802.11 PROTOCOL INTELLIGENCE

Service Sets - BSS, ESS, IBSS, MBSS

IEEE 802.11 defines four fundamental network topology types. Every Wi-Fi network - from a home router to a stadium deployment - is one or more of these service sets. The topology determines frame format, roaming capability, and how the Distribution System connects everything.

IEEE 802.11-2020 §4.3 CWNA Core Domain
BSS
Basic Service Set

One AP plus all its associated clients. The atomic unit of 802.11 networking.

Key Points
BSSID = AP radio MAC address (unique per radio)
AP generates Beacon frames every 102.4 ms to announce BSS
Clients associate via Auth → Assoc exchange
All data frames use BSSID in Address 1, 2, or 3
Multiple VAPs on one AP = multiple BSSIDs, one radio
Technical Detail

Infrastructure BSS: 1 AP (BSSID = AP radio MAC) + 0..n STAs. All STA-to-STA traffic flows through the AP - no direct STA-to-STA frames on-air (except WDS/mesh extensions). Each BSS has a unique BSSID; multiple BSSIDs (VAPs) can coexist on one AP radio.

PCAP

Look for Beacon frames with BSSID in Addr3 and ToDS=0, FromDS=0. All unicast data frames show BSSID in Addr1 (downlink) or Addr2 (uplink).

ESS
Extended Service Set

Multiple BSSes sharing the same SSID, connected by a wired Distribution System. What enterprise networks use.

Key Points
Same SSID across all APs in ESS
Different BSSID per AP radio
Distribution System (DS) = wired 802.3 infrastructure linking APs
Client roaming via Reassociation Request (FC Subtype=2)
802.11k provides Neighbor Reports; 802.11r provides fast key transition; 802.11v provides AP steering
Technical Detail

ESS = multiple BSSs sharing ESSID (SSID) + DS (Distribution System = 802.3 wired backbone). Each BSS has unique BSSID; ESSID is common across all APs. Client roams between BSSs via Reassociation. 802.11r/k/v enables fast transition between APs. L3 mobility (IP address preservation across subnets) handled separately by controller or PMKSA caching.

PCAP

Multiple Beacon streams with same SSID but different BSSIDs. Roaming event: Disassociation from AP-1 + Reassociation Request to AP-2 + Reassociation Response from AP-2.

IBSS
Independent BSS (Ad-hoc)

Peer-to-peer network with no AP. Devices talk directly to each other. No DS, no roaming.

Key Points
No AP - any STA can be beacon originator
BSSID generated randomly (not a hardware MAC)
ToDS=0, FromDS=0 for all data frames
Frames go directly STA→STA
No ESS roaming capability
Used in printers, game consoles, file sharing; replaced by Wi-Fi Direct in most uses
Technical Detail

IBSS: No AP - STAs form a direct peer mesh. One STA elected IBSS master (generates beacons). Frame exchange: ToDS=0, FromDS=0 (same as management frames). No DS connection. Limited to CSMA/CA DCF. No roaming (no DS to move through). Modern evolutions: Wi-Fi Direct (P2P, 802.11-2012 Annex P), NAN (Neighbor Awareness Networking, 802.11aq).

PCAP

Beacon frames with FC subtype=8 but BSSID is not a hardware MAC (locally administered bit often set). ToDS and FromDS both 0 in data frames.

MBSS
Mesh BSS (802.11s)

IEEE 802.11s wireless mesh network. MPs forward traffic for each other using HWMP routing. Self-forming, self-healing.

Key Points
Mesh Point (MP): forward-only, no client BSS
Mesh AP (MAP): MP + client-serving BSS (typical home mesh node)
Mesh Portal (MPP): MP + wired gateway uplink (root node)
HWMP: RREQ/RREP/RERR action frames for path selection
6-address MAC frame: RA, TA, DA, SA + Mesh Address Extension
AMPE = SAE-based authentication for mesh peer links
Technical Detail

802.11s MBSS: Mesh Points (MPs) form peer-to-peer wireless DS. Uses Mesh Control field in 6-address frames. HWMP (Hybrid Wireless Mesh Protocol): proactive RANN (Root Announcement) from MPP + reactive PREQ/PREP on demand. Airtime Link Metric (ALM): accounts for BW + retry rate. AMPE (Authenticated Mesh Peering Exchange): SAE-based per-link key establishment. MAP = MP + BSS. MPP = MP + gateway to DS.

PCAP

6-address 802.11 frames (ToDS=1, FromDS=1, Mesh Control present). Mesh Action frames (Category 13) for HWMP PREQ/PREP/RERR/RANN. MPP Beacon contains Mesh Profile IE.

SSID vs BSSID vs ESSID - Naming Clarity

SSID
Service Set Identifier

Human-readable network name (0-32 bytes UTF-8). Configured by admin. Same SSID can appear on multiple APs in an ESS. What users see in their device's Wi-Fi list. Wildcard SSID = zero-length string in Probe Request.

BSSID
Basic Service Set ID

Layer 2 identifier of a specific BSS. In infrastructure mode: the MAC address of the AP radio. Globally unique. Multiple BSSIDs (VAPs) can exist on one physical AP. In IBSS: randomly generated.

ESSID
Extended Service Set ID

Synonymous with SSID when referring to a multi-AP network. The common SSID shared across all APs in an ESS. All APs in the ESS broadcast the same ESSID in their Beacon frames. The term "ESSID" is often used in Linux wireless tools (iwconfig, hostapd).

HESSID
Homogeneous ESS ID

Used in 802.11u Hotspot 2.0 / Passpoint. A 6-byte value (MAC format) that identifies a Homogeneous ESS - a deployment where all APs share the same IP address space and authentication infrastructure. Carried in Interworking IE (IE 107). Enables seamless Passpoint federation.

Distribution System (DS)

The Distribution System is the 802.3 wired backbone that connects APs in an ESS. The DS is what enables roaming - when a client reassociates to a new AP, the controller or switch moves the client context through the DS. The DS is typically invisible in 802.11 management - it is the wired Ethernet infrastructure.

Wired DS (standard)

APs connected via 802.3 Ethernet. CAPWAP tunnels client traffic to WLC. Most enterprise deployments. Zero airtime for backhaul.

Wireless DS (WDS)

APs connected wirelessly using 4-address frames (ToDS=1, FromDS=1). Half-duplex - backhaul steals airtime from clients. Replaced by 802.11s mesh in modern deployments.

802.11s Mesh DS

MPs forward traffic wirelessly using HWMP path selection. Self-forming. Each link uses dedicated radio (tri-band mesh) or time-shares (dual-band mesh). MPP connects mesh to wired DS.

// related reference
WLAN Architectures →Device Roles →Roaming (k/v/r) →Frame Sequences →MAC Frame Format →