9.2 Roaming, Power Save and Protection Mechanisms

Winning the channel (section 9.1) is only part of MAC behavior. Stations also move between APs, sleep to save battery, and protect older PHYs that cannot decode newer PPDUs. Objective 3.7 groups those operations. Fast Transition key hierarchy and 802.1X live in the security domain; here you need operational awareness — who decides to roam, how the AP holds frames for a sleeping STA, and why a 2.4 GHz mixed cell suddenly fills with CTS frames.

Roaming: the client decides

In baseline 802.11, the station chooses when to leave one BSS and join another. The AP does not “hand off” the client the way a cellular tower does in older mobile networks. The STA measures beacons and data, applies its vendor roam logic, authenticates and associates (or fast-transitions) to a new BSSID, and the DS then forwards traffic to the new AP.

That design has a famous failure mode: the sticky client. A laptop associated at −48 dBm in a conference room walks 30 meters down a corridor. A closer AP is at −55 dBm, but the original AP is still at −72 dBm and still ACKs slowly. Many consumer and even some enterprise drivers refuse to roam until RSSI, missed beacons, or retry rates cross an internal cliff. Users experience “Wi-Fi is slow in the hallway” while a survey shows excellent coverage from the next AP. Sticky behavior is a client policy problem first, an RF-design problem second.

What the STA actually measures

Typical roam triggers (vendor-specific numbers, same ideas):

• RSSI / RCPI falling through a threshold (for example −70 to −75 dBm for data, higher for voice).
• SNR collapsing even if RSSI looks acceptable (noise floor rose).
• Retry rate / missed beacons / beacon loss.
• Insufficient uplink — the AP still sounds loud, but the STA’s weaker transmitter no longer reaches it cleanly (asymmetric link).

The STA then needs candidates. Passive scanning waits for beacons; active scanning sends probe requests. Either costs airtime and battery, and a full scan of 2.4, 5, and 6 GHz is slow compared with a voice packet budget.

802.11k, 802.11v, and 802.11r at CWNA depth

These amendments do not replace the rule that the client decides. They feed the client better information or shorten the handshake.

On CWNA-109, recognize the three letters and the job of each. Do not invent a story that 802.11v lets the controller forcibly teleport a client without client support, or that 802.11r is only “faster DHCP.” FT is about authentication/association latency, not about IP addressing. Sticky clients with no k/v/r support still roam late; enabling the features on the AP does nothing unless the STA implements them.

In practice

Voice WLAN design therefore combines RF overlap (so a candidate exists before RSSI dies), client driver tests, and k/v/r on both infrastructure and handsets. A controller or cloud policy may recommend a BSSID via BTM; the MAC still belongs to the STA.

Power save and frame buffering

Radios burn energy in receive. 802.11 lets a STA turn the receiver off and tell the AP to buffer downlink frames until the STA wakes.

Legacy Power Save and PS-Poll

1. The STA sets the Power Management bit in Frame Control on a frame to the AP (often a null data frame).
2. The AP marks that AID as asleep and buffers unicast for it.
3. Every beacon carries a Traffic Indication Map (TIM). If the STA’s AID bit is set, unicast is waiting.
4. The STA wakes for a beacon (according to its listen interval), sees its TIM bit, and sends a PS-Poll control frame.
5. The AP sends one buffered frame. The More Data bit tells the STA whether to poll again.
6. When the queue is empty, the STA may go back to sleep.

Broadcast and multicast are different. Group frames are not retrieved with PS-Poll. The AP waits for a DTIM (Delivery Traffic Indication Map) beacon, then sends buffered broadcast/multicast. DTIM interval is every n beacons (often 1, 2, or 3). A STA that stays asleep through DTIM misses group traffic — a classic reason mDNS, some DHCP, and some app discovery break for sleeping phones when DTIM is raised to save battery.

U-APSD / WMM-PS

Unscheduled Automatic Power Save Delivery (U-APSD), the mechanism behind WMM Power Save, is built for QoS queues. The STA marks access categories as trigger-enabled and delivery-enabled. A QoS Data or QoS Null sent by the STA on a trigger-enabled AC is the trigger — no extra PS-Poll. The AP then sends buffered frames on delivery-enabled ACs during a short service period and sets EOSP (End of Service Period) when done. Voice handsets use this so a talk spurt both uploads audio and pulls the downlink jitter buffer in one wake.

TWT as an HE mention

Target Wake Time (TWT) appears with 802.11ax (High Efficiency). The AP and STA agree on future wake times so the STA is not required to catch every TIM. Individual TWT schedules one STA; broadcast TWT can wake a group. CWNA-109 expects you to recognize TWT as an HE scheduled power-save tool, not to configure every TWT element field. Deep OFDMA scheduling belongs with PHY chapters; here the operational point is: HE can schedule sleep, whereas legacy PS is beacon-and-poll based.

Power-save troubleshooting pattern: client sleeps, AP shows buffered frames, user says “packets never arrive.” Check DTIM for multicast, listen interval versus AP buffer limits, whether WMM-PS is on both sides, and whether a noisy TIM (AID always set) is keeping phones awake.

Protection mechanisms

Newer PHYs send PPDUs that older stations cannot demodulate. Those older stations also cannot load NAV from a Duration field they never decoded. They may see CCA energy, or they may not, especially at the edge of the cell. If they think the medium is idle, they transmit on top of the OFDM frame.

ERP protection in 2.4 GHz

802.11g (ERP-OFDM) sharing a BSS or overlapping a BSS with DSSS/CCK (original 802.11 and 802.11b) is the textbook case. The ERP Information element carries bits such as NonERP_Present and Use_Protection. When protection is on, OFDM senders reserve the medium with a frame the legacy stations can understand:

• RTS/CTS at a DSSS/CCK basic rate, then the OFDM data, or
• CTS-to-Self at a DSSS/CCK basic rate, then the OFDM data.

CTS-to-Self is cheaper (one control frame). RTS/CTS reaches hidden nodes on both sides of the link. Either way, Duration in the control frame sets NAV on 802.11b neighbors for the length of the OFDM burst they cannot decode.

HT/VHT mixed-mode protection later reused the same idea (a legacy-readable reservation before an HT/VHT PPDU). For Objective 3.7, lock in ERP + RTS/CTS or CTS-to-Self + mixing OFDM with DSSS/CCK in 2.4 GHz.

Protection is not free. Every CTS-to-Self burns airtime at 1 or 2 Mbps. A single lingering 802.11b client, or an overlapping b-only BSS, can cut 802.11g/n throughput far more than “one slow client uses a slow MCS.” The MAC is spending time on protection frames, not only on the slow client’s data.

On the exam

• Client roams; sticky client is late roam logic, not an AP bug by default.
• 802.11k = neighbor list; 802.11v = BTM request/suggest; 802.11r = faster BSS transition handshake (security details later).
• TIM = unicast buffered; DTIM = group traffic after that beacon; PS-Poll = legacy unicast retrieval.
• U-APSD uses a QoS trigger instead of PS-Poll; TWT is the HE scheduled wake.
• Mixed OFDM + DSSS/CCK in 2.4 GHz → ERP protection via RTS/CTS or CTS-to-Self.

Key Takeaways

• Roam decision lives on the STA; k/v/r only assist.
• Sleeping STAs require AP buffering and a wakeup contract (TIM/DTIM, WMM-PS, or TWT).
• Protection exists so stations that cannot decode a PPDU still set NAV and stay silent.