I had an opportunity to investigate an issue where a 6 GHz SSID was not visible to the client. Even though the AP was configured to broadcast the SSID on 6 GHz, the client could not detect it.
Through this investigation, I learned several related topics, such as PSC (Preferred Scanning Channels), RNR (Reduced Neighbor Report), client scanning behavior and how they are related.
This YouTube video also helped me a lot with this topic.
In conclusion, the reason the client could not see the SSID is that the AP was configured to use a non-PSC channel on 6 GHz and was not broadcasting on 2.4 GHz or 5 GHz in my case.
This was easily reproducible with my CW9176I and iPhone 16 Pro.
I tested it using channel 33 on 6 GHz and used channel 100 on 5 GHz for a later test. Channel 33 is not a PSC channels.
The full list of 6 GHz PSC channels is 5, 21, 37, 53, 69, 85, 101, 117, 133, 149, 165, 181, 197, 213, and 229.
When I captured wireless packets, I could see beacons from the AP on the channel. I named the SSID .invisible-ssid-test so that it would appear at the top of the iPhone settings page, but it never showed it.
Apple also published a document (link) that mentions the following.
In addition, 6 GHz networks are discovered out-of-band by listening for the Reduced Neighbour Report information element of beacons in the 2.4 GHz and 5 GHz bands.
So, the key here for the client to be able to find it is RNR information element. To further confirm this, I then enabled 5 GHz on channel 100 and checked both bands. I also disabled 802.11be on the AP to make the test simple.
Once the AP is sending the SSID on the 5 GHz band, the client is able to see the SSID.
The 5 GHz beacons also show channel 33 for 6 GHz in the RNR. Using some online CRC32 calculators, I see the same hex value for the Short SSID when I input the SSID name .invisible-ssid-test.
Then, I connected to the SSID, and the capture shows that the client sent a probe request on 6 GHz using channel 33. The AP responded with a probe response, and I could also see the subsequent authentication and a full 4-way handshake.
Summary
The issue of a client not being able to find the SSID on the 6 GHz band is not always caused by a single factor. Understanding multiple factors has helped me accurately scope the problem. Here are the basic items to check when I encounter a similar issue next time.
1. Check if the AP is sending beacons on 6 GHz using PSC channels.
2. If not, verify whether the AP is broadcasting the SSID on other bands and including RNR information in the beacons.
3. If so, check whether the client is sending a probe request on the channel indicated by the RNR. If the probe request is not sent, the issue might be on the client side.
Lastly, I have seen a case where, even though the SSID was being sent with PSC channels, the SSID was not visible on the client. This issue ended up being on the client side after some investigation because the OS version did not recognize a specific element in the 6 GHz beacon.
Thank you for reading through this post. I hope this helps.
Comments