1. The Story
Press "Next" to go through it step by step. At each step, a character steps forward and explains what they are doing.
Prologue: a quick recap
Step 1 of 11
The wired LAN
The computers and TV at home are all cabled to me, so everyone is in the same LAN (Local Area Network). I use the MAC Address to send each Frame to the right Port.
Animation text version (all steps)
- Prologue: a quick recap
- The wired LAN · Octo: The computers and TV at home are all cabled to me, so everyone is in the same LAN (Local Area Network). I use the MAC Address to send each Frame to the right Port.
- Act 1: A new friend with no socket
- Here comes the phone · Mac: There's a new phone in the house. It wants to share photos with us, but it doesn't have a single network socket! Even Octo's long tentacles can't reach it.
- Enter the Access Point · Octo: We've brought in an Access Point, cabled to my P4. It's connected by cable on one side and talks with radio waves on the other, like a bilingual interpreter.
- The wired side speaks Ethernet
- The wireless side speaks Wi-Fi; its standard name is IEEE 802.11
- Beacon: "I'm Mac's Home!" · Pip: About every 0.1 seconds, the Access Point sends out a Beacon, announcing its name to everyone around: "Mac's Home". This Wi-Fi name is called the SSID (the wireless network's name).
- The list of networks you see in your phone's Wi-Fi settings is collected from Beacons
- Connect and check the password · Pip: The phone chooses "Mac's Home" and connects to the Access Point. Then WPA2 or WPA3 confirms that both sides know the password, and they agree on a set of encryption keys used only for this connection.
- ① Authentication and Association
- ② WPA2/WPA3: check the password, create encryption keys
- ③ Then use DHCP (Dynamic Host Configuration Protocol) to get an IP Address (Lesson 8)
- Act 2: A wireless Frame's journey
- Pip flies through the air · Pip: The phone wants to send a photo to Mac. First I put on a wireless Frame coat and fly to the Access Point on radio waves. In the air, my contents are encrypted, so even if the neighbours pick me up, they can't read me.
- The interpreter rewraps · Pip: The Access Point decrypts me, swaps my wireless coat for an Ethernet Frame, and hands me to Octo. The recipient and sender MAC Addresses stay the same, and so does the photo inside.
- Only the Frame wrapping changes; the IP Address and the data stay the same
- Octo: the phone is on P4 · Octo: I work as usual: I look at the sender and note that the phone is on P4; I look at the recipient and send the Frame to Mac on P1. To me, the phone is no different from any other computer. We're all in the same LAN!
- MAC Address Table:
- P1 →
…:01(Mac) - P4 →
…:03(phone, via Access Point)
- Act 3: Sharing the air
- The air is just one "cable" · Pip: On the same channel, all Wi-Fi devices share the same patch of air, as if everyone were plugged into the same Hub. Only one device can transmit at a time.
- Bands: 2.4 GHz (long reach, more crowded), 5 GHz (fast, shorter range), 6 GHz (Wi-Fi 6E/7)
- CSMA/CA: avoiding crashes · Pip: It's hard for wireless devices to listen while sending, so Wi-Fi uses CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance): listen first, and once it's quiet, wait a random time before sending. The recipient must reply with an ACK (acknowledgement). No ACK? Send it again.
- Wired Hub: CSMA/CD, deal with crashes afterwards
- Wi-Fi: CSMA/CA, avoid crashes where possible and confirm with ACKs
- Wrap-up: the invisible cable · Mac: With an Access Point, the phone joined our LAN without a cable. And that Wi-Fi router at home? It's usually a Router, a Switch and an Access Point, three in one!
- Access Point: connects wireless devices to the wired LAN
- SSID: the Wi-Fi's name; WPA2/WPA3: encryption
- Same channel shares the air; uses CSMA/CA and ACKs
2. Where Is the Problem
Octo, our Switch, is very capable, but he can only deliver over cables. Every device needs a network socket, plus a cable running to one of his Ports.
But lots of devices today have no network socket at all:
- Phones, tablets and smartwatches
- Many thin-and-light laptops
- Smart light bulbs, doorbells and speakers
Even with a socket, you can't drag a cable behind you while walking around the house with your phone.
So here is the problem: how do these devices join the same LAN (Local Area Network) and swap data with the wired computers and TV?
3. How the Network Solves It
We add a "bilingual interpreter" to the LAN: an Access Point.
On one side, it is connected to Octo by a cable and speaks Ethernet. On the other side, it talks to the phone using radio waves and speaks Wi-Fi. When data arrives, it simply changes the wrapping and passes it to the other side.
Wi-Fi is the technology that connects devices to a LAN using radio waves. To Octo, the phone is just another device sitting behind P4. Everyone is still in the same LAN.
4. A Closer Look
Four steps for a phone to join Wi-Fi
| Step | What happens |
|---|---|
| ① Search | About every 0.1 seconds, the Access Point sends out a Beacon announcing its SSID (the Wi-Fi network's name). The phone can also send out a query itself. |
| ② Connect | The phone chooses "Mac's Home" and completes Authentication and Association with the Access Point. |
| ③ Check the password | WPA2 or WPA3 (Wi-Fi Protected Access) confirms that both sides know the password, then they agree on a set of encryption keys used only for this connection. (With WPA3, the password check actually begins during the Authentication in step ②.) |
| ④ Get an IP | The phone uses DHCP (Dynamic Host Configuration Protocol) to get an IP Address from the Router. See Lesson 8 of the beginner course for details. |
Note: the password itself is never sent through the air. Both sides use the password to "calculate" the encryption keys, so an eavesdropper can't simply read the password. (A very simple password can still be guessed, though, so make it long enough.)
How does a wireless Frame become an Ethernet Frame?
When the phone sends a photo to Mac, the wireless Frame has three MAC Address fields, one more than an Ethernet Frame:
| Field | Wireless Frame (phone → Access Point) | Ethernet Frame (Access Point → Octo) |
|---|---|---|
| Receiver for this hop | The Access Point's wireless MAC Address | — |
| Sender | Phone 00:00:5E:00:53:03 |
Phone 00:00:5E:00:53:03 |
| Final recipient | Mac 00:00:5E:00:53:01 |
Mac 00:00:5E:00:53:01 |
| Contents | Encrypted IP Packet and photo | Decrypted IP Packet and photo |
After decrypting, the Access Point puts on the Ethernet wrapping, but the sender's and final recipient's MAC Addresses stay the same. So Octo learns "the phone …:03 is on P4", just as if the phone were plugged straight into P4.
The MAC Address on the Access Point's wireless side has its own special name: the BSSID (Basic Service Set Identifier).
Bands and channels
Wi-Fi works on several radio frequency bands:
| Band | Features |
|---|---|
| 2.4 GHz | Better at going through walls and reaches further; but has few channels and is shared with Bluetooth, microwave ovens and more, so it gets crowded |
| 5 GHz | Faster, with more channels; shorter range |
| 6 GHz | Only supported by Wi-Fi 6E and Wi-Fi 7; fastest, least interference, shortest range |
Each band is split into many Channels. All devices on the same channel share the same patch of air, as if they were all plugged into the same Hub: only one device can transmit at a time. That is why Wi-Fi is Half-duplex.
CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance): avoiding crashes where possible
Story 2 explained that devices on a Hub use CSMA/CD (Carrier Sense Multiple Access with Collision Detection): they deal with a crash after it happens.
That is very hard for wireless devices. A device's own signal is so strong that it drowns out the faint signals from other devices further away. So even if it listens while sending, it can't tell whether a crash happened.
Instead, Wi-Fi uses CSMA/CA:
- Listen first: if someone is using the channel, wait.
- Wait a random time: once the channel is free, don't send straight away. Wait a random extra time first, so it is less likely that everyone starts talking at once.
- Send.
- Wait for an ACK (acknowledgement): when the recipient gets a Unicast Frame, it must reply with an ACK immediately. No ACK means the send failed, so try again a bit later.
Your home "Wi-Fi router" is really three in one
The Wi-Fi router at home usually packs three devices into one box:
| Built-in device | Job |
|---|---|
| Router | Connects your home LAN to the Internet |
| Switch | The LAN sockets on the back |
| Access Point | Sends out the Wi-Fi signal |
So even though you can't see Octo at home, he is actually hard at work inside that box.
5. Try It Yourself
Mission: look at your phone's Wi-Fi details
- Open your phone's "Settings" → "Wi-Fi" (the names depend on your phone).
- Every network in the list is an SSID that a nearby Access Point announced with a Beacon. How many can you count?
- Tap the network you are connected to and check:
- Does it show "2.4 GHz", "5 GHz" or a channel number?
- Is the security type WPA2 or WPA3?
- What IP Address did your phone get? Does it start with
192.168?
- Many phones also show an option called "Private Address" or "Randomised MAC Address". This is a privacy feature (see "Where the Analogy Breaks" below).
Mini game
Wired or wireless?
Sort each item into wired Ethernet (plugged into a Switch) or wireless Wi-Fi (same channel). (Full-duplex means a device can send and receive at the same time.)
-
1Only one device on the same channel can transmit at a time
-
2Devices can use Full-duplex to send and receive at the same time
-
3Every Unicast Frame needs an ACK reply
-
4Uses CSMA/CA to avoid collisions where possible
-
5Needs an SSID and a password to join
-
6Signals travel along a cable, so outsiders can't easily pick them up
All sorted correctly! Wired devices on a Switch each have their own line, so they can use Full-duplex. Wi-Fi devices share the air, so they use CSMA/CA, ACKs and encryption.
6. Where the Analogy Breaks
- An Access Point does more than "interpret". It also manages connections, handles encryption and decryption, resends failed Frames, and even arranges for different devices to take turns transmitting. It is far busier than an interpreter.
- Radio waves don't fly politely in a straight line. In the animation, Pip flies along a line to the Access Point. In real life, radio waves spread out in all directions and get weakened or bounced by walls, furniture and human bodies, so the further away you are, the slower it gets.
- A phone's name tag might be a "nickname". To protect privacy, many phones today use a Random MAC Address for each Wi-Fi network they join, which isn't necessarily the one from the factory. To keep the story simple, the phone always uses
00:00:5E:00:53:03. - Encryption only protects the part in the air. WPA2/WPA3 only encrypts the radio waves between the phone and the Access Point. Once the Access Point decrypts it, the data travels along the cable without Wi-Fi encryption. To protect it all the way, you need other methods such as HTTPS (secure web transfer protocol).
- An "invisible cable" doesn't mean "no cables". The Access Point itself still needs a cable to the Switch or Router. Only the last short stretch is wireless.
7. Quiz
8. Key Notes
- An Access Point is cabled on one side and sends out a Wi-Fi signal on the other, putting wireless and wired devices in the same LAN.
- The SSID is the Wi-Fi network's name, which the Access Point keeps announcing with Beacons. WPA2/WPA3 encrypts the data in the air.
- The Access Point turns wireless Frames into Ethernet Frames. The sender and recipient MAC Addresses stay the same, so the Switch learns and delivers as usual.
- Devices on the same channel share the air, and only one can transmit at a time. Wi-Fi uses CSMA/CA and ACKs to avoid and handle collisions.
- A home Wi-Fi router is usually a Router, a Switch and an Access Point, three in one.
Further reading
With an Access Point, a phone can join the LAN without a cable. But when guests visit and connect to your network too, their computers can see every device in your home. In the next story, Octo puts up a "folding screen" that splits one Switch into a family zone and a guest zone: VLAN (Virtual LAN).