Hacker News Reader

Comment by lxgr | Hacker News Reader

> The obvious advice for roaming is “use one SSID everywhere”, and that is often correct if you’re running Wi-Fi in an office, a public venue, or generally somewhere where you don’t have (or care about) legacy devices.

What difference does the presence of legacy devices make? Is the intent to isolate them from modern devices from a network perspective? Then create a separate SSID on both 2.4 and 5 GHz for modern devices.

I can't think of any legitimate reason for split SSIDs anymore. Linux clients used to be pretty bad at preferring 5 over 2.4 GHz if RSSIs were both excellent but 2.4 was slightly better, but I haven't seen that in years.

View on HN

I've seen claims that the wifi 6E spec mandated that 6ghz networks required WPA3, so you would need to have a separate WPA2 ssid for legacy devices which therefore couldn't include 6ghz. A lot of access points now support a single SSID with all 3 bands using both WPA2 and WPA3, but I don't know if that is due to a change in the spec or if access points are violating the spec by offering that.

Can’t one SSID support different WPA versions across APs? I’m pretty sure all my devices just shrugged and connected when I downgraded my (single AP) SSID from WPA3/2 to 2 only and back up to 3/2.

Which is a bit sad, but also seems like it would allow this use case perfectly (assuming this was done on purpose and not just an oversight).

> Can’t one SSID support different WPA versions across APs?

I think so, yes. My OG Nintendo Switch connects to the PSK SSID on my two OpenWRT Ones that's using what OpenWRT calls 'sae-mixed' encryption mode. My PCs (using ath9k and rtw88_8822be drivers) and my Pixel 5a connect just fine to my EAP SSID that's using the 'wpa3-mixed' encryption mode.

wpa_supplicant says that the PSK SSID has "SAE" in two out of three of its supported operating modes, and the EAP one has "EAP-SHA256-CCMP-preauth" in one of the two. [0] I assume that means that they support WPA3 operation, but I don't know for certain. I'm somewhat ignorant about WPA3, and am profoundly ignorant about WPA3-EAP.

[0] I'm assuming that the "/"-separated list that comes after the "WPA2-" bit in wpa_supplicant's scan results is a list of what I'm calling supported operating modes.

There is zero benefit to using 2.4 for me, really, since it's crowded as heck. I'd rather skip it altogether.

If you don't need it, of course, you might as well deactivate it. But if you do, I don't see the point of having two different SSIDs if you don't need them for another reason anyway.

I do need it, but the IoT devices are conveniently close to most APs, so that sort of evens out.

It penetrates walls so much better than 5GHz. If I lived closer to my neighbors I would agree with you.

Plus I still have some esp8266-based widgets that I made which only operate on 2.4GHz.

Most IoT devices support 2.4GHz only. Notably this applies to ESP32-based devices and older phones and laptops too. I would argue that it is the 5GHz band that is optional, the only benefit (bandwidth), being relevant only for laptops and phones when downloading something.

Let me guess you don’t live in an apartment?

5ghz is important if you are interference limited. The lack of wall penetration and short range become benefits.

2.4ghz provides very poor performance in my condo due to the 30 different SSIDs I can see from my lounge room.

The 30 SSIDs your device can see are bad, but what might be even worse are the many non-802.11 devices on 2.4 GHz that are invisible to a simple SSID scanner and don't share bandwidth fairly with 802.11 CSMA/CA. (This includes Bluetooth!)

5 GHz has much less of that, but big parts of it have weather radars as a primary user, with APs being required to detect and avoid any channel where they can detect one.

> I can't think of any legitimate reason for split SSIDs anymore.

Different networks / vlans / firewall rules.

These are all not splits by frequency, though.

Huh?

I'm responding to the question about why you might split SSIDs. SSIDs don't have anything to do with frequency necessarily, morso network segregation.

Also:

> What difference does the presence of legacy devices make? Is the intent to isolate them from modern devices from a network perspective?

Yes. Old devices can only use limited data rates and they will drag down the throughput of other devices on the same channel. Some controllers or APs allow you to limit to lowest data rate you will accept a connection from.

> I'm responding to the question about why you might split SSIDs. SSIDs don't have anything to do with frequency necessarily, morso network segregation.

Sure, I was only talking about splitting by bands as I thought that's what this entire conversation is about. Of course there are plenty other reasons to have more than one network in the world :)

> Old devices can only use limited data rates and they will drag down the throughput of other devices on the same channel.

They will do so regardless of which AP or SSID they are connected to, though, as the channel is a shared physical medium.

If the goal is to isolate slow/old devices from modern ones, that can be done regardless of the band.

> They will do so regardless of which AP or SSID they are connected to, though, as the channel is a shared physical medium.

In a multi-ap setup you can isolate those 2.4ghz devices to their own, short range said that allows very permissive datarates. Then everything else gets 5ghz or 6ghz with mediumish output power and restricting the lower data rates. This prevents clients that move to the edge of the coverage zone from hitting lower data rates and dragging the whole channel or SSID or both down.

It just depends on your setup, number of APs, type of devices, device demands, etc.

I have my RADIUS server put supplicants coming in on SSID "A" on one of the VLANs that gets RPZ-based adblocking, and SSID "B" on one of the ones that gets no adblocking. It's pretty fun and easy.

Many APs now support either using Radius and username/password auth for this, or having multiple acceptable pass phrases for a WPA2 network which drop devices into different VLANs.

Reply on news.ycombinator.com