// viz · preamble puncturing

Preamble Puncturing Channel Bitmap

Wi-Fi 7 lets you punch out a 20 or 40 MHz slice of an 80/160/320 MHz channel when it's unusable. Click any subchannel to puncture, apply a pattern, or trigger a DFS radar event and watch the bitmap update.

— Shankar K. · Source: IEEE 802.11be-2024 Section 36.3.12.11, 9.4.2.311 · Wireshark: wlan.eht.op.disabled_subchannel_bitmap

// start here

The P (Primary) subchannel can never be punctured — beacons and legacy frames depend on it. At 320 MHz, puncture granularity jumps to 40 MHz (a single 20 MHz click selects the 40 MHz pair). Try each scenario button to see realistic triggers: DFS radar, OBSS legacy AP, AFC restriction.

// channel bandwidth
4 legal patterns (incl. baseline)
usable bandwidth
80 MHz of 80 MHz
punctured
0% loss
disabled bitmap (hex)
0x0
// legal patterns (click to apply)
// scenarios
Click a scenario to see a realistic puncturing trigger in action.
// spec reference
EHT Operation Element
9.4.2.311
Carries Disabled Subchannel Bitmap Present flag + variable-length bitmap (4/8/16 bits for 80/160/320 MHz).
Preamble Puncturing PHY
Section 36.3.12.11
80/160 MHz: 20 MHz granularity. 320 MHz: 40 MHz minimum (sub-484-tone not allowed).
MAC-level Restrictions
Section 35.15.2
Primary subchannel can never be punctured. Nested: primary 40/80/160 MHz cannot be fully punctured either.
Pattern Counts
36.3.12.11.1
80 MHz -> 4 patterns (incl baseline). 160 MHz -> 11. 320 MHz -> 17. PHY-layer code space is larger; MAC layer (35.15.2) removes primary-touching patterns.
Wi-Fi 7 Certification
WFA mandate
Static puncturing MANDATORY for APs and STAs in 6 GHz. Dynamic puncturing optional. 5 GHz: neither mandatory but widely implemented.
OFDMA Interaction
Section 36.3.2.2.3
Punctured subchannels skipped during RU allocation. MRU (996+484+242 etc) allowed within active subchannels.
Wireshark: wlan.eht.op.disabled_subchannel_bitmap_present == 1 finds all punctured BSSs. wlan.eht.op.disabled_subchannel_bitmap decodes the bitmap hex. wlan.eht.op.channel_width is 80/160/320.
See preamble puncturing in your Wi-Fi 7 capture
WiFi Analyser decodes the EHT Operation IE, flags active puncture bitmaps, and reports per-BSS bandwidth loss across the capture.
try it free ↑
// learner's guide
from the field 160 MHz enterprise rollout, DFS radar, users drop every 30 minutes
// the scenario

Enterprise Wi-Fi 7 rollout. Controller configured for 160 MHz channels for performance. Within 48 hours, users complain about random drops during Teams calls. Controller logs show continuous DFS radar detections on the 5 GHz band.

// what's actually happening

One 20 MHz slice of the 160 MHz channel overlaps with a nearby weather radar. Dynamic Frequency Selection (DFS) rules require the AP to vacate the entire 160 MHz channel for at least 30 minutes on every detection. The AP keeps cycling: 160 MHz when clear, fallback to 80 MHz after a radar hit, back to 160 MHz after the DFS timer expires. Clients disconnect on every transition because the channel width they're associated with changes.

// how this feature helps

Preamble Puncturing lets the AP mark that specific 20 MHz slice as unusable and keep operating across the remaining 140 MHz of the channel. Clients that support puncturing (all Wi-Fi 7 devices and some Wi-Fi 6 ones) read the puncture bitmap in the HE/EHT Operation Information Element and use only the non-punctured subchannels. No more disruptive full-channel drops on radar events — the wide channel survives the interference.

// still watch out for

Puncturing uses a fixed set of preset patterns per channel width, not arbitrary subchannels. If the interference falls in a slice that doesn't match any preset pattern, the AP can't puncture around it and has to fall back to a narrower channel. Wi-Fi 6 clients associated to the same BSS often can't use punctured channels and stay on 20, 40, or 80 MHz. Static puncturing is mandatory on Wi-Fi 7 APs in 6 GHz; in 5 GHz it's optional, so vendor support and deployment behavior vary.

basic What is preamble puncturing?

Preamble puncturing is a Wi-Fi 7 feature that lets an access point transmit on most of a wide channel while skipping ("puncturing") 20 or 40 MHz slices that are unusable. Without it, interference on just one 20 MHz sliver of an 80 MHz channel would force the whole AP to either halve its bandwidth or change channels entirely.

Think of a four-lane highway where one lane has construction. Before puncturing, the whole highway slows down. With puncturing, you keep three lanes open — traffic gets there, just a bit slower.

Why do you need to skip a channel? Three common reasons:

· Weather radar on 5 GHz interferes with channels 52-144 (DFS events). Legally, you must vacate within 30 seconds.
· Neighbor's old Wi-Fi 6 AP runs 80 MHz on part of your 160 MHz. You can't kick it off, so you puncture around it.
· AFC restrictions in 6 GHz (US) limit your transmit power on specific subchannels. Puncturing preserves power on the rest.

Wi-Fi 6 vs Wi-Fi 7. Wi-Fi 6 had a limited form of puncturing that only worked for OFDMA multi-user frames. Wi-Fi 7 made it mandatory and extended it to all frame types. In 6 GHz, Wi-Fi 7 clients must support static puncturing to get certified.

intermediate Patterns, primary constraint, static vs dynamic
Legal pattern counts per bandwidth:
80 MHz: 4 patterns (including baseline "no puncture")
160 MHz: 11 patterns
320 MHz: 17 patterns
PHY layer (36.3.12.11) defines a larger code space; MAC layer (35.15.2) rules out primary-touching patterns, giving the legal counts above.

Combinations of 20 MHz and 40 MHz puncture granularities, minus invalid patterns (primary-touching combinations).

The primary 20 MHz can NEVER be punctured. This is structural. Beacon frames, management frames, and legacy-client compatibility all depend on the primary subchannel. By extension, in 160 MHz the primary 80 MHz cannot be fully punctured. In 320 MHz, the primary 160 MHz cannot be fully punctured. Nested primary constraint.

20 MHz vs 40 MHz granularity:

· 80 MHz puncturing: 20 MHz granularity (you can puncture exactly 20 MHz)
· 160 MHz puncturing: 20 MHz OR 40 MHz
· 320 MHz puncturing: 40 MHz only (20 MHz granularity doesn't apply at 320 MHz)

Why the jump at 320 MHz? Spec rule: "puncturing a subchannel smaller than a 484-tone RU is not allowed in a 320 MHz PPDU bandwidth" (802.11be 36.3.12.11.1). 484 tones equals 40 MHz.

Static vs Dynamic puncturing. Static: the AP advertises the puncture bitmap in every Beacon via the Disabled Subchannel Bitmap field of the EHT Operation element. All PPDUs in the BSS honor this. Dynamic: the transmitter signals puncturing per-PPDU via the U-SIG field. Different PPDUs can have different puncture patterns, even within the same BSS.

Certification mandate: Static puncturing is mandatory for Wi-Fi 7 APs and STAs operating in 6 GHz. Dynamic puncturing is optional. In 5 GHz, static puncturing support is not mandatory but is widely implemented.

Real-device mapping:
· Cisco Catalyst 9130/9136 AP: static puncturing enabled by default when DFS event detected
· Aruba AP-635: supports both static and dynamic puncturing, configurable
· Legacy Wi-Fi 6 client on a punctured BSS: AP announces bandwidth reduction via separate operating mode IE to protect legacy clients
expert Spec-level mechanics

Disabled Subchannel Bitmap encoding. Field length varies with channel width: 4 bits for 80 MHz, 8 bits for 160 MHz, 16 bits for 320 MHz. Bit N corresponds to the N-th 20 MHz subchannel counted from lowest frequency. Bit = 1 means punctured.

Interaction with OFDMA. In an EHT MU PPDU, punctured subchannels are skipped during RU allocation. The AP's scheduler must honor the bitmap when assigning RUs. The remaining active subchannels still support 242/484/996-tone and MRU allocations. See OFDMA RU Allocator for how RUs nest inside 20/40/80 MHz subchannels.

Non-HT Duplicate PPDU with punctured preamble. Section 36.3.11 defines how RTS/CTS frames can be sent in a punctured-preamble non-HT-duplicate format, which legacy (pre-Wi-Fi 6) clients can decode even when the AP is transmitting on a punctured bandwidth. This preserves medium reservation semantics in mixed-generation deployments.

Sounding with puncturing. EHT sounding NDPs (Section 36.3.1) must also respect the puncture pattern. Section 7 of the EHT MAC spec adds "sounding for partial bandwidth" specifically to handle the case where one or more 20 MHz subchannels are punctured — the NDP skips those subchannels but still provides valid channel estimates for the active portion. Without this extension, beamforming would fail under puncturing.

Spectrum mask implications. The 802.11be spectrum mask for a PPDU with punctured channels is a modified version of the standard mask with the punctured slice replaced by an out-of-band emission mask. Regulatory compliance requires that the AP's PA deliver true zero power on punctured subchannels, not just attenuated power.

OBSS_PD and BSS Color interaction. A Wi-Fi 7 AP using static puncturing advertises the Disabled Subchannel Bitmap in Beacon. Neighboring APs running BSS Color spatial reuse can detect the punctured slice as free spectrum relative to this BSS. In dense deployments, two APs with complementary puncture patterns can co-exist on the same channel more effectively than non-punctured. See BSS Color OBSS Coexistence for spatial reuse context.

TX power on punctured subchannels. Zero. No exceptions. Regulatory compliance, EVM measurement, and interference management all depend on true zero power on punctured slices. The AP's PA design must support narrow-band shut-off, which is why preamble puncturing is mandatory in hardware spec — you can't software-punch it if the hardware can't zero-out a slice.

Wireshark expert view. wlan.eht.op.disabled_subchannel_bitmap_present == 1 finds all punctured BSSs. wlan.eht.op.disabled_subchannel_bitmap decodes the bitmap hex. wlan.eht.op.channel_width is 80/160/320. For dynamic puncturing, inspect U-SIG: wlan.usig.punctured_channel.

// share this page
// also on this site
viz
OFDMA RU Allocator
reference
Channels Reference
ie
Beacon IE Decoder
← previous
viz
BSS Color OBSS Coexistence
next →
reference
Wi-Fi 7 Track
SK
Shankar K., Wi-Fi engineer, Irving TX
Building WiFi Analyser V2 · CWNA-109 in progress · one post every two weeks
// leave a comment