// wi-fi 7 track · 802.11be
Field notes from Wi-Fi 7 gateway qualification
I qualify Wi-Fi 7 gateways for a living. These posts are what I'm finding at the frame level — things the spec doesn't warn you about. Every post includes a downloadable PCAP captured from real hardware.
// interactive wi-fi 7 tools — shipped
MLO Modes
MLSR, EMLSR, STR, NSTR side-by-side. Tune link overlap and watch mode resolvers play out.
open ↑
TWT Schedule
Individual + Broadcast TWT with r-TWT toggle. Live mantissa/exponent math on the wake interval.
open ↑
Preamble Puncturing
80/160/320 MHz bitmap. Three scenarios: DFS radar, legacy OBSS AP, 6 GHz AFC restriction.
open ↑
BSS Color SR
Click any STA in a 3-BSS overlap. OBSS_PD slider, TX power in lockstep, color collisions.
open ↑
// why this track exists
Most Wi-Fi 7 content online covers the marketing layer — "47% faster than Wi-Fi 6!" None of it covers what you actually see in a PCAP when MLO negotiates, when preamble puncturing fires, or when a gateway misreports its EHT capabilities to a client. I'm qualifying these devices daily. The captures exist. This is where I publish them.
// what's actually new in wi-fi 7
Wi-Fi 7 brings five marquee features. Some are mandatory for certification, some are optional, and vendor adoption varies widely. Here's the spec-accurate view with links to interactive visualizers where they exist.
802.11be section 35.3
Multi-Link Operation (MLO)
One logical association, multiple physical links across 2.4 / 5 / 6 GHz. The device (MLD) has one U-MAC address; each active link has its own L-MAC. Five operational modes: MLSR, EMLSR, STR, NSTR, EMLMR. See the mode deep dive below.
interactive: MLO modes → 802.11be section 36.3
320 MHz Channels & Preamble Puncturing
6 GHz only. Double the Wi-Fi 6E bandwidth. Preamble puncturing lets an AP punch out 20 or 40 MHz slices when a sub-channel is unusable (DFS, OBSS, AFC). Static puncturing is mandatory for 6 GHz Wi-Fi 7 certification.
interactive: puncturing bitmap → 802.11be section 36.3.2.2
Multi-RU (MRU)
Wi-Fi 6's OFDMA gives one STA one RU. Wi-Fi 7 gives one STA multiple non-contiguous RUs in the same PPDU — e.g., 996+484+242 tones combined across a 320 MHz channel. The key field insight: when part of a 6 GHz channel is dirty, the AP assigns RUs from the clean parts. You never face an empty slate. MRU is the reliability layer on top of the bandwidth layer.
interactive: OFDMA baseline → 802.11be section 35.6
Restricted TWT (r-TWT)
Target Wake Time with protected service periods. The AP broadcasts a Quiet element that silences non-r-TWT STAs before the SP begins. Inside the SP, only r-TWT members transmit. The answer to "can Wi-Fi guarantee low latency for AR/VR, gaming, voice?"
interactive: TWT + r-TWT → 802.11be section 36.1
4K-QAM (MCS 12, 13)
4096 points in the constellation, up from 1024 in Wi-Fi 6. Adds two MCS levels (12 and 13) for 20% higher peak PHY rates under excellent RF. Needs ~37 dB SNR to sustain — only works at short range with clean spectrum. Marketing headline; real-world relevance limited.
reference: MCS table → // the two layers of mlo — hardware and software
Most engineers see the hardware layer: three radios bonded into one pipe. That is the LAG story and it is the easy part. The software layer is where MLO becomes a different architecture — not just faster pipes but a smarter scheduler that Wi-Fi 6 simply cannot replicate.
AP UMAC — Upper MAC Scheduler
DL dispatch → band + client
TID-to-link mapping
Voice and real-time traffic assigned to the low-latency band. Bulk data to the wide pipe. The AP makes this decision per TID — no contention, no EDCA lottery.
Trigger frames as UL slot grants
The AP issues UL grants via trigger frames — functionally equivalent to 5G PDCCH scheduling. The client does not contend; it executes the UL slot grant per TID. Scheduled access replaces probabilistic CSMA.
Per-client scheduling
The AP schedules each MLD client individually across its active links. Traffic steering decisions happen at the UMAC layer before any frame hits the radio — not after the EDCA backoff.
Client UMAC — Upper MAC Receiver
ML-Rx always-on — receiver never goes dark
ML-Rx — bonded RX across all bands
The client receiver stays open on all active links simultaneously. When Wi-Fi 6 walks away from an AP and the radio re-scans, the session breaks. MLO: the client already listens on 5 GHz. TX shifts instantly. No scan. No break. Make-before-break.
SR-Tx — select cleanest band, fire
On UL, the client picks the cleanest band per frame — not per session, per frame. ACKs flow back on whichever band is cleanest at that moment, independent of the DL path. TCP window never collapses.
UL escape — primary congested
If the primary link is congested, UL automatically escapes to the secondary. No application change. No reconnect. The congestion is absorbed inside the UMAC — invisible to the TCP stack above.
// what this means in a pcap
Filter on the L-MAC addresses, not the U-MAC (MLD address). AP UMAC activity shows as trigger frames to specific L-MACs across multiple channels in rapid succession. Client SR-Tx shows as UL frames originating from different L-MACs (different bands) across consecutive time slots. If you only capture on one channel, you see half the picture. A dual-radio capture revealing interleaved L-MAC UL frames with no inter-frame gap between bands is the STR brownout signature — the radio that would have gone dark under Wi-Fi 6 is still transmitting.
// six outcomes — hardware features + software features
MLO is not one improvement. It maps six distinct hardware and software capabilities to six measurable network outcomes. Each is independently verifiable in a field trial PCAP.
Framework: Sridhar Sikha (field anatomy) + WBA Phase 2 Enterprise Trial (AT&T, RUCKUS Networks, Intel) March 2026
// field trial numbers — wba phase 2 + cablelabs verified
Two independent field trials — enterprise and residential — published by the Wireless Broadband Alliance. These are the numbers that make the enterprise reliability argument. All results from commercial equipment, not a lab.
WBA Phase 2 — Enterprise (March 2026)
AT&T network · RUCKUS R770 · Intel BE200
Clean spectrum (40+40 MHz) DL +42% UL +139%
Under CCI — DL throughput up to +75%
Under CCI — UL throughput up to +116%
DL latency (real-time traffic) −44%
UL latency (real-time traffic) −66%
6 GHz 160 MHz sustained to 40 ft 1+ Gbps
Brownout result: Under light CCI, non-MLO DL fell 33%. Saturation drives it to zero. MLO held — 5 GHz stayed clean while 6 GHz was hit. That is the enterprise reliability argument in one number.
WBA Residential — CableLabs + Intel (Feb 2025)
Home environment · 1 AP · ~12 MLO clients
TCP throughput (peak) 3.5 Gbps
Peak DL (6 GHz 320 MHz) 3.7 Gbps
App latency reduction −48%
P95 inter-burst time (IBT) −39%
80+80 MHz throughput vs Wi-Fi 6E doubled
Same bonding and brownout architecture as enterprise. Different pressure point: one AP, a dozen MLO clients. The ML-Rx and SR-Tx story is identical — the session never severs because the receiver never goes dark.
Sources: WBA Phase 2 Enterprise Field Trials Report — AT&T, RUCKUS Networks, Intel (wballiance.com, March 2026) · WBA Residential Field Trial — CableLabs, Intel (wballiance.com, February 2025). Both reports publicly available at wballiance.com.
// mlo modes — all five, per ieee 802.11be
MLO in Wi-Fi 7 is not one thing — it is five distinct operating modes with different hardware requirements and certification status. Getting these confused is the most common Wi-Fi 7 misconception.
MLSR
mandatory for APs + clients
Hardware
1 radio
How it works
One radio, one link at a time. Can switch links but not simultaneously. Baseline mode all Wi-Fi 7 devices must support.
Adoption
Universal — every Wi-Fi 7 device ships it.
EMLSR
optional
Hardware
1 radio with 2+ receive chains
How it works
Listens on multiple links simultaneously (1x1 per link). TX/RX on one link at a time (2x2 combined). Fast switching on demand.
Adoption
Most client vendors ship EMLSR. Low power, low cost, usable latency benefit.
STR
mandatory for APs
Hardware
2+ radios with RF isolation
How it works
True simultaneous operation — one radio TX on 5 GHz while the other RX on 6 GHz at the same moment. Full duplex across bands.
Adoption
Standard on APs. MLMR-STR on clients is the high-end flagship mode; Samsung S24/S25, high-end routers.
NSTR
optional — rarely deployed
Hardware
2+ radios, relaxed isolation
How it works
Synchronous multi-radio. Can TX or RX on both links, but not TX on one while RX on another. Backoff happens on primary link only.
Adoption
Defined in spec but has significant implementation complexity. Not in any shipped Wi-Fi 7 client this author has captured.
EMLMR
optional — rarely deployed
Hardware
2+ radios, dynamic spatial mux reconfig
How it works
MLMR plus the ability to dynamically reconfigure spatial multiplexing per link. Most flexible mode in the spec.
Adoption
Highest implementation complexity. No major vendor has shipped EMLMR on consumer devices as of 2026.
// field note — identifying MLO mode in a PCAP
Every MLO device has a U-MAC (the MLD address — shown in OS network settings) and one L-MAC per active link. Always filter by L-MAC in Wireshark — not U-MAC. Two L-MACs interleaved with no gap equals STR. L-MAC switching with short gaps equals EMLSR. Only one L-MAC ever transmitting equals MLSR. NSTR and EMLMR require inspecting per-link timing and spatial-stream negotiation in the Association Request capabilities.
| Feature | MLSR | EMLSR | STR | NSTR | EMLMR |
|---|---|---|---|---|---|
| Radios required | 1 | 1 | 2+ | 2+ | 2+ |
| Simultaneous TX/RX | No | No | Yes | Partial | Yes |
| Listen on all links | No | Yes (1x1) | Yes | Yes | Yes |
| Peak throughput | Low | Moderate | Highest | High | Highest |
| Battery efficiency | Best | High | Lower | Medium | Lowest |
| Cert status (AP) | mandatory | optional | mandatory | optional | optional |
| Cert status (client) | mandatory | optional | optional | optional | optional |
| Vendor adoption | universal | most clients | most APs | rare | none shipped |
Source: IEEE 802.11be-2024 Section 35.3 MLO, mrncciew CWNE study notes, Cisco Meraki Wi-Fi 7 Technical Guide (2025).
// field notes — blog posts, one every two weeks
mlo · 802.11be
MLO doesn't roam - it negotiates. Here's the difference in the frames.
Your existing tools are reading the wrong MAC address. The MLD MAC (U-MAC) is not the one to filter on.
eht · beacon
Reading an 802.11be beacon: EHT capabilities, MCS 0-13, and beacon protection bits
A field-by-field walkthrough of what's new in the EHT Capabilities IE vs. HE.
320 mhz · puncturing
Preamble puncturing in the wild - what it looks like and when it fires
The spec allows it. Real hardware does it differently. Here's what showed up in my gateway captures.