Study guide
7.1 Stations, BSS, ESS and the Distribution System
CWNA Certified Wireless Network Administrator CWNA-109
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 CWNA-109 Knowledge Domains and Study Strategy
2 RF Fundamentals
2.1 RF Waves, Propagation, Gain and Loss 2.2 Reflection, Multipath, VSWR and Free-Space Path Loss 2.3 RF Units and the Rule of 10s and 3s
3 RF Measurement and Antenna Systems
3.1 Noise Floor, SNR, RSSI and EIRP 3.2 Line of Sight, Fresnel Zone, Polarization and MIMO 3.3 Antenna Types, Charts, Cables and Lightning Protection
4 Industry Bodies and Legacy PHY
4.1 Industry Organizations and OSI Layers 4.2 Legacy 802.11 PHY Standards 4.3 Spread Spectrum, Modulation and MCS
5 Modern 802.11 PHY and Channel Concepts
5.1 Wi-Fi 4 HT and Wi-Fi 5 VHT 5.2 Wi-Fi 6 and Wi-Fi 6E High Efficiency 5.3 Primary Channels, OBSS, Throughput and Guard Interval
6 Spectrum Rules and WLAN Use Cases
6.1 Frequency Bands, DFS and Transmit Power Control 6.2 WLAN, Bridging, Peer-to-Peer and Mesh
7 802.11 Service Sets and Framing
7.1 Stations, BSS, ESS and the Distribution System 7.2 MSDU, MPDU, PSDU, PPDU and Aggregation 7.3 MAC Frame Format and Addressing
8 Frame Types, Discovery, and Association
8.1 Management, Control and Data Frames 8.2 Scanning, Authentication and Association
9 Channel Access, MAC Operations, and Devices
9.1 DCF, EDCA, RTS/CTS and Interframe Spaces 9.2 Roaming, Power Save and Protection Mechanisms 9.3 Access Points, Controllers and Client Devices
10 PoE, Architectures, and Proprietary Features
10.1 Power over Ethernet, PSE and Power Budgets 10.2 Centralized vs Distributed Forwarding and Network Planes 10.3 Airtime Fairness, Band Steering and RRM
11 WLAN Design and Supporting Services
11.1 Data, Voice, Video and Legacy Client Design 11.2 High-Density, Location Services and Guest Access 11.3 DHCP, DNS, Time, VLANs and AAA
12 WLAN Security
12.1 Weak and Deprecated WLAN Security 12.2 AES, WPA2-Personal and WPA2-Enterprise 12.3 WPA3, SAE and Opportunistic Wireless Encryption 12.4 PMF, Fast Roaming, WIPS and Secure Management
13 RF Validation Surveys and Tools
13.1 Post-Implementation Validation Surveys 13.2 Application and Performance Testing 13.3 Validation Tools: Survey, Protocol and Spectrum
14 Interference, Troubleshooting, and Common Faults
14.1 Co-Channel Contention vs Adjacent Channel Interference 14.2 Protocol Analyzers, Spectrum Analyzers and Monitoring 14.3 Common WLAN Faults and Hidden Nodes
7.1 Stations, BSS, ESS and the Distribution System
Key Takeaways Explain This Topic AI
An 802.11 station (STA) is any device with an 802.11 MAC and PHY, including access points and clients
An infrastructure BSS is one AP plus associated client STAs, and its BSSID is typically that AP radio MAC
The SSID is a shared network name; APs in one ESS reuse the SSID while each BSS keeps a unique BSSID
An ESS is one or more infrastructure BSSs tied together by a Distribution System so they look like one network
- A Harborline-style warehouse uses Ethernet as the DSM: many APs, one SSID, different BSSIDs, and a wired DS
- Last updated: September 2026
Harborline Logistics runs a 200,000-square-foot warehouse. Handheld scanners, forklift tablets, label printers, and a few supervisor laptops all join a network named HL-Warehouse . Walk the floor and it feels like one Wi-Fi network. Capture frames and a different picture appears: every access point uses a different BSSID , and the Ethernet switches behind those APs are doing the work IEEE 802.11 calls the Distribution System (DS) .
This section teaches the service-set vocabulary that Domain 3 expects you to use without mixing up names. The identifiers people see (SSID) are not the identifiers radios use (BSSID). The device people call a “client” is only one kind of station . Independent ExamFinch material here is study teaching from ExamFinch, not a claim of sponsorship by CWNP or IEEE.
Station (STA)
In 802.11, a station (STA) is any device that implements an 802.11 MAC and an 802.11 PHY. That definition includes access points and clients . An AP is an AP STA. A scanner, phone, or laptop is a non-AP STA. If an exam stem says “STA,” do not translate it as “client only.”
STAs share the wireless medium, run CSMA/CA, and exchange 802.11 frames. A STA does not have to be a user endpoint. A wireless bridge, a mesh node, and Harborline’s aisle AP are STAs in the IEEE sense. The AP is special because it also offers DS services : it is the wireless edge that can move MSDUs into and out of the Distribution System.
Harborline’s floor scanners are non-AP STAs. Each aisle AP is an AP STA that creates a BSS, beacons a BSSID, and accepts association. Until you can name both roles as STAs, later MAC-address questions will feel arbitrary.
Infrastructure BSS
The Basic Service Set (BSS) is the atomic 802.11 topology. In infrastructure mode , one AP plus the non-AP STAs associated to it form an infrastructure BSS . The AP is the hub. Client-to-client traffic typically goes to the AP and then onward, rather than STA-to-STA on the air. Direct-link extras exist in the wider standard; CWNA-depth infrastructure BSS still centers on the AP.
The geographic coverage of that BSS is the Basic Service Area (BSA) . In an empty field the BSA looks like a circle. Inside Harborline’s steel racking it looks like a lumpy blob shaped by metal, pallets, people, and forklifts. Two BSAs should overlap enough for a roam, not so much that co-channel airtime collapses—that design work lives in later domains. Here, remember that a BSS is a membership set , and a BSA is the RF footprint of that set.
A non-AP STA becomes a member of an infrastructure BSS by authenticating and associating with the AP (the frame exchange is the next chapter). Until association succeeds, the STA can hear beacons but does not have data service through that BSS.
One physical AP radio can host several virtual APs (VAPs) . Each VAP is a distinct BSS with its own BSSID, even when they share one radio and one channel. Harborline might advertise HL-Warehouse for scanners and HL-Guest for visitors from the same AP hardware: two BSSIDs, two BSSs, two membership lists.
SSID versus BSSID
- Identifier What it is Unique per radio BSS? Harborline example
- SSID Human-readable network name (0–32 octets) No — many APs share it HL-Warehouse
- BSSID 48-bit identifier of one BSS Yes AP-Aisle-1 radio MAC 00:11:22:33:44:01
The SSID (Service Set Identifier) is what users pick. It is not a Layer-2 address. Two buildings can reuse a name; the name does not identify a specific radio.
The BSSID (Basic Service Set Identifier) does. In infrastructure mode, the BSSID is typically the MAC address of the AP radio that operates that BSS. Beacons, Probe Responses, and data frames carry that BSSID so a STA can tell “this AP” from “the AP two aisles over,” even when both strings say HL-Warehouse .
Exam trap: SSID and BSSID are not interchangeable. Same SSID with different BSSIDs is the normal multi-AP ESS. The same BSSID on two APs would be a misconfiguration or a spoof. In an IBSS , there is no AP radio to donate a MAC, so the BSSID is randomly generated (locally administered) by the STA that starts the ad hoc set.
Extended Service Set (ESS)
An Extended Service Set (ESS) is one or more infrastructure BSSs interconnected by a Distribution System so they appear as a single network to LLC . In practice: multiple APs, same SSID , different BSSIDs , one roaming domain.
Harborline’s aisle APs all beacon HL-Warehouse . A forklift tablet associated to AP-Aisle-1 (BSSID …:01 ) can roam to AP-Aisle-12 (BSSID …:0C ) without changing the name the user selected. From the IP stack’s view it is still “the warehouse WLAN.” From 802.11’s view the STA left one BSS and joined another.
Roaming is not automatic magic. The STA must reassociate (or use a fast-roam method taught later). The ESS is the architecture that makes that move possible while keeping one network identity. A single-AP home router is still an ESS of one BSS. “ESS” does not require a dozen APs; it requires infrastructure BSS(s) plus a DS. The interesting exam case is the multi-AP ESS Harborline runs.
If Harborline gave every AP a unique SSID ( HL-Aisle-1 , HL-Aisle-12 ), users would see many networks and roaming would break. If every AP cloned one BSSID, STAs could not tell which radio they were talking to. Correct ESS design: one SSID, many BSSIDs, one DS .
Independent BSS (IBSS)
An IBSS is ad hoc 802.11: STAs communicate directly with no AP and no DS . Two engineers at Harborline’s loading dock who form a temporary laptop-to-laptop link are in an IBSS. There is no infrastructure BSS, no AP-donated BSSID, and no Ethernet DS carrying 802.11 distribution service.
IBSS is useful for a pop-up peer network. It is a poor fit for a warehouse that needs roaming, centralized policy, and wired servers. Do not call an infrastructure BSS an IBSS. The letter I means Independent , not Infrastructure.
Distribution System (DS) and DSM
The Distribution System (DS) interconnects BSSs and moves frames between STAs that are not in the same BSS—including frames that must reach a wired server. The AP is the STA’s portal into the DS.
The Distribution System Medium (DSM) is the medium the DS uses. At Harborline, the DSM is Ethernet : each AP uplink hits an access switch, those switches hit distribution, and scanners reach WMS servers on the wired LAN. That wired fabric is the DS/DSM the 802.11 architecture assumes in a classic ESS.
The DS can also be wireless (WDS / wireless bridging / some mesh backhauls). Then the DSM is radio, and four-address frames appear in section 7.3. Harborline’s design choice is the common enterprise one: wired Ethernet DS , wireless only for the last hop to STAs.
What the DS does on this floor:
Delivers a frame from a scanner in aisle 1 to a wired WMS host.
Delivers a frame from that host back to the scanner through the correct AP.
After a roam, delivers the next frames through AP-Aisle-12 instead of AP-Aisle-1.
The DS is not “the SSID.” It is the interconnection system behind the APs. Integration with a non-802.11 LAN happens at a portal function—in a simple warehouse AP, that is the AP’s wired side bridging 802.11 MSDUs onto 802.3.
Harborline three-AP walkthrough
- AP BSSID (typical AP radio MAC) BSA
- AP-Dock 00:11:22:33:44:10 Receiving doors
- AP-Aisle-1 00:11:22:33:44:01 Racking 1–6
- AP-Aisle-12 00:11:22:33:44:0C Racking 7–12
All three uplinks are 802.3 into the warehouse switching fabric (DSM). Together they are one ESS named HL-Warehouse . A scanner associated to AP-Aisle-1 has a wireless hop to that AP’s BSSID. When the frame is destined to the WMS server, the AP forwards it onto the Ethernet DS. When the scanner drives toward aisle 12, it hears a different BSSID, roams, and the DS now uses AP-Aisle-12 as the wireless edge.
Topology comparison
- Topology AP present? Typical BSSID DS used? STA-to-STA path
- Infrastructure BSS Yes AP radio MAC Yes, to leave the BSS Via AP / DS
- ESS Yes (one or more) Distinct per BSS Yes — interconnects BSSs Via AP and DS
- IBSS No Random / locally administered No Direct on the air
Keep the exam vocabulary as roles , not product names. Controller, cloud AP, and CAPWAP tunnel are implementation choices that still sit on this IEEE model: STAs, BSSs identified by BSSIDs, an SSID shared across an ESS, and a DS/DSM that ties the APs together.