14.3 Common WLAN Faults and Hidden Nodes
Key Takeaways
- Insufficient throughput is often in the DS: speed/duplex mismatch, exhausted PoE budget, or WAN/Internet bandwidth, not the radio
- RF interference is confirmed and identified with a spectrum analyzer; SNR, retransmissions, and airtime utilization explain many performance tickets
- DHCP, DNS, and time faults are proven with the client OS and IP tools while the station remains associated
- Security mismatches show up as 802.11 status/reason codes, 4-way failures, or EAP-Failure rather than as a coverage hole
- A hidden node collides at the AP because two STAs hear the AP but not each other; RTS/CTS extends NAV as the classic mitigation
Objective 6.6 is the catalog of common WLAN faults and the hidden node problem. Everything in 14.1 and 14.2 feeds this section: you already know CCC versus ACI, and you already know which tool sees frames versus energy versus logs. Now you close the ticket. This OpenExamPrep section is independent CWNA-109 study material by OpenExamPrep. It does not claim CWNP approval, partnership, or exact equivalence with CWNP training.
Harborline Terminals runs a warehouse ESS (HL-Warehouse), a corporate SSID (HL-CORP), and a guest SSID. The following tickets are composite but typical. Read them as exam stems.
Insufficient throughput in the distribution system
The Distribution System (DS) is the wired side that 802.11 uses to forward MSDUs. A perfect radio still delivers application throughput no faster than the Ethernet, PoE, and WAN behind it. Objective 6.6 names three DS failures you must not call "Wi-Fi."
LAN speed and duplex mismatch. Harborline AP-W12's uplink autonegotiated 100 Mbps half duplex after a damaged cable and a cheap midspan. Air interface MCS still reported hundreds of Mbps. Users said "Wi-Fi is slow." Switch counters showed collisions and runts on that port. iperf to a local server through that AP capped near half-duplex 100 with retries on Ethernet, not on 802.11. Repair: replace the drop, lock or correctly autoneg 1 Gbps full duplex (or 2.5/5 Gbps where the AP and switch support it), and throw away the failing injector. Always compare wireless MCS to wired port speed and duplex before you redesign RF.
Insufficient PoE budget. Chapter 10 taught class and PSU math. In 6.6 the symptom is operational: the AP reboots, comes up with a radio disabled, or runs a low-power indoor SKU behavior when the PSE cannot feed the PD. Harborline IDF-3's 48-port PoE+ switch advertised PoE+ on every jack and still starved the last twelve dual-band high-radio APs at 07:00 when cameras and phones joined the same PSU. Syslog: repeated AP boot. WNMS: radios bouncing. Spectrum: nothing. Repair: bigger PSU, fewer PDs per switch, LLDP power negotiation, or a midspan with a real watt budget — not another site survey.
Insufficient Internet / WAN bandwidth. Guest and cloud applications cross the WAN. Local WMS on the warehouse VLAN does not. Ticket 2180: "Guest Wi-Fi is unusable; warehouse scanners are fine." iperf from a guest laptop to a Harborline server on-campus was excellent. The firewall graph was pegged. That is WAN capacity, maybe also a guest rate-limit, not CCC. Repair the circuit or the policy. Do not add APs.
| DS fault | Typical symptom | What looks healthy | First proof |
|---|---|---|---|
| Speed/duplex mismatch | All SSIDs on one AP are slow; others are fine | High RSSI, decent SNR | Switch port counters, negotiated speed/duplex |
| PoE budget | One IDF's APs reboot or lose a radio | Other buildings normal | PSE remaining watts, PD class, AP syslog |
| WAN/Internet | Cloud/guest slow; local IP fast | RF charts green | iperf local vs Internet, firewall/WAN graphs |
RF interference: use the spectrum analyzer
6.6 repeats a 6.2/6.5 pairing on purpose: solve RF interference with spectrum analyzers. When retries are high and the scanner does not explain them with OBSS, measure energy. Do not keep capturing Beacons hoping a magnetron will send a management frame.
Harborline ticket 1902 (break room): spectrum waterfall, oven signature, relocate oven and steer scanners to 5 GHz. Ticket 1933 (yard): analog camera carrier on 2.412 GHz, replace with an Ethernet camera. Both closed without touching AP power.
Performance issues: SNR, retransmissions, airtime
Three numbers explain most "it feels slow" RF tickets that are not DS:
SNR. RSSI without noise is a vanity metric. A −55 dBm signal over a −70 dBm noise floor is only 15 dB SNR — often too thin for high MCS and voice. A −70 dBm signal over a −95 dBm noise floor is 25 dB and may outperform the "stronger" AP. Harborline's metal racks raised the noise floor with ACI and reflections; bars stayed high, SNR did not.
Retransmissions. Retry percent is the operational translation of lost MPDUs. Voice and scanners die when retries climb even if the headline data rate is still "300 Mbps." Capture the retry bit; read WNMS retry charts. Causes: CCC, ACI, hidden node, low SNR, or a broken client driver. The metric tells you loss is happening; 14.1 and hidden-node analysis tell you which loss.
Airtime utilization. A channel at 70 percent busy cannot accept another dozen scanners even if each has −50 dBm. Utilization is how CCC shows up on the controller. If utilization is low and retries are high, think collisions you are not deferring for (hidden node, ACI, non-Wi-Fi). If utilization is high and retries are moderate, think too much successful Wi-Fi traffic (capacity).
| Pattern | SNR | Retries | Airtime | Read it as |
|---|---|---|---|---|
| Coverage hole | Low | High | Low–medium | Move AP, fix antenna, check client Tx |
| CCC / too many OBSS | High | Medium–high | High | Replan channels/power |
| ACI / non-Wi-Fi / hidden node | High or medium | High | Medium (energy may busy CCA) | Spectrum + RTS/CTS / replan |
| DS bottleneck | High | Low on air | Low–medium | Duplex, PoE, WAN |
Network services: DHCP, DNS, and time
Objective 6.6 says to troubleshoot network services with native interface and IP tools. That means the client OS and ordinary IP utilities, not a new survey.
DHCP. Associated with a 169.254/16 address (APIPA) or no address: the air worked; the pool, helper, VLAN, or server did not. Windows: ipconfig /all. macOS: TCP/IP pane or ipconfig getpacket. Linux: ip addr, dhclient logs. Ping the gateway only after you have a unicast address. Packet capture if the OS view is not enough (14.2).
DNS. Ping by IP to the application server works; the name fails. nslookup / dig against the advertised DNS. Harborline ticket 2204: guest portal loaded by IP in a test, not by name — wrong DNS option in the guest pool. Users called it "Wi-Fi down."
Time (NTP/SNTP). 802.1X with EAP-TLS, controller certificates, and log correlation fail when the AP or client clock is wrong. date / timedatectl / Windows Date & Time. Harborline APs that could not join after a WAN outage had clocks in 2019; TLS looked like "Wi-Fi auth broken."
Native tools first. Then logs. RF last if association and SNR already look sane.
Security configuration mismatches
The station can hear the AP and still never pass user traffic. Mismatches 6.6 expects you to recognize:
- Client WPA2-Personal versus AP WPA3-SAE only (or the reverse on a client that cannot do SAE).
- PMF required on the AP, client without 802.11w.
- PSK mismatch — 4-way handshake timeout, deauth, no DHCP because 802.1X/4-way never finished.
- AKM mismatch (PSK versus 802.1X) — association status in the capture.
- TKIP still offered on one SSID while the client or policy demands CCMP-only.
- RADIUS Reject (user, cert, or tunnel VLAN) after a successful 802.11 association.
Ticket 2240: a new rugged tablet had a stale PSK for HL-Warehouse. RSSI −47 dBm. Helpdesk raised AP power twice. Protocol analyzer: 4-way failed. Repair: correct the passphrase. Power was never the variable.
Hidden nodes and RTS/CTS
A hidden node is a topology, not a vendor bug. STA-A and STA-C both reach AP-B. A and C do not receive each other (racks, corners, long indoor distances, directional clients). Each sees CCA idle, transmits, and collides at the AP. The AP fails FCS; both STAs miss ACK and retry. SNR from each STA to the AP can be fine. A WLAN scanner at A does not list C's transmissions as a neighbor you can decode.
RTS/CTS is the textbook mitigation (objective 3.6 taught the handshake; 6.6 asks you to use it). The sender emits RTS; the AP answers CTS; C hears the CTS even though it never heard A's RTS, loads NAV, and stays quiet for A's data. Cost: two extra control frames. Use an RTS threshold so tiny frames skip the handshake.
Other mitigations that are design, not a checkbox: add an AP so A and C are less hidden, lower power and increase density with proper channel reuse, or remove the metal obstruction. CTS-to-Self helps ERP protection and stations that hear the sender; it does not protect a hidden receiver's neighborhood the way a CTS from the AP does.
Worked Harborline tickets (close the queue)
Ticket 1847 — Conference 2 slow, bars full. Scanner: four BSSIDs on channel 36. WNMS: 64 percent airtime, SNR 32 dB, retries 18 percent. Fault: CCC. Repair: replan 5 GHz primaries, reduce 2.4 GHz. Not: more power.
Ticket 1902 — Break room, lunch only. Spectrum: 2.45 GHz smear. Fault: non-802.11 microwave. Repair: move oven, prefer 5 GHz. Tool: spectrum analyzer.
Ticket 2011 — Aisle APs bounce at shift start. Syslog: AP reset. Switch: PoE denied. Fault: insufficient PoE budget. Repair: PSU/budget, not RF.
Ticket 2055 — Associated, yellow bang, 169.254.x.x. ipconfig /all: no DHCP. Capture: Discover, no Offer. Fault: helper/pool/VLAN. Tools: native IP + protocol analyzer.
Ticket 2110 — Two forklift tablets in aisle 12 and 18 drop only when both transmit. Capture at AP: colliding data, few RTS. Tablets cannot hear each other through racks. Fault: hidden node. Repair: enable RTS/CTS (threshold), consider an extra AP. Not: raise both tablets' power (worsens the collision).
Ticket 2188 — Single AP, all SSIDs capped. Switch: 100/half, CRC on copper. Fault: DS speed/duplex. Repair: cable and autoneg.
Ticket 2204 — "Internet down," ping to 8.8.8.8 works. nslookup fails. Fault: DNS. Tool: native DNS lookup.
Ticket 2240 — New tablet never gets a DHCP address. 4-way fails. Fault: PSK mismatch (security configuration). Tool: protocol analyzer.
Ticket 2180 — Guest cloud apps crawl; WMS fine. WAN graph pegged. Fault: insufficient Internet bandwidth. Repair: WAN/QoS, not APs.
On the exam
- Slow + good RF → check DS (duplex, PoE, WAN) before RF redesign.
- Interference → spectrum analyzer.
- Performance → SNR, retries, airtime together, never RSSI alone.
- Associated but useless → DHCP/DNS/time with OS tools.
- Hear the AP, cannot pass 802.1X/4-way → security mismatch.
- Two clients, one AP, collisions at the AP → hidden node / RTS/CTS.
Key Takeaways
- The DS can starve a healthy radio.
- Spectrum finds interferers; SNR, retries, and airtime explain RF performance.
- Native IP tools find DHCP, DNS, and time faults.
- Security mismatches are frame and AAA failures.
- Hidden nodes need NAV from RTS/CTS, not more EIRP.
Harborline AP-W12 shows high MCS and −50 dBm client RSSI, but every SSID on that AP is slow. Neighbor APs are fine. The access-switch port counters show collisions, and the port is negotiated at 100 Mbps half duplex. Where is the fault?
Two Harborline forklift tablets both reach the same aisle AP with good SNR. They cannot decode each other's frames through metal racks. When both transmit, the AP records FCS failures and both tablets retry. Which fault and mitigation match objective 6.6?
A Harborline laptop shows associated to HL-CORP with excellent RSSI. The user cannot load the intranet by name. ping to the intranet server's IP address succeeds. ipconfig shows a DHCP lease and DNS servers. Which fault should you investigate with native IP tools first?
You've completed this section
Continue exploring other exams