6GHz Discovery: 3 Things I Didn’t Know

As part of my normal job, I’ve been spending a fair amount of time testing and experimenting with 6GHz. I figured it was time to start writing down some of the things I didn’t know in hopes of that helping others who also “don’t know” yet.

---

Discovery Thing #1: RNR is the way

Not all devices scan 6GHz. In fact, most don’t. And support for things like FILS Discovery and Unsolicited Probe Responses (UPR) are pretty poorly supported across the ecosystem in 2023. The reality is that almost all devices rely on RNR in order to discover 6GHz SSID.

TLDR: Make sure you have an SSID in another band to advertise RNRs.

Discovery Thing #2: Devices may not scan 6GHz right away.

Turns out, that even with the RNR advertised in a Legacy band, devices may not choose to join a 6GHz only network. Because when they power up, wake from sleep, etc, they will do a legacy scan to check the regulatory domain, which won’t support 6GHz. Sadly, most devices will make a decision to connect based on this legacy scan, completely ignoring 6GHz only networks.

This behavior is also likely the driving force behind folks suggesting no 6GHz-only networks, because this behavior can cause the device to skip a preferred network.

Devices with a cellular radio can bypass this, as they can learn the regulatory info via cellular and immediately scan 6GHz and join. You can see the behavioral difference when disabling cellular on a Pixel 7.

Testing on a Pixel 7 (cellular disabled)

1. connect to 5GHz only SSID
2. connect to 6GHz only SSID
3. Put phone into airplane mode
4. turn on Wi-Fi: device connects to 5GHz SSID

Testing on Pixel 7 (cellular enabled)

1. connect to 5GHz only SSID
2. connect to 6GHz only SSID
3. disable Wi-Fi with cellular enabled
4. re-enable Wi-Fi: device connects to 6GHz SSID

This behavior comes from FCC regulations around determing the country. You can read about this more from LAR here:

So you got an Intel AX210 adapter installed on your Linux computer and are ready to start capturing Wi-Fi traffic on 6 GHz, except that it doesn't work. Here's what you should know. 🧵

— Adrián Granados (@adriangranados) May 25, 2022

TLDR: Single-band SSIDs are going to be problematic for initial discovery and connection to a SSID. If you use a dual-band (say 5GHz + 6GHz) client will discover the SSID quickly, and can then roam to 6GHz. Cellular devices tend to handle this with fewer issues.

Discovery Thing #3: Probing with short-SSID

6GHz clients definetly probe on 6GHz. However, I’ve seen client probe for odd SSIDs. Like 80. This behavior appears to be when the client is probing by using the short SSID. I’m not sure how it picks the SSID value, but it includes the tagged parameters (Tag 58).

While this looks somewhat odd, the AP replies with the correct SSID based on the short SSID, and the client probes again after making and SSID selection using the SSID name.

TLDR: Clients probe in 6GHz and you may miss probes for a specific SSID unless you are also looking at the short BSSID tag.