Wireless and mobile networks

In short

A wireless network carries frames over a shared radio channel instead of a cable, and a mobile network additionally lets a node keep its connection while it changes its point of attachment. Radio changes everything the wired layers assume: the channel is broadcast and half-duplex, errors are frequent, collisions cannot be detected by the sender, and the destination's address no longer tells you where it physically is. The topic covers IEEE 802.11 WLAN (framing, DCF, RTS/CTS, power save), Bluetooth and Zigbee personal-area networks, cellular generations from GSM to 5G, and mobility management via Mobile IP and handover. It is a standard unit in AICTE/CBCS computer-networks syllabi, carries 2-4 marks in GATE CS most years, and is examined in interviews at Jio, Airtel, Nokia, Ericsson, Samsung R&D, Qualcomm India, Tejas Networks, Cisco and in every IoT/embedded role.

Explained

Why wireless is different from wired

• Shared broadcast medium with no wire: every transmission in range is heard by all; there is no separate collision domain per cable segment.
• Signal strength falls fast: received power ∝ 1/dⁿ with path-loss exponent n ≈ 2 in free space and 3-5 indoors, so SNR varies hugely with distance.
• Interference and noise: other users, microwave ovens (2.4 GHz ISM), Bluetooth and adjacent APs all land on the same band; bit error rates of 10⁻³ to 10⁻⁵ are normal against 10⁻¹² on fibre.
• Multipath fading: copies of the signal arrive via reflections with different delays, adding constructively or destructively; delay spread causes inter-symbol interference, fixed by OFDM's guard interval.
• Half duplex: a radio cannot usefully listen while transmitting (its own signal is ~10⁹ times stronger), so CSMA/CD is impossible - collision *avoidance* is used instead.
• Hidden terminal: A and C both hear B but not each other, so both sense "idle" and collide at B. Exposed terminal: B transmits to A, so C defers although its transmission to D would not have collided - carrier sense at the sender is the wrong place to test.
• Mobility: a moving node changes AP or cell, and if it changes IP subnet the routing of its address breaks - hence Mobile IP and cellular location management.

IEEE 802.11 WLAN (Wi-Fi)

• Architecture: a BSS (basic service set) is one AP plus its stations, identified by the BSSID (the AP's MAC). Several BSSs joined by a distribution system form an ESS sharing one SSID (network name). IBSS / ad hoc mode has no AP.
• Association: the station scans (passive - listens for beacons, typically every 100 ms; active - sends probe requests), then authenticates, then sends an association request; only then may it send data.
• Standards (PHY): 802.11b 2.4 GHz/11 Mbps DSSS; 802.11a 5 GHz/54 Mbps OFDM; 802.11g 2.4 GHz/54 Mbps; 802.11n (Wi-Fi 4) MIMO, 40 MHz, up to 600 Mbps; 802.11ac (Wi-Fi 5) 5 GHz, 80/160 MHz, MU-MIMO downlink; 802.11ax (Wi-Fi 6/6E) OFDMA, uplink MU-MIMO, 1024-QAM, BSS colouring, 6 GHz in 6E; 802.11be (Wi-Fi 7) 320 MHz, 4096-QAM, multi-link operation. India delicensed the lower 6 GHz band (5925-6425 MHz) for low-power indoor Wi-Fi in 2024-25 - check current DoT rules, as conditions have been revised.
• Channels: 2.4 GHz has 13 channels in India, each 22 MHz wide and spaced 5 MHz, so only 1, 6, 11 are non-overlapping. 5 GHz has many non-overlapping 20 MHz channels, some needing DFS (radar avoidance).
• MAC - DCF with CSMA/CA (the examined default):
  1. Sense the channel (physical carrier sense plus virtual carrier sense via the NAV).
  2. If idle for a DIFS, transmit; if busy, wait until idle for DIFS, then run binary exponential backoff - pick a random number of slots in [0, CW], count down only while the channel is idle, freeze while busy.
  3. The receiver waits a SIFS and sends an ACK (there is no collision detection, so an unacknowledged frame is assumed lost).
  4. On failure, double CW (CWmin 15 → 31 → 63 … up to CWmax 1023 for 802.11a/g-style OFDM; 802.11b DSSS starts at CWmin 31) and retry; drop after the retry limit.
• Inter-frame spaces: SIFS < PIFS < DIFS < EIFS - shorter wait means higher priority, which is why ACKs and CTS always win the channel.
• RTS/CTS (virtual carrier sense): sender sends RTS, receiver replies CTS; every station that hears *either* sets its NAV (network allocation vector) for the stated duration and stays silent. This solves the hidden-terminal problem because the hidden node hears the CTS. Used only above the RTS threshold (commonly 2347 bytes = effectively off) since the handshake costs airtime.
• PCF: optional contention-free polling by the AP during the contention-free period; rarely implemented. 802.11e / WMM adds four access categories (voice, video, best-effort, background) with different AIFS and CW values - this is what real QoS uses.
• Fragmentation: long frames are split so a collision wastes less airtime; fragments are sent as a burst separated by SIFS.
• Frame format: frame control (2) | duration/ID (2) | addresses 1-3 (6 each) | sequence control (2) | address 4 (6) | optional QoS | payload | FCS (4). Three types: management (beacon, probe, association, authentication), control (RTS, CTS, ACK, PS-Poll), data.
• Why four addresses: To-DS/From-DS bits select the meaning - source, destination, transmitter and receiver differ when a frame crosses an AP or a wireless bridge (both bits set).
• Power management: a station tells the AP it is dozing; the AP buffers frames and advertises them in the TIM in each beacon, and the station sends PS-Poll to collect them. 802.11ax adds TWT (target wake time) for IoT battery life.
• Security: WEP (RC4, 24-bit IV) is broken; WPA (TKIP) is deprecated; WPA2 uses AES-CCMP with a 4-way handshake; WPA3 adds SAE (dragonfly) replacing the pre-shared-key handshake, forward secrecy and protected management frames. Enterprise mode uses 802.1X/EAP with a RADIUS server.

Bluetooth, Zigbee and other WPAN/LPWAN

• Bluetooth (IEEE 802.15.1): 2.4 GHz ISM, frequency-hopping spread spectrum, 79 channels of 1 MHz, 1600 hops/s. A piconet has one master and up to 7 active slaves (plus up to 255 parked); the master's clock and address drive the hop sequence. Overlapping piconets sharing a node form a scatternet.
• Classic Bluetooth links: SCO (synchronous, reserved slots, voice) and ACL (asynchronous, data with ARQ). Range classes: ~1 m, ~10 m, ~100 m.
• BLE (Bluetooth Low Energy, 4.0+): 40 channels of 2 MHz, 3 advertising channels, connectionless discovery, microamp sleep currents - the basis of fitness bands, beacons, and India's Aarogya Setu-era contact tracing.
• Zigbee (IEEE 802.15.4 PHY/MAC): 2.4 GHz (250 kbps), mesh with coordinator/router/end-device roles, very low power, used in smart meters and home automation.
• Others: 6LoWPAN carries IPv6 over 802.15.4 by header compression and fragmentation; LoRaWAN and NB-IoT give kilometre-scale low-rate IoT links (NB-IoT runs on licensed operator spectrum in India); RFID/NFC are near-field; Li-Fi uses visible light.
• 802.16 WiMAX: connection-oriented, scheduled (not contention) MAC for fixed/nomadic broadband; largely superseded by LTE.

Cellular networks: GSM to 5G

• Cellular principle: divide the area into cells, each with a base station on a subset of channels; the same channels are reused in cells far enough apart. Cluster size N = i² + ij + j² (so N = 1, 3, 4, 7, 9, 12…); smaller N gives more capacity but worse co-channel interference.
• GSM architecture: MS (mobile station = ME + SIM) → BTS → BSC (together the BSS) → MSC (switching, also GMSC to the PSTN) → registers HLR (home subscriber data), VLR (visitors in the MSC area), AuC (authentication keys), EIR (IMEI blacklist - India's CEIR portal blocks stolen handsets by IMEI).
• GSM identifiers: IMSI (subscriber, 15 digits, MCC 404/405 for India), TMSI (temporary, for privacy), MSISDN (dialled number), IMEI (handset), LAI (location area; TAC is the LTE tracking-area equivalent).
• GSM air interface: FDMA + TDMA - 200 kHz carriers each with 8 time slots; uplink 890-915 MHz and downlink 935-960 MHz in classic GSM-900, with GSM-1800 also used in India. Gross rate 270.833 kbps per carrier; full-rate speech 13 kbps.
• Data evolution: GPRS (packet switched, adds SGSN and GGSN, "2.5G"), EDGE (8-PSK), UMTS/WCDMA (3G, CDMA air interface, Node B and RNC), HSPA, LTE (4G).
• LTE (4G): all-IP, no circuit switching - voice uses VoLTE (IMS). Architecture: UE → eNodeB (E-UTRAN) → EPC = MME (signalling, mobility), S-GW, P-GW (IP anchor, internet), HSS (subscriber database), PCRF (policy). OFDMA downlink, SC-FDMA uplink, scalable 1.4-20 MHz bandwidth, carrier aggregation, MIMO.
• 5G NR: enhanced mobile broadband, URLLC (ultra-reliable low-latency, ~1 ms air latency target) and mMTC (massive IoT); sub-6 GHz FR1 and mmWave FR2; massive MIMO and beamforming; network slicing; NSA (anchored on LTE) then SA (5G core, gNB, AMF/SMF/UPF). India's commercial 5G launched in October 2022 on bands including 700 MHz, 3.3-3.67 GHz and 26 GHz; allocations and launch details vary by operator and circle.
• Indian regulation: DoT licenses spectrum and TRAI regulates tariffs and QoS; WPC (Wireless Planning & Coordination wing) issues radio licences and defines delicensed bands; Wi-Fi in 2.4 GHz and 5.15-5.35/5.725-5.875 GHz is licence-exempt for indoor low-power use. The Telecommunications Act, 2023 replaced the Indian Telegraph Act 1885 for licensing and spectrum assignment; PM-WANI is the framework for public Wi-Fi hotspots.

Mobility, handover and Mobile IP

• Handover (handoff) types: hard (break-before-make, GSM/LTE), soft (make-before-break, only CDMA/UMTS where the mobile talks to two cells at once), softer (two sectors of one site), horizontal (same technology) vs vertical (Wi-Fi ↔ LTE).
• Handover triggers: received signal strength with hysteresis and a time-to-trigger, to prevent ping-pong between two cells.
• Location management: the network pages a mobile within its location area / tracking area; the mobile does a location update when it crosses a boundary - a trade-off between paging cost and update cost.
• Mobile IP (RFC 5944): keeps the home address permanent while the node moves.
  • Home agent (HA) on the home network, foreign agent (FA) on the visited network, care-of address (CoA) - either the FA's address (shared) or a co-located CoA from DHCP.
  • Steps: agent discovery (agent advertisements) → registration of the CoA with the HA → HA intercepts packets for the home address by proxy ARP → tunnels them (IP-in-IP encapsulation) to the CoA → decapsulation and delivery.
  • Triangular routing: correspondent → HA → mobile, while the reply goes direct - inefficient; fixed by route optimisation (binding updates), which is built into Mobile IPv6 along with no need for an FA.
  • Reverse tunnelling is needed because a firewall doing ingress filtering drops packets whose source is the home address sent from a foreign network.
• Why mobility breaks routing: an IP address encodes a subnet (location), so moving a node to another subnet would normally require a new address and break open TCP connections.

Transport over wireless, and multiple access

• Why TCP suffers: TCP treats every loss as congestion and halves cwnd, but most wireless losses are bit errors, not congestion - throughput collapses even though the path is free.
• Fixes: link-layer ARQ and FEC hide errors (802.11 retransmits); split-connection (Indirect TCP) breaks the connection at the base station but violates end-to-end semantics; Snoop protocol caches segments at the base station and locally retransmits, suppressing duplicate ACKs; explicit loss notification; freezing timers during handover.
• Multiple access methods: FDMA (separate frequencies), TDMA (separate time slots), CDMA (same band, orthogonal/pseudo-random codes, uses power control and the near-far problem), OFDMA (groups of subcarriers, LTE/5G/Wi-Fi 6), SDMA (spatial beams/sectors).
• Spread spectrum: DSSS multiplies data by a chipping code (processing gain = chip rate/data rate); FHSS hops carriers - both resist narrowband interference and jamming.
• Ad hoc and sensor networks (MANET): no infrastructure, multi-hop, nodes act as routers. Proactive/table-driven: DSDV, OLSR (routes always ready, constant overhead). Reactive/on-demand: AODV (route request flood, route reply, sequence numbers), DSR (source routing with full path in the header). Hybrid: ZRP. VANET is the vehicular case.
• Antennas and capacity levers: MIMO spatial multiplexing (capacity scales with min(Nt, Nr)), beamforming, sectorisation, cell splitting, and adaptive modulation and coding.

Key points

• CSMA/CA, not CSMA/CD - a half-duplex radio cannot detect its own collisions, so 802.11 avoids collisions and confirms with ACKs.
• Hidden terminal - two senders out of each other's range collide at a common receiver; solved by RTS/CTS and the NAV.
• Exposed terminal - a station defers unnecessarily because it senses a transmission that would not have interfered.
• NAV - a countdown timer set from the duration field of any overheard frame; virtual carrier sense that costs no energy.
• IFS ordering - SIFS < PIFS < DIFS: the shorter the wait, the higher the priority (ACK and CTS use SIFS).
• Binary exponential backoff - CW doubles on each failure from CWmin to CWmax; the counter freezes while the channel is busy.
• BSS, ESS, SSID, BSSID - one AP's cell, a set of them bridged together, the network name, and the AP's MAC address.
• Four address fields - needed because transmitter/receiver differ from source/destination when frames cross an AP or wireless bridge.
• Only channels 1, 6, 11 are non-overlapping in the 2.4 GHz band.
• Piconet - one Bluetooth master and up to 7 active slaves on an FHSS hop sequence; linked piconets make a scatternet.
• Frequency reuse - cluster size N = i² + ij + j²; co-channel reuse ratio Q = D/R = √(3N).
• GSM core registers - HLR (permanent), VLR (visiting), AuC (keys), EIR (IMEI); SIM holds IMSI and Ki.
• GSM air interface - FDMA/TDMA, 200 kHz carrier, 8 slots, 270.833 kbps gross.
• LTE is all-IP - MME/S-GW/P-GW/HSS, OFDMA down, SC-FDMA up, voice over IMS as VoLTE.
• Mobile IP - home address stays fixed; HA tunnels to the CoA; triangular routing is the classic inefficiency.
• Soft handover exists only in CDMA - GSM and LTE use hard (break-before-make) handover.
• TCP over wireless - losses are errors, not congestion; Snoop and link-layer ARQ hide them from the sender.
• WPA3/SAE replaces WPA2's pre-shared-key handshake and adds forward secrecy; WEP is cryptographically broken.

Formulas and examples

• Example 1 - GSM carriers and channels. GSM-900 uplink is 890-915 MHz, 25 MHz wide, with 200 kHz carriers. Number of carriers = 25,000/200 = 125; with 8 TDMA slots each, total voice channels = 125 × 8 = 1,000 (one carrier/slot is reserved for control, so about 992 usable). With a 7-cell cluster, channels per cell = 1,000/7 ≈ 143.
• Example 2 - frequency reuse distance. A cell of radius R = 2 km uses cluster size N = 7. Q = √(3 × 7) = √21 ≈ 4.58, so the co-channel reuse distance D = Q × R = 4.58 × 2 ≈ 9.17 km. Moving to N = 4: Q = √12 ≈ 3.46, D ≈ 6.93 km - closer reuse, more capacity per unit area, but higher co-channel interference.
• Example 3 - Shannon capacity of a 20 MHz Wi-Fi channel. B = 20 MHz, SNR = 25 dB → S/N = 10^2.5 ≈ 316.2. C = 20×10⁶ × log₂(317.2) = 20×10⁶ × (ln 317.2/ln 2) = 20×10⁶ × 8.309 ≈ 166 Mbps theoretical. A real 802.11n 20 MHz single stream delivers ~72 Mbps PHY and ~45 Mbps of TCP goodput - overheads (preamble, DIFS, backoff, ACK, headers) cost roughly half.
• Example 4 - 802.11 DCF airtime for one frame. 802.11g parameters: slot 9 µs, SIFS 10 µs, DIFS = SIFS + 2×slot = 28 µs, CWmin = 15 so average backoff = 7.5 × 9 = 67.5 µs, PLCP preamble 20 µs, data rate 54 Mbps. A 1500-byte payload with 34 bytes of MAC header/FCS = 1534 bytes = 12,272 bits → 12,272/54 ≈ 227 µs. ACK (14 bytes at 24 Mbps) ≈ 5 µs + 20 µs preamble = 25 µs.
  • Total airtime ≈ 28 + 67.5 + 20 + 227 + 10 + 25 ≈ 377.5 µs.
  • Throughput = 1500 × 8 / 377.5 µs = 12,000/377.5 ≈ 31.8 Mbps against a 54 Mbps PHY rate - about 59% efficiency, which is why Wi-Fi never delivers its headline number.
• Example 5 - Doppler shift. A passenger on a train at 108 km/h (= 30 m/s) uses a 1,800 MHz GSM carrier, moving directly towards the tower (θ = 0). fd = (30/3×10⁸) × 1.8×10⁹ = 180 Hz. At a 3.5 GHz 5G carrier the same speed gives (30/3×10⁸) × 3.5×10⁹ = 350 Hz - higher carriers suffer more Doppler, which is why 5G NR uses larger subcarrier spacings.

Where it is used

• Telecom operators and vendors: Jio, Airtel, Vi, BSNL run LTE/5G RAN and core; Nokia, Ericsson, Samsung, Tejas Networks and HFCL build and test gNBs and transport - roles in RF planning, drive testing, RAN optimisation and protocol-stack development in Bengaluru, Noida, Chennai and Pune.
• Enterprise and campus Wi-Fi: Cisco, Aruba (HPE), Ruckus and Jio/Airtel managed services deploy controller-based WLANs in offices, hospitals, airports and university campuses; roles cover site surveys, channel planning, RADIUS/802.1X and troubleshooting.
• IoT and smart metering: BLE, Zigbee, LoRaWAN and NB-IoT in smart meters under RDSS/smart-city projects, wearables, industrial sensors - firmware and embedded roles at Bosch, Honeywell, Tata Elxsi, L&T Technology Services.
• Indian Railways and public services: RailTel's RailWire public Wi-Fi at stations, PM-WANI hotspots, metro CBTC radio links, and police/defence trunked radio.
• Product and chipset engineering: Qualcomm India, Broadcom, MediaTek and Intel India work on Wi-Fi 6/7 and 5G modem MAC/PHY; strong 802.11 MAC and 3GPP knowledge is the hiring filter.
• Testing and security: protocol testing with Wireshark and iperf, WLAN penetration testing (WPA2/WPA3 handshake capture, rogue APs) and spectrum analysis in audit and SOC roles.

Interview questions

• Q: Why does 802.11 use CSMA/CA instead of CSMA/CD? A: A radio is half-duplex and its own transmission swamps the receiver, so a sender cannot detect a collision; 802.11 therefore avoids collisions with backoff and confirms delivery with an ACK.
• Q: What is the hidden terminal problem and how is it solved? A: Two stations out of range of each other both sense idle and transmit to a common receiver, colliding there; RTS/CTS makes the receiver's CTS silence everyone in its range via the NAV.
• Q: What is the NAV? A: A virtual carrier-sense timer each station sets from the duration field of any frame it overhears, during which it treats the medium as busy without listening.
• Q: Why is SIFS shorter than DIFS? A: So that responses already part of an exchange - ACK, CTS, the next fragment - seize the channel before any new contender that must wait a full DIFS.
• Q: Why does an 802.11 frame carry four address fields? A: Because across a distribution system the transmitter and receiver (the APs) differ from the original source and final destination; the To-DS/From-DS bits say which field means what.
• Q: Difference between hard and soft handover? A: Hard handover releases the old cell before acquiring the new one (GSM, LTE); soft handover holds both links simultaneously and is only possible in CDMA systems where cells share the frequency.
• Q: Why does TCP perform badly over a wireless link, and how is it fixed? A: TCP interprets packet loss as congestion and shrinks its window, but wireless losses are mostly bit errors; link-layer ARQ/FEC, the Snoop protocol at the base station or explicit loss notification keep congestion control from reacting.
• Q: Explain triangular routing in Mobile IP. A: Packets to the mobile go to its home agent, which tunnels them to the care-of address, while replies go directly to the correspondent - an asymmetric, longer path removed by route optimisation in Mobile IPv6.
• Q: Why are only channels 1, 6 and 11 used in the 2.4 GHz band? A: Each channel occupies about 22 MHz but channel centres are 5 MHz apart, so only those three are far enough apart to avoid overlap.
• Q: What does the HLR store that the VLR does not? A: The HLR holds the permanent subscription record (IMSI, services, current VLR pointer); the VLR holds a temporary copy for subscribers currently roaming in that MSC area and discards it when they leave.
• Q: What happens when a Wi-Fi station's frame gets no ACK? A: The sender assumes a collision or error, doubles its contention window, backs off again and retransmits with the retry bit set, dropping the frame after the retry limit.
• Q: How does frequency reuse increase cellular capacity, and what limits it? A: Reusing the same channels in distant cells multiplies the channels available over an area; the limit is co-channel interference, set by the reuse ratio D/R = √(3N).

Common mistakes

• Saying 802.11 uses CSMA/CD, or that a collision is detected by the sender - it is inferred only from a missing ACK.
• Confusing the hidden terminal (collision at the receiver) with the exposed terminal (needless deferral by the sender).
• Thinking RTS/CTS is always on; it is used only above the RTS threshold because the handshake itself costs airtime.
• Quoting the PHY rate as throughput - DIFS, backoff, preamble, SIFS and ACK typically cut usable throughput to 50-60%.
• Using SNR in dB directly inside Shannon's formula instead of converting to a power ratio first.
• Claiming LTE or GSM supports soft handover - only CDMA-based systems (IS-95, UMTS) do.
• Mixing up the care-of address with the home address in Mobile IP, or forgetting that the home agent uses tunnelling, not routing changes.
• Treating a MANET routing protocol as a cellular feature, or calling AODV proactive when it is on-demand.

Related topics

• Data link layer: framing, error control and MAC · IP addressing and subnetting · Routing algorithms and protocols · TCP, UDP, HTTP and DNS · Network security: firewalls, VPN and IDS · OSI and TCP/IP models