// reference · timing
802.11 Exchange Timing Reference
SLA thresholds for every 802.11 exchange - from Auth Request to DHCP ACK. Enter a measured timing to compare against PASS/WARN/FAIL thresholds. Sources: IEEE 802.11-2020, nfstream NFlow schema, wlanpi-profiler IE timing gates, 15 years of enterprise field data.
— Shankar K. · Source: IEEE 802.11-2020, RFC 2131, field practice
// sla calculator - enter a measured timing
Status
WARN threshold
FAIL threshold
IEEE Reference
0 ms
// complete sla threshold reference
| Exchange | WARN | FAIL | Standard | Wireshark field |
|---|---|---|---|---|
| Auth Request → Auth Response | >200ms | >500ms | IEEE 802.11-2020 §11.3.2 | wlan.fc.type_subtype == 0x0B |
| Assoc Request → Assoc Response | >200ms | >500ms | IEEE 802.11-2020 §11.3.3 | wlan.fc.type_subtype == 0x00 |
| EAPOL M1 → M2 | >200ms | >1000ms | IEEE 802.11i §8.5.3 | eapol && wlan_rsna_eapol.keydes.key_info.key_ack == 1 |
| EAPOL M2 → M3 | >500ms | >2000ms | IEEE 802.11i §8.5.3 | eapol && wlan_rsna_eapol.keydes.key_info.install == 1 |
| EAPOL M3 → M4 | >200ms | >1000ms | IEEE 802.11i §8.5.3 | eapol && wlan_rsna_eapol.keydes.key_info.key_mic == 1 |
| Full 4-Way Handshake (M1–M4) | >500ms | >2000ms | IEEE 802.11i §8.5.3 | eapol |
| FT Auth Cycle (802.11r) | >50ms | >100ms | IEEE 802.11r §12.11 | wlan_mgt.fixed.action_code == 2 |
| BSS Transition Response (802.11v) | >1000ms | >3000ms | IEEE 802.11v §11.22 | wlan_mgt.fixed.action_code == 7 |
| Reassociation (roaming event) | >100ms | >300ms | IEEE 802.11-2020 §11.3.5 | wlan.fc.type_subtype == 0x02 |
| DHCP Discover → Offer | >500ms | >2000ms | RFC 2131 | bootp.option.dhcp == 1 |
| DHCP Full DORA Cycle | >1000ms | >5000ms | RFC 2131 | bootp |
// field note
EAPOL timeout - Reason 15
The most common EAPOL failure in enterprise. AP sends M1, client never responds with M2 (wrong PSK, driver bug, or RF path loss at that instant). AP retries M1 up to 3 times, then deauths with Reason 15. If you see Reason 15, find the missing M2 in the PCAP - its absence tells you where the failure is. WiFi Analyser flags this as CONNECTIVITY.EAPOL.TIMEOUT.
// field note
FT timing vs full re-auth
Full re-auth roam: Auth + Assoc + 4-Way = 300–800ms typical. 802.11r FT roam: FT Auth + Assoc = 40–80ms typical. Over-the-DS FT is slightly faster than over-the-air because the AP pre-stages PMK-R1 distribution before the client even departs. If FT takes >100ms, the PMK-R1 hierarchy between APs is broken - check controller config.
// field note
DHCP blocking roaming
The most-overlooked roaming SLA element. A client that roams in 80ms then waits 4 seconds for DHCP appears as a 4-second roam in user experience. Always measure DHCP separately in a PCAP. DHCP Discover → ACK >2000ms = DHCP server overloaded or VLAN routing delay. Most enterprise controllers offer IP address retention (OKC + PMKSA caching) to eliminate DHCP entirely on L2 roams.
Measure these timings in your own PCAP
WiFi Analyser automatically calculates auth_ms, assoc_ms, eapol_ms, and DHCP timing - and flags WARN/FAIL against these thresholds.