2.2 RF Signal Measurements, Noise Floor & Link Quality Metrics

2.2 RF Signal Measurements, Noise Floor & Link Quality Metrics

Delivering predictable, enterprise-grade wireless performance requires continuous telemetry, rigorous RF link measurement, and automated interference management. Cisco wireless network engineers must translate raw RF metrics—such as Transmit Power, Receiver Sensitivity, Noise Floor, and Signal-to-Noise Ratio (SNR)—into actionable design decisions. Furthermore, maintaining network integrity requires mastering the architectural differences between Wi-Fi contention interference, spectral overlap, non-Wi-Fi industrial emissions, and malicious rogue access points operating on the corporate floor.

---

1. Enterprise RF Telemetry & Signal Measurement Metrics

Radio frequency measurements quantify power, loss, and signal quality across the physical layer. Understanding the distinctions between transmitter metrics and receiver metrics is essential for troubleshooting client performance.

  [ AP Transmitter ]                                              [ Client Receiver ]
  Tx Power: +20 dBm (100 mW)                                      Rx Power: -65 dBm
  Antenna Gain: +5 dBi                                            Noise Floor: -92 dBm
         |                                                               |
         v                                                               v
    [ EIRP: +25 dBm ] ---> [ Free Space Path Loss & Attenuation ] ---> [ SNR = 27 dB ]

Transmit Power ($P_t$)

Transmit power is the physical RF energy generated by the radio's internal power amplifier, expressed in either absolute milliwatts (mW) or decibel-milliwatts (dBm):

$\text{Power (dBm)} = 10\log_{10}\left(\frac{P_{\text{mW}}}{1 \text{ mW}}\right)$ $\text{Power (mW)} = 10^{\left(\frac{P_{\text{dBm}}}{10}\right)}$

• $100 \text{ mW} = +20 \text{ dBm}$
• $50 \text{ mW} = +17 \text{ dBm}$
• $25 \text{ mW} = +14 \text{ dBm}$
• $1 \text{ mW} = 0 \text{ dBm}$

In Cisco Catalyst 9800 Series Wireless LAN Controllers, Transmit Power Control (TPC) assigns numerical power levels (e.g., Level 1 through Level 8) based on regulatory domains and AP models. For example, on a Catalyst 9130AX Series AP, Power Level 1 represents maximum power (typically $20 - 23 \text{ dBm}$ depending on the band and channel), with each subsequent level reducing power by $3 \text{ dB}$ (halving the wattage).

Receiver Sensitivity ($P_{\text{rx,min}}$)

Receiver sensitivity represents the minimum received signal power threshold required by a radio's demodulator to decode an incoming frame with a Packet Error Rate (PER) below $10%$ (the IEEE 802.11 benchmark).

Receiver sensitivity is not static; it scales directly with the complexity of the Modulation and Coding Scheme (MCS):

• Robust Low-Order Modulation (BPSK, MCS 0): Highly tolerant of noise and distortion; requires a minimal sensitivity threshold of approximately $-92 \text{ dBm}$ to $-89 \text{ dBm}$.
• Moderate Modulation (64-QAM, MCS 7): Requires approximately $-75 \text{ dBm}$ to $-72 \text{ dBm}$.
• High-Order Modulation (256-QAM, MCS 9 / Wi-Fi 5 & 6): Requires approximately $-68 \text{ dBm}$ to $-65 \text{ dBm}$.
• Ultra-Dense Modulation (1024-QAM, MCS 11 / Wi-Fi 6): Demands an exceptionally pristine signal with a sensitivity threshold of $-62 \text{ dBm}$ to $-59 \text{ dBm}$.
• Extreme Modulation (4096-QAM, MCS 13 / Wi-Fi 7): Demands sensitivity thresholds above $-56 \text{ dBm}$ to $-53 \text{ dBm}$.

When a client wanders toward the cell edge and its received signal falls below the sensitivity threshold for high-order QAM, the rate adaptation algorithm steps down to simpler MCS rates, reducing data throughput.

RSSI vs. Received Power in dBm

A common point of confusion in enterprise Wi-Fi is the difference between RSSI and dBm:

1. Received Signal Strength Indicator (RSSI): IEEE 802.11 defines RSSI as a relative indication whose absolute scale and accuracy are implementation-specific. A chipset may maintain a proprietary internal index, while a controller, driver, or operating system may present an estimated received power in dBm. Do not assume that identically labeled values from different devices were measured or normalized the same way.
2. Received Power in dBm: dBm is an absolute logarithmic power unit. Enterprise tools commonly express coverage targets in dBm because that representation is comparable in principle, but reported values still inherit the measuring device’s calibration and sampling behavior. Record the device, band, channel width, and measurement point when comparing surveys or telemetry.

---

2. The Thermal Noise Floor & The Physics of kTB

The noise floor is the baseline level of background RF energy present across a given frequency channel. It consists of ambient cosmic radiation, thermal agitation of electrons in receiver circuitry, and distant unresolvable electrical emissions.

Thermal Noise Calculation ($kTB$)

The theoretical minimum noise floor is dictated by thermodynamics and Johnson-Nyquist thermal noise:

$P_N = k \cdot T \cdot B$

Where:

• $k = 1.380649 \times 10^{-23} \text{ J/K}$ (Boltzmann's constant)
• $T = 290 \text{ K}$ (standard engineering reference temperature, approx. $17^\circ\text{C} / 62^\circ\text{F}$)
• $B$ = Channel bandwidth in Hertz (Hz)

Expressed on a per-Hertz basis in logarithmic decibels:

$10\log_{10}(k \cdot T) \approx -173.98 \text{ dBm/Hz} \approx -174 \text{ dBm/Hz}$

To calculate the theoretical thermal noise floor across standard Wi-Fi channel bandwidths, add $10\log_{10}(B)$ to $-174 \text{ dBm/Hz}$:

• 20 MHz Channel: $-174 \text{ dBm} + 10\log_{10}(20 \times 10^6) = -174 + 73.01 \approx -101 \text{ dBm}$
• 40 MHz Channel: $-174 \text{ dBm} + 10\log_{10}(40 \times 10^6) = -174 + 76.02 \approx -98 \text{ dBm}$
• 80 MHz Channel: $-174 \text{ dBm} + 10\log_{10}(80 \times 10^6) = -174 + 79.03 \approx -95 \text{ dBm}$
• 160 MHz Channel: $-174 \text{ dBm} + 10\log_{10}(160 \times 10^6) = -174 + 82.04 \approx -92 \text{ dBm}$
• 320 MHz Channel (Wi-Fi 7): $-174 \text{ dBm} + 10\log_{10}(320 \times 10^6) = -174 + 85.05 \approx -89 \text{ dBm}$

The Hardware Noise Figure (NF) and Enterprise Reality

Real-world access points and client radios are not mathematically perfect; their internal low-noise amplifiers (LNAs), mixers, and analog filters contribute internal thermal noise. This addition is quantified as the Noise Figure (NF), typically $4 \text{ to } 6 \text{ dB}$ in enterprise hardware.

Adding a $5 \text{ dB}$ Noise Figure to the theoretical $-101 \text{ dBm}$ thermal floor yields a practical baseline noise floor of $-96 \text{ dBm}$ for a clean $20 \text{ MHz}$ channel. In operational enterprise environments with ambient industrial emissions and dense digital equipment, typical noise floors range between $-90 \text{ dBm}$ and $-95 \text{ dBm}$.

Critical Engineering Trade-off: Every time channel bandwidth is doubled (e.g., from $20 \text{ MHz}$ to $40 \text{ MHz}$, or $40 \text{ MHz}$ to $80 \text{ MHz}$), the integrated thermal noise increases by $3 \text{ dB}$. On an $80 \text{ MHz}$ channel, the noise floor is $6 \text{ dB}$ higher than on a $20 \text{ MHz}$ channel. Consequently, a client on an $80 \text{ MHz}$ channel requires a $6 \text{ dB}$ stronger received signal simply to achieve the same SNR and MCS rate as a client on a $20 \text{ MHz}$ channel.

---

3. Link Quality Metrics: SNR, SINR, and Error Vector Magnitude (EVM)

RF engineers evaluate link quality using three interconnected metrics: Signal-to-Noise Ratio (SNR), Signal-to-Interference-plus-Noise Ratio (SINR), and Error Vector Magnitude (EVM).

Signal-to-Noise Ratio (SNR)

Signal-to-Noise Ratio (SNR) represents the delta between the desired received Wi-Fi signal power and the background noise floor. Because both quantities are expressed logarithmically in dBm, SNR is calculated via subtraction and expressed in decibels (dB):

$\text{SNR (dB)} = P_{\text{Signal (dBm)}} - P_{\text{Noise (dBm)}}$

For example, if an access point measures a client signal at $-65 \text{ dBm}$ in an environment with a noise floor of $-92 \text{ dBm}$:

$\text{SNR} = -65 \text{ dBm} - (-92 \text{ dBm}) = +27 \text{ dB}$

Enterprise Design Targets Across Applications

Enterprise design guides publish signal, SNR, overlap, and application-performance targets. Treat them as validated design objectives for the chosen clients and application—not as protocol-mandated universal cutoffs:

Signal-to-Interference-plus-Noise Ratio (SINR)

While SNR considers only thermal noise, real-world enterprise deployments are typically interference-limited rather than noise-limited. The Signal-to-Interference-plus-Noise Ratio (SINR) accounts for both background noise and co-channel interference power ($P_I$):

$\text{SINR} = \frac{P_{\text{Signal}}}{P_{\text{Interference}} + P_{\text{Noise}}}$

$\text{SINR (dB)} = 10\log_{10}\left(\frac{P_{\text{Signal (mW)}}}{P_{\text{Interference (mW)}} + P_{\text{Noise (mW)}}}\right)$

In a dense corporate campus, if an access point measures a client signal at $-65 \text{ dBm}$ ($3.16 \times 10^{-7} \text{ mW}$), a background noise floor of $-95 \text{ dBm}$ ($3.16 \times 10^{-10} \text{ mW}$), and overlapping BSS (OBSS) co-channel interference at $-70 \text{ dBm}$ ($1.00 \times 10^{-7} \text{ mW}$):

• The co-channel interference power is over $316 \text{ times stronger}$ than the thermal noise floor.
• The effective SINR is: $\text{SINR (dB)} = 10\log_{10}\left(\frac{3.16 \times 10^{-7}}{1.00 \times 10^{-7} + 0.00316 \times 10^{-7}}\right) \approx 10\log_{10}(3.15) \approx 5.0 \text{ dB}$
• Even though the nominal SNR appears excellent ($-65 - (-95) = 30 \text{ dB}$), the true link quality (SINR) collapses to only $5 \text{ dB}$, forcing the client down to basic BPSK modulation (MCS 0) and inducing severe latency.

Error Vector Magnitude (EVM)

While SNR and SINR quantify power ratios, Error Vector Magnitude (EVM) evaluates the actual fidelity and linearity of the demodulated constellation points. EVM measures the vector difference in the complex I/Q plane between the ideal constellation symbol position and the actual measured symbol position:

               Q (Quadrature)
                     |         Actual Received Symbol Point (Z)
                     |          * - - - - +
                     |         /          |
                     |        /           |  Error Vector (e)
                     |       /            |
                     |      /             |
                     |     * Ideal Symbol Point (S)
                     |    /
                     +---/------------------ I (In-Phase)
                        /

EVM is expressed as a percentage of peak signal amplitude or in decibels:

$\text{EVM (dB)} = 20\log_{10}\left(\frac{E_{\text{RMS}}}{S_{\text{max}}}\right)$

As modulation schemes increase in density, the decision boundaries between adjacent constellation points become microscopic. Consequently, the IEEE 802.11 standards mandate strict minimum EVM thresholds for transmitter linearity:

Hardware impairments—such as power amplifier non-linear compression (requiring power amplifier backoff), local oscillator phase noise, carrier frequency offset (CFO), and I/Q amplitude/phase imbalance—directly degrade EVM. If an access point or client operates with an EVM of $-28 \text{ dB}$, it can never sustain 1024-QAM or 256-QAM, even if the measured RSSI is $-50 \text{ dBm}$ and SNR is $45 \text{ dB}$.

---

4. Wi-Fi Interference Taxonomy: CCI vs. ACI vs. Non-802.11 Sources

Interference is anything that degrades the desired RF signal, increases the effective noise floor, or consumes channel airtime. In enterprise networks, interference falls into three distinct classifications: Co-Channel Interference (CCI), Adjacent Channel Interference (ACI), and Non-Wi-Fi Interference.

                                  [ RF Interference Taxonomy ]
                                                |
       +----------------------------------------+----------------------------------------+
       |                                        |                                        |
 [ Co-Channel (CCI / OBSS) ]             [ Adjacent Channel (ACI) ]            [ Non-802.11 Interference ]
  Same channel medium sharing             Sideband spectral regrowth             Uncoordinated raw RF energy
  CSMA/CA contention & NAV delay          Physical frame bit corruption          Microwaves, BLE, Radar, Cams
  No packet collisions (MAC backoff)      Near-Far front-end saturation          Continuous duty cycle jamming

Co-Channel Interference (CCI / OBSS)

Co-Channel Interference—more accurately termed Co-Channel Contention or Overlapping Basic Service Set (OBSS) interference—occurs when multiple access points or clients operate on the exact same frequency channel within hearing range of one another.

Because Wi-Fi is a half-duplex shared medium governed by Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA), radios perform Clear Channel Assessment (CCA) prior to transmitting:

1. Preamble Detect (Signal Detect): If a radio detects a valid 802.11 preamble from any AP or client on its operating channel at a level above $-82 \text{ dBm}$, it decodes the frame's Layer 2 Duration/ID field and updates its Network Allocation Vector (NAV).
2. Virtual Carrier Sense: The radio sets its internal NAV timer and defers transmission, remaining silent until the channel is clear.
3. Energy Detect: If the radio senses raw unmodulated RF energy above $-62 \text{ dBm}$ ($20 \text{ dB}$ higher than preamble detect), it also defers.

The Critical CCI Insight: Co-channel devices that can decode one another generally share airtime through CSMA/CA rather than behaving like uncoordinated adjacent-channel energy. Collisions can still occur—for example with hidden nodes or simultaneous transmitters—so CCI is best analyzed through contention, retries, airtime, and topology rather than described as collision-free.

802.11ax/be Solution: Wi-Fi 6 introduced BSS Coloring (a 6-bit numerical tag from 1 to 63 in the PHY preamble) combined with Spatial Reuse (SR). BSS coloring enables an AP to identify co-channel frames from neighboring BSSs (inter-BSS) and apply an elevated OBSS Packet Detect (OBSS-PD) threshold (between $-82 \text{ dBm}$ and $-62 \text{ dBm}$), allowing simultaneous transmissions when path isolation is sufficient.

Adjacent Channel Interference (ACI)

Adjacent Channel Interference occurs when transmissions on one channel bleed spectral energy into an adjacent or partially overlapping frequency channel.

• Spectral Mask Regrowth: Radio power amplifiers are non-linear devices; they cannot cut off emitted energy sharply at the channel boundary. Transmit energy spills into neighboring sidebands as harmonic distortion.
• The 2.4 GHz Catastrophe: In North America, the 2.4 GHz band provides 11 channels spaced $5 \text{ MHz}$ apart, yet each channel occupies $20 - 22 \text{ MHz}$ of spectral mask bandwidth. Only channels 1, 6, and 11 are non-overlapping. Configuring an AP on Channel 1 and an adjacent AP on Channel 2 or 3 produces $15 \text{ MHz}$ of direct co-frequency overlap.
• The Near-Far Problem: ACI is severely exacerbated when a client transmitting on Channel 6 is physically close to an AP operating on Channel 1. The high-power adjacent transmission overwhelms the analog bandpass filters of the Channel 1 AP receiver, drowning out the weak incoming signal from a distant Channel 1 client.
• Impact: Unlike CCI, ACI is not recognized by CSMA/CA as a valid Wi-Fi transmission. It acts as raw physical noise, directly corrupting frame preambles and data payloads, triggering CRC errors, frame drops, and exponential MAC backoffs.

Non-802.11 Interference Sources

Non-Wi-Fi interferers emit uncoordinated RF energy without complying with 802.11 CSMA/CA protocol standards:

1. Microwave Ovens (2.4 GHz): Industrial and breakroom microwave ovens utilize high-power magnetrons operating around $2.45 \text{ GHz}$. They cycle at the $60 \text{ Hz}$ AC line frequency ($50%$ duty cycle: $8.33 \text{ ms}$ on, $8.33 \text{ ms}$ off), sweeping across a wide $15 - 20 \text{ MHz}$ band of spectrum and corrupting channels 6 through 11.
2. Bluetooth & BLE (2.4 GHz): Bluetooth utilizes Frequency-Hopping Spread Spectrum (FHSS), hopping across seventy-nine $1 \text{ MHz}$ channels at a rate of $1600 \text{ hops/second}$. While individual collision bursts are brief, high-density Bluetooth deployments raise the overall noise floor.
3. Continuous Wave (CW) Video Transmitters & Cordless Phones: Analog security cameras and older cordless phones transmit continuous, unmodulated or FM signals with a $100%$ duty cycle, completely blinding any Wi-Fi AP within range.
4. Radar in DFS Bands (5 GHz): Weather radar (Terminal Doppler Weather Radar - TDWR) and military tracking systems operate across UNII-2 (Channels 52-64) and UNII-2 Extended (Channels 100-144). 802.11h mandates Dynamic Frequency Selection (DFS). If an AP detects a radar pulse, it must execute a Channel Switch Announcement (CSA) and immediately vacate the channel within $200 \text{ ms}$, enforcing a 30-minute Non-Occupancy Period (NOP).

---

5. Cisco CleanAir Technology & Spectrum Intelligence

Standard Wi-Fi chipsets demodulate only valid 802.11 frames; they are completely blind to the underlying physical waveforms of non-Wi-Fi interferers. Cisco CleanAir technology addresses this limitation by integrating a dedicated, patented Spectrum ASIC directly into enterprise Catalyst access points.

           [ Dual-Band Wi-Fi Radio ]          [ Dedicated CleanAir Spectrum ASIC ]
            Serves Clients (802.11)             Direct FFT Physical Waveform Analysis
                       |                                          |
                       v                                          v
            [ 802.11 Data Frames ]                    [ Non-Wi-Fi Interferer Signatures ]
                       |                                          |
                       +-------------------+----------------------+
                                           |
                                           v
                          [ Cisco Catalyst 9800 WLC ]
                          - Air Quality Index (AQI)
                          - Duty Cycle & Severity
                          - Event-Driven RRM (ED-RRM)

The CleanAir Architecture

The CleanAir Spectrum ASIC performs high-resolution Fast Fourier Transform (FFT) sweeps across the entire frequency band up to hundreds of times per second. Crucially, the CleanAir ASIC operates independently of the client-serving Wi-Fi radios, ensuring zero degradation to client throughput.

Air Quality Index (AQI)

CleanAir computes an Air Quality Index (AQI) for every monitored channel, reporting a scalar value from 100 down to 0:

• AQI = 100: Pristine spectrum with zero non-Wi-Fi interference.
• AQI < 50: Severely degraded spectrum; client associations drop, and throughput collapses.
• AQI Calculation: The index evaluates the percentage of channel airtime occupied (Duty Cycle), the power level of the interferer, and the number of active interfering devices.

Interferer Classification & Signatures

The CleanAir engine compares intercepted RF waveforms against an on-chip library of mathematical signatures, instantly classifying devices by type, including:

• Microwave Ovens
• Bluetooth Devices
• 2.4 GHz / 5 GHz Cordless Phones
• Analog Continuous Video Transmitters
• Wi-Fi Inverters and RF Jamming Devices
• Motion Sensors and Wireless Bridges

For every detected interferer, CleanAir reports the Interferer Type, Center Frequency, Affected Channels, Signal Strength (RSSI), Duty Cycle (%), and a composite Severity Score (0 - 100).

Event-Driven Radio Resource Management (ED-RRM)

Standard Cisco Dynamic Channel Assignment (DCA) runs on a periodic schedule (typically evaluating channel quality every 10 minutes or 60 seconds). However, when a catastrophic, high-duty-cycle non-Wi-Fi interferer (such as a $100%$ duty cycle analog video transmitter) activates, waiting 10 minutes for DCA to run results in unacceptable network downtime.

Event-Driven RRM (ED-RRM), when explicitly enabled with CleanAir, acts as an immediate circuit-breaker:

1. The CleanAir ASIC detects that an acute non-Wi-Fi interferer has caused the channel AQI to drop below the configured threshold (default Medium sensitivity threshold: AQI 50).
2. ED-RRM triggers an emergency channel reassignment within 30 seconds.
3. The AP broadcasts an 802.11h Channel Switch Announcement (CSA) to connected clients and immediately migrates to a clean channel, bypassing the standard DCA calculation cycle.

---

6. Rogue Access Point Detection, Classification & Containment

An unauthorized access point connected to an enterprise network represents one of the most dangerous vulnerabilities in corporate infrastructure. Rogue APs bypass 802.1X enterprise authentication, firewalls, and network access control (NAC), exposing the internal broadcast domain to unauthorized external parties.

  [ Enterprise Wired LAN ] ====== [ Managed Switch ] ====== [ Corporate AP ] ~~~ (Authorized Clients)
                                         |
                                    (Wall Jack)
                                         |
                                  [ Rogue AP ] ~~~ (Unauthorized / Attacker Access)
                                  (BRIDGES WIRED LAN TO AIRSPACE!)

Cisco Rogue Taxonomy

Cisco Catalyst 9800 WLCs classify unmanaged wireless devices into distinct operational categories:

1. Friendly APs: Known, authorized access points operating nearby (e.g., neighbor APs belonging to another company in an adjacent suite, or known internal test lab APs) that have been explicitly acknowledged by the network administrator.
2. Malicious Rogue APs: Any unauthorized AP detected operating within RF proximity that has not been acknowledged as friendly.
3. Rogue Off-Line (Air-Only Rogue): An unauthorized AP detected broadcasting in the local airspace (such as an employee mobile hotspot) that has no physical connection to the corporate wired Ethernet network. While it consumes airtime and contributes to CCI, it does not provide a backdoor into internal network resources.
4. Rogue On-Wire (The Critical Threat): An unauthorized access point physically plugged into an internal enterprise switch port. It bridges the corporate Ethernet VLAN directly into the airspace, allowing any external client associating with the rogue AP to acquire a corporate IP address via DHCP and access sensitive internal file shares and servers.
5. Honeypot / Evil Twin: A malicious rogue AP configured to broadcast the exact same SSID name (such as "Corporate-WLAN") as the legitimate enterprise network. Its objective is to trick corporate devices into associating with the attacker's AP, allowing the attacker to harvest credentials, intercept sensitive data, or launch Man-in-the-Middle (MitM) attacks.

Rogue Location Discovery Protocol (RLDP)

To differentiate between a harmless neighbor AP and a catastrophic "Rogue On-Wire", Cisco controllers utilize Rogue Location Discovery Protocol (RLDP).

RLDP is an active diagnostic probing mechanism executed by an authorized AP operating in Local or Monitor mode:

[ Cisco WLC ] <=== (Wired Mgmt VLAN) === [ Corporate Switch ] <=== (Access Port) === [ Rogue AP ]
     ^                                                                                    ^
     | (Wired Test Packet Received!)                                                      | (Associates as Client)
     +------------------------------ [ Cisco AP (Monitor Mode) ] -------------------------+

1. When an AP discovers a rogue SSID, the WLC directs an AP to initiate RLDP.
2. The authorized AP temporarily connects to the rogue AP as a standard wireless client.
3. The AP requests an IP address from the rogue AP's DHCP server.
4. Once assigned an IP address, the AP transmits proprietary Cisco UDP test packets addressed to the controller's wired management IP address.
5. If the WLC receives these test packets on its wired distribution network, the rogue AP is definitively confirmed to be physically connected to the corporate LAN (Rogue On-Wire).

Containment Strategies & Legal Considerations

Once a rogue AP is classified, administrators can enforce containment:

• Over-the-Air 802.11 Deauthentication Containment: Authorized Cisco APs transmit spoofed 802.11 Deauthentication and Disassociation frames to the rogue BSSID and all associated client MAC addresses, preventing clients from sustaining a wireless connection.

  WARNING - Legal Compliance: Over-the-air deauthentication containment injects spoofed management frames into the shared public airspace. In many jurisdictions (including under United States FCC Part 15 and Title 47 regulations), jamming or intentionally disrupting non-owned wireless networks—even those operating on private corporate property—is illegal and subject to severe civil and criminal penalties (e.g., the FCC enforcement action against Marriott International). Over-the-air containment should never be used against neighboring corporate networks.

• Switch Port Containment (Physical Remediation): The legally compliant, industry-standard containment method. Using Cisco Catalyst Center (DNA Center) or Cisco Prime Infrastructure, the management system correlates the rogue AP's wired MAC address (learned via RLDP or switch ARP snooping) with switch CAM tables via CDP and LLDP. Once the exact switch and physical port are identified (e.g., Switch-Bldg4, GigabitEthernet1/0/18), the controller or administrator issues a programmatic shutdown command on the switch port, physically neutralizing the threat without touching the shared airspace.