What Is WLAN? Wireless LAN Basics for Office Networks

A printer drops off the network every afternoon, a laptop clings to a far access point, and the guest password has been the same since 2019. Each of those is a wireless problem with a wired network behind it, and the fix starts with knowing which parts you own. This guide explains what a WLAN is, how the pieces fit together, and what a small office needs to get right.

TL;DR

A WLAN is a wireless local area network: access points, the clients that join them and the wired network behind them, inside one building or campus. Wi-Fi is the brand name for the technology most WLANs use, and 802.11 is the standard underneath. The decisions that matter are channel and band planning, how the access points are managed, and which security tier each network runs. Survey before you buy, separate guest and staff traffic, and monitor signal as well as uptime.

What WLAN Means

WLAN stands for wireless local area network. NIST's glossary defines it as a group of wireless access points and associated infrastructure in a limited area such as an office building or campus, usually built as extensions of existing wired LANs to provide enhanced user mobility. The key idea is that a WLAN extends a wired LAN. A wireless network is a doorway into the same switches, VLANs and servers the cables already reach.

Three words get mixed up in tickets. LAN is any local network, wired or wireless. WLAN is the wireless kind. Wi-Fi is the Wi-Fi Alliance's brand for products certified against the IEEE 802.11 family of standards, which is the technical name for what the radios speak. In English-language IT, WLAN is the generic term and Wi-Fi is what people say out loud. In German, WLAN is the everyday word for Wi-Fi, which is why search results for the acronym mix office networking with driver forums and consumer help pages. Other things share the letters too, such as a vendor's WLAN modules for industrial equipment, so read the context before you trust an answer.

Two neighbouring terms are easy to confuse with WLAN. A WAN is a wide area network, the links between sites or out to the internet, and your WLAN reaches it through the router like any other LAN. A WPAN is a personal area network, such as Bluetooth between a headset and a phone, with a range of a few metres and a different purpose. A WLAN sits between them in size: bigger than a desk, smaller than a city.

If you want the same distinction for the cabled side, our guide to network topology covers how the wired parts of a LAN are laid out.

How a WLAN Is Built

Four parts make a WLAN. Clients are laptops, phones, printers and scanners with a radio. Access points (APs) are the radios on the ceiling that clients talk to. The distribution system is the wired network behind the APs, usually a switch carrying every AP's traffic back to the router. And the management layer decides how the APs are configured, which later sections cover.

Names are where the confusion lives. An SSID is the network name people see, a string of up to 32 bytes configured on every device in the network. A BSS, or basic service set, is one AP and the clients connected to it, and each BSS is identified by a BSSID, which is the AP radio's MAC address. When several APs share one SSID and one distribution system, the group is an extended service set, and clients roam between the BSSs without the user selecting a second network. That is the whole trick behind covering a building.

One SSID can therefore be dozens of BSSIDs. When a laptop says it is connected to "Office", a log or netsh wlan show interfaces tells you which BSSID it is on, and that is the access point to blame. Power for those APs usually comes over the same cable as the data, which our post on the PoE injector explains.

Wi-Fi Generations and Bands

The standard has grown through generations, and the Wi-Fi Alliance gave the recent ones numbers. The table lists the ones you will meet on a purchase order.

Generations only help when both ends support them. A Wi-Fi 7 access point serving a fleet of Wi-Fi 5 laptops delivers Wi-Fi 5 to each of them, and the older device slows nothing else down by itself. Plan the refresh around the clients you can replace, not the access point's headline speed.

Bands matter more than generations in a small office. Lower frequencies travel further but carry less, so 2.4 GHz covers a building and 5 and 6 GHz carry more data over shorter distances, because walls and floors absorb them. The 2.4 GHz band has three channels that do not overlap in North America (1, 6 and 11), which means three neighbours or three of your own access points can share it before they start interfering. The 5 GHz band offers at least 23 non-overlapping 20 MHz channels in much of the world, which is why dense offices push staff devices there and leave 2.4 GHz for printers and sensors.

Airtime, Interference and Why More Access Points Can Make It Worse

Radio is a shared medium. Within range of each other, only one transmitter can use a channel at a time, so every device and every access point on a channel takes turns. The shared resource is airtime, and it runs out long before the cable behind the access point does.

When two access points that can hear each other sit on the same channel, they share that airtime instead of adding to it. That is co-channel interference, and it is what reusing a channel causes. It also means that putting a fifth access point in a crowded office on the same three 2.4 GHz channels adds contention, not capacity. Channels that are four or more numbers apart interfere very little if the transmitters are a few metres apart, which is why the 1, 6 and 11 plan works.

Your neighbours count too. The access points in the next office or the flat upstairs compete for the same channels, and you cannot configure them. A channel scan from a survey tool or a laptop shows who is sharing the band before you pick a plan, and the plan should change when a neighbour changes theirs.

The fix is rarely more power. Fewer, better-placed access points, distinct channels on 2.4 GHz, wider channels only where 5 GHz is quiet, and transmit power turned down so cells overlap just enough to roam are the usual order of work. Slow clients also hold the channel longer for the same amount of data, so a handful of old devices can drag a whole room, which is one more reason to know what is connecting.

Legacy Devices and the 2.4 GHz Problem

Every office has devices that never got the memo. Printers, label makers, scanners, door controllers, thermostats and older handhelds often speak only 2.4 GHz and only older security modes. They are the reason many networks keep a second SSID on the older band and the older settings.

Treat that SSID as a separate zone. Put it on its own VLAN, give it access only to what the devices need (a print server, a collector), and keep it away from staff laptops and file servers. A stateful firewall rule between the VLANs does the job, and it tells you when something on that segment starts talking to places it never has.

Then keep an inventory with a replacement date. A device that cannot do WPA2 does not get a security exception forever, and a printer that forces the whole network to keep an older mode is a ticket waiting to be written. Splitting the SSIDs also costs you automatic band steering for those devices, which is fine, because they were never going to move to 5 GHz anyway.

Controllers, Cloud Management and Standalone Access Points

Every WLAN needs somewhere to hold the SSID, the channel plan and the security settings. There are three common ways to run that.

Standalone (autonomous) access points carry their own configuration. Two or three APs in a small office can run this way, and every change means logging into each unit. It stops being pleasant around the fifth AP.

Controller-based WLANs keep the configuration in a wireless LAN controller, a box or virtual appliance that the access points join. The IETF standard for that conversation is CAPWAP, the Control And Provisioning of Wireless Access Points protocol, published as RFC 5415 in March 2009. A controller gives you central configuration, coordinated channel and power settings and roaming handled for you, at the cost of one more thing to patch.

Cloud-managed WLANs move the controller into a vendor's cloud service. The APs still carry client traffic locally, and a loss of the internet link usually leaves the network running with the last good configuration. The cost is a subscription, and the lock-in sits in the dashboard, not in the radios. Our look at network management software compares tools that cover this layer.

Which model you pick depends on how many sites you run and who changes the configuration. A single office with four APs and one technician is well served by any of them. Twenty sites with rotating staff want the central view.

WLAN Security: Personal, Enterprise and Guest

Security on a WLAN is a setting per SSID, and each setting has a different answer to "who can join and who can read the traffic". The Wi-Fi Alliance's current family is WPA3, which is mandatory for Wi-Fi CERTIFIED devices and comes in a Personal and an Enterprise form. WPA3-Personal adds protection against password guessing, and WPA3-Enterprise uses higher-grade protocols for sensitive networks. Protected Management Frames, which stop forged management traffic, are required for all new certified devices. If your clients still run WPA2, our guide to WPA2 explains what that generation does and where it ends.

Personal networks use one shared passphrase. They suit homes and small guest networks, and they stop suiting you the day an employee leaves, because everyone with the password still has it. Enterprise networks use 802.1X, where each user or device authenticates against a RADIUS server, and the access point never sees a shared secret. The strongest version uses certificates (EAP-TLS) so a stolen password is not enough. Guest networks sit on their own VLAN with internet access only, and may use Wi-Fi Enhanced Open, which encrypts traffic without a password.

An r/networking thread asked how to build an enterprise WLAN for laptops when the pieces are a Cisco controller, access points and an identity server connected to Active Directory. The replies gave the standard answer: certificates from Active Directory Certificate Services for both users and machines, a group policy to push the SSID profile so nobody configures laptops by hand, and an authentication server that speaks RADIUS.

Designing a Small Office WLAN

Start with a survey, before you buy anything. Walk the space with a laptop or a survey tool, note where the signal drops, and mark the walls that block it. Brick, concrete, elevator shafts and kitchens each cost range in ways a floor plan never shows. A rule of thumb says an access point covers about 20 metres indoors, but that is a ceiling, not a design.

Then decide the layout. Mount access points on ceilings, not in cupboards. Give each a clean channel on 2.4 GHz and wider channels on 5 GHz where the noise allows. Cable every AP back to a switch with PoE, and do not rely on wireless repeaters between them. Put the SSIDs on separate VLANs from the start, one for staff, one for devices, one for guests.

A homelab thread shows what skipping the plan feels like. The poster's mesh kept dropping and reverting to factory settings on reboot, and wanted a locally meshable Wi-Fi 7 access point without a vendor's gateway. The takeaway for an office is the reverse: choose the management model first and the radios second.

For a new or rebuilt network, this order avoids most rework:

1. List the clients, including the printers and sensors nobody mentions.
2. Survey the space and mark where the signal drops.
3. Choose the management model: standalone, controller or cloud.
4. Cable and power every access point back to a switch.
5. Create SSIDs and VLANs for staff, devices and guests.
6. Set the security tier for each SSID and test a leaving employee.
7. Walk the building with a laptop and check where it roams.
8. Write down each access point's room, name and channel.
9. Put signal, retries and AP uptime on a dashboard with alerts.

The checklist below collects what a review of an existing office WLAN should find.

Documentation is the step that gets skipped, and it is the one that saves an afternoon. Name each access point after the room it hangs in, so a BSSID in a log leads to a ceiling. Our guide to network mapping software covers tools that discover devices and draw them for you.

A Worked Example: 25 People on Two Floors

Here is what the plan looks like on paper for an imaginary office. It is an illustration of the method, not a sizing rule.

The office has 25 staff across two floors, a reception area with visitors, three printers and a door controller. The survey shows the signal dropping at the stairwell and in the meeting room behind the kitchen. That points to two access points per floor, one near the stairs and one at the far end, mounted on ceilings and cabled to a PoE switch in the comms cupboard.

Three SSIDs cover the use cases. Staff runs enterprise authentication on its own VLAN, with the SSID profile pushed by group policy so laptops join on their own. Devices is a 2.4 GHz network for the printers and the door controller, on a separate VLAN with a firewall rule allowing only what they need. Guest is internet-only on a third VLAN, with Wi-Fi Enhanced Open or a passphrase that is rotated on a schedule.

On 2.4 GHz the four access points take channels 1, 6, 11 and 1 again, with the repeated channel on opposite floors, and transmit power is turned down so the cells overlap only enough to roam. On 5 GHz each access point gets its own channel, wide where the survey shows quiet air. The configuration lives in a cloud dashboard because one technician looks after it, and the dashboard also holds the AP names, which match the room labels on the floor plan.

None of this takes a specialist. It takes a survey, a naming scheme and the discipline to keep the three SSIDs apart when someone asks for a "quick exception".

Troubleshooting a WLAN by Symptom

Wireless tickets sound alike and have different causes, so sort them by the symptom before you touch a setting. Slow everywhere points at the uplink or at channel congestion. Slow in one room points at coverage. Dropping every few minutes points at roaming or a client driver. Unable to connect at all points at authentication, the RADIUS server or an expired certificate.

On a Windows client, netsh wlan show interfaces shows the SSID, the BSSID, the channel, the radio type and the signal in one screen, and netsh wlan show wlanreport builds a history of recent connection failures. Those two commands answer most first-line questions: which access point the laptop is on, and whether that is the one it should be on. OpenFrame can run them across a client's devices and collect the output, so signal, channel and connected BSSID land in one list.

If the symptom is general slowness, check the internet link before the radios. Our guide to checking bandwidth usage separates a saturated link from a quiet one.

Keep the access points themselves on a dashboard, with an alert for any that go offline or report heavy retries. Our guide to infrastructure monitoring covers what to watch and which tools fit.

Wireless also changes what other tools can do. A laptop that sleeps on Wi-Fi drops its connection, so Wake-on-LAN usually works only over a cable. That is a design reason to keep desktops and servers wired.

The Short Version

A WLAN is the wireless extension of a wired LAN. Wi-Fi is the brand, 802.11 is the standard, and the access points, the controller model and the security tier are the three choices you make. Survey the space, plan bands and channels, run enterprise authentication for staff and a separate guest network, and keep a floor plan with every access point named. When it breaks, sort by symptom before you change a setting.

FAQ

What does WLAN stand for?

WLAN stands for wireless local area network. It is a local network that uses radio links instead of cables for its client devices, usually built as an extension of an existing wired network.

What is the difference between WLAN and Wi-Fi?

WLAN is the generic term for any wireless local area network. Wi-Fi is the Wi-Fi Alliance's brand for devices certified against the IEEE 802.11 standards, which is the technology almost every WLAN uses today. In German, WLAN is simply the everyday word for Wi-Fi.

What is the difference between SSID and BSSID?

The SSID is the network name that clients choose, up to 32 bytes long. The BSSID is the MAC address of a single access point radio. One SSID can be served by many BSSIDs, which is how several access points make one network across a building.

Do I need a wireless controller?

Not for a small office with a few access points, which can run standalone or from a cloud dashboard. A controller or cloud management becomes worth it when you have many access points or sites, because it holds the SSIDs, channels and security settings in one place and coordinates roaming.

Is WPA3 mandatory?

WPA3 is mandatory for devices that earn the Wi-Fi Alliance's Wi-Fi CERTIFIED label, according to the Alliance. Older clients can still be on WPA2, so many networks run both until the last older device is replaced.

How many access points does an office need?

It depends on the building, not the headcount. Walls, floors and device density decide it, and a survey answers it better than a rule of thumb. Plan for coverage first, then add access points where many devices gather.