the paths mathematically separable. Multipath, the enemy in older systems, became the resource MIMO exploits.

PLAIN31.3.3 a worked example#

1. A real link budget for a laptop five metres from a router.
2. Router transmit power +20 dBm, plus 3 dBi antenna gain, gives +23 dBm radiated.
3. Free space loss at 5 metres and 2.4 GHz is 54 dB. One internal wall costs 6 dB. Laptop antenna gain 0 dBi.
4. Received signal: 23 - 54 - 6 = -37 dBm. Very strong.
5. The same at 5 GHz, which loses about 6.4 dB more and where walls cost roughly double: 23 - 72.4 - 24 = -73.4 dBm. Marginal.

6. See it yourself. On macOS: wdutil info. On Linux: iw dev wlan0 link. On Windows: netsh wlan show interfaces.

PLAIN31.3.4 what is really happening inside#

1. Power spreads over the surface of an expanding sphere. Double the distance and the same power covers four times the area, so a fixed antenna catches a quarter as much. That is exactly 6 dB per doubling.
2. Higher frequency loses more for a subtle reason. The spreading is identical, but an antenna sized for a shorter wavelength has a smaller catching area.
3. Multipath means copies arrive at different times. Where two copies arrive half a wavelength apart, they cancel.
4. Half a wavelength at 2.4 GHz is 6 centimetres, which is why moving a laptop by a hand’s width can change signal by 10 dB.
5. That cancellation is fading, and it is frequency-dependent: one subcarrier may sit in a null while its neighbour is fine. OFDM survives by spreading data across many subcarriers plus error correction.
6. MIMO uses several antennas at each end. Each pair sees a slightly different mix of echoes.
7. With enough difference, the receiver solves a small set of simultaneous equations and separates two or more independent streams sent at the same time on the same channel. Each is a spatial stream.
8. Beamforming is different. It sends the same data from several antennas with small timing offsets so the copies add at the receiver and cancel elsewhere. It improves signal, not stream count.

TECHNICAL31.3.5 the engineer’s version#

1. dBm is decibels relative to one milliwatt: P(dBm) = 10 x log10(P in mW).
2. Free space path loss in decibel form: FSPL(dB) = 20 log10(d_km) + 20 log10(f_MHz) + 32.44.
3. Worked: d = 0.005 km, f = 2437 MHz. 20 log10(0.005) = -46.0. 20 log10(2437) = 67.7. Total = 54.1 dB.
4. Same at 5180 MHz: 20 log10(5180) = 74.3, giving 60.7 dB. The 6.6 dB difference is the 2.4 versus 5 GHz penalty.
5. Thermal noise is N = k x T x B with k = 1.38 x 10^-23 J/K. At 290 K the noise density is -174 dBm/Hz.
6. For 20 MHz: -174 + 10 log10(20,000,000) = -101 dBm. Add a typical 5 dB receiver noise figure and the practical floor is about -96 dBm.

7. The honest version of RSSI: in the standard it is a vendor-defined unitless integer with no required scale. Drivers convert it to dBm using their own table, so two adapters in the same spot can legitimately disagree.
8. Tools: iperf3 for throughput, iw dev wlan0 station dump for per-station rate and signal, and Wireshark with a monitor-mode adapter for the radiotap header.

WORDS31.3.6 remember these#

1. Noise floor — the background hiss you must shout over — kTB thermal noise plus receiver noise figure, about -96 dBm in a 20 MHz channel.
2. SNR — the gap between your signal and the hiss — signal-to-noise ratio in decibels, the direct determinant of usable modulation order.
3. Multipath — the same signal arriving by several routes — delayed replicas causing frequency-selective fading.
4. MIMO — several antennas sending different data at once — multiple input multiple output spatial multiplexing.
5. Beamforming — aiming the signal by timing several antennas — applying a steering matrix so transmissions add constructively at the receiver.

31.4 Spectrum and regulation#

PLAIN31.4.1 in simple words#

1. Radio is shared. If everyone transmits on the same frequency, nobody gets through, so governments divide the spectrum into bands and say who may use each one, for what, and at what power.
2. Most bands are licensed. One company pays for exclusive use. Mobile phone bands work this way.
3. A few bands are unlicensed. Anyone may transmit if they obey power limits and interference rules, and may not complain about interference.
4. The main ones are the ISM bands, short for industrial, scientific and medical. They were not created for communication. They were set aside for machines that leak radio while doing something else.
5. A microwave oven is the classic example. It cooks with radio at 2.45 GHz. Nobody wanted that band because ovens were already polluting it.
6. The rules differ by country. The rule set in force where you are is called a regulatory domain, and your router turns off channels not allowed there.
7. Part of the 5 GHz band is shared with weather and military radar. There, a WiFi device must listen first and leave immediately if it hears a radar. That rule is called DFS.

PLAIN31.4.2 a picture in your head#

1. Think of the spectrum as a very long street of shops. Most of it is rented, one tenant per shop with a locked door. That is licensed spectrum.
2. A few stretches are public squares. Anyone may set up a stall, under rules about how loud you may shout and how big your stall may be.
3. One square sits next to a factory that hums loudly. Rents there are zero. That square is 2.4 GHz.

Where this comparison breaks: a market stall takes a fixed amount of floor. Radio devices share time and frequency together, and a well-behaved device can share a channel with dozens of others by taking short turns. Also the square is public per country, not globally: the same square is open in India and closed in Japan, on the same street.

PLAIN31.4.3 a worked example#

1. The 2.4 GHz band runs from 2400 to 2483.5 MHz in most countries.
2. WiFi defines 14 channels in it, spaced 5 MHz apart, but each channel is about 20 MHz wide, so neighbours overlap heavily.
3. Only channels 1, 6 and 11 are far enough apart not to overlap. That is the origin of the famous advice to use 1, 6 or 11.

4. Country differences: the United States allows channels 1 to 11, most of Europe and India allow 1 to 13, and Japan allows 1 to 14 with channel 14 restricted to the old 802.11b modulation.

5. India is a useful case because it moved recently.
6. The Department of Telecommunications published draft rules in May 2025 and notified the final delicensing on 22 January 2026, opening 5925 to 6425 MHz for indoor low-power and very-low-power wireless access.
7. That is half the band the United States opened in April 2020. India’s rules also forbid use on oil platforms, in cars, trains, boats and drones, and on aircraft below 10,000 feet.

PLAIN31.4.4 what is really happening inside#

1. Access points advertise their country in a Country information element inside every beacon frame, and a client supporting 802.11d adopts it.
2. DFS works in three steps. Before using a radar channel, the access point listens silently for 60 seconds. That is the channel availability check.
3. While using it, the access point keeps listening. On detecting a radar it must stop transmitting within 200 milliseconds and vacate within 10 seconds.
4. It must then avoid that channel for 30 minutes, the non-occupancy period.
5. This is why a 5 GHz network sometimes vanishes for a minute and returns on a different channel. It is not a fault. It is the law working.

TECHNICAL31.4.5 the engineer’s version#

1. The ISM bands are defined in the ITU Radio Regulations, article 5.
2. The key ones are 902 to 928 MHz (Region 2 only), 2400 to 2500 MHz (global), 5725 to 5875 MHz (global) and 24 to 24.25 GHz.
3. Domestic microwave ovens operate at 2450 MHz plus or minus 50 MHz, which is exactly why that band was designated ISM and why WiFi shares it.
4. The founding regulatory act for WiFi was the United States FCC Report and Order in Docket 81-413, adopted in May 1985, permitting unlicensed spread spectrum in the ISM bands up to 1 watt.
5. Michael Marcus, then an FCC engineer, drove that rulemaking.

6. India’s regulator for spectrum is the Wireless Planning and Coordination Wing of the Ministry of Communications, written WPC. Equipment approval runs through Equipment Type Approval, ETA.
7. Inspect the applied domain on Linux with iw reg get:

country IN: DFS-UNSET
    (2402 - 2482 @ 40), (N/A, 20), (N/A)
    (5170 - 5330 @ 160), (N/A, 23), (N/A)
    (5735 - 5835 @ 80), (N/A, 30), (N/A)

8. The honest version of “1, 6 and 11 do not overlap”: they do not overlap at the -30 dB level used in the spectral mask, but real transmitters leak outside the mask and cheap receivers reject adjacent channels imperfectly.
9. It is a standard that 2.4 GHz channels are 5 MHz apart. It is a convention, not a standard, that everyone uses 1, 6 and 11.

WORDS31.4.6 remember these#

1. ISM band — bands set aside for machines that leak radio — allocations under ITU Radio Regulations article 5.
2. Regulatory domain — the country rule set your radio obeys — a country code mapping to permitted channels, power and DFS requirements.
3. DFS — get off the channel if radar is heard — dynamic frequency selection per ETSI EN 301 893 or FCC Part 15.407.
4. WPC — India’s spectrum authority — Wireless Planning and Coordination Wing, Ministry of Communications.

31.5 The WiFi hardware#

PLAIN31.5.1 in simple words#

1. A WiFi radio is four things in a row: a digital part, a converter, an analogue radio part, and an antenna.
2. The digital part works out what wave shape should be sent. That is the baseband processor.
3. It also runs the rules of taking turns on the air. That part is the MAC, short for medium access control.
4. The analogue radio part shifts that wiggle up to 2.4 or 5 GHz, amplifies it, and pushes it to the antenna. Coming in, its most important job is to amplify an extremely weak signal without adding noise.
5. In a modern device the first three are one silicon chip. Around it sit a power amplifier, a low-noise amplifier, switches and filters, together called the RF front end.
6. The chip runs its own small program, stored as firmware. Your operating system does not do the split-second radio timing. The chip does.

PLAIN31.5.2 a picture in your head#

1. Think of a small radio station with four rooms.
2. A producer writes the script and decides when the station goes on air. That is the MAC and the baseband.
3. A machine turns the script into sound, and a transmitter lifts that sound onto the broadcast frequency where an amplifier makes it loud. That is the converter, the mixer and the power amplifier.
4. Incoming signals run the same rooms backwards, and the most delicate part is the first receive stage, because whatever noise it adds is amplified along with the tiny signal forever after. That stage is the low-noise amplifier.

Where this comparison breaks: a radio station transmits or receives. A WiFi chip must do both, alternating thousands of times per second, sharing one antenna through a switch that must settle in under a few microseconds.

PLAIN31.5.3 a worked example#

1. Open a laptop from around 2020 and you find a small card in an M.2 2230 slot, about 22 mm by 30 mm.
2. Two thin coaxial wires run from that card up through the hinge into the lid, ending at flat metal shapes printed just above the screen.
3. Those are the antennas, placed high and away from the metal chassis and your hands.

4. In a phone there is no card. WiFi, Bluetooth and often GPS sit in one combo chip soldered to the main board.
5. Phone antennas are usually part of the metal frame, split into segments by the thin plastic gaps you can see on the outside edge.
6. Real examples: Apple used Broadcom BCM4387-family parts in iPhone 13 and 14 era devices, and Qualcomm’s FastConnect 7800, announced in 2022, was the first widely shipped WiFi 7 combo.

PLAIN31.5.4 what is really happening inside#

1. Follow one packet out of the chip. The MAC has a frame of bytes and permission to transmit.
2. The baseband adds error correction, maps groups of bits onto constellation points, and lays those points across the OFDM subcarriers.
3. An inverse fast Fourier transform turns that set of subcarriers into a stream of numbers describing the wave shape over time.
4. Converters turn those numbers into two voltages, I and Q, and a mixer multiplies them by a pure tone from a local oscillator to shift everything up to 2.4 or 5 GHz.
5. The power amplifier raises it from a few milliwatts to 60 or 100 milliwatts, a switch connects the antenna, and the wave leaves.
6. Coming in, the low-noise amplifier boosts the tiny signal first, before anything can add noise.
7. A mixer shifts it down, converters digitize it, an FFT splits it into subcarriers, an equalizer undoes the channel distortion using known training symbols at the start of the frame, and a decoder recovers bits.
8. The firmware handles anything faster than the operating system can be trusted to react: acknowledgements within 16 microseconds, backoff countdown, rate selection and power save timing.

TECHNICAL31.5.5 the engineer’s version#

1. CNVi is an instructive implementation detail: Intel moved the MAC and baseband into the platform controller hub, leaving only RF on the M.2 card. This is why Intel CNVi cards do not work in AMD laptops.
2. Firmware is loaded at driver initialization from files on the host. On Linux they live under /lib/firmware:

/lib/firmware/iwlwifi-ty-a0-gf-a0-89.ucode      Intel AX210
/lib/firmware/brcm/brcmfmac43455-sdio.bin       Broadcom in Pi 4
/lib/firmware/ath11k/QCA6390/hw2.0/amss.bin     Qualcomm
/lib/firmware/mediatek/WIFI_RAM_CODE_MT7922_1.bin

3. Check what is loaded with dmesg | grep -i firmware or ethtool -i wlan0, which prints driver, firmware version and bus address.
4. Nearly all WiFi firmware is a closed binary. That is a real limitation for auditability, and it has hosted serious vulnerabilities, notably Google Project Zero’s 2017 findings against Broadcom WiFi firmware.
5. Two design styles exist. FullMAC puts scanning, association and much of the MAC in firmware. SoftMAC puts them in the host driver.
6. Most Broadcom and Qualcomm mobile parts are FullMAC; most Atheros and Intel parts on Linux are SoftMAC, which is why they support monitor mode better.

WORDS31.5.6 remember these#

1. Baseband — the part that shapes the wave from bits — PHY layer coding, mapping, IFFT and FFT.
2. MAC — the part that decides when to talk — medium access control, the 802.11 state machine and timing.
3. Low-noise amplifier — the delicate first receive stage — LNA whose noise figure sets the receiver’s sensitivity.
4. Firmware — the program running on the radio chip itself — closed binary loaded from the host, handling microsecond timing.
5. SoftMAC — the computer handles connecting — MAC state machine in the host driver, as with Linux mac80211.

31.6 WiFi history and standards#

PLAIN31.6.1 in simple words#

1. WiFi did not start as a product idea. It started as a regulator giving away spectrum nobody wanted.
2. In 1985 the United States regulator allowed unlicensed devices to use the ISM bands if they used spread spectrum. That made it legal to build a wireless network without buying spectrum.
3. The way devices take turns was borrowed from ALOHAnet, built at the University of Hawaii and operating from June 1971.
4. ALOHAnet connected islands by radio at 9600 bits per second. Its rule was simple: transmit when you have something to send, and if no acknowledgement comes, wait a random time and try again.
5. That idea, random access with random backoff, became Ethernet and then WiFi.
6. The first WiFi standard, IEEE 802.11, arrived in 1997 at 1 or 2 megabits per second. It was too slow to matter.
7. In 1999 two versions appeared: 802.11b at 11 megabits in 2.4 GHz, and 802.11a at 54 megabits in 5 GHz. 802.11b won, because 2.4 GHz radios were cheaper and the range was better.
8. The name WiFi was invented in 1999 by a branding company. It does not stand for anything.

PLAIN31.6.2 a picture in your head#

1. Think of WiFi generations as widening a road and adding lanes.
2. 802.11b was one narrow lane. 802.11a and g repaved it with a better surface, OFDM instead of DSSS, for five times the traffic.
3. 802.11n added lanes, with several antennas sending different data at once, and 802.11ac widened each lane from 20 MHz to 80 and then 160.
4. 802.11ax neither widened nor added lanes. It fixed the junction, letting several small vehicles cross together instead of one at a time.
5. 802.11be opened a second road, the 6 GHz band, and lets a device use two roads at once.

Where this comparison breaks: roads do not interfere with each other. Radio channels do, and adding width in a crowded area can make things worse. A 160 MHz channel in a block of flats often performs worse than an 80 MHz one.

PLAIN31.6.3 a worked example#

1. Here is the complete family. Read the rate column as a theoretical ceiling no real device reaches.

2. Note the numbering gap. The Wi-Fi Alliance introduced generation numbers in October 2018 and applied them backwards only to n, ac and ax. “WiFi 1” through “WiFi 3” for b, a and g are retrospective informal labels.
3. WiFi 6E is not a new standard. It is 802.11ax operating in the 6 GHz band, branded separately from 2021.

PLAIN31.6.4 what is really happening inside#

1. Now the Australian claim, told honestly, because it is often told badly.
2. In the early 1990s a team at CSIRO, Australia’s national science agency, was working on a radio astronomy problem: detecting a weak signal smeared by echoes.
3. The team was led by John O’Sullivan, with Graham Daniels, Terence Percival, Diethelm Ostry and John Deane.
4. Their solution combined forward error correction, frequency-domain interleaving and multi-carrier modulation, done with fast Fourier transforms in a single chip.
5. That combination was granted as US Patent 5,487,069 on 23 January 1996.
6. CSIRO settled with Hewlett-Packard in April 2009, then Microsoft, Intel, Dell, Toshiba, Asus, Nintendo and others in 2009 and 2010, and with AT&T, Verizon and T-Mobile in 2012 for about 229 million dollars.
7. Total income from the patent was roughly 430 million dollars, and the inventors received the European Inventor Award in 2012.
8. What is not true is that CSIRO invented WiFi.
9. OFDM itself was described by Chang at Bell Labs in 1966, and the 802.11 committee was chaired by Vic Hayes of NCR in the Netherlands, whose team built the first products.
10. The honest version: WiFi has no single inventor.
11. The FCC opened the band, NCR and Lucent built the first radios, the IEEE committee wrote the rules, CSIRO contributed a key patented signal processing idea, and Apple shipping AirPort in the 1999 iBook made it mainstream.

TECHNICAL31.6.5 the engineer’s version#

1. IEEE 802.11 formed as a working group in 1990. Vic Hayes of NCR chaired it for ten years and is commonly called the father of WiFi.
2. The 1997 base standard defined three physical layers: FHSS at 2.4 GHz, DSSS at 2.4 GHz, and diffuse infrared at 1 and 2 Mbit/s. The infrared PHY was never commercially implemented.
3. 802.11b, ratified September 1999, added CCK for 5.5 and 11 Mbit/s. 802.11a, ratified the same month, used OFDM at 5 GHz with rates 6 to 54 Mbit/s.
4. The Wireless Ethernet Compatibility Alliance was founded in 1999 and renamed the Wi-Fi Alliance in 2002. Interbrand coined the name WiFi in 1999 from a list of ten candidates.
5. The “Wireless Fidelity” expansion is a myth. Phil Belanger, a founding member, has stated the name has no expanded meaning; early Alliance marketing briefly used the phrase and created the confusion.
6. 802.11ax was published as IEEE 802.11ax-2021, with Wi-Fi Alliance certification from September 2019. It introduced OFDMA, uplink MU-MIMO, 1024-QAM, target wake time and BSS colouring.
7. 802.11be certification as Wi-Fi 7 began on 8 January 2024, with the IEEE standard published 22 July 2025. Key additions: 320 MHz channels, 4096-QAM, multi-link operation, multiple resource units and preamble puncturing.
8. Rate arithmetic for 802.11be: 8 spatial streams, 320 MHz, 4096-QAM, 5/6 coding and a 0.8 us guard gives about 23 Gbit/s. The headline 46 Gbit/s assumes the specification maximum of 16 spatial streams, which no product implements.
9. Wi-Fi 8 is IEEE 802.11bn, under the banner Ultra High Reliability, projected to be finalized around May 2028.
10. Its stated goal is not higher peak rate but better worst-case behaviour: lower latency variance, seamless roaming and coordinated access points. Treat published figures as active work, not established fact.

WORDS31.6.6 remember these#

1. IEEE 802.11 — the committee and document that defines WiFi — the working group and its standard, amended by letter suffixes.
2. Wi-Fi Alliance — the industry group that tests and brands — the certifier owning the WiFi trademark and generation numbers.
3. 802.11ax — the standard behind WiFi 6 and 6E — high efficiency WLAN with OFDMA and 1024-QAM, published 2021.
4. 802.11be — the standard behind WiFi 7 — extremely high throughput with 320 MHz, 4096-QAM and multi-link operation, published July 2025.
5. CSIRO patent — the Australian signal processing patent WiFi uses — US 5,487,069 of January 1996, covering FEC with interleaved multicarrier modulation.

31.7 How WiFi actually works on the air#

PLAIN31.7.1 in simple words#

1. An access point announces itself about ten times a second with a short message called a beacon, carrying the network name, supported speeds, security type and a timestamp.
2. Your device can sit quietly and listen for beacons, called passive scanning, or shout a question and wait for answers, called active scanning. The shout is a probe request.
3. The network name you see is the SSID. The unique hardware address of the access point radio is the BSSID.
4. To join, your device sends an authentication frame, then an association request. The access point replies and gives it a small ID number. Then the security handshake runs, and only then can real data flow.
5. The rule is: listen first. If the channel is busy, wait. If it is free, wait a random extra amount, then transmit.
6. Every unicast frame must be acknowledged. No acknowledgement means it was lost and is sent again.
7. All that listening, waiting and acknowledging costs time. Roughly half the advertised speed disappears into it.

PLAIN31.7.2 a picture in your head#

1. Think of a polite conference call with no chairperson.
2. Nobody can hear themselves while speaking, because their own voice drowns everything out, so nobody can tell if they talked over someone.
3. That is exactly the radio situation: a transmitter cannot listen on its own channel while transmitting, because its own signal is a billion times stronger than anything arriving.
4. The etiquette is: wait for silence, count silently for a random number, and if it is still silent when you reach zero, start talking.
5. Now a problem: two people at opposite ends of a long table can both hear the chairperson but not each other, and will talk over each other forever.
6. The fix is to ask the chairperson “may I speak”, and have the chairperson say out loud “yes, everyone else be quiet for two minutes”.

Where this comparison breaks: humans hear a clash afterwards and apologize. Radios never learn about the clash directly, only from the missing acknowledgement. Also the “random count” is not seconds, it is a count of 9 microsecond slots, and the range doubles after every failure.

PLAIN31.7.3 a worked example#

1. Here is a full join sequence, in order.

Client                              Access point
  |                                       |
  |<---------- Beacon (every 102.4 ms) ---|
  |------ Probe Request (broadcast) ----->|
  |<----- Probe Response ------------------|
  |------ Authentication (open) --------->|
  |<----- Authentication (success) -------|
  |------ Association Request ----------->|
  |<----- Association Response (AID 3) ---|
  |<----- EAPOL 4-way handshake msg 1 ----|
  |------ EAPOL msg 2 ------------------->|
  |<----- EAPOL msg 3 --------------------|
  |------ EAPOL msg 4 ------------------->|
  |         (keys installed, port open)   |
  |------ DHCP Discover ----------------->|
  |<----- DHCP Offer / Ack ---------------|
  |         data flows                    |

2. Typical times: probe response within 10 milliseconds, authentication and association a few milliseconds, four-way handshake 20 to 60 milliseconds, DHCP 10 to 100 milliseconds. Total join time is usually 100 to 300 milliseconds.
3. Now the taking-turns arithmetic for one 1500 byte packet on a 5 GHz 802.11ac link advertising 866 Mbit/s.

4. Useful data moved: 12,000 bits in 175 microseconds is 68.5 Mbit/s, against an advertised 866.
5. That is why frame aggregation exists. Send 64 frames in one burst with one preamble and one block acknowledgement, and the fixed costs are shared.
6. With aggregation the same link delivers roughly 500 to 600 Mbit/s of real throughput. Still not 866, but far better than 68.

PLAIN31.7.4 what is really happening inside#

1. SIFS, short interframe space, is the shortest gap, used for replies that must not be interrupted, such as an acknowledgement.
2. DIFS, distributed interframe space, is longer, and is what a device must see idle before starting a fresh transmission.
3. After DIFS, the device picks a random number between 0 and the contention window and counts down one slot at a time.
4. If the channel goes busy mid-count, the count freezes and resumes after the next idle DIFS. It does not restart, which gives waiting devices fairness.
5. On failure the contention window doubles: 15, 31, 63, 127, up to 1023. That is exponential backoff, the same idea Ethernet uses.
6. The hidden node problem is common: two clients on opposite sides of an access point may be unable to hear each other.
7. The fix is RTS/CTS. The sender asks with a request to send, and the access point answers with a clear to send that every client hears.
8. The clear to send carries a duration. Everyone who hears it sets a countdown called the network allocation vector and stays silent for that long, even without hearing the channel busy. That is virtual carrier sense.
9. Every 802.11 frame starts with a 2 byte frame control field saying what kind it is, then a duration, then up to four addresses.

TECHNICAL31.7.5 the engineer’s version#

1. The 802.11 MAC header layout, in bytes:

+----+----+------+------+------+-----+------+-----+------+
| FC | Dur| Addr1| Addr2| Addr3| Seq | Addr4| QoS | Body |
|  2 |  2 |   6  |   6  |   6  |  2  |  6*  |  2* |  ... |
+----+----+------+------+------+-----+------+-----+------+
                                             then FCS: 4
* present only in some frame types

2. Aggregation: A-MSDU packs several IP packets under one MAC header, up to 11,454 bytes in 802.11n. A-MPDU packs several MAC frames under one PHY preamble, up to 1 megabyte in 802.11ac and ax, with a block ACK.
3. As a rule of thumb, TCP throughput lands at 45 to 60 percent of the PHY rate for 802.11n and ac, and 60 to 70 percent for 802.11ax with OFDMA, because OFDMA removes much of the per-station contention.
4. OFDMA in 802.11ax divides the channel into resource units measured in subcarriers, called tones.

5. The access point schedules who uses which resource unit with a trigger frame, so uplink transmissions from several clients arrive simultaneously and must be time-aligned within 0.4 microseconds.
6. Target wake time lets a client and access point agree a future window for traffic so the client sleeps in between. It is the single biggest battery feature in 802.11ax and matters most for sensors.
7. Band steering is a vendor behaviour, not a standard: the access point withholds or delays probe responses on 2.4 GHz to push dual-band clients to 5 GHz.
8. The related real standards are 802.11k for neighbour reports, 802.11v for BSS transition management and 802.11r for fast roaming.
9. Capture and inspect: iw dev wlan0 set type monitor, then tcpdump -i wlan0 -e -s0 or Wireshark with the display filter wlan.fc.type_subtype == 0x08 for beacons.

WORDS31.7.6 remember these#

1. Beacon — the regular announcement an access point sends — a management frame every 100 TU carrying SSID, capabilities and timestamp.
2. BSSID — the identity of one specific access point radio — the MAC address of that radio, unique per band per access point.
3. CSMA/CA — listen, wait a random time, then talk — carrier sense multiple access with collision avoidance and exponential backoff.
4. SIFS — the tiny gap before a reply — short interframe space, 16 us on 5 GHz OFDM, giving replies priority over new transmissions.
5. RTS/CTS — asking permission out loud so hidden devices hear — request to send and clear to send, setting the network allocation vector.
6. OFDMA — several devices sharing one transmission by frequency — scheduled resource units within a channel.
7. TWT — an agreed appointment so a device can sleep — target wake time, introduced in 802.11ax.

31.8 WiFi security#

PLAIN31.8.1 in simple words#

1. On radio, everything is in the air and anyone in range receives every bit, so WiFi must encrypt by default and must prove who is who.
2. The first attempt, WEP from 1997, was broken beyond repair within four years.
3. WPA in 2003 was a patch that ran on the same old hardware. It bought time.
4. WPA2 in 2004 was the real fix, using the AES cipher. It is still everywhere.
5. WPA3, announced in 2018, fixed the last big weakness: an attacker who captured your handshake could guess your password offline, forever.
6. There is also open, with no password, where every byte is readable by anyone in range unless the site itself uses HTTPS.

PLAIN31.8.2 a picture in your head#

1. Think of a locked diary with a code wheel on the front.
2. WEP used one short code and wrote part of it on the outside of every page. After watching enough pages, you could work out the whole code.
3. WPA2 uses a proper safe. The password is not the key: the password plus a fresh random number is stirred into a key used only for this session.
4. WPA3 changes the opening ceremony so the recording is useless. Each guess must be made live, against the real router, one at a time.

Where this comparison breaks: a diary code is one secret. WiFi has a hierarchy of keys, one master key from the password, one pairwise key per client, one group key for broadcasts. Also, encryption stops at the access point. Everything past it is in the clear unless the application encrypts too.

PLAIN31.8.3 a worked example#

1. The absolute rule of a stream cipher is that a keystream must never be used twice. If it is, adding the two ciphertexts cancels the keystream.
2. To vary the keystream, WEP prepends a 24-bit initialization vector to the shared key and sends that vector in the clear with every packet.
3. 24 bits gives 16,777,216 values. By the birthday problem a repeat becomes likely after about 5,000 packets, which a busy access point sends in seconds.
4. Worse, RC4 has a related-key weakness, published as the FMS attack by Scott Fluhrer, Itsik Mantin and Adi Shamir in August 2001.
5. The 2007 PTW attack by Erik Tews, Andrei Pyshkin and Ralf-Philipp Weinmann recovers a 104-bit WEP key from about 40,000 packets in under a minute.
6. Now the WPA2 four-way handshake. Both sides already know a master key derived from the password and the network name.

AP                                          Client
 |--- 1. ANonce (AP random number) --------->|
 |     client now has both nonces and both   |
 |     MACs, so it computes the PTK          |
 |<-- 2. SNonce + MIC (proves it has PTK) ---|
 |     AP computes the same PTK and checks   |
 |--- 3. GTK (encrypted) + MIC ------------->|
 |<-- 4. Acknowledgement + MIC --------------|
 |     both install keys, data port opens    |

7. Nothing secret crosses the air. Both sides derive the same session key from things they already share plus two random numbers.

PLAIN31.8.4 what is really happening inside#

1. The password and the SSID are stretched into a 256-bit pairwise master key by 4096 rounds of hashing. That slowness is deliberate, to make guessing expensive.
2. The four-way handshake mixes that master key with two fresh random numbers and both MAC addresses to make a pairwise transient key for this session only.
3. The KRACK attack of October 2017, found by Mathy Vanhoef and Frank Piessens at KU Leuven in Belgium, attacked this handshake.
4. It blocks message four so the access point resends message three. The client reinstalls the same key and resets its packet counter.
5. Reusing a counter with a stream-like cipher exposes the keystream, which is exactly the WEP failure in a new place.
6. On Android and Linux the wpa_supplicant implementation was worse: it installed an all-zero key on reinstallation, removing encryption entirely. That was fixed in wpa_supplicant 2.7.
7. WPA3 replaces the password-to-key step with SAE, simultaneous authentication of equals, a password-authenticated key exchange.
8. With SAE a captured handshake cannot be used for offline guessing, and each session gets forward secrecy: learning the password later does not decrypt old recorded traffic.

TECHNICAL31.8.5 the engineer’s version#

1. WPA2 is IEEE 802.11i-2004. CCMP is AES in counter mode with CBC-MAC, 128-bit key, 48-bit packet number and an 8-byte message integrity code.
2. TKIP was a stopgap that kept RC4 but added per-packet key mixing, a 48-bit sequence counter and the Michael integrity check. The Wi-Fi Alliance barred TKIP-only devices from certification in 2012.
3. Key derivation is PMK = PBKDF2-HMAC-SHA1(passphrase, SSID, 4096 iterations, 256 bits). Because the SSID is the salt, common names such as “linksys” have precomputed rainbow tables.
4. KRACK carries ten CVEs, CVE-2017-13077 through CVE-2017-13088.
5. OWE, opportunistic wireless encryption, branded Enhanced Open, encrypts open networks with an unauthenticated Diffie-Hellman exchange. It stops passive sniffing but not an active impostor access point.
6. WPS is dangerous. Its 8-digit PIN is validated in two halves and the last digit is a checksum, so the search space is 11,000, not 100 million.
7. Stefan Viehbock published this in December 2011, and Dominique Bongard’s 2014 Pixie Dust attack breaks many chipsets offline in seconds. Turn it off.
8. Enterprise uses IEEE 802.1X: the client is the supplicant, the access point the authenticator, and a RADIUS server the authentication server.
9. EAP carries the method, with EAP-TLS using client certificates and PEAP-MSCHAPv2 or EAP-TTLS tunnelling a password inside TLS.
10. Tools: wpa_cli status, hostapd_cli, aircrack-ng for auditing your own network, and Wireshark with the display filter eapol to watch the four-way handshake.

WORDS31.8.6 remember these#

1. WEP — the broken first attempt — RC4 with a 24-bit IV, key recoverable from 40,000 packets by the PTW attack.
2. WPA2 — the long-standing standard — IEEE 802.11i with AES-CCMP and the four-way handshake.
3. Four-way handshake — the exchange proving both sides know the password — EAPOL-Key frames deriving the PTK from PMK, two nonces and two MACs.
4. KRACK — the 2017 attack that replayed a handshake message — key reinstallation causing nonce reuse.
5. WPA3 — the current standard — SAE replacing the PSK exchange, giving forward secrecy and no offline dictionary attack.
6. WPS — the push-button feature you should disable — Wi-Fi Protected Setup, whose PIN has an effective search space of 11,000.

31.9 The WiFi software stack#

PLAIN31.9.1 in simple words#

1. Five layers of software sit between your click and the air.
2. Firmware runs on the WiFi chip itself and handles anything measured in microseconds.
3. The driver runs inside the operating system kernel and talks to the chip over PCIe or SDIO.
4. The 802.11 stack implements the rules of scanning, joining and framing for drivers that do not do it in firmware.
5. The supplicant is a background program that does the security handshake and holds your passwords.
6. The network manager is the part with the menu you click. It decides which network to join and asks the supplicant to do it.
7. Your password is not sent to the router. It is used locally to compute a key. This is worth repeating because almost everyone assumes otherwise.

PLAIN31.9.2 a picture in your head#

1. Think of joining a members-only club.
2. The network manager is you, reading the list of clubs and picking one.
3. The supplicant is your solicitor, who holds your documents and handles the paperwork at the door.
4. The 802.11 stack is the club’s standard entry procedure: queue here, show this, sign that.
5. The driver is the doorman who opens the door, and the firmware is the door mechanism, which must latch in microseconds and cannot wait for anyone.
6. Once inside, DHCP is the receptionist who assigns you a table number.

Where this comparison breaks: in a club these are separate people. On a FullMAC phone chip the procedure, the doorman and the mechanism are one closed piece of firmware, and the operating system only sends high-level requests such as “join this network”.

PLAIN31.9.3 a worked example#

1. Here is exactly what happens in software when you click a network name and type a password. This is the Linux path, the one you can read.

 1. You click. The GUI calls NetworkManager over D-Bus.
 2. NetworkManager writes a connection profile file.
 3. NetworkManager tells wpa_supplicant over D-Bus:
    "network={ssid=..., psk=...}, select it".
 4. wpa_supplicant asks the kernel to scan, via nl80211.
 5. cfg80211 passes the request to the driver; the driver
    programs the chip to sweep channels.
 6. Scan results come back up the same path as a list of
    BSSIDs with signal, channel and security info.
 7. wpa_supplicant picks the best BSSID for that SSID.
 8. It computes PMK = PBKDF2(password, SSID, 4096, 256).
 9. It asks the kernel to authenticate and associate.
10. mac80211 sends the auth and assoc frames on the air.
11. The AP replies; the association succeeds.
12. The AP sends EAPOL message 1. The driver passes it up.
13. wpa_supplicant computes the PTK and sends message 2.
14. Messages 3 and 4 complete. Keys go to the kernel.
15. The kernel installs keys into the chip's key table.
16. The netdev is marked carrier-up. NetworkManager sees it.
17. NetworkManager runs its DHCP client. An address arrives.
18. Routes and DNS servers are installed. You are online.

2. Steps 1 to 3 take milliseconds. The scan is the slow part: a full sweep of all channels takes 1 to 4 seconds, because it must dwell on each channel long enough to catch a beacon.
3. Steps 8 to 15 take 20 to 100 milliseconds, and step 17 takes 10 to 100.

4. A minimal supplicant configuration looks like this:

ctrl_interface=/run/wpa_supplicant
update_config=1

network={
    ssid="HomeNet"
    psk="a-long-passphrase"
    key_mgmt=WPA-PSK
    priority=10
}

PLAIN31.9.4 what is really happening inside#

1. Reconnecting later skips most of that, because the profile is already stored: no typing and no dialogue.
2. The device keeps a list of known networks and scans for them on waking.
3. Historically it also sent probe requests naming each known SSID, which leaked your home and office network names to anyone listening. Modern devices prefer passive scanning and randomized MAC addresses.
4. If the master key has not expired, PMK caching lets a device reassociate to a previously used access point without the expensive derivation. Standards 802.11r and opportunistic key caching extend this between access points in one network.
5. Roaming decisions live in the client, not the network. The client watches signal and loss, and jumps when a better BSSID crosses a threshold.
6. That is why a laptop sometimes clings to a distant access point: the thresholds are a vendor implementation detail, not a standard, and vary widely between chipsets.
7. On macOS the same pieces exist with different names: the driver family is IO80211Family, network selection lives in airportd, applications use the CoreWLAN framework, and passwords sit in the keychain as items of kind “AirPort network password”.

TECHNICAL31.9.5 the engineer’s version#

1. The Linux layering, top to bottom:

  GUI  ->  NetworkManager or iwd   (userspace policy)
            |  D-Bus
        wpa_supplicant             (802.1X, WPA, SAE)
            |  nl80211 over netlink
        cfg80211                   (config API, regulatory)
            |
        mac80211                   (SoftMAC 802.11 state machine)
            |
        driver: iwlwifi / ath11k / mt76 / brcmfmac
            |  PCIe, SDIO, USB
        firmware on the chip

2. cfg80211 is the configuration layer and holds the regulatory database. mac80211 is the SoftMAC implementation, used only by drivers that need it; FullMAC drivers such as brcmfmac register directly with cfg80211.

3. On macOS 13 and later, sudo wdutil info prints RSSI, noise, channel, security, country code and the MAC address in use. The older airport utility inside Apple80211.framework was removed in macOS 14.4.
4. The security boundary is worth stating plainly: your operating system trusts the WiFi firmware completely, and on PCIe that firmware has DMA access unless an IOMMU is configured. That is an established weakness, not a theoretical one.
5. Debugging: dmesg -w while connecting shows driver and firmware messages, and wpa_supplicant -dd -i wlan0 -c file.conf in the foreground prints every state transition, which is the fastest way to see where a join fails.

WORDS31.9.6 remember these#

1. Supplicant — the program that does the security handshake — 802.1X supplicant, typically wpa_supplicant or iwd on Linux.
2. mac80211 — the kernel’s 802.11 rules engine — the SoftMAC framework implementing scanning, association and rate control.
3. Network manager — the part with the menu — the userspace policy daemon choosing networks and running DHCP.
4. PMK caching — remembering a key so reconnecting is fast — caching the pairwise master key security association per BSSID.

31.10 Bluetooth#

PLAIN31.10.1 in simple words#

1. Bluetooth solves a different problem to WiFi. WiFi connects you to a network. Bluetooth connects two devices to each other.
2. It uses the same 2.4 GHz band as WiFi but very differently: it hops between narrow channels 1600 times a second.
3. A small group of connected devices is a piconet. One device is in charge of timing and the others follow.
4. Because the purposes vary so much, Bluetooth defines profiles: agreed rules for one job, such as stereo audio, a keyboard, or a phone call.
5. Pairing is the one-time ceremony creating a shared secret, so the two devices recognize each other later without asking again.

PLAIN31.10.2 a picture in your head#

1. Think of a busy hall where many pairs of people hold private conversations.
2. Each pair agrees a rule: after every sentence, move to a different spot, following a shuffle order only they know.
3. Pairing is the moment two people first exchange a private codeword, in person, so they can recognize each other later in the dark.

Where this comparison breaks: people would collide constantly while moving. The hopping pattern is derived from the leader’s address and clock, so every follower knows exactly where the leader will be next. Also, since Bluetooth 1.2 in 2003, devices drop persistently busy channels from the hop list, which no wandering person could do.

PLAIN31.10.3 a worked example#

1. The radio numbers: 79 channels of 1 MHz each from 2402 to 2480 MHz, hopped 1600 times a second, so each hop lasts 625 microseconds.

PLAIN31.10.4 what is really happening inside#

1. One device in a piconet is the central, historically called master, and up to seven others are actively connected peripherals.
2. The central’s clock and address generate the hop sequence. Time is divided into 625 microsecond slots and the central decides who transmits in each.
3. Above the radio sit a link layer, a multiplexing layer called L2CAP, then the profiles. Profiles exist so a headset from one maker works with a phone from another with no shared code.
4. Legacy pairing, before 2007, used a short PIN, often 0000, and a passive listener who captured the exchange could recover the link key.
5. Secure Simple Pairing, in Bluetooth 2.1 from 2007, uses elliptic curve Diffie-Hellman so a passive listener learns nothing.
6. It offers four association models, chosen by what each device can display and what you can type into it.
7. Numeric comparison: both show a six-digit number and you confirm they match. This is the strongest common model.
8. Passkey entry: one shows a number and you type it into the other, used for keyboards.
9. Just Works: neither device can display or input, so nothing is checked. It stops passive eavesdropping but not an active impostor.
10. The result is a link key stored on both sides. Storing it is bonding, and it is why a headset reconnects silently forever after.

TECHNICAL31.10.5 the engineer’s version#

1. Development began at Ericsson Mobile in Lund, Sweden, where Nils Rydbeck started a short-link radio project in 1989. Design work began in 1994, led by Jaap Haartsen with Sven Mattisson.
2. The Bluetooth Special Interest Group launched in May 1998 with five founding members: Ericsson, IBM, Intel, Nokia and Toshiba. The specification was announced on 20 May 1998.
3. The name was proposed by Jim Kardach of Intel in 1997 after Harald “Bluetooth” Gormsson, the tenth-century Danish king who united the Danish tribes. It was meant as a code name and stuck.
4. The controller and host are separated by the HCI, host controller interface, over UART, USB or SDIO. That split is why one chip works with Linux BlueZ, Windows and Android alike.
5. Attacks worth naming: BlueBorne, published by Armis in September 2017, gave remote code execution with no pairing.
6. KNOB, by Antonioli, Tippenhauer and Rasmussen in 2019, forced the encryption key down to one byte of entropy. BIAS in 2020 impersonated a previously bonded device.
7. The honest version of “Bluetooth is secure”: the cryptography in Secure Connections mode, added in 4.2 using P-256 ECDH and AES-CCM, is sound.
8. The weaknesses are almost all in negotiation, downgrade paths and Just Works, plus a long tail of unpatched embedded devices.

WORDS31.10.6 remember these#

1. Piconet — a small group sharing timing — one central and up to seven active peripherals on a common hop sequence.
2. Frequency hopping — jumping between narrow channels constantly — 1600 hops per second across 79 channels of 1 MHz.
3. Profile — an agreed rule set for one job — a specification such as A2DP or HFP guaranteeing cross-vendor interoperability.
4. Pairing — the one-time ceremony creating a shared secret — Secure Simple Pairing with ECDH and one of four association models.
5. HCI — the boundary between chip and operating system — host controller interface over UART, USB or SDIO.

31.11 Bluetooth Low Energy#

PLAIN31.11.1 in simple words#

1. Bluetooth Low Energy shares the name and the band with classic Bluetooth and almost nothing else. It is a separate protocol.
2. It was created for devices that send tiny amounts of data occasionally and must run for a year on a coin cell: a fitness band, a door sensor, a car key.
3. Instead of building a long-lived connection, a device may simply shout a tiny message every so often. That is advertising.
4. If more is needed, a scanner can ask to connect, and then the two exchange named pieces of data organized as services and characteristics.

PLAIN31.11.2 a picture in your head#

1. Classic Bluetooth is a telephone call: you dial, you stay connected, and you pay for the whole time whether you speak or not.
2. BLE is a postcard on a noticeboard. The device pins a small card up every second, then goes back to sleep.
3. If you want more than the card says, you knock on the door, and the device opens a short conversation from a printed menu of what it can tell you.
4. That menu is the GATT database: sections are services, items are characteristics.

Where this comparison breaks: a noticeboard is passive. A BLE advertisement costs real energy each time, which is why the advertising interval is the main battery knob. Longer intervals mean longer life and slower discovery.

PLAIN31.11.3 a worked example#

1. Take a heart rate monitor chest strap. Its GATT database looks like this.

Service: Heart Rate            (UUID 0x180D)
  Characteristic: Heart Rate Measurement (0x2A37)
      properties: NOTIFY
      value: flags byte + rate, e.g. 00 4B  -> 75 bpm
  Characteristic: Body Sensor Location    (0x2A38)
      properties: READ
      value: 01  -> chest

Service: Battery Service       (UUID 0x180F)
  Characteristic: Battery Level           (0x2A19)
      properties: READ, NOTIFY
      value: 5B  -> 91 percent

2. The phone does not poll for the heart rate. It subscribes once, and the strap sends a notification each time the value changes.
3. Power arithmetic: a CR2032 coin cell holds about 225 milliamp-hours. Advertising once per second at 10 milliamps for 2 milliseconds averages about 20 microamps, plus 2 microamps sleeping. That is over 1,000 days.

PLAIN31.11.4 what is really happening inside#

1. Here is a BLE device from power-on to data flowing.

 1. Power on. The chip configures its radio and loads its
    GATT table from flash into memory.
 2. It picks an advertising interval, say 1000 ms.
 3. Every interval it wakes and transmits the same short
    packet on channels 37, 38 and 39 in turn, then sleeps.
 4. A phone scanning hears one of those three channels.
 5. The phone may send a scan request; the device answers
    with a scan response holding extra bytes, e.g. its name.
 6. The user taps connect. The phone sends a connect request
    carrying an access address, a hop increment and a
    connection interval.
 7. Both sides move onto the 37 data channels, hopping by
    the agreed increment.
 8. At each connection interval the peripheral wakes, listens
    for the central's packet, replies, and sleeps again.
 9. The phone discovers services, then characteristics.
10. The phone writes 0x0001 to the heart rate CCCD.
11. The strap now sends a notification every beat, inside
    the normal connection events. No polling.

2. Privacy is a real concern. A device advertising the same address forever is trackable, so BLE supports resolvable private addresses that change every fifteen minutes and can be linked back only by a device holding the identity resolving key.
3. Beacons are advertisements with a fixed payload and no connection. Apple’s iBeacon, from 2013, and Google’s Eddystone, from 2015, are two formats.
4. They enable indoor positioning and also silent presence tracking, which is why both Android and iOS gate scanning behind a location permission.

TECHNICAL31.11.5 the engineer’s version#

1. BLE was developed by Nokia as Wibree from 2006, adopted by the Bluetooth SIG and published in the Bluetooth 4.0 core specification in June 2010.
2. Radio: 40 channels of 2 MHz from 2402 to 2480 MHz, with GFSK modulation.
3. Speeds are 1 Mbit/s at LE 1M and 2 Mbit/s at LE 2M, added in 5.0, plus a coded PHY at S=2 or S=8 giving four times the range at one eighth the rate.
4. Stack, bottom to top: link layer, L2CAP, then ATT (attribute protocol) and GATT (generic attribute profile), with SMP (security manager protocol) alongside for pairing.
5. ATT is the wire protocol: a flat table of handles, each with a UUID, permissions and a value, with operations read, write, write without response, notify and indicate.
6. GATT is the convention layered on ATT that groups attributes into services and characteristics. It is a profile, not a separate protocol.
7. Since BLE 4.2, data length extension raises the link layer payload from 27 to 251 bytes, roughly tripling throughput.
8. Tools: bluetoothctl and btmon on Linux, the nRF Connect application on Android and iOS for exploring a GATT table, and a Nordic nRF52 sniffer with Wireshark for over-the-air capture.

WORDS31.11.6 remember these#

1. Advertising — shouting a small packet periodically — unconnected broadcast on channels 37, 38 and 39.
2. GATT — the small named database on a device — generic attribute profile organizing ATT handles into services and characteristics.
3. Characteristic — one named value you can read or subscribe to — an ATT attribute with a UUID, properties and optional descriptors.
4. Resolvable private address — an address that changes to avoid tracking — a rotating address resolvable only with the identity resolving key.

31.12 Bluetooth audio#

PLAIN31.12.1 in simple words#

1. Bluetooth audio was poor for a long time, and the reasons explain most of what people complain about.
2. Every device must support one basic method so anything works with anything. That method, SBC, was designed in 2002 to be cheap, not good.
3. Squeezing and unsqueezing takes time. That delay is latency, and it is why lips can be out of step with sound when watching video.
4. Worst of all, when you use the microphone the link switches to a different, much narrower mode and quality collapses.
5. That is why music sounds fine until a call starts, and then everything sounds like a 1990s telephone.

PLAIN31.12.2 a picture in your head#

1. Think of a narrow letterbox. Thin envelopes go through quickly.
2. Now you want a two-way conversation through the same letterbox. Half the space must go to your outgoing envelopes.
3. With half the space gone, the incoming book must be squashed far harder, into something barely readable. That is what happens when the microphone opens.

Where this comparison breaks: a letterbox is only about width. The old profile also switched to a completely different, much older codec, so the damage was larger than a simple halving of bandwidth. LE Audio fixes this by using one modern codec in both directions.

PLAIN31.12.3 a worked example#

1. Latency figures, approximate and highly device dependent: SBC 150 to 250 ms, AAC on Apple devices 100 to 160 ms.
2. aptX Low Latency is 32 to 40 ms, LC3 over LE Audio is 20 to 30 ms, and a wired 3.5 mm jack is under 1 ms.
3. Humans notice audio and video out of step at roughly 45 milliseconds of audio lag. That is why video players delay the picture when Bluetooth is in use, and why gaming over Bluetooth feels wrong.

PLAIN31.12.4 what is really happening inside#

1. Two different profiles handle audio, and that is the root of the problem.
2. A2DP, the advanced audio distribution profile, is one-way, high quality and used for music.
3. HFP, the hands-free profile, is two-way and used for calls.
4. When a call starts the headset switches from A2DP to HFP. Classic HFP originally offered only the CVSD codec at 8 kHz sampling, telephone quality, later improved to mSBC at 16 kHz, called wideband speech.
5. LE Audio, introduced in Bluetooth 5.2 in 2019 and shipping in products from 2022, replaces both. It uses one codec, LC3, developed by Fraunhofer IIS and Ericsson, in both directions over new isochronous channels that guarantee timing.
6. LC3 at 160 kbit/s is judged better than SBC at 345 kbit/s in listening tests run by the Bluetooth SIG, so it gives better sound at half the bitrate, which also means longer battery life.
7. Auracast is LE Audio’s broadcast mode. One transmitter serves unlimited receivers, so a television, an airport gate or a lecture hall can broadcast audio anyone nearby joins, optionally with a password.
8. The Bluetooth SIG announced the Auracast brand in 2022.

TECHNICAL31.12.5 the engineer’s version#

1. HFP uses a SCO or eSCO link, which is synchronous and reserves fixed slots.
2. CVSD is 64 kbit/s at 8 kHz; mSBC is a constrained SBC configuration at 16 kHz over eSCO, defined in HFP 1.6 in 2009.
3. There is genuine expert disagreement about whether LDAC and aptX HD are audibly better than well-implemented AAC. Blind listening tests generally fail to separate them at 256 kbit/s and above.
4. Treat “hi-res Bluetooth” as a marketing claim, and codec efficiency at low bitrate as the engineering fact.
5. LE Audio components: the LC3 codec, isochronous channels (CIS for connected, BIS for broadcast), the Basic Audio Profile, and the Public Broadcast Profile for Auracast.
6. Inspect on Linux with pactl list sinks or bluetoothctl plus PipeWire or BlueZ logs, which name the negotiated codec. On Android, Developer options shows the Bluetooth audio codec, sample rate and bit depth.

WORDS31.12.6 remember these#

1. HFP — the profile for calls — hands-free profile over a synchronous SCO or eSCO link, historically CVSD then mSBC.
2. LC3 — the modern codec of LE Audio — low complexity communication codec, better quality per bit than SBC.
3. LE Audio — the redesign that fixes call quality — Bluetooth 5.2 isochronous channels with LC3 in both directions.
4. Auracast — broadcasting audio to many listeners — LE Audio broadcast isochronous streams, branded by the SIG in 2022.

31.13 Cellular#

PLAIN31.13.1 in simple words#

1. WiFi covers a room. Cellular covers a country with the same amount of spectrum, by reusing it over and over.
2. The trick is the cell. Divide the land into patches and give each patch a low-power transmitter that covers only that patch.
3. Two patches far enough apart can use the same frequency without hearing each other. That is frequency reuse, and it is the whole idea.
4. As you move you leave one cell and enter another, and the network moves your call across without dropping it. That is handover.
5. Unlike WiFi, cellular spectrum is licensed and expensive, so the operator controls exactly who transmits and when. There is no random backoff.

PLAIN31.13.2 a picture in your head#

1. Imagine a country covered in hexagonal tiles, like a bathroom floor.
2. Seven colours are enough that no two touching tiles share a colour. Each colour is a set of frequencies.

Where this comparison breaks: real cells are not hexagons and not equal. Coverage is a messy blob shaped by hills and buildings, cells overlap heavily, and modern networks reuse every frequency in every cell, relying on coding and interference coordination instead of colour separation.

PLAIN31.13.3 a worked example#

1. GSM, the dominant 2G system, was agreed by 15 representatives from 13 European countries in Copenhagen in 1987 and launched commercially in Finland in December 1991, with the first call on 1 July 1991.
2. GSM voice used a 13 kbit/s full-rate codec and 9.6 kbit/s circuit-switched data. GPRS services launched in 2000 and EDGE first ran in 2003.
3. 5G frequency ranges: FR1 is everything below 7.125 GHz with channels up to 100 MHz; FR2 is 24.25 to 71 GHz with channels up to 400 MHz.

PLAIN31.13.4 what is really happening inside#

1. The SIM card is a small computer, not a memory card. It runs a program and holds a secret it will never reveal.
2. It holds the ICCID, the card’s serial number; the IMSI, which identifies the subscriber; and Ki, a 128-bit secret key.
3. The IMEI is different and lives in the phone, not the SIM. It identifies the handset, and is what a stolen-phone blocklist uses.
4. Authentication never sends the key. The network sends a random challenge, the SIM computes a response using Ki, and returns it. The network computes the same response independently, and if they match you are in.
5. In 2G this was one-way: the phone proved itself to the network but not the reverse, which is why fake base stations, IMSI catchers, worked. 3G onwards added mutual authentication.
6. Roaming works because your home network holds Ki and the visited network does not. The visited network asks your home network for challenge and response pairs, and uses them without learning the key.

What happens when a phone attaches
1. Power on. Radio scans bands for the strongest cell.
2. It reads broadcast information: operator, cell ID,
   tracking area, and how to send a request.
3. It sends a random-access preamble on a shared channel.
4. The network grants a small uplink allocation.
5. The phone sends an attach request with an identity,
   ideally a temporary one, not the IMSI.
6. Authentication challenge and response, both directions.
7. Ciphering and integrity protection are switched on.
8. The core network sets up a default data bearer.
9. An IP address is assigned, usually behind carrier NAT.
10. Data flows. The phone is paged in its tracking area.

7. Now tie this back to the reader’s home broadband from Chapter 29. On home broadband your router gets an address and your packets go straight into the ISP’s network.
8. On mobile, packets are first carried inside a tunnel from the tower all the way to a gateway deep in the operator’s core, and only there do they enter the internet.
9. It is also why the reader’s own session showed github.com loading instantly on mobile data while timing out on home broadband: the two paths into the internet were entirely different networks with different routing.

TECHNICAL31.13.5 the engineer’s version#

1. GSM was specified by ETSI, then everything from 3G onward by 3GPP, which publishes numbered Releases.
2. LTE is Release 8 of 2008; 5G New Radio is Release 15 of 2018, with Release 16 in 2020 adding ultra-reliable low latency and Release 17 in 2022 adding reduced-capability devices.
3. IMSI is 15 digits: a 3-digit mobile country code, a 2 or 3 digit network code, and the subscriber number. India’s country codes are 404 and 405. IMEI is 15 digits with a Luhn check digit.
4. Authentication algorithms: 2G used COMP128 variants with A5/1 or the deliberately weakened A5/2 for ciphering, both broken. 3G, 4G and 5G use MILENAGE or TUAK with AES, giving mutual authentication.
5. 5G added SUCI, the subscription concealed identifier, which encrypts the subscriber identity with the operator’s public key, closing the IMSI-catcher hole that persisted through 4G.
6. Network slicing is a Release 15 feature: several logical networks with separate quality guarantees run over one physical network, identified by an S-NSSAI.
7. Slicing is deployed commercially, but its widely promoted use cases remain partly a marketing claim rather than a mass reality as of 2026.

WORDS31.13.6 remember these#

1. SIM — the small computer holding your identity — a UICC storing IMSI and Ki and computing authentication responses.
2. IMSI — who the subscriber is — 15-digit identity, concealed as SUCI in 5G.
3. IMEI — which handset it is — 15-digit equipment identity with a Luhn check.
4. VoLTE — voice carried as data — SIP over IMS on a dedicated LTE bearer.
5. Network slicing — several virtual networks on one physical one — 3GPP Release 15 S-NSSAI-identified logical networks.

31.14 GPS and positioning#

PLAIN31.14.1 in simple words#

1. GPS satellites do not know where you are and never hear from you. They only broadcast. Your receiver does all the work.
2. Each satellite broadcasts the same thing over and over: “I am satellite number seven, here is exactly where I am, and the time is now”.
3. Several arrive at slightly different times, because each travelled a different distance. From the delay, the receiver works out each distance.
4. Distance to one satellite puts you somewhere on a sphere around it. Two narrow it to a circle. Three narrow it to two points, one of them absurd, out in space.
5. So three would be enough if your clock were perfect. It is not.
6. Your phone’s clock is out by thousandths of a second, and light travels 300 kilometres in a thousandth of a second. That error is enormous.
7. So the receiver treats its own clock error as a fourth unknown and solves for it. Four unknowns need four measurements, so you need four satellites.

PLAIN31.14.2 a picture in your head#

1. Imagine standing in fog with four lighthouses, each sounding a horn at exactly noon.
2. You hear them at slightly different moments, and since sound takes time, the delay tells you the distance to each. If your watch is right, three horns fix your position.
3. If your watch is wrong by a fixed amount, all four distances are wrong by the same amount. That common error is a fingerprint you can solve for.
4. You find the one position and one clock correction that make all four distances consistent. That is trilateration with a clock unknown.

Where this comparison breaks: sound is slow and the satellites move at about 3.9 km per second, so the receiver must also account for satellite motion, the rotation of the Earth during the signal’s travel time, and the slowing of radio by the ionosphere.

PLAIN31.14.3 a worked example#

1. Relativity: the satellite clock runs slow by about 7 microseconds a day due to its speed, and fast by about 45 microseconds a day due to weaker gravity. Net, it runs about 38 microseconds per day fast.
2. Uncorrected, that is 38 microseconds times 300 metres per microsecond, about 11 kilometres of drift per day. GPS is engineering that depends on general relativity to work at all.

PLAIN31.14.4 what is really happening inside#

1. The GPS signal arrives weaker than the background noise, around -130 dBm against a noise floor near -111 dBm in the same bandwidth. You cannot see it on a spectrum analyser.
2. It is recovered by correlation. Each satellite modulates its signal with a unique 1023-chip code that repeats every millisecond.
3. The receiver generates the same code locally and slides it against the received noise, looking for the offset where the two line up.
4. When they line up, the wanted signal adds coherently over 1023 chips and the noise does not, giving roughly 30 dB of processing gain and lifting the signal above the noise.
5. Once locked, the receiver reads the navigation message at 50 bits per second. A full frame takes 30 seconds; the complete almanac takes 12.5 minutes.
6. That is the real reason a cold start can take 15 minutes. It is waiting to download data at 50 bits per second, not struggling to hear.
7. Assisted GPS delivers that same data over the mobile network in milliseconds, plus a rough position and time, so the search space shrinks.
8. A phone rarely uses GPS alone. It fuses satellites, WiFi access point locations from a crowdsourced database, cell tower positions, the accelerometer and gyroscope for dead reckoning, and the barometer for floor level.
9. Indoors the WiFi database usually dominates, which is why a phone knows which shop you are in with no satellite in sight.

TECHNICAL31.14.5 the engineer’s version#

1. The first GPS prototype launched in 1978. The full 24-satellite constellation became operational in 1993, and Full Operational Capability was declared in April 1995.
2. Selective Availability, the deliberate degradation of civil accuracy to about 100 metres, was switched off on 1 May 2000, immediately improving civilian accuracy to roughly 10 metres.

3. NavIC, run by ISRO and formerly called IRNSS, covers India and about 1,500 km beyond, uses L5 and S-band, and is mandated for some vehicle tracking and emergency use in India.

WORDS31.14.6 remember these#

1. Trilateration — finding a position from distances — solving for x, y, z from ranges to several known points.
2. Assisted GPS — getting satellite data over the network — A-GPS delivering ephemeris, time and rough position.
3. Processing gain — how a signal below the noise is recovered — about 30 dB from correlating against the 1023-chip C/A code.
4. GNSS — the general name for all such systems — GPS, GLONASS, Galileo, BeiDou and regional NavIC.

31.15 The other short-range radios#

PLAIN31.15.1 in simple words#

1. WiFi and Bluetooth are not the only radios in your life. Several others sit in niches where those two are wrong.
2. NFC works over four centimetres and can power the other device: a card with no battery works because the reader’s field energizes it.
3. RFID is the same family, used for shop tags, warehouse pallets and animal microchips.
4. Zigbee, Z-Wave and Thread are for home sensors: tiny messages, years of battery, and a mesh so distant devices relay for each other.
5. Matter is not a radio at all. It is a common language spoken over Thread, WiFi and Ethernet so devices from different makers work together.
6. LoRa trades speed for distance: a few hundred bits per second, but kilometres of range through buildings.
7. UWB measures distance very precisely by timing a very short pulse, to within about ten centimetres.

PLAIN31.15.2 a picture in your head#

1. Think of a toolbox. WiFi is the power drill: fast, hungry, plugged in. Bluetooth is the screwdriver: handy, personal, battery powered.
2. NFC is the key you touch to a lock: no power of its own, works only when almost touching.
3. LoRa is a foghorn: barely any information, but heard for miles. UWB is a tape measure.

Where this comparison breaks: tools do not interfere with each other. Zigbee, Thread, WiFi and Bluetooth all share 2.4 GHz and do interfere, which is why Zigbee channels are chosen to sit in the gaps between WiFi channels 1, 6 and 11, and why a busy WiFi network can make smart bulbs unreliable.

PLAIN31.15.3 a worked example#

1. NFC data rates are 106, 212 or 424 kbit/s under ISO/IEC 18092.

PLAIN31.15.4 what is really happening inside#

1. NFC is not radiation. It is transformer action across a gap.
2. The reader drives a coil at 13.56 MHz, creating a strong alternating magnetic field in the near field, within a few centimetres.
3. A tag’s coil sits in that field, and the changing field induces a current that powers the tag’s tiny chip.
4. The tag replies not by transmitting but by changing how much energy it absorbs, which the reader detects as a change in its own coil’s load. That is load modulation.
5. That is why an NFC card works with no battery, and why the range is physically limited: near-field magnetic strength falls off as the cube of distance, not the square.
6. Zigbee and Thread both run on the IEEE 802.15.4 radio, a standard from 2003 defining 250 kbit/s at 2.4 GHz using offset QPSK.
7. Zigbee, from the Zigbee Alliance formed in 2002 with its first specification in 2004, defines its own application layer above that radio.
8. Thread, launched by the Thread Group in July 2014, keeps 802.15.4 but runs IPv6 over it using 6LoWPAN header compression, so every device is a real IP host with no translating gateway.
9. Matter, from the Connectivity Standards Alliance, released version 1.0 on 4 October 2022. It began in December 2019 as Project Connected Home over IP, founded by Amazon, Apple and the Zigbee Alliance.
10. LoRa uses chirp spread spectrum: each symbol is a sweep across the band rather than a fixed tone, and a sweep is easy to detect far below the noise floor.
11. The spreading factor, 5 to 12, sets how long each chirp lasts, trading range against data rate.
12. UWB sends pulses under two nanoseconds long, spread over at least 500 MHz. Because the pulse is so short, its arrival time can be measured very precisely, which is what gives centimetre ranging.

TECHNICAL31.15.5 the engineer’s version#

1. NFC standards: ISO/IEC 18092 and ECMA-340 define NFCIP-1, ISO/IEC 14443 covers proximity cards, and ISO/IEC 15693 covers vicinity cards at about one metre. The NFC Forum was founded on 18 March 2004 by Nokia, Philips and Sony.
2. RFID spans several bands: 125 to 134 kHz for animal tags, 13.56 MHz for smart cards, and 860 to 960 MHz for retail and logistics, where passive tags read at up to about 10 metres by backscatter.
3. Z-Wave was created by Zensys in Denmark around 1999, acquired by Sigma Designs and then by Silicon Labs in 2018.
4. Its band is region-specific: 908.42 MHz in the United States, 868.42 MHz in Europe, 865.2 MHz in India. Being sub-gigahertz, it avoids 2.4 GHz congestion entirely.
5. UWB was authorized for unlicensed use by the FCC in February 2002 from 3.1 to 10.6 GHz, with a power spectral density limit of -41.3 dBm/MHz.
6. The standards are IEEE 802.15.4a and the newer 802.15.4z, which added secure ranging with scrambled timestamp sequences.
7. UWB ranging uses two-way time of flight, so a clock offset between the two devices cancels. Ten centimetre accuracy is routine.
8. Car makers use UWB for digital keys under the Car Connectivity Consortium Digital Key 3.0 specification, because ranging defeats the relay attacks that break Bluetooth and radio key fobs.
9. LPWAN alternatives to LoRa: NB-IoT and LTE-M are 3GPP standards from Release 13 in 2016, running in licensed cellular spectrum, with NB-IoT using a 180 kHz carrier.
10. Sigfox was a proprietary ultra-narrowband system from a French company founded in 2010; it entered receivership in 2022, which is a useful caution about proprietary networks.

WORDS31.15.6 remember these#

1. NFC — a tap-range link that powers the other device — 13.56 MHz inductive coupling with load modulation, ISO/IEC 18092.
2. RFID — tagging things with a chip and no battery — passive backscatter tags at 125 kHz, 13.56 MHz or 860-960 MHz.
3. Zigbee — a mesh for home sensors with its own application layer — IEEE 802.15.4 radio plus the Zigbee stack, from 2004.
4. Thread — an IPv6 mesh for home sensors — IEEE 802.15.4 plus 6LoWPAN, from the Thread Group in 2014.
5. Matter — one language so smart devices interoperate — a CSA application layer over IP, version 1.0 released October 2022.
6. LoRa — very long range at very low data rates — chirp spread spectrum with spreading factors 5 to 12.
7. UWB — measuring distance to a few centimetres — sub-nanosecond pulses over 500 MHz or more, IEEE 802.15.4z two-way ranging.

31.98 Common wrong ideas#

1. Wrong: WiFi and the internet are the same thing. Right: WiFi is only the last few metres of radio. A working WiFi link with a broken uplink gives full signal bars and no internet at all.
2. Wrong: more bars means faster. Right: bars show received signal strength, only one input. A strong signal on a congested channel is slower than a weaker signal on a clear one.
3. Wrong: the advertised router speed is what you get. Right: an “AX5400” figure adds every band and stream together. Real single-client throughput is typically 40 to 60 percent of one band’s headline number.
4. Wrong: 5 GHz is always better than 2.4 GHz. Right: 5 GHz carries more data but loses about 6.5 dB more over distance and roughly twice as much through each wall. Through two brick walls, 2.4 GHz usually wins.
5. Wrong: your WiFi password is sent to the router. Right: it never leaves your device. Both sides derive the same key from it, and only random numbers and proofs cross the air.
6. Wrong: Bluetooth and Bluetooth Low Energy are versions of one protocol. Right: they share a brand, a band and a chip, and are otherwise different protocols with different radios, packet formats and stacks.
7. Wrong: Hedy Lamarr invented WiFi. Right: she and George Antheil patented frequency hopping in 1942, an idea Bluetooth uses and WiFi mostly does not.
8. Wrong: GPS satellites track your phone. Right: satellites only broadcast, and a GPS receiver transmits nothing. Anything tracking you does so through the mobile or WiFi network, not through GPS.

31.99 Chapter summary in 20 lines#

1. A radio wave is made when alternating current in a conductor sheds a self-sustaining pair of electric and magnetic fields into space.
2. Wavelength is the speed of light divided by frequency: 12.3 cm at 2.4 GHz and 5.8 cm at 5 GHz, which is why antennas are the sizes they are.
3. Radio is light at a frequency you cannot see, and its photons are far too weak to break chemical bonds.
4. Information rides on a wave by changing amplitude, frequency or phase, and modern systems change all of them at once as QAM.
5. More bits per symbol needs a cleaner signal: 1024-QAM needs about 35 dB signal-to-noise ratio where BPSK needs 2 dB.
6. Spread spectrum trades bandwidth for robustness, by hopping in Bluetooth or by spreading with a code in 802.11b and GPS.
7. OFDM sends many slow narrow subcarriers instead of one fast wide one, and its guard interval swallows echoes. It underlies WiFi, LTE and 5G.
8. Signal is measured in dBm against a noise floor near -96 dBm in a 20 MHz channel, and the gap between them decides your data rate.
9. WiFi exists because the FCC opened the ISM bands to unlicensed spread spectrum in 1985, and because ALOHAnet in 1971 had shown how to share a channel by random access.
10. The standards run from 802.11-1997 at 2 Mbit/s to 802.11be in 2024, with Wi-Fi 8 as 802.11bn expected around 2028 aiming at reliability, not speed.
11. CSIRO’s US patent 5,487,069 of 1996 covers a real technique WiFi uses and earned about 430 million dollars, but WiFi has no single inventor.
12. On the air, devices listen, wait a random backoff, transmit and wait for an acknowledgement, because a transmitter cannot hear a collision.
13. Overheads mean real throughput is roughly half the advertised rate; aggregation, OFDMA and MU-MIMO exist to claw that back.
14. WEP failed because a 24-bit initialization vector repeats within minutes, WPA2 fixed it with AES-CCMP, KRACK broke the handshake’s assumptions in 2017, and WPA3 with SAE removed offline password guessing.
15. In software, firmware, driver, cfg80211 and mac80211, a supplicant and a network manager cooperate, and your password becomes a key locally.
16. Bluetooth began at Ericsson in 1994 with Jaap Haartsen, was published by a five-company SIG in 1998, and hops 1600 times a second across 79 channels.
17. Bluetooth Low Energy is a separate protocol using advertising, connections and a small named database called GATT, designed for coin cells.
18. Cellular reuses the same spectrum in every cell, keeps tight central control, and authenticates with a secret the SIM never reveals.
19. GPS needs four satellites because the receiver’s clock is a fourth unknown, and it depends on a relativistic correction of 38 microseconds per day.
20. NFC, RFID, Zigbee, Thread, Matter, LoRa and UWB each exist because WiFi and Bluetooth are the wrong tool for some job.