Device Roles - Network Infrastructure
Understanding what each device actually does - and doesn't do - at the 802.11/802.3 layer is foundational for troubleshooting, design, and certification. A gateway is not just a router. An AP is not a router. A mesh node is not a repeater. The distinctions matter in the PCAP.
OSI Layer Mapping
Layer determines what the device reads and acts on. A switch only reads MAC addresses (L2) - it never looks at IP headers. A router reads IP addresses (L3) but passes L4–L7 data unchanged. An AP bridges 802.11 MAC frames to 802.3 Ethernet - L2 only. Everything above L2 is opaque to the AP unless it also routes.
Wired Devices - The Network Foundation
Multi-port repeater. Receives a bit stream on one port and immediately repeats it to ALL other ports.
Multi-port bridge with a CAM (Content Addressable Memory) table. Delivers frames only to the correct port.
Routes IP packets between different networks using a routing table. Each interface is a separate broadcast domain.
Protocol translator between incompatible systems. In home networking, "gateway" = combined modem + router + AP in one device.
Access Point Architectures - Fat, Thin, Cloud, Mesh
An AP bridges 802.11 wireless clients to the wired 802.3 network at L2. But "AP" describes the role, not the architecture. The same hardware may operate as a fat AP, thin AP, or cloud-managed AP depending on how it's deployed.
Full 802.11 MAC stack runs ON the AP. The AP handles association, auth (RADIUS client), DHCP, routing, and RF decisions locally. No controller required.
802.11 MAC is SPLIT between AP (real-time RF) and WLC (policy, auth, mobility). AP tunnels client traffic to WLC via CAPWAP (UDP 5246/5247). Data plane: local or central bridging.
AP phones home to vendor cloud over HTTPS. Config, firmware, and analytics managed from dashboard. Data plane stays LOCAL - only management traverses cloud.
Controller function runs as a VM in the cloud or on-site server. APs discover controller automatically. Hybrid: data plane local, control plane virtual.
Mesh Roles - MP, MAP, MPP (802.11s)
IEEE 802.11s-2011 (now incorporated into 802.11-2020) defines a mesh network using the HWMP routing protocol. Three roles determine what a node does in the mesh. Every home mesh system (Eero, Google Nest, Orbi) implements these roles, though vendors often rename them.
The basic mesh node. Participates in HWMP path selection, forwards mesh traffic via the Airtime Link Metric. Has no BSS - cannot connect regular 802.11 clients directly. Pure backhaul node.
Mesh Point that ALSO runs a BSS - can serve regular 802.11 clients while simultaneously participating in the mesh backhaul. The typical home mesh node. Combines AP and mesh functions on different radios (or same radio time-sliced).
Mesh Point with uplink to the wired Distribution System (Ethernet to router/switch). Acts as the gateway between the mesh domain and the rest of the network. MUST have at least one MPP in every mesh. Usually the root/primary node plugged into the ISP router.
A repeater (range extender) receives a signal and re-transmits it on the SAME channel - halving throughput because it must both receive and transmit using the same airtime. A mesh node uses a dedicated backhaul radio (or separate backhaul channel) so the client-facing radio is unaffected. If a device only has one radio, it is a half-duplex repeater, not a mesh node - regardless of marketing. Always check: how many radios? Is backhaul wireless or wired? Wired backhaul = fastest, zero airtime penalty.
Common Misconceptions
A DHCP server assigns IPs - which often runs ON the gateway but is a separate service. Enterprise networks often have a dedicated DHCP server (Windows DHCP, ISC dhcpd) that the AP/controller queries via DHCP relay.
An AP bridges 802.11 to 802.3. The router/gateway connects to the internet. Without a working default gateway route, the AP gives you "connected, no internet" even with perfect RF.
A switch and hub operate at completely different layers. A switch creates dedicated collision domains per port with full-duplex - structurally different from a hub, not just faster.
A two-radio mesh node with wireless backhaul may still halve throughput if both radios share the same frequency band (2.4 GHz backhaul + 2.4 GHz client). Tri-band mesh (dedicated 5 GHz backhaul) avoids this. Wired backhaul is always better.
Cloud-managed APs (Meraki, Mist) cache their last-known config locally. If the cloud is unreachable, existing clients continue working. NEW associations may require the controller for full auth policy - depends on the vendor.
The AP is the 802.1X Authenticator - a passthrough proxy. The RADIUS server is the Authentication Server. The AP never sees the password, only the EAP exchange. Authentication decision is made by RADIUS.