Study guide
9.2 Roaming, Power Save and Protection Mechanisms
CWNA Certified Wireless Network Administrator CWNA-109
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 CWNA-109 Knowledge Domains and Study Strategy
2 RF Fundamentals
2.1 RF Waves, Propagation, Gain and Loss 2.2 Reflection, Multipath, VSWR and Free-Space Path Loss 2.3 RF Units and the Rule of 10s and 3s
3 RF Measurement and Antenna Systems
3.1 Noise Floor, SNR, RSSI and EIRP 3.2 Line of Sight, Fresnel Zone, Polarization and MIMO 3.3 Antenna Types, Charts, Cables and Lightning Protection
4 Industry Bodies and Legacy PHY
4.1 Industry Organizations and OSI Layers 4.2 Legacy 802.11 PHY Standards 4.3 Spread Spectrum, Modulation and MCS
5 Modern 802.11 PHY and Channel Concepts
5.1 Wi-Fi 4 HT and Wi-Fi 5 VHT 5.2 Wi-Fi 6 and Wi-Fi 6E High Efficiency 5.3 Primary Channels, OBSS, Throughput and Guard Interval
6 Spectrum Rules and WLAN Use Cases
6.1 Frequency Bands, DFS and Transmit Power Control 6.2 WLAN, Bridging, Peer-to-Peer and Mesh
7 802.11 Service Sets and Framing
7.1 Stations, BSS, ESS and the Distribution System 7.2 MSDU, MPDU, PSDU, PPDU and Aggregation 7.3 MAC Frame Format and Addressing
8 Frame Types, Discovery, and Association
8.1 Management, Control and Data Frames 8.2 Scanning, Authentication and Association
9 Channel Access, MAC Operations, and Devices
9.1 DCF, EDCA, RTS/CTS and Interframe Spaces 9.2 Roaming, Power Save and Protection Mechanisms 9.3 Access Points, Controllers and Client Devices
10 PoE, Architectures, and Proprietary Features
10.1 Power over Ethernet, PSE and Power Budgets 10.2 Centralized vs Distributed Forwarding and Network Planes 10.3 Airtime Fairness, Band Steering and RRM
11 WLAN Design and Supporting Services
11.1 Data, Voice, Video and Legacy Client Design 11.2 High-Density, Location Services and Guest Access 11.3 DHCP, DNS, Time, VLANs and AAA
12 WLAN Security
12.1 Weak and Deprecated WLAN Security 12.2 AES, WPA2-Personal and WPA2-Enterprise 12.3 WPA3, SAE and Opportunistic Wireless Encryption 12.4 PMF, Fast Roaming, WIPS and Secure Management
13 RF Validation Surveys and Tools
13.1 Post-Implementation Validation Surveys 13.2 Application and Performance Testing 13.3 Validation Tools: Survey, Protocol and Spectrum
14 Interference, Troubleshooting, and Common Faults
14.1 Co-Channel Contention vs Adjacent Channel Interference 14.2 Protocol Analyzers, Spectrum Analyzers and Monitoring 14.3 Common WLAN Faults and Hidden Nodes
9.2 Roaming, Power Save and Protection Mechanisms
Key Takeaways Explain This Topic AI
The client station decides when to roam; sticky clients stay on a weak BSS despite a stronger neighbor unless RSSI, retries, or 802.11k/v assistance force a better choice
802.11k neighbor reports, 802.11v BSS Transition Management, and 802.11r Fast BSS Transition improve roam decisions and handshake time at CWNA awareness depth
Legacy power save uses the TIM in beacons plus PS-Poll for unicast, while DTIM beacons mark when buffered broadcast and multicast go out; U-APSD/WMM-PS and HE TWT reduce wake-ups
ERP protection in mixed 2.4 GHz cells uses RTS/CTS or CTS-to-Self so DSSS/CCK stations set NAV around OFDM frames they cannot decode
Last updated: September 2026
Winning the channel (section 9.1) is only part of MAC behavior. Stations also move between APs , sleep to save battery , and protect older PHYs that cannot decode newer PPDUs. Objective 3.7 groups those operations. Fast Transition key hierarchy and 802.1X live in the security domain; here you need operational awareness — who decides to roam, how the AP holds frames for a sleeping STA, and why a 2.4 GHz mixed cell suddenly fills with CTS frames.
Roaming: the client decides
In baseline 802.11, the station chooses when to leave one BSS and join another. The AP does not “hand off” the client the way a cellular tower does in older mobile networks. The STA measures beacons and data, applies its vendor roam logic, authenticates and associates (or fast-transitions) to a new BSSID, and the DS then forwards traffic to the new AP.
That design has a famous failure mode: the sticky client . A laptop associated at −48 dBm in a conference room walks 30 meters down a corridor. A closer AP is at −55 dBm, but the original AP is still at −72 dBm and still ACKs slowly. Many consumer and even some enterprise drivers refuse to roam until RSSI, missed beacons, or retry rates cross an internal cliff. Users experience “Wi-Fi is slow in the hallway” while a survey shows excellent coverage from the next AP. Sticky behavior is a client policy problem first, an RF-design problem second.
What the STA actually measures
Typical roam triggers (vendor-specific numbers, same ideas):
RSSI / RCPI falling through a threshold (for example −70 to −75 dBm for data, higher for voice).
SNR collapsing even if RSSI looks acceptable (noise floor rose).
Retry rate / missed beacons / beacon loss .
Insufficient uplink — the AP still sounds loud, but the STA’s weaker transmitter no longer reaches it cleanly (asymmetric link).
The STA then needs candidates . Passive scanning waits for beacons; active scanning sends probe requests. Either costs airtime and battery, and a full scan of 2.4, 5, and 6 GHz is slow compared with a voice packet budget.
802.11k, 802.11v, and 802.11r at CWNA depth
These amendments do not replace the rule that the client decides. They feed the client better information or shorten the handshake.
Amendment Name you will see What the STA or AP gains
802.11k Radio Resource Measurement; neighbor report AP (or a request/response) lists nearby BSS candidates with channel and BSSID so the STA can roam without a full scan
802.11v Wireless Network Management; BSS Transition Management (BTM) AP can request or suggest that a STA move to a listed BSSID (load balance, AP going down, sticky-client nudge). The STA may still refuse
802.11r Fast BSS Transition (FT) Over-the-air or over-the-DS FT handshake so the STA does not repeat a full 802.1X/4-way on every roam. Deep keying is a later security topic
On CWNA-109, recognize the three letters and the job of each. Do not invent a story that 802.11v lets the controller forcibly teleport a client without client support, or that 802.11r is only “faster DHCP.” FT is about authentication/association latency , not about IP addressing. Sticky clients with no k/v/r support still roam late; enabling the features on the AP does nothing unless the STA implements them.
In practice
Voice WLAN design therefore combines RF overlap (so a candidate exists before RSSI dies), client driver tests, and k/v/r on both infrastructure and handsets. A controller or cloud policy may recommend a BSSID via BTM; the MAC still belongs to the STA.
Power save and frame buffering
Radios burn energy in receive. 802.11 lets a STA turn the receiver off and tell the AP to buffer downlink frames until the STA wakes.
Legacy Power Save and PS-Poll
The STA sets the Power Management bit in Frame Control on a frame to the AP (often a null data frame).
The AP marks that AID as asleep and buffers unicast for it.
Every beacon carries a Traffic Indication Map (TIM) . If the STA’s AID bit is set, unicast is waiting.
The STA wakes for a beacon (according to its listen interval), sees its TIM bit, and sends a PS-Poll control frame.
The AP sends one buffered frame. The More Data bit tells the STA whether to poll again.
When the queue is empty, the STA may go back to sleep.
Broadcast and multicast are different. Group frames are not retrieved with PS-Poll. The AP waits for a DTIM (Delivery Traffic Indication Map) beacon, then sends buffered broadcast/multicast. DTIM interval is every n beacons (often 1, 2, or 3). A STA that stays asleep through DTIM misses group traffic — a classic reason mDNS, some DHCP, and some app discovery break for sleeping phones when DTIM is raised to save battery.
- Indicator Where it appears What it means
- TIM Every beacon Per-AID unicast waiting at the AP
- DTIM Every n th beacon After this beacon, buffered broadcast/multicast will be sent
- PS-Poll STA → AP control frame “Send me one buffered unicast frame”
- More Data AP → STA in the delivered frame More unicast remains; stay awake or poll again
- Listen interval Association How many beacon periods the STA may sleep; AP must buffer at least that long
- U-APSD / WMM-PS
Unscheduled Automatic Power Save Delivery (U-APSD), the mechanism behind WMM Power Save , is built for QoS queues. The STA marks access categories as trigger-enabled and delivery-enabled . A QoS Data or QoS Null sent by the STA on a trigger-enabled AC is the trigger — no extra PS-Poll. The AP then sends buffered frames on delivery-enabled ACs during a short service period and sets EOSP (End of Service Period) when done. Voice handsets use this so a talk spurt both uploads audio and pulls the downlink jitter buffer in one wake.
TWT as an HE mention
Target Wake Time (TWT) appears with 802.11ax (High Efficiency). The AP and STA agree on future wake times so the STA is not required to catch every TIM. Individual TWT schedules one STA; broadcast TWT can wake a group. CWNA-109 expects you to recognize TWT as an HE scheduled power-save tool, not to configure every TWT element field. Deep OFDMA scheduling belongs with PHY chapters; here the operational point is: HE can schedule sleep , whereas legacy PS is beacon-and-poll based.
Power-save troubleshooting pattern: client sleeps, AP shows buffered frames, user says “packets never arrive.” Check DTIM for multicast, listen interval versus AP buffer limits, whether WMM-PS is on both sides, and whether a noisy TIM (AID always set) is keeping phones awake.
Protection mechanisms
Newer PHYs send PPDUs that older stations cannot demodulate. Those older stations also cannot load NAV from a Duration field they never decoded. They may see CCA energy, or they may not, especially at the edge of the cell. If they think the medium is idle, they transmit on top of the OFDM frame.
ERP protection in 2.4 GHz
802.11g (ERP-OFDM) sharing a BSS or overlapping a BSS with DSSS/CCK (original 802.11 and 802.11b) is the textbook case. The ERP Information element carries bits such as NonERP_Present and Use_Protection . When protection is on, OFDM senders reserve the medium with a frame the legacy stations can understand:
RTS/CTS at a DSSS/CCK basic rate, then the OFDM data, or
CTS-to-Self at a DSSS/CCK basic rate, then the OFDM data.
CTS-to-Self is cheaper (one control frame). RTS/CTS reaches hidden nodes on both sides of the link. Either way, Duration in the control frame sets NAV on 802.11b neighbors for the length of the OFDM burst they cannot decode.
Situation Risk without protection Typical reservation
ERP-OFDM STA sending in a BSS that still has a CCK STA CCK STA transmits during OFDM PPDU CTS-to-Self or RTS/CTS at 1/2/5.5/11 Mbps
Neighboring 802.11b BSS overlapping the ERP BSS Same collision pattern from next door Use_Protection when NonERP is detected
All-ERP or 5 GHz-only BSS Legacy CCK stations absent Protection can stay off; do not pay CTS tax
HT/VHT mixed-mode protection later reused the same idea (a legacy-readable reservation before an HT/VHT PPDU). For Objective 3.7, lock in ERP + RTS/CTS or CTS-to-Self + mixing OFDM with DSSS/CCK in 2.4 GHz .
Protection is not free. Every CTS-to-Self burns airtime at 1 or 2 Mbps. A single lingering 802.11b client, or an overlapping b-only BSS, can cut 802.11g/n throughput far more than “one slow client uses a slow MCS.” The MAC is spending time on protection frames, not only on the slow client’s data.
On the exam
Client roams; sticky client is late roam logic, not an AP bug by default.
802.11k = neighbor list; 802.11v = BTM request/suggest; 802.11r = faster BSS transition handshake (security details later).
TIM = unicast buffered; DTIM = group traffic after that beacon; PS-Poll = legacy unicast retrieval.
U-APSD uses a QoS trigger instead of PS-Poll; TWT is the HE scheduled wake.
Mixed OFDM + DSSS/CCK in 2.4 GHz → ERP protection via RTS/CTS or CTS-to-Self .
Key Takeaways
Roam decision lives on the STA; k/v/r only assist.
Sleeping STAs require AP buffering and a wakeup contract (TIM/DTIM, WMM-PS, or TWT).
Protection exists so stations that cannot decode a PPDU still set NAV and stay silent.