11 ms·

Recommended settings for Wi-Fi routers and access points

303 points by butz 4y ago

Avamander 4y ago
It's actually really annoying that it shows a permanent Privacy Warning for disabling "Private WiFi address" you can't disable on trustworthy networks. Apple you don't know, so stop speculating, mkay. The rest is nice though, bad configurations finally display a warning. People harden their WiFi configurations which is nice.
- JoBrad 4y ago
  Agreed. It would be nice if you could specify a network add your home network, and private address would just be disabled there.
wildekek 4y ago
Most problems with Apple products and WiFi are related to multicast settings. Not a single word about it in the article.
- muppetman 4y ago
  Care to elaborate? My experience, limited though it is, seems to point more to DTIM interval. Which wifi setting that impacts multicast do you mean?
  - tinus_hn 4y ago
    Probably it’s igmp snoop, which kind of a protocol violation. It’s understandable because multicast over WiFi is really a problem, especially if you’re transmitting a TV stream, but if the snoop implementation is poor or out of date you’ll end up breaking anything based on mDNS/Bonjour, so pretty much Apple build the last decade, and it’s difficult to diagnose. If you have TV based on multicast, put it on a separate VLAN so it doesn’t end up spreading over your whole lan.
    - NobodyNada 4y ago
      Do you happen to have any resources/tools/ideas on how to troubleshoot this? I’m having issues with mDNS sometimes just not working on a network I maintain. I can run Wireshark on two devices and see that one is sending out mDNS queries and the other isn’t receiving them at all. It’s not just mDNS though; all multicast traffic is affected (sometimes ARP doesn’t even work, and I can’t ping the other device by IP).
      - klabb3 4y ago
        I've had an issue where mdns transmit would cease after X minutes uptime on windows. Nothing even shows up in Wireshark. I'm still not sure why but I'm assuming the NIC driver for windows didn't like it. Switching from wifi to ethernet fixed the problem. Switching to Linux (same machine) also fixed the problem. Oh and it was only certain multicast udp that was affected. Regular ip broadcast still worked.
      - tinus_hn 4y ago
        ARP is not multicast in the IGMP sense, if that doesn’t work your cabling or switches are broken or you have a serious firewall issue. But given it sometimes doesn’t work, probably hardware.
qzw 4y ago
I’ve tried using the same SSID for 2.4Ghz and 5Ghz but find that some devices (my kids’ Fire tablets, for example) end up hanging on to a weak 5Ghz connection when they would’ve been better off switching to 2.4Ghz. But if the bands have different SSIDs, I can at least easily force them to switch manually.
- guidedlight 4y ago
  Your router needs to support 802.11k for devices to reliably switch between wifi networks using the same SSID. This is normally a feature offered by enterprise or pro-consumer equipment.
  - oneplane 4y ago
    Works fine without K or R, but then the client has to do more work and lots of client devices have bad software on them. On top of that, while K and R can help, even then it needs to work with the client to have all the benefits.
  - xrisk 4y ago
    openwrt offers this. Another reason to install it whenever you can!
  - illiac786 4y ago
    Let's not forget that the client (phone, tablet...) also must support 802.11k for it to work.
- jon_adler 4y ago
  My Ubiquiti WAPs support band steering with a minimum signal strength setting for 5Ghz. Perhaps you could upgrade to get a better experience?
  - vetinari 4y ago
    The decision is always client side, just like with roaming. There are ways to influence the client, which is basically what Ubiquiti is doing (and the client can ignore), and the last resort is to always kick the client once the signal is below some threshold.
culopatin 4y ago
Is it actually good to have the same name for 2.4Ghz and 5Ghz SSIDs? Would devices always pick the 5Ghz if they can? I don’t want to be connected to 2.4 all the time just because it might have a marginally better signal strength and be limited to 2.4Ghz speeds.
- exitheone 4y ago
  From my experience, both Android, Linux and Windows consistently fail to use the faster 5ghz WiFi when starting out on the 2.4ghz. That's why I still have two separate SSIDs at home.
- jwr 4y ago
  I've been doing this for many years now with excellent results. Ubiquiti APs and mostly Apple devices, FWIW.
- oynqr 4y ago
  The phone will pick 5GHz when it's both needed (the phone isn't asleep) and it is actually faster than 2.4GHz. Forcing 5GHz is bad when your phone is good at roaming.
- misterdata 4y ago
  Some APs (eg Ubiquiti) can actually steer clients from one band to the other based on minimum RSSI and other parameters (including device compatibility, and you can exclude or force a band for individual devices), which prevents this from happening.
- muppetman 4y ago
  Look up band-steering. There's many ways to make a client prefer 5Ghz.
- neilalexander 4y ago
  My experience with using the same SSID for both bands is that most devices will do the right thing, pick based on signal strength and will reevaluate that choice fairly often. However, a small number of devices (normally older or cheaper devices) will often stick to a band until they have no other choice. That said, a weaker 5GHz signal can sometimes still be better or more stable than a stronger 2.4GHz signal since the risk of interference in the 2.4GHz band is often much higher. I’ve never ever had enough of an issue to worry about it.
matsemann 4y ago
Have Apple devices become better "citizens" lately? Remember at Uni they for some time banned Apple devices, as they would mess up DHCP by reusing stale IP assignments to make it seem quicker to connect or so. Edit: found a discussion from the time https://news.ycombinator.com/item?id=2755461 https://news.ycombinator.com/item?id=2755461
- neilalexander 4y ago
  This isn’t unique to Apple, I believe Windows also does this and there is even an RFC explaining the concept. Also it’s not so much that it deliberately “messes up” anything, it’s more that a DHCP server shouldn’t tell a client device that it holds an address for a certain amount of time and then either not honour it or forget that state. It’s a reasonable thing for a client to resume using an address if there is time still left on the lease and wasn’t told otherwise and the ARP collision detection mechanism is supposed to detect conflicts before it becomes an issue. Unfortunately, DHCP implementations in the wild vary in quality considerably and the people administering them don’t necessarily understand the inner workings of DHCP all that well either, because as long as it hands out addresses, they normally don’t ever need to.
- simondotau 4y ago
  Such a ridiculous complaint, after all, it's not like there's a worldwide shortage of non-routable IPs. Just make your network address space large enough that your DHCP server is rarely, if ever, reassigning the same IP address more than once. I see so many network operators desperate to "right size" their IP ranges when they could just allocate a /18 or /16 or even larger. Microsoft and Apple might not be following the DHCP spec correctly, but they're breaking it for the right reasons. Offering very long lease times is one way to increase apparent network responsiveness to your end users. Give devices an IP address for weeks or even months if you can. Why not?
  - londons_explore 4y ago
    Lots of routers start choking when they have more than a few thousand DHCP leases. Often, they do compute hungry things periodically with every entry in the DHCP lease table - like for example tracking download and upload bandwidth and bytes transferred per client every second using some low performance python script. This has become especially bad since most devices started using a new mac address for every connection. It means an apple device going in and out of range of a wifi point all night can easily create thousands of leases, all active for 7 days or whatever the default (and often unconfigurable) lease time is. You soon run out of IP's, and even if you don't, you run into the aformentioned performance issues.
nullify88 4y ago
These days I just disable 2.4ghz completely since all our devices support 5ghz and we have enough (2) access points around the house to give a good signal anywhere.
- julianlam 4y ago
  That's fortunate, what usable range do you see with your 5GHz network? I find the range is pretty dismal even with a wood frame and drywall house. My AP can be right below me and the signal is only perhaps 50% Wifi Analyzer will show the signal as coming from 30+ meters away when it is only about 4m (with multiple walls and floors in between)
  - londons_explore 4y ago
    Insulated walls often have foil backed insulation which is really good at blocking wifi. Even with devices the same side of the wall, the foil makes nice constructive and destructive interference patterns that mean a device that's working great can lose all signal if you move it a few inches. I really wish insulation makers would use a different backing material - the supposed reflectivity of the foil doesn't really add much to the insulation properties anyway.
    - elric 4y ago
      > the supposed reflectivity of the foil doesn't really add much to the insulation properties anyway Can you elaborate on that? Seems hard to believe. There are many kinds of insulation without foil, and the foil backed variants tend to be more expensive. It's hard to imagine that we'd be making the stuff like that without a good reason.
      - b3morales 4y ago
        The "good" reason is often that the seller can talk the buyer into a higher price for the extra "feature". It can even be higher marginally: i.e. insulation costs $0.50 to manufacture, and they can sell it for $1; adding foil costs an additional $0.15 but now they can charge $1.50. This is common, even pervasive, with consumer pricing.
newsclues 4y ago
Please make a modern airport base station.
- spamboy 4y ago
  Seriously, this. I run an enterprise grade Meraki deployment (router and access point) with all the 802.11ax bells and whistles. I have 8 HomePods/minis in a ~1000 sq ft space. They can reliably play music all synced up maybe… 20% of the time? It’d be really great if Apple just provided an AP that would drive them without issues.
sinuhe69 4y ago
One negative side-effect of the same SSID policy is you might not be able to share your WiFi password by simply putting your devices close to each other. Ordinarily, Apple devices can share WiFi password easily by putting an already set up device close to a new one. But if they are momentarily connected to different networks (frequencies), even though they have the same SSID and same password, Apple software will see them (correctly) as on two different networks so the password will not be shared even when the password is the same on both networks. I don’t know if the automatic band switching is any better than the manual one but I find this issue is quite a hassle.
- gruez 4y ago
  >But if they are momentarily connected to different networks (frequencies), even though they have the same SSID and same password, Apple software will see them (correctly) as on two different networks so the password will not be shared even when the password is the same on both networks. I don't get it, how is this an issue? If both devices are already connected to the same SSID, then both devices already have the password. Why would you need to share passwords?
  - jzwinck 4y ago
    One is connected and logged on. The other sees the same-named network and is not logged on yet because it doesn't know the password. Two different senses of "connected."
  - woqe 4y ago
    Multiple non-unique SSIDs (name) can exist within a single router. More extremely, you and your neighbor can have the same SSID on two different routers.
- exikyut 4y ago
  This might actually be completely fixable by borrowing the trick Bluetooth-less Wi-Fi lightbulbs use for pairing. To pair, the lightbulb's ESP8266 (or cheaper equivalent) sits with its Wi-Fi radio in monitor mode - not authenticated to anything, just watching All The Packets flying back and forth - and the smartphone sprays crafted packets to 255.255.255.255 with specific lengths (Wi-Fi encryption does not alter packet length), where the length of each packet taken in sequence then interpreted as ASCII represents the encoded setup packet containing the target SSID and password. (Of course that setup packet is plaintext and I was able to vacuum up your password *sad exploding brain* D:) Apple could do the same basic idea here: have the connected iPhone spray a magic packet sequence to 255.255.255.255, representing say an OTP-esque nonce or similar sort of thing that is communicated to the non-connected iPhone OOB (eg Bluetooth or cellular). If the non-connected iPhone can see this sequence fly past in monitor mode, then ultimately it's on the same network even if the SSID is different. ...Or at least this all works if you can associate packet X, with length Y, *with SSID Z*. If you can't localize the sequence to an SSID without being authenticated this doesn't work.
justusthane 4y ago
Unfortunately the only way I’ve been able to get my HomePod Minis to work reliably is to disable the 5Ghz band completely and only have 2.4 — even when they’re in the same room as the AP! Having two separate SSIDs and joining them to the 2.4GHz SSID also works, but it’s kind of a pain and you lose certain functionality if they aren’t on the same SSID as your iPhone.
- psydvl 4y ago
  I have in my router options possibility to choose what Gz should device connect to: for example, old notebook I connect to 2.4 only. Maybe you should enable same for homepod?
- rcarmo 4y ago
  The SSID should’t matter if they are on the same IP address space. Make sure your router isn’t handing out different DHCP ranges for each SSID or frequency range.
- incogitomode 4y ago
  Interesting to read you have issues with your HomePod Mini. Mine has been stable, however all my (7) original HomePods had constant issues connecting starting around OS 14.5 / 15. I have to imagine it's related to AirPlay 2. I went through two different WiFi-6 networks, in every possible configuration, with no luck. Cumulatively I must have spent 20-30 hours debugging the networks, and finally happened upon something that works, albeit with caveats. I got two Eero Pro 6 access points, and disabled band steering — it was an experimental setting at the time — and everything worked! I've since re-enabled the setting and immediately have issues so I feel confident saying band steering is the issue. Since then Eero has updated the setting to include AP switching and it's called "client steering". So, unfortunately, to have my HomePods connect I sacrifice AP handoff and have to toggle wifi if I move my laptop to the other end of the apartment. There are quite a few folks who have brought this up in an Apple issue, and I have a friend in Tucson — where radio interference isn't an issue — with the same problem.
hjuutilainen 4y ago
Two more useful and related Apple KB articles: macOS wireless roaming for enterprise customers https://support.apple.com/en-us/HT206207 https://support.apple.com/en-us/HT206207 About wireless roaming for enterprise https://support.apple.com/en-us/HT203068 https://support.apple.com/en-us/HT203068
- exikyut 4y ago
  This is an offtopic side-track/distraction, but I've been completely thrown by the masking in the screenshots and example CSV dump. The first thing I'm distracted by in the expanded Wi-Fi menu in the first link is "Address: xx:x0:00:00:x0:00:00". wHaT wErE tHe 'x's bEfOrE?? Why mask out the first 1½ octets of the MAC when the first 3 octets are manufacturer-specific and (IIUC) would have been one of Apple's prefixes, and given that the assignment is apparently random¹ this would practically have leaked absolutely nothing. Next, the first half of the 5th octet is an 'x'. wHy??//? 𝖜𝖍𝖆𝖙 𝖉𝖔𝖊𝖘 𝖎𝖙 𝖒𝖊𝖆𝖓 Further down in the menu we have... OwO what's this™, 𝕒 🄷🄾🄻🄻🅈🅆🄾🄾🄳 𝕀ℙ 𝕒𝕕𝕕𝕣𝕖𝕤𝕤? "010.101.0.10"? Do I briefly switch to octal to parse that first octet? Pretty impressed the Mac in question is the network's router though - especially given it's a Wi-Fi network. Oh - sorry, you got a bit of sarcasm on you there, let me get it off :P Then we have the scan window further down in the same article. OK, so the distribution of noughts and crosses :) is apparently correlated with the security setting (the protocols are all over the place and seem to represent different routers). I honestly don't get it. Moving onto the next article, ...oh no the 'X's have gotten angry and are now in ＵＰＰＥＲＣＡＳＥ! I wonder where "01:01:00:01:XX:01" is??? "10:01:10:01:X0:10" looks positively scary. A small tangent is required to remark about how everything that has ever happens on an iPhone happens at 09:41 really has gone so far as to be unrealistic. The original idea was just to have the marketing materials acknowledge when iPhone went live at WWDC. These screenshots with the "scan result: 09:41:45 AM" are absurd, both because iOS 11 did not exist back then, and because it would not be possible to practically do a network scan and deployment at the exact same nanosecond the OS you're supposedly supposed to be using is being debuted. The one event categorically predates the other. Hmph. OK, moving to the bottom of this article we get the... notascreenshotsoapparentlytheartdepartmentcantseeit™ CSV data. With 𝘤𝘰𝘯𝘧𝘶𝘴𝘪𝘰𝘯 inside©! Firstly, unfortunately I don't know how to do a "this SSID and this SSID within 10km of each other" search, so I don't know if ACES and Cuba are actually real, but what I can say is that while the first listed MAC address turns out to be invalid (makes sense), the second and third entries are Apple-prefixed - which doesn't make any sense since this is supposed to be a list of access points, not client devices - but in any case, both MACs are valid and resolve to a street address - 𝔀𝓪𝓽, 𝓪𝓹𝓹𝓵𝓮? 𝓾 𝓸𝓴? - and while the second MAC only has one entry, the third has a location history that includes an address <10 meters away from the second one. Hi developer who gets around! ¹ https://apple.stackexchange.com/questions/49948/differentiating-apple-products-by-their-mac-addresses https://apple.stackexchange.com/questions/49948/differentiat..., http://www.coffer.com/mac_find/?string=apple http://www.coffer.com/mac_find/?string=apple
exabrial 4y ago
How does the carrier wifi network thing work? Some sort of radius auth?
thedougd 4y ago
My Mac displays a permanent warning that my AP name isn't unique enough. Funny enough, I've never seen anyone else use it in the wild.
andix 4y ago
Funny thing about WPA3: it works with all my devices (including a 12 year old think pad x201s), but only on Linux. On windows they all can’t do WPA3, because the cards are „unsupported for WPA3“.
- oneplane 4y ago
  The difference is probably in the way WPA is handled; WPA Supplicant can be made to work with any radio module that supports passing through the authentication and encryption. But Windows doesn't use WPA Supplicant and instead relies on each manufacturer to make sure their driver either has its own WPA Supplicant or uses on-chip authentication and encryption in the WiFi module itself. The big difference between them is that on Linux it will work, but heavy traffic will eat CPU cycles. On Windows it simply might not work at all, but when it does, and if the driver is not written by 1000 monkeys on typewriters, it can offload a lot of heavy lifting to the WiFi ASIC. I'd say that in all cases, the WiFi chip manufacturers are to blame, but the software fallback that WPA supplicant provides should really be the lowest bar any device or OS should be able to pass.
  - zekica 4y ago
    Only authentication will not be offloaded, actual data encryption still is. The only exception is if your driver doesn't support management frame protection (802.11w). Then, if your AP has 11w enabled or you are using WPA3, it will use software encryption. ath9k, ath10k, ath11k, ath9k_htc, ath6kl, brcmfmac, brcmsmac, iwlwifi, iwlegacy, mt76, mwifiex, mwl8k, rtl8xxxu, all rtl8xxxe drivers support 11w, while some others: rt2xxxpci rt2xxxusb, ipw2200, carl9170 don't.
    - oneplane 4y ago
      In the old days we needed a lot of tricks because firmware loading either didn't work or we didn't have the firmware binaries yet, so even (IIRC) ath9k didn't utilise on-ASIC for everything. But that was in the B (and maybe G) days.
  - spookthesunset 4y ago
jimmaswell 4y ago
Does this mean Apple devices whine at you for joining open networks at grocery stores etc?
- JoBrad 4y ago
  There’s a notice saying it’s unprotected.
tzs 4y ago
> Make sure that your device has Location Services turned on for Wi-Fi networking, because regulations in each country or region define the Wi-Fi channels and wireless signal strength allowed there. That one surprised me. I'd have expected that there would be a field in the data broadcast from the router that identified what country's or region's regulations it is operating under, and that client devices designed to handle multiple multiple countries or regions would use that to select channels and power levels that are legal there.
- tracnar 4y ago
  A rogue AP could then trick devices into breaking regulations :)
- jeffbee 4y ago
  There is. The wifi beacon frame contains regulatory information. https://www.oreilly.com/library/view/80211-wireless-networks/0596100523/ch04.html#wireless802dot112-CHP-4-FIG-38 https://www.oreilly.com/library/view/80211-wireless-networks... I also find it odd that Apple recommends this since users must disable location services on M1 mac mini systems to make the wifi work. It's just flat out broken and has been that way since they launched it.
  - icebergonfire 4y ago
    I don't want to invalidate your experience, but allow me to offer an anecdata counterpoint: Wifi works perfectly on my M1 Mac Mini and has since day 1 (to the point I never bothered to wire it up), and I have location services enabled. I wonder what other variables are in play here that make it not work for you.
    - jeffbee 4y ago
      Not sure either but if you google it you’ll see I’m not alone.
chevman 4y ago
Funny timing. Was helping my father in law troubleshoot his WiFi this weekend and came across this article. All his wireless printers and his really old iPad (I think gen 1 or 2) refused to connect suddenly a couple weeks ago. No apparent changes or new devices on his network. Turned out Comcast pushed an update to his wireless gateway that enabled ‘managed security functionality’. Part of this included forcing WPA3 security on all devices. Once I figured out how to set it back to WPA2 for the 2.4 ghz network, all the old devices reconnected. Good times :)
- jms703 4y ago
  I don't think WPA3 is totally ready for widespread use (yet) due to older IoT devices. I'm not even totally sure what problem it solves, so I should probably read up on it.
- teaearlgraycold 4y ago
  You’d think they’d have some kind of migration system to detect if there are devices on the network that are lost after the switch over and revert if so.
  - daed 4y ago
    You are clearly not a Comcast customer.
    - teaearlgraycold 4y ago
      Sonic Fiber!
  - CharlesW 4y ago
    This is a brilliant idea. It makes me wonder if there are any user-friendly network scanners that do snapshot diffs.
- cronix 4y ago
  This is one of the main reasons I bought my own docsis 3 router for about $100 6 years ago. Comcast doesn't have access to it. The other bonus is you save a lot of money over the years by not having to rent it from Comcast, every month for the lifetime of your service. It pays for itself the first year. You give up pay per view/on-demand which never affected me, but something to consider if he uses that. I think you can still get ppv but have to call in or something and can't just order it using the remote, but my memory on that is foggy since I never use ppv. They make good Christmas presents and saving the FIL money always builds up the brownie bank :)
janandonly 4y ago
Not sure I agree with Apple’s recommendations. don't give your 2.4GHz and 5GHz bands different names. I purposefully did set different names for these two band. I also only gave all my devices the password for the 5GHz band. Because latency is lower on that band. I cannot disable 2.4GHz band because my old WiFi printer doesn’t support the 5GHz but if it wasn’t for that I would disable it altogether.
- legulere 4y ago
  The problem with the 5 GHz band is that it can be turned off any time because of radar: https://en.wikipedia.org/wiki/Dynamic_frequency_selection https://en.wikipedia.org/wiki/Dynamic_frequency_selection
  - simoncion 4y ago
    Only certain slices of it. The article you linked to mentions the frequencies in the US that must use DFS. This table in the article _it_ links to goes into much more detail. <https://en.wikipedia.org/wiki/List_of_WLAN_channels#4.9%E2%80%935.0_GHz_(802.11j)_WLAN https://en.wikipedia.org/wiki/List_of_WLAN_channels#4.9%E2%8...> Look for the cells that contain "DFS" to see on which channels APs are required to channel hop if they believe they have heard radar. In my personal experience, channel hopping works fine.
  - exikyut 4y ago
    Ooooh. Now I wanna find out how I can fly over an area with a drone and make pictures like the example! On a somewhat smaller, more theoretical note, I wonder what "a radar signal" is as far as a Wi-Fi SoC is concerned. Sounds like the wild-west, much-trickier-to-block counterpart to the old deauth packet attack. At least the FCC/etc can get shouty if needed... Edit: Oh, right, it only goes offline if channel selection is manual. And presumably radar only uses the one band (?) so you couldn't flood it out or play cat and mouse. Hmph, this is actually well designed. Given that this requires pretending to be a radar you might as well switch to a smaller pot of hot water and just get a 5.8GHz signal jammer.
- orev 4y ago
cmeacham98 4y ago
> It's usually best to enable every mode offered by your router, rather then a subset of those modes. All devices, including older devices, can then connect using the fastest radio mode they support. This also helps reduce interference from nearby legacy networks and devices. Is this really the best advice? My (limited) understanding is that if a device connects with an older standard everyone gets slowed down by this. My router has a setting it calls "Airtime Fairness" that purports to combat this.
- zekica 4y ago
  Airtime fairness helps a lot but if a 11b device connects, you automatically lose 1/3 of the throughput even when that device is not active. 11g can also slow down others but only a couple percent. Also, if you disable 11b rates you can have more SSID beacons (more networks) in parallel as the beacon is then transmitted at 6Mbps PSK instead of 1Mbps DSSS.
eBombzor 4y ago
If you live in an apartment please turn down the transmit power for the sake of everyone in the building.
prophesi 4y ago
Another recommendation I'd add is appending "_optout_nomap" to your SSID name. That will let you opt out of both Microsoft and Google's access point data collection.
- kartugestu 4y ago
  is the "_optout" part of "_optout_nomap" required? i thought "_nomap" is sufficient. https://support.google.com/maps/answer/1725632?hl=en#zippy=%2Chow-do-i-secure-my-wireless-network-with-strong-password-encryption%2Cwill-my-access-point-be-removed-from-other-location-services%2Chow-do-i-opt-my-access-point-out-of-google-location-services https://support.google.com/maps/answer/1725632?hl=en#zippy=%...
  - kartugestu 4y ago
    ah _optout is microsoft i did not know that.
    - prophesi 4y ago
      Yeah I only learned about it recently. And apparently "_nomap" _has_ to be at the end of the SSID. A weird system for something that should be opt-in anyways.
deleted 4y ago
[deleted]
encryptluks2 4y ago
I'm surprised hiding the SSID makes it less secure? Or they just saying it isn't worth the inconvenience?
- cesarb 4y ago
  If you hide the SSID, your phone or laptop has to ask for that specific SSID in a probe request every time it scans for nearby networks, even when it's nowhere near your router. If you don't hide the SSID, your phone or laptop can just ask for the wildcard SSID in the probe requests, or even passively listen for the periodic beacons. That is: if you hide your SSID, not only you're announcing to everyone around you all the time your SSID, but also it doesn't hide it very well, since the SSID is still sent in plaintext in the probe request every time your devices attempt to connect to your router.
  - encryptluks2 4y ago
    I don't see how that is any different than having a public SSID. The goal behind hiding it isn't to prevent people from knowing it, just make it less obvious.
wtvanhest 4y ago
Does anyone have a recommended way to monitor my wifi connection on my PC or Mac over time? I recently started at a new company which uses google meets and I’m having an issue where my out sound and video output freeze for people communicating with me for 1 to 3 seconds. I’ve replaced the PC and I’m still having the issue so Id like to troubleshoot the problem by ensuring my network connection is working correctly. Hardware: replaced google home wifi mesh with top of the line eero mesh.
- webmobdev 4y ago
  Maybe Wifi Scanner - https://www.accessagility.com/wifi-scanner https://www.accessagility.com/wifi-scanner
- grosswait 4y ago
  Try running mtr continuously. Press d twice to see color and symbol encoded latency.
JuliusMeinl 4y ago
May I ask: How do the Cisco AP perform in comparison to other companies products? Is Cisco really up to date when it comes to wireless? I just set up a "last gen" 2702i and I am still in the process of tuning it to perform as good as my modem/router/ap combi device I used before, and my experience is not really pleasant, but I could imagine that at large scale deployments there is still nothing better then Cisco and a lot of the features/setting that seem unintuitive are necessary in such cases. But yes in my case I had to go to (autonomous) firmware from 2018 to be able to use the GUI, because every newer autonomous firmware breaks the GUI, the newer ones (the newest is just some months old) all have a major bug where you can't save the changes you made and get an 404 error...

303 points by butz 4y ago

It's actually really annoying that it shows a permanent Privacy Warning for disabling "Private WiFi address" you can't disable on trustworthy networks. Apple you don't know, so stop speculating, mkay. The rest is nice though, bad configurations finally display a warning. People harden their WiFi configurations which is nice.

JoBrad 4y ago
Agreed. It would be nice if you could specify a network add your home network, and private address would just be disabled there.

wildekek 4y ago

Most problems with Apple products and WiFi are related to multicast settings. Not a single word about it in the article.

muppetman 4y ago
Care to elaborate? My experience, limited though it is, seems to point more to DTIM interval. Which wifi setting that impacts multicast do you mean?
- tinus_hn 4y ago
  Probably it’s igmp snoop, which kind of a protocol violation. It’s understandable because multicast over WiFi is really a problem, especially if you’re transmitting a TV stream, but if the snoop implementation is poor or out of date you’ll end up breaking anything based on mDNS/Bonjour, so pretty much Apple build the last decade, and it’s difficult to diagnose. If you have TV based on multicast, put it on a separate VLAN so it doesn’t end up spreading over your whole lan.
  - NobodyNada 4y ago
    Do you happen to have any resources/tools/ideas on how to troubleshoot this? I’m having issues with mDNS sometimes just not working on a network I maintain. I can run Wireshark on two devices and see that one is sending out mDNS queries and the other isn’t receiving them at all. It’s not just mDNS though; all multicast traffic is affected (sometimes ARP doesn’t even work, and I can’t ping the other device by IP).
    - klabb3 4y ago
      I've had an issue where mdns transmit would cease after X minutes uptime on windows. Nothing even shows up in Wireshark. I'm still not sure why but I'm assuming the NIC driver for windows didn't like it. Switching from wifi to ethernet fixed the problem. Switching to Linux (same machine) also fixed the problem. Oh and it was only certain multicast udp that was affected. Regular ip broadcast still worked.
    - tinus_hn 4y ago
      ARP is not multicast in the IGMP sense, if that doesn’t work your cabling or switches are broken or you have a serious firewall issue. But given it sometimes doesn’t work, probably hardware.

qzw 4y ago

I’ve tried using the same SSID for 2.4Ghz and 5Ghz but find that some devices (my kids’ Fire tablets, for example) end up hanging on to a weak 5Ghz connection when they would’ve been better off switching to 2.4Ghz. But if the bands have different SSIDs, I can at least easily force them to switch manually.

guidedlight 4y ago
Your router needs to support 802.11k for devices to reliably switch between wifi networks using the same SSID. This is normally a feature offered by enterprise or pro-consumer equipment.
- oneplane 4y ago
  Works fine without K or R, but then the client has to do more work and lots of client devices have bad software on them. On top of that, while K and R can help, even then it needs to work with the client to have all the benefits.
- xrisk 4y ago
  openwrt offers this. Another reason to install it whenever you can!
- illiac786 4y ago
  Let's not forget that the client (phone, tablet...) also must support 802.11k for it to work.
jon_adler 4y ago
My Ubiquiti WAPs support band steering with a minimum signal strength setting for 5Ghz. Perhaps you could upgrade to get a better experience?
- vetinari 4y ago
  The decision is always client side, just like with roaming. There are ways to influence the client, which is basically what Ubiquiti is doing (and the client can ignore), and the last resort is to always kick the client once the signal is below some threshold.

culopatin 4y ago

Is it actually good to have the same name for 2.4Ghz and 5Ghz SSIDs? Would devices always pick the 5Ghz if they can? I don’t want to be connected to 2.4 all the time just because it might have a marginally better signal strength and be limited to 2.4Ghz speeds.

exitheone 4y ago
From my experience, both Android, Linux and Windows consistently fail to use the faster 5ghz WiFi when starting out on the 2.4ghz. That's why I still have two separate SSIDs at home.
jwr 4y ago
I've been doing this for many years now with excellent results. Ubiquiti APs and mostly Apple devices, FWIW.
oynqr 4y ago
The phone will pick 5GHz when it's both needed (the phone isn't asleep) and it is actually faster than 2.4GHz. Forcing 5GHz is bad when your phone is good at roaming.
misterdata 4y ago
Some APs (eg Ubiquiti) can actually steer clients from one band to the other based on minimum RSSI and other parameters (including device compatibility, and you can exclude or force a band for individual devices), which prevents this from happening.
muppetman 4y ago
Look up band-steering. There's many ways to make a client prefer 5Ghz.
neilalexander 4y ago
My experience with using the same SSID for both bands is that most devices will do the right thing, pick based on signal strength and will reevaluate that choice fairly often. However, a small number of devices (normally older or cheaper devices) will often stick to a band until they have no other choice. That said, a weaker 5GHz signal can sometimes still be better or more stable than a stronger 2.4GHz signal since the risk of interference in the 2.4GHz band is often much higher. I’ve never ever had enough of an issue to worry about it.

matsemann 4y ago

Have Apple devices become better "citizens" lately? Remember at Uni they for some time banned Apple devices, as they would mess up DHCP by reusing stale IP assignments to make it seem quicker to connect or so. Edit: found a discussion from the time https://news.ycombinator.com/item?id=2755461 https://news.ycombinator.com/item?id=2755461

neilalexander 4y ago
This isn’t unique to Apple, I believe Windows also does this and there is even an RFC explaining the concept. Also it’s not so much that it deliberately “messes up” anything, it’s more that a DHCP server shouldn’t tell a client device that it holds an address for a certain amount of time and then either not honour it or forget that state. It’s a reasonable thing for a client to resume using an address if there is time still left on the lease and wasn’t told otherwise and the ARP collision detection mechanism is supposed to detect conflicts before it becomes an issue. Unfortunately, DHCP implementations in the wild vary in quality considerably and the people administering them don’t necessarily understand the inner workings of DHCP all that well either, because as long as it hands out addresses, they normally don’t ever need to.
simondotau 4y ago
Such a ridiculous complaint, after all, it's not like there's a worldwide shortage of non-routable IPs. Just make your network address space large enough that your DHCP server is rarely, if ever, reassigning the same IP address more than once. I see so many network operators desperate to "right size" their IP ranges when they could just allocate a /18 or /16 or even larger. Microsoft and Apple might not be following the DHCP spec correctly, but they're breaking it for the right reasons. Offering very long lease times is one way to increase apparent network responsiveness to your end users. Give devices an IP address for weeks or even months if you can. Why not?
- londons_explore 4y ago
  Lots of routers start choking when they have more than a few thousand DHCP leases. Often, they do compute hungry things periodically with every entry in the DHCP lease table - like for example tracking download and upload bandwidth and bytes transferred per client every second using some low performance python script. This has become especially bad since most devices started using a new mac address for every connection. It means an apple device going in and out of range of a wifi point all night can easily create thousands of leases, all active for 7 days or whatever the default (and often unconfigurable) lease time is. You soon run out of IP's, and even if you don't, you run into the aformentioned performance issues.

nullify88 4y ago

These days I just disable 2.4ghz completely since all our devices support 5ghz and we have enough (2) access points around the house to give a good signal anywhere.

julianlam 4y ago
That's fortunate, what usable range do you see with your 5GHz network? I find the range is pretty dismal even with a wood frame and drywall house. My AP can be right below me and the signal is only perhaps 50% Wifi Analyzer will show the signal as coming from 30+ meters away when it is only about 4m (with multiple walls and floors in between)
- londons_explore 4y ago
  Insulated walls often have foil backed insulation which is really good at blocking wifi. Even with devices the same side of the wall, the foil makes nice constructive and destructive interference patterns that mean a device that's working great can lose all signal if you move it a few inches. I really wish insulation makers would use a different backing material - the supposed reflectivity of the foil doesn't really add much to the insulation properties anyway.
  - elric 4y ago
    > the supposed reflectivity of the foil doesn't really add much to the insulation properties anyway Can you elaborate on that? Seems hard to believe. There are many kinds of insulation without foil, and the foil backed variants tend to be more expensive. It's hard to imagine that we'd be making the stuff like that without a good reason.
    - b3morales 4y ago
      The "good" reason is often that the seller can talk the buyer into a higher price for the extra "feature". It can even be higher marginally: i.e. insulation costs $0.50 to manufacture, and they can sell it for $1; adding foil costs an additional $0.15 but now they can charge $1.50. This is common, even pervasive, with consumer pricing.

newsclues 4y ago

Please make a modern airport base station.

spamboy 4y ago
Seriously, this. I run an enterprise grade Meraki deployment (router and access point) with all the 802.11ax bells and whistles. I have 8 HomePods/minis in a ~1000 sq ft space. They can reliably play music all synced up maybe… 20% of the time? It’d be really great if Apple just provided an AP that would drive them without issues.

sinuhe69 4y ago

One negative side-effect of the same SSID policy is you might not be able to share your WiFi password by simply putting your devices close to each other. Ordinarily, Apple devices can share WiFi password easily by putting an already set up device close to a new one. But if they are momentarily connected to different networks (frequencies), even though they have the same SSID and same password, Apple software will see them (correctly) as on two different networks so the password will not be shared even when the password is the same on both networks. I don’t know if the automatic band switching is any better than the manual one but I find this issue is quite a hassle.

gruez 4y ago
>But if they are momentarily connected to different networks (frequencies), even though they have the same SSID and same password, Apple software will see them (correctly) as on two different networks so the password will not be shared even when the password is the same on both networks. I don't get it, how is this an issue? If both devices are already connected to the same SSID, then both devices already have the password. Why would you need to share passwords?
- jzwinck 4y ago
  One is connected and logged on. The other sees the same-named network and is not logged on yet because it doesn't know the password. Two different senses of "connected."
- woqe 4y ago
  Multiple non-unique SSIDs (name) can exist within a single router. More extremely, you and your neighbor can have the same SSID on two different routers.
exikyut 4y ago
This might actually be completely fixable by borrowing the trick Bluetooth-less Wi-Fi lightbulbs use for pairing. To pair, the lightbulb's ESP8266 (or cheaper equivalent) sits with its Wi-Fi radio in monitor mode - not authenticated to anything, just watching All The Packets flying back and forth - and the smartphone sprays crafted packets to 255.255.255.255 with specific lengths (Wi-Fi encryption does not alter packet length), where the length of each packet taken in sequence then interpreted as ASCII represents the encoded setup packet containing the target SSID and password. (Of course that setup packet is plaintext and I was able to vacuum up your password *sad exploding brain* D:) Apple could do the same basic idea here: have the connected iPhone spray a magic packet sequence to 255.255.255.255, representing say an OTP-esque nonce or similar sort of thing that is communicated to the non-connected iPhone OOB (eg Bluetooth or cellular). If the non-connected iPhone can see this sequence fly past in monitor mode, then ultimately it's on the same network even if the SSID is different. ...Or at least this all works if you can associate packet X, with length Y, *with SSID Z*. If you can't localize the sequence to an SSID without being authenticated this doesn't work.

justusthane 4y ago

Unfortunately the only way I’ve been able to get my HomePod Minis to work reliably is to disable the 5Ghz band completely and only have 2.4 — even when they’re in the same room as the AP! Having two separate SSIDs and joining them to the 2.4GHz SSID also works, but it’s kind of a pain and you lose certain functionality if they aren’t on the same SSID as your iPhone.

psydvl 4y ago
I have in my router options possibility to choose what Gz should device connect to: for example, old notebook I connect to 2.4 only. Maybe you should enable same for homepod?
rcarmo 4y ago
The SSID should’t matter if they are on the same IP address space. Make sure your router isn’t handing out different DHCP ranges for each SSID or frequency range.
incogitomode 4y ago
Interesting to read you have issues with your HomePod Mini. Mine has been stable, however all my (7) original HomePods had constant issues connecting starting around OS 14.5 / 15. I have to imagine it's related to AirPlay 2. I went through two different WiFi-6 networks, in every possible configuration, with no luck. Cumulatively I must have spent 20-30 hours debugging the networks, and finally happened upon something that works, albeit with caveats. I got two Eero Pro 6 access points, and disabled band steering — it was an experimental setting at the time — and everything worked! I've since re-enabled the setting and immediately have issues so I feel confident saying band steering is the issue. Since then Eero has updated the setting to include AP switching and it's called "client steering". So, unfortunately, to have my HomePods connect I sacrifice AP handoff and have to toggle wifi if I move my laptop to the other end of the apartment. There are quite a few folks who have brought this up in an Apple issue, and I have a friend in Tucson — where radio interference isn't an issue — with the same problem.

hjuutilainen 4y ago

Two more useful and related Apple KB articles: macOS wireless roaming for enterprise customers https://support.apple.com/en-us/HT206207 https://support.apple.com/en-us/HT206207 About wireless roaming for enterprise https://support.apple.com/en-us/HT203068 https://support.apple.com/en-us/HT203068

exikyut 4y ago
This is an offtopic side-track/distraction, but I've been completely thrown by the masking in the screenshots and example CSV dump. The first thing I'm distracted by in the expanded Wi-Fi menu in the first link is "Address: xx:x0:00:00:x0:00:00". wHaT wErE tHe 'x's bEfOrE?? Why mask out the first 1½ octets of the MAC when the first 3 octets are manufacturer-specific and (IIUC) would have been one of Apple's prefixes, and given that the assignment is apparently random¹ this would practically have leaked absolutely nothing. Next, the first half of the 5th octet is an 'x'. wHy??//? 𝖜𝖍𝖆𝖙 𝖉𝖔𝖊𝖘 𝖎𝖙 𝖒𝖊𝖆𝖓 Further down in the menu we have... OwO what's this™, 𝕒 🄷🄾🄻🄻🅈🅆🄾🄾🄳 𝕀ℙ 𝕒𝕕𝕕𝕣𝕖𝕤𝕤? "010.101.0.10"? Do I briefly switch to octal to parse that first octet? Pretty impressed the Mac in question is the network's router though - especially given it's a Wi-Fi network. Oh - sorry, you got a bit of sarcasm on you there, let me get it off :P Then we have the scan window further down in the same article. OK, so the distribution of noughts and crosses :) is apparently correlated with the security setting (the protocols are all over the place and seem to represent different routers). I honestly don't get it. Moving onto the next article, ...oh no the 'X's have gotten angry and are now in ＵＰＰＥＲＣＡＳＥ! I wonder where "01:01:00:01:XX:01" is??? "10:01:10:01:X0:10" looks positively scary. A small tangent is required to remark about how everything that has ever happens on an iPhone happens at 09:41 really has gone so far as to be unrealistic. The original idea was just to have the marketing materials acknowledge when iPhone went live at WWDC. These screenshots with the "scan result: 09:41:45 AM" are absurd, both because iOS 11 did not exist back then, and because it would not be possible to practically do a network scan and deployment at the exact same nanosecond the OS you're supposedly supposed to be using is being debuted. The one event categorically predates the other. Hmph. OK, moving to the bottom of this article we get the... notascreenshotsoapparentlytheartdepartmentcantseeit™ CSV data. With 𝘤𝘰𝘯𝘧𝘶𝘴𝘪𝘰𝘯 inside©! Firstly, unfortunately I don't know how to do a "this SSID and this SSID within 10km of each other" search, so I don't know if ACES and Cuba are actually real, but what I can say is that while the first listed MAC address turns out to be invalid (makes sense), the second and third entries are Apple-prefixed - which doesn't make any sense since this is supposed to be a list of access points, not client devices - but in any case, both MACs are valid and resolve to a street address - 𝔀𝓪𝓽, 𝓪𝓹𝓹𝓵𝓮? 𝓾 𝓸𝓴? - and while the second MAC only has one entry, the third has a location history that includes an address <10 meters away from the second one. Hi developer who gets around! ¹ https://apple.stackexchange.com/questions/49948/differentiating-apple-products-by-their-mac-addresses https://apple.stackexchange.com/questions/49948/differentiat..., http://www.coffer.com/mac_find/?string=apple http://www.coffer.com/mac_find/?string=apple

exabrial 4y ago

How does the carrier wifi network thing work? Some sort of radius auth?

thedougd 4y ago

My Mac displays a permanent warning that my AP name isn't unique enough. Funny enough, I've never seen anyone else use it in the wild.

andix 4y ago

Funny thing about WPA3: it works with all my devices (including a 12 year old think pad x201s), but only on Linux. On windows they all can’t do WPA3, because the cards are „unsupported for WPA3“.

oneplane 4y ago
The difference is probably in the way WPA is handled; WPA Supplicant can be made to work with any radio module that supports passing through the authentication and encryption. But Windows doesn't use WPA Supplicant and instead relies on each manufacturer to make sure their driver either has its own WPA Supplicant or uses on-chip authentication and encryption in the WiFi module itself. The big difference between them is that on Linux it will work, but heavy traffic will eat CPU cycles. On Windows it simply might not work at all, but when it does, and if the driver is not written by 1000 monkeys on typewriters, it can offload a lot of heavy lifting to the WiFi ASIC. I'd say that in all cases, the WiFi chip manufacturers are to blame, but the software fallback that WPA supplicant provides should really be the lowest bar any device or OS should be able to pass.
- zekica 4y ago
  Only authentication will not be offloaded, actual data encryption still is. The only exception is if your driver doesn't support management frame protection (802.11w). Then, if your AP has 11w enabled or you are using WPA3, it will use software encryption. ath9k, ath10k, ath11k, ath9k_htc, ath6kl, brcmfmac, brcmsmac, iwlwifi, iwlegacy, mt76, mwifiex, mwl8k, rtl8xxxu, all rtl8xxxe drivers support 11w, while some others: rt2xxxpci rt2xxxusb, ipw2200, carl9170 don't.
  - oneplane 4y ago
    In the old days we needed a lot of tricks because firmware loading either didn't work or we didn't have the firmware binaries yet, so even (IIRC) ath9k didn't utilise on-ASIC for everything. But that was in the B (and maybe G) days.
- spookthesunset 4y ago

jimmaswell 4y ago

Does this mean Apple devices whine at you for joining open networks at grocery stores etc?

JoBrad 4y ago
There’s a notice saying it’s unprotected.

tzs 4y ago

> Make sure that your device has Location Services turned on for Wi-Fi networking, because regulations in each country or region define the Wi-Fi channels and wireless signal strength allowed there. That one surprised me. I'd have expected that there would be a field in the data broadcast from the router that identified what country's or region's regulations it is operating under, and that client devices designed to handle multiple multiple countries or regions would use that to select channels and power levels that are legal there.

tracnar 4y ago
A rogue AP could then trick devices into breaking regulations :)
jeffbee 4y ago
There is. The wifi beacon frame contains regulatory information. https://www.oreilly.com/library/view/80211-wireless-networks/0596100523/ch04.html#wireless802dot112-CHP-4-FIG-38 https://www.oreilly.com/library/view/80211-wireless-networks... I also find it odd that Apple recommends this since users must disable location services on M1 mac mini systems to make the wifi work. It's just flat out broken and has been that way since they launched it.
- icebergonfire 4y ago
  I don't want to invalidate your experience, but allow me to offer an anecdata counterpoint: Wifi works perfectly on my M1 Mac Mini and has since day 1 (to the point I never bothered to wire it up), and I have location services enabled. I wonder what other variables are in play here that make it not work for you.
  - jeffbee 4y ago
    Not sure either but if you google it you’ll see I’m not alone.

chevman 4y ago

Funny timing. Was helping my father in law troubleshoot his WiFi this weekend and came across this article. All his wireless printers and his really old iPad (I think gen 1 or 2) refused to connect suddenly a couple weeks ago. No apparent changes or new devices on his network. Turned out Comcast pushed an update to his wireless gateway that enabled ‘managed security functionality’. Part of this included forcing WPA3 security on all devices. Once I figured out how to set it back to WPA2 for the 2.4 ghz network, all the old devices reconnected. Good times :)

jms703 4y ago
I don't think WPA3 is totally ready for widespread use (yet) due to older IoT devices. I'm not even totally sure what problem it solves, so I should probably read up on it.
teaearlgraycold 4y ago
You’d think they’d have some kind of migration system to detect if there are devices on the network that are lost after the switch over and revert if so.
- daed 4y ago
  You are clearly not a Comcast customer.
  - teaearlgraycold 4y ago
    Sonic Fiber!
- CharlesW 4y ago
  This is a brilliant idea. It makes me wonder if there are any user-friendly network scanners that do snapshot diffs.
cronix 4y ago
This is one of the main reasons I bought my own docsis 3 router for about $100 6 years ago. Comcast doesn't have access to it. The other bonus is you save a lot of money over the years by not having to rent it from Comcast, every month for the lifetime of your service. It pays for itself the first year. You give up pay per view/on-demand which never affected me, but something to consider if he uses that. I think you can still get ppv but have to call in or something and can't just order it using the remote, but my memory on that is foggy since I never use ppv. They make good Christmas presents and saving the FIL money always builds up the brownie bank :)

janandonly 4y ago

Not sure I agree with Apple’s recommendations. don't give your 2.4GHz and 5GHz bands different names. I purposefully did set different names for these two band. I also only gave all my devices the password for the 5GHz band. Because latency is lower on that band. I cannot disable 2.4GHz band because my old WiFi printer doesn’t support the 5GHz but if it wasn’t for that I would disable it altogether.

legulere 4y ago
The problem with the 5 GHz band is that it can be turned off any time because of radar: https://en.wikipedia.org/wiki/Dynamic_frequency_selection https://en.wikipedia.org/wiki/Dynamic_frequency_selection
- simoncion 4y ago
  Only certain slices of it. The article you linked to mentions the frequencies in the US that must use DFS. This table in the article _it_ links to goes into much more detail. <https://en.wikipedia.org/wiki/List_of_WLAN_channels#4.9%E2%80%935.0_GHz_(802.11j)_WLAN https://en.wikipedia.org/wiki/List_of_WLAN_channels#4.9%E2%8...> Look for the cells that contain "DFS" to see on which channels APs are required to channel hop if they believe they have heard radar. In my personal experience, channel hopping works fine.
- exikyut 4y ago
  Ooooh. Now I wanna find out how I can fly over an area with a drone and make pictures like the example! On a somewhat smaller, more theoretical note, I wonder what "a radar signal" is as far as a Wi-Fi SoC is concerned. Sounds like the wild-west, much-trickier-to-block counterpart to the old deauth packet attack. At least the FCC/etc can get shouty if needed... Edit: Oh, right, it only goes offline if channel selection is manual. And presumably radar only uses the one band (?) so you couldn't flood it out or play cat and mouse. Hmph, this is actually well designed. Given that this requires pretending to be a radar you might as well switch to a smaller pot of hot water and just get a 5.8GHz signal jammer.
orev 4y ago

cmeacham98 4y ago

> It's usually best to enable every mode offered by your router, rather then a subset of those modes. All devices, including older devices, can then connect using the fastest radio mode they support. This also helps reduce interference from nearby legacy networks and devices. Is this really the best advice? My (limited) understanding is that if a device connects with an older standard everyone gets slowed down by this. My router has a setting it calls "Airtime Fairness" that purports to combat this.

zekica 4y ago
Airtime fairness helps a lot but if a 11b device connects, you automatically lose 1/3 of the throughput even when that device is not active. 11g can also slow down others but only a couple percent. Also, if you disable 11b rates you can have more SSID beacons (more networks) in parallel as the beacon is then transmitted at 6Mbps PSK instead of 1Mbps DSSS.

eBombzor 4y ago

If you live in an apartment please turn down the transmit power for the sake of everyone in the building.

prophesi 4y ago

Another recommendation I'd add is appending "_optout_nomap" to your SSID name. That will let you opt out of both Microsoft and Google's access point data collection.

kartugestu 4y ago
is the "_optout" part of "_optout_nomap" required? i thought "_nomap" is sufficient. https://support.google.com/maps/answer/1725632?hl=en#zippy=%2Chow-do-i-secure-my-wireless-network-with-strong-password-encryption%2Cwill-my-access-point-be-removed-from-other-location-services%2Chow-do-i-opt-my-access-point-out-of-google-location-services https://support.google.com/maps/answer/1725632?hl=en#zippy=%...
- kartugestu 4y ago
  ah _optout is microsoft i did not know that.
  - prophesi 4y ago
    Yeah I only learned about it recently. And apparently "_nomap" _has_ to be at the end of the SSID. A weird system for something that should be opt-in anyways.

deleted 4y ago

[deleted]

encryptluks2 4y ago

I'm surprised hiding the SSID makes it less secure? Or they just saying it isn't worth the inconvenience?

cesarb 4y ago
If you hide the SSID, your phone or laptop has to ask for that specific SSID in a probe request every time it scans for nearby networks, even when it's nowhere near your router. If you don't hide the SSID, your phone or laptop can just ask for the wildcard SSID in the probe requests, or even passively listen for the periodic beacons. That is: if you hide your SSID, not only you're announcing to everyone around you all the time your SSID, but also it doesn't hide it very well, since the SSID is still sent in plaintext in the probe request every time your devices attempt to connect to your router.
- encryptluks2 4y ago
  I don't see how that is any different than having a public SSID. The goal behind hiding it isn't to prevent people from knowing it, just make it less obvious.

wtvanhest 4y ago

Does anyone have a recommended way to monitor my wifi connection on my PC or Mac over time? I recently started at a new company which uses google meets and I’m having an issue where my out sound and video output freeze for people communicating with me for 1 to 3 seconds. I’ve replaced the PC and I’m still having the issue so Id like to troubleshoot the problem by ensuring my network connection is working correctly. Hardware: replaced google home wifi mesh with top of the line eero mesh.

webmobdev 4y ago
Maybe Wifi Scanner - https://www.accessagility.com/wifi-scanner https://www.accessagility.com/wifi-scanner
grosswait 4y ago
Try running mtr continuously. Press d twice to see color and symbol encoded latency.

JuliusMeinl 4y ago

May I ask: How do the Cisco AP perform in comparison to other companies products? Is Cisco really up to date when it comes to wireless? I just set up a "last gen" 2702i and I am still in the process of tuning it to perform as good as my modem/router/ap combi device I used before, and my experience is not really pleasant, but I could imagine that at large scale deployments there is still nothing better then Cisco and a lot of the features/setting that seem unintuitive are necessary in such cases. But yes in my case I had to go to (autonomous) firmware from 2018 to be able to use the GUI, because every newer autonomous firmware breaks the GUI, the newer ones (the newest is just some months old) all have a major bug where you can't save the changes you made and get an 404 error...