The Road to AP Discovery in 6 GHz

This is the fourth in a series of continuing blogs about Wi-Fi 6E and the new spectrum bonanza in the 6 GHz frequency band. And this is the first of two blogs where I discuss how the traditional methods of AP discovery no longer apply for Wi-Fi 6E clients.

Wi-Fi clients have traditionally used an active hunt-and-seek method to scan for access points (APs). Clients send out probe request frames across the 2.4 and 5 GHz channels to discover APs. The APs respond with a probe response frame which contains all the necessary information for a client device to learn about the parameters of the basic service set (BSS). For example, the AP’s channel size, SSID, BSSID, security parameters, and much more.

Wi-Fi clients use an active scanning method to send probe request frames across all available channels by the client device. If a client receives probe responses from multiple APs, the incoming signal strength, SNR, and other metrics are typically used by the client to determine which AP has the best signal and thus which AP to connect to.

A client will sequentially send probe requests on each of the supported channels. In fact, it is typical for a client already associated with an AP (and receiving data) to temporarily go off-channel and continue sending probe requests every few seconds across other channels. The primary purpose of off-channel probing is so that a Wi-Fi client can find other APs to potentially roam to.

Figure 1 – Client probing

In the example in Figure 1, the client is already associated to the AP on channel 36. However, the client actively scans and sends probe requests across multiple channels, and other APs will send their information via probe responses. Wi-Fi clients use probing to maintain and update a list of known APs, as shown in Figure 2. In this example, the client has discovered three other APs to which it might potentially roam. This “known AP” list is constantly updated by active off-channel scanning. The roaming thresholds for client devices are proprietary; however 802.11k neighbor information may be used to influence the client's roaming decision.

Figure 2 – Known AP table of client associated to AP on channel 36

How often a Wi-Fi client goes off-channel for active scanning purposes is proprietary and depends on the client device drivers. For example, a Wi-Fi radio in a mobile device, such as a smartphone or tablet, may send probe requests across all channels more frequently than an Wi-Fi radio in a laptop. Some client devices give the user to adjust the probing rate.

Everything changes in 6 GHz

We are now entering the age of Wi-Fi 6E, and probing is actually discouraged in the 6 GHz frequency band. The traditional active scanning method is no longer efficient for initial AP discovery and even worse for roaming between APs. The bottom line is that client probing takes too much time because there are so many channels in the 6 GHz band.

Although the use of 80 MHz channels is widely expected in 6 GHz, probing must occur on the 20 MHz primary channel of any bonded channels. Wi-Fi clients can only send probe requests on 20 MHz channels. Scanning all 59 of the 20 MHz channels in 6 GHz is not an option. Especially for clients that are mobile. Because there are so many channels, a client might not discover all the potential neighbor APs, and roaming could be adversely affected. Passive scanning on each channel would take even longer. It would take over 6 seconds for a client to listen for AP beacon frames on all 59 channels. Six seconds is an eternity in Wi-Fi communications.

Therefore, new in-band and out-of-band AP discovery mechanisms have been designated for Wi-Fi 6E clients. The whole purpose of these new discovery mechanisms is to discourage clients from using active probing the 6 GHz frequency band. In this blog, I will discuss the in-band (6 GHz) AP discovery mechanisms.

There are three potential methods for in-band discovery of 6 GHz APs:

• Passive: Fast Initial Link Setup (FILS) discovery announcement frames
• Passive: Unsolicited probe response frames
• Active: Preferred Scanning Channels (PSC)

The first two in-band (6 GHz) discovery methods are passive. The first method uses FILS discovery announcement frames. A FILS frame is analogous to a condensed beacon. Only critical information such as SSID, BSSID, and channel can be found in a FILS frame. If implemented, the 6 GHz AP sends this broadcast action frame out every 20 time units (TUs), approximately 20 milliseconds, as shown in Figure 3.

Figure 3 - FILS discovery – passive in-band discovery of 6 GHz APs

The second passive method uses unsolicited probe response frames. A probe response frame contains all the same detailed information as a beacon. If implemented, the 6 GHz AP sends these unsolicited probe responses to a broadcast address approximately 20 milliseconds as seen in Figure 4.

Figure 4 – Unsolicited probe responses – passive in-band discovery of 6 GHz APs

You will note that both passive methods are timed well for VoWiFi mobile devices that might use off-channel passive scanning. Both methods are also referred to as fast passive scanning. Both passive methods can be used on all 59 of the 20 MHz channels if implemented. Clients can listen on all the channels, but they are limited in their probing activities.

The third in-band AP discovery method is an active method and the only way Wi-Fi 6E clients are allowed to send probe requests. Active scans on a preferred scanning channel (PSC) are the only method used for in-band probing. Figure 5 depicts all the PSC channels in the UNII-5 band. Effectively, Wi-Fi 6E clients can only send probes requests on every fourth 20 MHz channel.

Figure 5 – Preferred channel scanning – active in-band discovery of 6 GHz APs

The complete list of all the 6 GHz PSC channels is 5, 21, 37, 53, 69, 85, 101, 117, 133, 149, 165, 181, 197, 213, 229. As shown in Figure 6, the PSC channels also serve as the primary channels when channel bonding is used for 80 MHz channels. This has many implications regarding how we will configure primary channels in 6 GHz and the potential for OBSS interference do to improper channel design. I promise to circle back to the topic of primary channels is some future blogs.

Figure 6 – PSC channels and 80 MHz

Once again, the goal is that Wi-Fi 6E clients do not have to probe across all 59 channels. In fact, all three of these in-band discovery methods were originally intended for APs that only have a 6 GHz radio. In other words, these methods are supposed to be used when the AP does not have a 2.4 or 5 GHz radio housed in the same AP form factor. In the real world, most vendors will manufacture tri-frequency band APs. I expect PSC to be a widely used backup mechanism to the better discovery methods that occur out-of-band. However, FILS and UPR will be off by default and should only be used with 6 GHz-only APs.

Most chipsets used in Wi-Fi 6E client radios will also have 2.4 and 5 GHz capabilities, meaning they can scan and connect to APs using the legacy frequency bands. A tri-band AP can inform a Wi-Fi 6E client actively probing the 2.4 GHz or 5 GHz bands about the existing 6 GHz radio co-located in the AP. In my next Wi-Fi 6E blog, I will discuss the out-of-band discovery processes, which will be the primary methods for Wi-Fi 6E clients to find Wi-Fi 6E APs.