Blog

This post covers two topics that meet at the boundary between the physical and MAC layers. Channel bonding is a PHY decision: how many 20 MHz channels a transmission occupies. Frame types are a MAC concept: what kinds of frames 802.11 sends and what is inside them. Together they explain much of what a packet capture shows and why a “faster” wide-channel network can end up slower.

Part 1 — Channel Bonding

What It Is

Wi-Fi channels are defined in 20 MHz units. Channel bonding combines adjacent 20 MHz channels into a wider channel, giving the transmission more OFDM subcarriers and therefore a higher data rate:

Width	20 MHz channels bonded	Introduced	Bands
40 MHz	2	802.11n (Wi-Fi 4)	2.4 (avoid), 5, 6 GHz
80 MHz	4	802.11ac (Wi-Fi 5)	5, 6 GHz
160 MHz	8	802.11ac (Wi-Fi 5)	5, 6 GHz
320 MHz	16	802.11be (Wi-Fi 7)	6 GHz only

802.11ac also defined an 80+80 MHz mode using two non-adjacent 80 MHz segments; it saw little adoption and was dropped from Wi-Fi 7.

Primary and Secondary Channels

A bonded channel is not one undifferentiated block. One 20 MHz channel is the primary; the rest are secondary (secondary 20, secondary 40, secondary 80 and so on).

• Beacons, most management frames, control responses and all traffic to 20 MHz-only clients use the primary channel only.
• Contention (CSMA/CA backoff) is performed on the primary channel. Before transmitting wide, the station checks that the secondary channels have also been idle for a short period; secondary channels use a less sensitive busy threshold than the primary.
• If a secondary channel is busy, the transmission falls back to a narrower width that excludes it. 802.11n could only fall back to 20 MHz; 802.11ac added dynamic bandwidth signalling — RTS frames duplicated on every 20 MHz slice, with the receiver’s CTS indicating which slices are clear.
• Preamble puncturing (optional in Wi-Fi 6, a key Wi-Fi 7 feature) lets a station transmit on a wide channel while skipping a busy 20 MHz slice, rather than dropping to a narrower channel. Wi-Fi 7 can also puncture statically — permanently avoiding part of a channel used by an incumbent.

Two networks whose primary channels differ but whose bonded channels overlap interfere in an awkward way: each sees the other only as secondary-channel energy, constantly forcing fallbacks. Aligning primary channels (the default in most RRM systems) avoids this.

Channel Notation

• 36/80 — an 80 MHz channel with primary channel 36 (vendor notation; Aruba uses 36E for 80 MHz and 36S for 160 MHz in some outputs).
• 36+ or 40− — 40 MHz channels with the secondary above or below the primary (802.11n notation).
• Centre channel number — 802.11ac/ax identify wide channels by their centre: channel 42 is 36–48 at 80 MHz, channel 50 is 36–64 at 160 MHz, channel 155 is 149–161 at 80 MHz.

What Wider Channels Buy

Width	Data subcarriers (Wi-Fi 6)	1-stream peak (MCS 11, 0.8 µs GI)	Noise floor change	MCS 11 sensitivity (standard minimum)
20 MHz	234	143 Mbps	baseline	−52 dBm
40 MHz	468	287 Mbps	+3 dB	−49 dBm
80 MHz	980	600 Mbps	+6 dB	−46 dBm
160 MHz	1,960	1,201 Mbps	+9 dB	−43 dBm
320 MHz (Wi-Fi 7, MCS 13)	3,920	≈ 2,882 Mbps	+12 dB	—

Doubling the width slightly more than doubles the peak rate (fewer edge subcarriers are wasted proportionally). But each doubling also spreads the same transmit power over twice the spectrum and collects twice the noise — a 3 dB SNR penalty — so at a given distance the client may fall to a lower MCS. Close to the AP, wide channels shine; at the cell edge, much of their advantage disappears. The underlying maths is in RF Power and OFDM.

What Wider Channels Cost: Reuse

Band (US)	20 MHz	40 MHz	80 MHz	160 MHz	320 MHz
2.4 GHz	3	1 (do not use)	—	—	—
5 GHz without UNII-4	25	12	6	2	—
5 GHz with UNII-4	28	14	7	3	—
5 GHz without DFS	9	4	2	0	—
6 GHz	59	29	14	7	3

Wi-Fi capacity comes from reusing channels across many small cells. Every doubling of width halves the number of channels. On a floor with a dozen APs, 20 or 40 MHz channels let every AP have its own channel; 80 MHz forces neighbours to share. Worse, an 80 MHz BSS defers to activity on any of its four 20 MHz slices, so it hears more neighbours than a 20 MHz BSS would. In dense environments the aggregate capacity of many narrow channels usually beats a few wide ones, even though each client’s peak speed is lower.

Choosing a Width

Scenario	5 GHz	6 GHz
Home, small office, few neighbours	80 MHz	160 MHz
Typical enterprise floor	40 MHz (with DFS)	80 MHz
High density (auditorium, arena, lecture hall)	20 MHz	40–80 MHz
Multi-tenant building with many neighbours	20–40 MHz	80 MHz
Low density, very high throughput (labs, media)	80 MHz	160–320 MHz

And always 20 MHz in 2.4 GHz: a 40 MHz 2.4 GHz channel occupies two of the three non-overlapping channels.

On Aruba Networks

The original version of this post attributed channel-width decisions to ClientMatch; that is not its job. On Aruba:

• Allowed widths and channels are set in the regulatory-domain profile (valid 40/80/160 MHz channel groups) and the radio profiles.
• In AOS 8, AirMatch on the Mobility Conductor chooses each radio’s channel and width as part of its network-wide plan, narrowing channels where AP density requires it. In AOS 6 and Instant, ARM makes these decisions per AP. In AOS 10, AirMatch runs in Aruba Central.
• ClientMatch steers clients between APs and bands; it does not change channel width.
• Radar on one 20 MHz slice of a DFS-bonded channel forces the whole bonded channel off, which is one reason wide DFS channels move more often. See Aruba Wireless Part 7.

Part 2 — 802.11 Frames

Frame Types

Every 802.11 frame has a two-bit Type and four-bit Subtype in its Frame Control field. The three working types are management, control and data; a fourth “extension” type is reserved for special PHYs.

The MAC Header

Field	Size	Purpose
Frame Control	2 bytes	Protocol version, type, subtype and flags: To DS, From DS, More Fragments, Retry, Power Management, More Data, Protected Frame, +HTC/Order
Duration / ID	2 bytes	How long the medium is reserved (sets other stations’ NAV); in PS-Poll frames, the client’s Association ID
Address 1–3	6 bytes each	Receiver, transmitter and source/destination/BSSID depending on direction
Sequence Control	2 bytes	Sequence and fragment number — lets receivers detect duplicates caused by lost ACKs
Address 4	6 bytes	Only in frames between two APs or mesh nodes (To DS = From DS = 1)
QoS Control	2 bytes	QoS data frames: traffic identifier (user priority 0–7), ACK policy, A-MSDU flag
HT Control	4 bytes	Optional link adaptation and Wi-Fi 6/7 control information
Frame Body	variable	The payload: management information elements, or an encrypted LLC/IP packet
FCS	4 bytes	CRC-32 checksum; a frame that fails it is discarded and not acknowledged

Two flags are worth watching in captures: Retry marks retransmissions, so a high proportion of retries points at RF problems (interference, hidden nodes, weak signal); Protected means the body is encrypted. The Power Management bit tells the AP the client is going to sleep (or off-channel), so the AP should buffer its frames.

The Four Address Fields

Ethernet frames need two addresses because the sender and receiver are on the same wire. On Wi-Fi, the device a frame is sent to over the air is usually the AP, not the final destination, so 802.11 separates receiver and transmitter (the two radios on this hop) from destination and source (the endpoints). The To DS and From DS bits say which arrangement applies. When an AP bridges a frame to Ethernet, it rebuilds an Ethernet header from the source and destination addresses; when it bridges the other way, it adds its own BSSID as transmitter.

Management Frames

Management frames set up, maintain and end relationships between stations. They are sent at the lowest basic rate so every station can decode them, and they are unencrypted — although with Protected Management Frames (802.11w) the most dangerous ones gain integrity protection.

Frame	Purpose and notable contents
Beacon	Sent per SSID about every 102.4 ms. Contains a timestamp, beacon interval, capability information, SSID, supported rates, channel, Traffic Indication Map, country/power information, RSN element (security), HT/VHT/HE/EHT capabilities and operation, WMM parameters, and in 2.4/5 GHz a Reduced Neighbor Report for co-located 6 GHz BSSs
Probe Request / Response	Active scanning. Requests can be wildcard (any SSID) or directed (a specific SSID). Modern clients randomize their MAC address while probing for privacy
Authentication	Algorithm 0 = Open System (the norm), 1 = Shared Key (obsolete WEP), 2 = Fast BSS Transition (802.11r), 3 = SAE (WPA3-Personal)
Association Request / Response	The client’s capabilities and requested security; the AP’s status code and assigned Association ID
Reassociation Request / Response	Used when roaming within an ESS, naming the current AP so state can be transferred
Disassociation / Deauthentication	End association or authentication, carrying a reason code. Unprotected, they can be spoofed to knock clients off — the reason PMF exists
Action	A family of function-specific frames: Channel Switch Announcement (802.11h), ADDBA for Block Ack sessions, QoS (ADDTS for admission control), radio measurement and neighbour reports (802.11k), BSS Transition Management (802.11v), FT (802.11r), SA Query (802.11w)

802.11 tracks each client through three states, and only certain frame classes are allowed in each: unauthenticated and unassociated (class 1 frames only — beacons, probes, authentication), authenticated but not associated (class 2 — association), and associated (class 3 — data). A client sending data before associating triggers a deauthentication with reason code 7.

Useful Reason Codes

Code	Meaning	Typical cause
1	Unspecified	Generic; often vendor features such as steering
2	Previous authentication no longer valid	AP restarted or lost the client’s state
3	Station is leaving	Client turned Wi-Fi off or roamed away
4	Inactivity	Idle timeout
7	Class 3 frame from nonassociated station	Client sent data the AP did not expect (state mismatch)
8	Leaving BSS	Client disassociating, often to roam
15	4-way handshake timeout	Wrong passphrase, or key exchange failing
23	802.1X authentication failed	RADIUS reject, certificate problem

Control Frames

Control frames help deliver other frames. They are short, have no body, and are sent at basic rates.

• ACK (14 bytes) — acknowledges one unicast frame after SIFS. A missing ACK triggers retransmission.
• Block Ack / Block Ack Request — acknowledge a whole aggregate (A-MPDU) with a bitmap, set up by ADDBA action frames. Essential for the throughput of Wi-Fi 4 and later.
• RTS / CTS (20 / 14 bytes) — reserve the medium, solving hidden nodes and signalling bandwidth for dynamic channel bonding. CTS-to-self is a lighter protection mechanism.
• PS-Poll — a legacy power-save client asking the AP for one buffered frame.
• Trigger (Wi-Fi 6) — the AP schedules uplink OFDMA and uplink MU-MIMO transmissions from several clients at once.
• NDP Announcement — starts channel sounding for beamforming and MU-MIMO.

Data Frames

• Data and QoS Data — carry user traffic. QoS Data (used by every WMM device) adds the QoS Control field with the traffic identifier that maps to an access category — Voice, Video, Best Effort or Background. See Spectrum Management, QoS and Security.
• Null and QoS Null — data frames with no payload, used to change power-management state (for example before going off-channel to scan) and as keep-alives.

Data frames are where encryption applies: with WPA2/WPA3 the body is encrypted with CCMP or GCMP, adding 8 bytes of header (packet number and key ID) and an 8- or 16-byte integrity check.

Seeing Frames in Wireshark

Capturing 802.11 frames (rather than the Ethernet frames an operating system shows) requires a wireless adapter in monitor mode, or an AP that can stream captures. Useful display filters:

Filter	Shows
wlan.fc.type == 0 / 1 / 2	All management / control / data frames
wlan.fc.type_subtype == 0x0008	Beacons
wlan.fc.type_subtype == 0x0004 || wlan.fc.type_subtype == 0x0005	Probe requests and responses
wlan.fc.type_subtype == 0x000b	Authentication
wlan.fc.type_subtype == 0x000c || wlan.fc.type_subtype == 0x000a	Deauthentication and disassociation
eapol	802.1X and the 4-way handshake
wlan.fc.retry == 1	Retransmissions
wlan.addr == aa:bb:cc:dd:ee:ff	Everything to or from one station
wlan_radio.data_rate < 12	Frames sent at low legacy rates

Common Mistakes

• 40 MHz in 2.4 GHz.
• 80 or 160 MHz everywhere in 5 GHz on dense floors, then wondering why throughput fell.
• Misaligned primary channels between overlapping wide-channel networks.
• Reading “deauth” as “attack” without checking the reason code — most deauthentications are normal behaviour (roaming, steering, idle timeouts).
• Capturing on a laptop without monitor mode and concluding that management frames do not exist.
• Ignoring the Retry flag — retry rate is one of the best single indicators of RF health.

Exercises

1. An AP uses 5 GHz channel 36 at 80 MHz. Which 20 MHz channels does it occupy, which is primary, and what is the centre channel number?

Show answer

Channels 36, 40, 44 and 48; channel 36 is primary (36/80); the centre channel number is 42 (5210 MHz).

2. A neighbour’s AP sits on channel 44 at 20 MHz. What happens to the 36/80 AP from question 1 when the neighbour is busy, with Wi-Fi 6 and with Wi-Fi 7?

Show answer

Channel 44 is part of the secondary 40. A Wi-Fi 6 AP must fall back to 40 MHz (36–40) while 44 is busy (puncturing in Wi-Fi 6 is limited to certain MU transmissions). A Wi-Fi 7 AP can puncture channel 44 and transmit on 36, 40 and 48.

3. A building has 16 APs per floor. Compare 20, 40 and 80 MHz in 5 GHz (US, with DFS, without UNII-4) in terms of channel reuse.

Show answer

20 MHz: 25 channels — every AP gets its own channel with spare channels for neighbouring floors. 40 MHz: 12 channels — four channels used twice on the floor. 80 MHz: 6 channels — each used two or three times on one floor, and each AP defers to activity on four 20 MHz slices. 40 MHz is a reasonable compromise; 80 MHz would create heavy co-channel contention.

4. In a capture, a frame has To DS = 1 and From DS = 0. Address 1 is the AP’s BSSID, Address 2 is a laptop and Address 3 is the default gateway’s MAC. Describe the frame’s journey.

Show answer

The laptop (source and transmitter) sends the frame over the air to the AP (receiver). The AP bridges it to the wired network, rebuilding an Ethernet frame addressed to the gateway (the final destination in Address 3), with the laptop as the Ethernet source.

5. Clients on a WPA2-Personal network connect briefly and then drop. A capture shows deauthentication frames with reason code 15. What is the most likely cause?

Show answer

Reason 15 is a 4-way handshake timeout: the client and AP do not derive matching keys, almost always because the passphrase on the client is wrong (or saved incorrectly). Less often, a client driver problem or heavy frame loss during the handshake.

6. Why are management frames sent at the lowest basic rate, and what does that imply about having many SSIDs?

Show answer

So that every station in range, including the weakest and oldest, can decode them. Each SSID sends its own beacons at that low rate, roughly ten times a second per radio, so every extra SSID consumes noticeable airtime — more so if the lowest basic rate is 1 Mbps. Fewer SSIDs and higher minimum basic rates save airtime.

Summary

Channel bonding combines 20 MHz channels into 40, 80, 160 and (in 6 GHz) 320 MHz channels built around a primary 20 MHz channel that carries beacons and contention; busy secondary channels force narrower transmissions unless Wi-Fi 7 puncturing skips them. Wider channels raise peak speed but cost 3 dB of SNR per doubling and halve the number of channels available for reuse, so dense networks favour narrower channels. On Aruba, AirMatch (or ARM) chooses widths — not ClientMatch. The 802.11 MAC header carries frame control flags, a duration that sets the NAV, up to four addresses for receiver, transmitter, source and destination, sequence control, QoS control and a checksum. Management frames build and end connections (with reason codes that explain why), control frames coordinate the medium, and data frames carry the encrypted payload.

Next: Spectrum Management, QoS and Security covers the amendments that made Wi-Fi coexist with radar (802.11h), prioritize voice (802.11e) and become secure (802.11i, WPA2 and WPA3).