Short answer: a client discovers a BSSID, negotiates an association and security, then obtains or reuses IP configuration. Roaming changes its attachment to another BSSID. The client normally decides when to roam; 802.11k, 802.11r, and 802.11v assist different parts of that process.
Read bands and airtime, DHCP, and certificate trust first.
An exhibition pass, not just a building name
At a trade exhibition, seeing the event's name doesn't admit you. You choose an entrance, present a pass, clear the admission check, and find the stand you need. The event name is the SSID; a particular entrance is a BSSID; association establishes the radio relationship; security establishes authorized protected access; DHCP and DNS help you reach your destination. A copied event sign doesn't prove an entrance is genuine, just as an SSID alone doesn't authenticate a network.
Joining: identify the last successful stage
- Discovery: the client learns about BSSIDs from beacons and, where applicable, probe exchanges. Capabilities and the
RSNinformation element advertise supported security. Discovery behavior differs by band, especially at 6 GHz. - 802.11 authentication and association: the client and AP exchange management frames. Open System authentication used in WPA2 networks is not password validation. WPA3-Personal uses
SAEauthentication before association. - Security and keys: enterprise networks typically run 802.1X/EAP authentication, often through a RADIUS service. An ordinary full WPA2/WPA3 connection also establishes traffic keys with the four-way handshake. A shared password is not transmitted as plaintext in that handshake.
- IP and service access: IPv4 may use DHCP, followed by gateway/ARP and DNS checks. IPv6 uses its own router-discovery and address-configuration mechanisms. A successful association doesn't prove any of these later stages succeeded.
Know what each security mode authenticates
| Mode | How access is established | Operational consequence |
|---|---|---|
| WPA2-Personal with AES-CCMP | A pre-shared secret contributes to key establishment | Shared-secret distribution and rotation are difficult; weak passphrases are vulnerable to offline guessing from suitable captured exchanges |
| WPA3-Personal | SAE is a password-authenticated key exchange; PMF is required | Improves resistance to passive offline dictionary attacks; still needs strong credentials, supported clients, and updates |
| WPA2/WPA3-Enterprise | 802.1X with an EAP method, usually backed by RADIUS | Supports individual identities and policy; EAP-TLS uses certificates and requires a working certificate lifecycle |
| Enhanced Open (OWE) | Encrypts the wireless link without a shared password | Does not authenticate the hotspot's identity; application TLS remains important |
At the exhibition, a shared invitation code is different from a named pass verified against an issuer. For EAP-TLS, validate the authentication server's certificate and expected name, as well as the client certificate. Don't teach users to accept an unexpected certificate prompt. A RADIUS accept can carry an assigned VLAN, so authentication success followed by no DHCP lease may be a VLAN or DHCP-path fault.
Protected Management Frames (PMF) protect selected robust management frames, including protected deauthentication/disassociation after keys exist. They don't prevent RF interference, protect every management frame, or make an evil-twin SSID impossible. WPA2/WPA3 transition mode retains a legacy path; it isn't equivalent to a WPA3-only deployment. Wi-Fi certification for 6 GHz requires newer security modes such as WPA3 or Enhanced Open rather than legacy WPA2-only operation.
A captive portal is an application sign-in after basic connectivity, not a replacement for wireless encryption or server identity checks. In the exhibition, a survey inside the hall isn't the entrance's identity check.
Roaming is a client decision with assistance
| Mechanism | What it helps with | Exhibition equivalent |
|---|---|---|
| 802.11k | Neighbor reports help the client find candidate BSSIDs/channels | A directory of nearby entrances |
| 802.11v | BSS transition management can suggest alternatives; the client evaluates them | Staff recommend a less crowded entrance |
| 802.11r | Fast BSS Transition reduces security handoff work within the configured mobility domain | Participating entrances recognize a securely derived admission credential |
The client weighs signal, candidates, driver policy, and sometimes load. APs can influence selection, but a forced disconnection is not a guarantee of a smooth roam. Vendor thresholds such as Apple's documented triggers describe particular clients, not a universal -70 dBm law. Test legacy scanners and voice clients before changing FT or PMF requirements.
Worked example: a call crosses two APs
A handset on SSID Staff moves from BSSID 02:00:00:00:07:01 to 02:00:00:00:07:02. In this synthetic example, it remains in VLAN 20 and keeps 10.20.0.42/24. The application connection may survive a short handoff without a new DHCP lease. Record the old/new BSSID, authentication result, IP address, and packet-delivery gap to establish what happened.
If the second AP maps Staff to a different subnet, an identical SSID doesn't preserve IP reachability by itself. A supported mobility tunnel/anchor design may preserve addressing, or the client may need new IP configuration. At the exhibition, another entrance bearing the same event sign must still lead into the same admission system and hall.
Join and roam diagnostics
| Symptom | Check | Interpretation |
|---|---|---|
| SSID visible, client cannot join | Association status, negotiated security, PMF and band support | Discovery succeeded; admission may not have |
| Enterprise authentication fails | Client/server time, certificate chain and name, EAP method, RADIUS logs | Distinguish a credential rejection from an unreachable authentication server |
| Connected, but no usable address | Assigned VLAN, DHCP scope/relay, IPv6 router advertisements | Radio/security may be healthy while address configuration fails |
| Call drops only while walking | Time-aligned BSSID changes, retries, EAP/FT results, address continuity | Separate RF coverage, slow authentication, and a subnet/policy mismatch |
Walk the actual route with the affected client and application. A single signal reading cannot establish roaming quality, and a successful ping after the roam doesn't measure the interruption during it.
Related topics
Connect this to VLAN mapping, DHCP, and authenticated encryption above Wi-Fi.
Sources
- Wi-Fi Alliance: WPA3, Enhanced Open, and PMF.
- Apple: Wi-Fi roaming support. Client-specific behavior, not a cross-vendor threshold.
- RFC 9190: EAP-TLS with TLS 1.3 and RFC 8110: Opportunistic Wireless Encryption.