Chapter 7: Wireless and Mobile Networks

Kurose & Ross, Computer Networking: A Top-Down Approach, 9th edition (2025) – Full lecture coverage

Learning Objectives

Characterize wireless links: attenuation, interference, multipath, SNR vs BER.
Analyze the hidden terminal and exposed terminal problems.
Explain 802.11 (BSS, ESS, CSMA/CA, RTS/CTS, frame format, rate adaptation).
Recognize Personal Area Networks (Bluetooth, Zigbee).
Describe 4G LTE and 5G NR architectures (eNodeB, MME, SGW, PGW, gNB, AMF, SMF, UPF).
Explain mobility management: home/foreign networks, Mobile IP, indirect vs direct routing, 4G handoff.
Understand the impact of wireless on TCP and higher-layer protocols.
Recognize wireless security (WEP, WPA, WPA2, WPA3).

Chapter Roadmap

§7.1 Intro §7.2 Link Char. §7.3 WiFi §7.3.4 PANs §7.4 Cellular §7.5 Mobility §7.6 Security

Prerequisites: Solid understanding of Link Layer (Chapter 6): CSMA/CD, MAC addresses, Ethernet, and the Network Layer (Chapters 4-5): IP addressing and routing.

1. Introduction: Wireless and Mobility

Wireless networks have become the dominant way users connect to the Internet. Two distinct, yet often intertwined, challenges must be addressed:

Wireless (Communication over air)

Attenuation: signal strength drops with distance (path loss).
Interference: other sources (microwaves, Bluetooth, neighboring APs) operate on the same band.
Multipath: reflected signals arrive slightly delayed, causing fading.
Bit errors are much more common than on wired links.

Mobility (Users moving)

Devices change their point of attachment — from one AP to another, or from WiFi to 4G.
Must preserve ongoing sessions (voice calls, video streams).
Requires handoff (handover) and location management.
Requires a protocol layer that hides mobility from upper layers (Mobile IP, GTP).

Key distinction: Wireless refers to the physical layer — communicating over a radio link. Mobility refers to a higher-layer concern — handling the user's movement across networks. A device can be wireless but not mobile (e.g., a fixed WiFi camera), and it can be mobile but not wireless (e.g., a laptop plugged into a different Ethernet port each day).

2. Wireless Link Characteristics

Path Loss, Interference, Multipath Fading

Phenomenon	Cause	Impact
Path loss (attenuation)	Signal spreads out; energy absorbed by obstacles	Signal strength decreases with distance — limits coverage
Interference	Other transmitters on same frequency (Bluetooth, microwaves, neighboring APs)	Increases noise floor — lowers effective SNR
Multipath fading	Reflections from walls, ground, objects arrive slightly delayed	Constructive/destructive cancellation; signal quality varies

SNR vs BER

SNR (Signal-to-Noise Ratio) measures the received signal power relative to the noise power. It is expressed in decibels (dB).

BER (Bit Error Rate) is the probability that a received bit is in error.

As SNR increases, BER decreases — the two are inversely related, but the exact relationship depends on the modulation scheme. Higher modulation (e.g., 64-QAM) packs more bits per symbol but requires higher SNR to maintain the same BER. This is the basis of rate adaptation in 802.11: the sender chooses a higher rate when the channel is good, and a lower rate when the channel is poor.

Hidden Terminal and Exposed Terminal Problems

Problem	Cause	Impact
Hidden terminal	A and C can each hear the AP B, but cannot hear each other. Both transmit to B simultaneously.	Collision at the AP; neither sender detects it (they are half-duplex and cannot listen while transmitting).
Exposed terminal	A is transmitting to B. C wants to send to D (independent link, does not interfere) but hears A and defers.	Wasted capacity (unnecessary deferral).

Hidden Terminal: A and C both transmit to B, but cannot hear each other

3. IEEE 802.11 Wireless LANs (WiFi)

3.1 Architecture

BSS (Basic Service Set): One AP + associated stations. The fundamental building block.
ESS (Extended Service Set): Multiple BSSs connected via a Distribution System (DS, usually Ethernet).
Infrastructure mode: All traffic passes through the AP (which connects to the wired network).
Ad-hoc mode: No AP; stations communicate directly. Rarely used in practice.

802.11 ESS: Multiple BSSs linked by a Distribution System

3.2 Scanning: How a Station Finds an AP

Passive Scanning

AP periodically broadcasts beacon frames (typically every 100 ms).
Station listens on each channel; when it hears a beacon, it learns SSID, capabilities, and BSSID.
Station sends association request; AP replies with association response.

Pros: Simplest. Cons: Slow; the station may miss beacons on channels it isn't listening to.

Active Scanning

Station broadcasts probe request frames on each channel.
Any AP in range replies with a probe response.
Station picks the best AP (typically strongest signal), sends association request.

Pros: Faster, discovers all APs. Cons: Generates more traffic.

3.3 CSMA/CA — Why Not CSMA/CD?

Wireless cannot detect collisions during transmission because the radio is half-duplex — while transmitting, the station cannot listen. Also, collisions at the receiver (hidden terminal) are invisible to the sender. Therefore 802.11 uses CSMA/CA: Collision Avoidance, not Detection. Rather than detect collisions after they happen, we try to prevent them in the first place.

CSMA/CA Algorithm (DCF — Distributed Coordination Function)

Station with a frame to send senses the channel.
If the channel is idle for DIFS (Distributed Inter-Frame Space ≈ 34 μs), transmit immediately.
If busy, wait for idle, then start a random backoff counter (chosen from [0, CW]) that counts down while the channel is idle.
If the channel becomes busy during backoff, freeze the counter; resume when idle for DIFS again.
When counter reaches 0, transmit.
Receiver sends ACK after SIFS (Short IFS ≈ 16 μs).
If sender does not receive ACK within a timeout, back off again and retransmit.

Why two different IFS values? SIFS (short) is used for control frames (ACK, CTS) — they get priority. DIFS (long) is used for data frames — ensures ACKs always beat new data. If both used the same IFS, a new frame could collide with the ACK.

CSMA/CA Timing: DIFS, backoff, SIFS, ACK

3.4 RTS/CTS — Solving the Hidden Terminal Problem

RTS/CTS is an optional mechanism (802.11 supports it but many deployments disable it to reduce overhead). It works as follows:

Sender → AP: RTS (Request to Send). RTS includes a duration field.
AP → All: CTS (Clear to Send), broadcast. All stations within range hear the CTS and read its duration field.
Sender → AP: DATA, transmitted.
AP → Sender: ACK, closing the exchange.

Any station that hears the CTS (including hidden terminals) sets its NAV (Network Allocation Vector) to the duration value and defers all transmissions for that period. Since the CTS comes from the AP and is heard by hidden terminals, they are silenced for the entire exchange.

RTS/CTS overhead is significant. Each RTS and CTS is a full frame. For small data frames, this overhead is not worth it — so most APs have a RTS threshold (e.g., 500 bytes): RTS/CTS is only used for large frames or in high-collision scenarios.

3.5 802.11 MAC Frame Format

| Frame Control (2B) | Duration (2B) | Addr1 (6B) | Addr2 (6B) | Addr3 (6B) | Seq (2B) | [Addr4 (6B)] | Payload | FCS (4B) |

Frame Control: protocol version, type (data/management/control), subtype (beacon, RTS, CTS, ACK, ...), flags (ToDS, FromDS, more frag, retry, power mgmt, ...).
Duration: for NAV — how long the sender wants to reserve the channel.
Addr1–4: up to 4 MAC addresses. Roles depend on ToDS/FromDS flags:
- To DS = 0, From DS = 0 (ad-hoc): Addr1 = Dest, Addr2 = Source, Addr3 = BSSID.
- To DS = 1, From DS = 0 (station → AP): Addr1 = AP, Addr2 = Source, Addr3 = Dest (for onward routing).
- To DS = 0, From DS = 1 (AP → station): Addr1 = Dest, Addr2 = AP, Addr3 = Source.
- To DS = 1, From DS = 1 (mesh / WDS): Addr4 is used for the second bridge.
Seq: sequence number, used to detect duplicates.
FCS: CRC-32 for error detection.

3.6 Rate Adaptation

802.11 supports multiple physical-layer data rates (e.g., in 802.11ac: 65, 130, 260, 390, 520, ..., 6933 Mbps). The sender chooses a rate based on the current channel conditions:

If frames are ACKed reliably → increase rate.
If two consecutive frames are not ACKed → decrease rate.
This is closed-loop rate control, driven by the sender based on ACK feedback.

3.7 Standard Evolution

Standard	Year	Band	Max Rate	Key Feature
802.11b	1999	2.4 GHz	11 Mbps	First mass-market WiFi
802.11a	1999	5 GHz	54 Mbps	Higher rate, less crowded band
802.11g	2003	2.4 GHz	54 Mbps	Higher rate on 2.4 GHz
802.11n (WiFi 4)	2009	2.4 / 5 GHz	600 Mbps	MIMO, channel bonding
802.11ac (WiFi 5)	2013	5 GHz	3.5 Gbps	MU-MIMO downlink, 80/160 MHz
802.11ax (WiFi 6/6E)	2019-21	2.4 / 5 / 6 GHz	9.6 Gbps	OFDMA, uplink MU-MIMO, TWT (target wake time)
802.11be (WiFi 7)	2024+	2.4 / 5 / 6 GHz	~46 Gbps	Multi-link operation (MLO), 320 MHz, 16x16 MU-MIMO

4. Personal Area Networks (PANs)

A PAN interconnects devices within a person's workspace (a few meters). Three main standards:

Bluetooth (IEEE 802.15.1)

Ad-hoc piconet: 1 master + up to 7 active slaves.
Frequency-hopping spread spectrum in 2.4 GHz band (79 channels, 1600 hops/s).
Classic Bluetooth: ~1-3 Mbps. BLE (Bluetooth Low Energy): ~1 Mbps, designed for IoT.
Typical range: 10 m (Class 2) or 100 m (Class 1).
Use cases: headsets, keyboards, smartwatches, medical devices.

Zigbee (IEEE 802.15.4)

Designed for low-power, low-rate IoT.
Supports star, tree, and mesh topologies.
Data rate: 250 kbps (2.4 GHz), 40 kbps (915 MHz), 20 kbps (868 MHz).
Typical range: 10-100 m per hop, but mesh routing extends it.
Use cases: smart home (Zigbee bulbs, sensors, thermostats), industrial IoT.

NFC (Near Field Communication) is a related standard (not covered by Kurose-Ross) for contactless payments and pairing — operates at 13.56 MHz, range < 10 cm. It's a short-range subset of RFID.

5. Cellular Networks: 4G LTE and 5G NR

5.1 Cellular Architecture: The Big Picture

A cellular network divides geography into cells, each served by a base station. The same frequency band is reused in non-adjacent cells to increase overall capacity.

5.2 4G LTE Architecture (E-UTRAN / EPC)

Component	Full Name	Role
UE	User Equipment	The mobile device (phone, dongle, tablet).
eNodeB (eNB)	Evolved Node B	Base station. Manages radio resources in its cell: scheduling, handover initiation, encryption.
MME	Mobility Management Entity	Handles authentication, security key distribution, and bearer (session) setup. Handles paging and tracking of idle UEs.
SGW	Serving Gateway	Local anchor for user data. Forwards packets from UE to PGW (and vice versa). Acts as mobility anchor for inter-eNodeB handover.
PGW	Packet Data Network Gateway	Connects the EPC to the Internet. Assigns IP addresses to UEs. Enforces QoS policy.
HSS	Home Subscriber Server	Central database — subscriber profiles, authentication credentials, current MME affiliation.

4G LTE: E-UTRAN (radio) + EPC (core)

5.3 5G NR (New Radio)

5G introduces a new radio interface (NR) and a redesigned, more flexible core (5GC). Key features:

Three usage scenarios:
- eMBB (enhanced Mobile Broadband): high throughput (up to 20 Gbps).
- URLLC (Ultra-Reliable Low-Latency Communication): < 1 ms latency, 99.999% reliability.
- mMTC (massive Machine-Type Communication): up to 1 million devices per km².
Spectrum: Sub-6 GHz (FR1) and mmWave (FR2, 24–100 GHz) — more bandwidth, shorter range.
Massive MIMO: up to 64-256 antennas at the base station.
Network Slicing: one physical network partitioned into multiple virtual networks, each with its own SLA.
Service-Based Architecture (SBA): all core functions communicate via HTTP/2 APIs over REST.

5.4 5G Core Components (SBA)

Component	Role
gNB	5G base station. The 5G equivalent of eNodeB.
AMF (Access and Mobility Function)	Equivalent to 4G's MME. Handles registration, mobility, authentication.
SMF (Session Management Function)	Establishes and manages sessions (PDU sessions). Assigns IP addresses (via UPF).
UPF (User Plane Function)	Forwards user data. Combines roles of SGW and PGW from 4G. Can be deployed at the edge (MEC).
AUSF, UDM, PCF, NRF	Authentication, unified data management, policy control, service registry.

6. Mobility Management

6.1 Terminology

Home network: the network the mobile node "belongs to" (has a permanent subscription).
Home agent (HA): a router in the home network that tracks the mobile's current location.
Foreign network: the network the mobile is currently visiting.
Foreign agent (FA): a router in the foreign network that helps the mobile register with its HA.
Care-of-address (COA): the mobile's current IP address in the foreign network.
Correspondent: the host that wants to communicate with the mobile.

6.2 Mobile IP: Indirect Routing

The mobile registers with the foreign agent (or obtains a COA via DHCP).
The foreign agent notifies the home agent of the COA (registration).
The correspondent sends packets to the mobile's permanent IP address (in the home network).
The home agent intercepts these packets and tunnels them to the COA.
The foreign agent decapsulates and delivers to the mobile.

Problem — triangle routing: if the correspondent is geographically close to the mobile's current location but the home agent is far away, packets route back through the home network — wasting latency and bandwidth. This is the main limitation of indirect routing.

6.3 Mobile IP: Direct Routing

Same registration as before (mobile → FA → HA).
The correspondent learns the mobile's COA (via the HA) before sending data.
The correspondent then sends packets directly to the COA.

Pros: No triangle routing. Cons: The correspondent must understand mobility (needs to be updated). Also, when the mobile moves to a new COA, the correspondent must be notified.

Mobile IP numbers you should remember: The MN is identified by its permanent IP and a Home Address; the FA and HA act on behalf of the MN; the COA is temporary. Ports and protocols: Mobile IPv4 uses UDP port 434 for registration; the "Home Address" option in the IP header tells the receiver the packet is from a mobile node.

6.4 Handoff in 4G LTE

When a UE moves from one eNB to another, sessions must survive. LTE uses the X2 interface for handover between eNBs:

UE sends measurement reports to its serving eNB.
If a neighbor eNB is better, the serving eNB sends a Handover Request to the target eNB over X2.
Target eNB prepares resources and replies with Handover Request Acknowledge.
Serving eNB sends a Handover Command to the UE; UE synchronizes with target.
Data buffered at the serving eNB is forwarded to the target eNB.
MME is notified; SGW updates its path.
UE sends Handover Confirm; new path established.
Old eNB releases resources.

7. Wireless Security Fundamentals

Protocol	Year	Encryption	Authentication	Status
WEP	1997	RC4 with 40-bit or 104-bit key	Open / Shared Key	Broken — trivially cracked. Do not use.
WPA	2003	TKIP (RC4-based, with per-packet key)	PSK or 802.1X	Deprecated. Vulnerable to KRACK.
WPA2	2004	AES-CCMP	PSK or 802.1X (Enterprise)	Still widely used. Vulnerable to KRACK if unpatched.
WPA3	2018	AES-GCMP (192-bit in Enterprise mode)	SAE (Simultaneous Authentication of Equals) — resists offline dictionary attacks	Recommended for new deployments. Forward secrecy.

8. Practical Lab: Wi-Fi Packet Capture

Lab: Analyze 802.11 Frames with Wireshark

Install Wireshark and a supported Wi-Fi adapter (for monitor mode, you may need airmon-ng on Linux).
Enable monitor mode on the adapter. This mode captures ALL Wi-Fi frames (not just those addressed to your device).
Start a capture with the display filter wlan.
Filter wlan.fc.type_subtype == 0x08 to see beacon frames — one per SSID per ~100 ms.
Filter wlan.fc.type_subtype == 0x04 to see probe request frames — sent by STAs during active scanning.
Filter wlan.fc.type_subtype == 0x0d to see ACK frames — you should see a burst of ACKs after each data frame.
Inspect one RTS frame (wlan.fc.type_subtype == 0x1b) and the following CTS (0x1c). Note the Duration field.
Download the pcap file and analyze it in Wireshark. Answer the lab questions in the report.

Discussion questions:

What is the difference between an RTS and a CTS frame? Who sends which?
Why is the size of an ACK frame so small? What does it carry?
How many addresses does an 802.11 data frame have? How does this differ from Ethernet?
What is the NAV? Where does it come from?

9. Homework Assignment (Theoretical, Graded)

Instructions: Answer all questions in a separate document (PDF or Word). Submit via the learning platform. This assignment counts towards your final grade (5%).

Part I: Short Essays (40 points)

Compare CSMA/CA (wireless) with CSMA/CD (Ethernet). Why does wireless need a fundamentally different MAC protocol?
Explain the hidden terminal problem. Describe a scenario in detail, and explain how RTS/CTS solves it.
Identify the key components of an LTE/4G network (eNodeB, MME, SGW, PGW, HSS). What does each one do?
Compare indirect and direct routing in Mobile IP. What trade-offs does each approach make?
Why is SNR critical in wireless links? How does it relate to BER, and what is the role of rate adaptation?

Part II: True/False + Correction (30 points)

802.11 uses CSMA/CD to detect collisions. (True / False)
The hidden terminal problem is unique to wireless networks. (True / False)
The MME is responsible for forwarding user data packets. (True / False)
In Mobile IP, the home agent is responsible for updating the COA. (True / False)
5G mmWave frequencies have longer range than 4G frequencies. (True / False)

For each false statement, write the correct version.

Part III: Problem Solving (30 points)

An 802.11 frame of 1500 bytes is transmitted at 54 Mbps. How long does it take to transmit? Show your work.
A mobile moves from one BSS to another. What triggers the handoff, and which frames are exchanged? Describe the process for 4G LTE (X2 handover) and note the key differences from an 802.11 re-association.
In a cellular network with SNR = 20 dB and BER requirement of 10⁻⁵, if doubling transmit power reduces BER by a factor of 100, is that reduction sufficient? Explain, and describe how the network adjusts (e.g., via rate adaptation or power control).

Grading criteria: correctness, completeness, proper use of terminology, and clarity of explanation.

Deadline: Two weeks from the lecture date.

Chapter 7 Summary

Wireless links suffer from attenuation, interference, and multipath fading. These cause bit errors and necessitate robust link-layer protocols (CSMA/CA, forward error correction, ARQ).
SNR vs BER: Higher SNR → lower BER. Rate adaptation dynamically chooses the PHY data rate based on channel conditions.
Hidden terminal problem: Nodes that cannot hear each other can both transmit to the AP, causing collisions. Exposed terminal problem: A node defers unnecessarily because it hears another transmission that does not actually interfere.
802.11 uses CSMA/CA: sense before transmit, exponential backoff, SIFS/DIFS, and optional RTS/CTS to mitigate hidden terminals.
PANs: Bluetooth (piconet, frequency hopping, low power) and Zigbee (mesh, low rate, IoT).
4G LTE: eNodeB (radio access) + EPC (MME, SGW, PGW, HSS). 5G NR: gNB + 5GC (AMF, SMF, UPF), network slicing, mmWave, massive MIMO, three usage scenarios (eMBB, URLLC, mMTC).
Mobility: Home/foreign networks, COA, Mobile IP (indirect vs direct). Handover in 4G via X2 interface. Impact on TCP: mobility affects RTT; TCP needs to adapt (CUBIC, BBR, or MPTCP for multi-path).
Wireless security: WEP (broken), WPA (deprecated), WPA2 (widely used), WPA3 (recommended).

Self‑review questions (exam preparation):
• Why can't wireless use CSMA/CD? What physical constraint prevents it?
• Explain the DIFS and SIFS intervals. Why are they different?
• What is the NAV, and how does it prevent collision in RTS/CTS?
• Describe the 4G LTE core network in one paragraph.
• What is network slicing in 5G? Give an example of two slices with conflicting requirements.
• Compare Mobile IP indirect and direct routing. Which is more scalable? Which is more efficient?
• What is the difference between BSS and ESS in 802.11?
• List the 802.11 MAC frame address fields for: (a) STA → AP, (b) AP → STA, (c) ad-hoc.
• Why do some routers not respond to traceroute with ICMP Type 11?
• Explain the difference between handoff and roaming.

Looking Ahead to Chapter 8

Question: How do we make networks secure? How do we protect confidentiality, integrity, and availability against attackers?

Answer: Chapter 8 (Security) covers cryptography (AES, RSA, DH), authentication (certificates, TLS), email security (PGP, S/MIME), network-layer security (IPsec, VPNs), wireless security (WPA3, EAP), and operational security (firewalls, IDS/IPS).

The Final Exam will cover Chapters 1-7 (comprehensive). Practice tracing packet flows (DHCP → ARP → DNS → TCP → HTTP) and explaining each protocol's role clearly.