802.11 PROTOCOL INTELLIGENCE

DFS / TPC - 802.11h Radar Avoidance

IEEE 802.11h-2003 (incorporated into 802.11-2020) defines two mechanisms for 5 GHz coexistence with radar systems: DFS (Dynamic Frequency Selection) for radar avoidance and TPC (Transmit Power Control) for interference reduction. Both are mandatory for operating on UNII-2A and UNII-2C channels worldwide.

IEEE 802.11h-2003 / 802.11-2020 §11.9 FCC 15.407 / ETSI EN 301 893 CWNA Domain

5 GHz UNII Band Plan

UNII-1
5.150–5.250 GHz
Ch 36, 40, 44, 48
Max: 50 mW (17 dBm)

Indoor only (low power limit). No radar co-existence required. Most common enterprise indoor band. Wi-Fi 6E APs often prioritise here for backhaul.

UNII-2A
DFS TPC
5.250–5.350 GHz
Ch 52, 56, 60, 64
Max: 250 mW (24 dBm)

DFS + TPC required. TDWR (Terminal Doppler Weather Radar) frequencies. Typical 60s CAC before first use. High-value channels - 4 clean non-overlapping 20 MHz slots.

UNII-2C
DFS TPC
5.470–5.725 GHz
Ch 100–144 (11 ch)
Max: 250 mW (24 dBm)

DFS + TPC required. Largest DFS sub-band. Includes long-range weather radar frequencies. 11 non-overlapping 20 MHz channels = most spectrum in 5 GHz.

UNII-3
5.725–5.850 GHz
Ch 149, 153, 157, 161, 165
Max: 1 W (30 dBm)

No DFS required. Outdoor use allowed (US FCC 15.407). Highest power limit in 5 GHz. Often used for outdoor point-to-point links and mesh backhaul.

CWNA EXAM NOTE

UNII-1: no DFS, indoor only. UNII-2A + UNII-2C: DFS + TPC mandatory. UNII-3: no DFS, outdoor allowed, highest power. The 6 GHz band (UNII-5 through UNII-8) has no DFS requirement - no radar systems operate there. Wi-Fi 6E and Wi-Fi 7 benefits: clean 6 GHz spectrum with no DFS delays.

DFS Lifecycle - From CAC to Recovery

CAC (Channel Availability Check) 60 seconds (min)

AP monitors the DFS channel for radar pulses BEFORE transmitting any 802.11 frames. If no radar detected in 60s → channel declared available. Some radars require longer CAC: weather radar (TDWR) = 10 minutes in some regions.

In-Service Monitor Continuous

Once channel is in use, AP continues passive radar detection while serving clients. Energy detection threshold: −64 dBm for short pulses (1 µs) and longer bursts. A compliant AP must detect >3840 pulses/second at correct pulse repetition frequency (PRF) before declaring radar.

Radar Detected <10 seconds

AP must stop transmitting on the DFS channel within 10 seconds of radar detection (FCC 15.407(h)(3)). Non-occupancy period (NOP) = 30 minutes - channel cannot be reused for 30 min after detection.

CSA (Channel Switch Announcement) 5–10 Beacon intervals

AP broadcasts Channel Switch Announcement IE (IE 37) in Beacon and Probe Response frames. Fields: Channel Switch Mode (0=STA may transmit before switch, 1=STA must not transmit), New Channel Number, Channel Switch Count (Beacon intervals remaining). Clients cease transmission before switch.

New Channel CAC 60 seconds

AP must perform full CAC on the new target channel before resuming service. If the AP has a monitor radio, it can scan alternate channels continuously and cache their DFS status (background scan), reducing perceived outage.

TPC - Transmit Power Control

TPC allows the AP to reduce transmission power when operating near radar systems to minimise interference. 802.11h defines two TPC frames and a set of IEs for power negotiation.

Power Constraint IE (IE 32)

Broadcast in Beacons. Single byte: Local Power Constraint in dB. STA calculates its maximum allowed TX power = Max Regulatory Power (from Country IE) − Power Constraint. e.g., If Country IE says 23 dBm max and Power Constraint = 6 dB → STA uses ≤17 dBm.

TPC Request / Response (Action frames)

AP → STA: TPC Request (Action frame, Category 0, Action 2). STA → AP: TPC Report (transmit power used + link margin in dB). AP uses this to determine if STA needs power reduction. Part of spectrum management negotiation.

Power Capability IE (IE 33)

Sent by STAs in Assoc Req when operating on DFS channels. Min TX power (signed dBm) + Max TX power (signed dBm). Informs AP of STA transmit capability for regulatory compliance. Required field for 5 GHz DFS association.

CSA - Channel Switch Announcement

The Channel Switch Announcement IE (IE 37) is included in Beacon and Probe Response frames when the AP needs to move the BSS to a new channel - either because of radar detection or for load-balancing.

CSA IE (IE 37) STRUCTURE
IE ID = 37 1B
Length = 3 1B
Mode 1B
New Ch 1B
Count 1B
Mode: 0 = STAs may transmit before switch. 1 = STAs must NOT transmit after receiving this IE until channel switch (prevents interference).
New Channel: Target channel number (e.g., 36 for Ch 36 in 5 GHz).
Count: Number of Beacon intervals until switch. Count decrements each Beacon. 0 = switch on next Beacon. Typical: 5-10 Beacon intervals (512–1024 ms).
OPERATIONAL IMPACT

DFS channel switches cause a service interruption of approximately 60 seconds (new channel CAC). Enterprise APs with dual radios can maintain one radio on a non-DFS channel (UNII-1/UNII-3) as a fallback, serving clients during the DFS transition. APs that pre-scan DFS channels with a monitor radio (background scan) can reduce perceived outage significantly by pre-qualifying alternate channels before the switch is needed.

PCAP Identification

CSA IE (37) in Beacon
AP is about to change channels. Check Mode byte (0 or 1), New Channel, and Count. If Count reaches 0 → switch imminent. Clients should reassociate to new channel.
Extended CSA IE (60) in Beacon
802.11n+ variant carrying Operating Class + Channel Number + Count. Used when channel width also changes (e.g., 40 → 20 MHz on DFS event).
Channel in Beacon changes
AP has completed channel switch. All subsequent Beacons use new Channel number in DS Parameter Set IE (IE 3). Clients tracking old BSSID should rescan.
AP Beacon disappears entirely for 60s
DFS detection on current channel. AP went silent for mandatory CAC on new channel. Clients timeout and must reassociate. This is the 60s "blackout" in PCAP.
wlan.tag.number == 37 // CSA IE present (radar event)
wlan.tag.number == 32 // Power Constraint IE
wlan.tag.number == 33 // Power Capability IE
wlan_mgt.tag.channel_switch_count == 0 // Switch happening NOW
// related reference
Channel Reference →IE Catalog →PPDU Formats →Legacy PHY →