Reduced Neighbor Report Plays A Critical Role in Wi-Fi 6E

January 13, 2023 By Rowell Leave a Comment

What are the benefits of using Reduced Neighbor Reports (RNRs) in Wi-Fi 6E and how they can help optimize Wi-Fi connectivity?

Although Wi-Fi 6E brings a plethora of spectrum for devices to slaughter over, it’s too much for a single device to scan through as it has been done in 2.4 GHz and 5 GHz.

In order for Wi-Fi 6E devices to discover access points in the 6 GHz spectrum, they must scan through each channel. But doing so can take a considerable amount of time, even for a device, as it roams through an environment.

Reduced Neighbor Reports (RNRs) are not new. It was first introduced in 802.11k and it allows a device to receive specific information from an access point (AP) about neighboring access points.

This information can include the AP’s current load, signal strength, and available channels, among other things. By requesting this information from the AP, a device can make more informed decisions about how it should roam to an ideal AP.

The RNR element is defined in the 802.11-2020 standard in section 9.4.2.170. Within this element is the Neighbor AP Information Field. There could be more than one for each neighboring AP and their information.

The Details Are In The Beacon Frame

On each channel, we’ll find a beacon frame from the AP45 APs for my Mandalorian SSID. Within that beacon frame you will find a Reduced Neighbor Report element. The element ID of the RNR is 201. Contained inside of the RNR are two Neighbor AP Information Fields, one for each Mist AP45.

I’m not sure if this implementation is the same for all vendors, but the Neighbor AP Information Fields will only list the 6 GHz channels. Could it be useful to include the 5 GHz channels of neighboring APs as well? I’ll have to test with other vendors but I lack the resources to procure two of everything.

Keep in mind, this is the frame format of the Reduced Neighbor Report.

The juice is in the Neighbor AP Information Fields.

Within the Neighbor AP Information Fields you will find the Target Beacon Transmission Time (TBTT) Information Header and operating channel of the AP for an SSID. Inside of the TBTT Information Set contains the BSSID, Short SSID, and BSS Parameters. If there are more than one SSIDs being broadcasted, you’ll see multiple TBTT Information Headers.

Here is the frame format of the AP Information Field and TBTT Information Header:

The Filtered Neighbor AP subfield is used in a Probe Response frame which I haven’t been able to fully understand yet but I’ll update this post when I get to it.

The Operating Class and Channel Number field work together. The Operating Class indicates a channel starting frequency and with the Channel Number it indicates the primary operating channel of the AP. These two fields are help devices with passive scanning.

According to the 802.11-2020 standard, Operating Class 134 falls within some reserved parameters. I’m not sure if this is really utilized during my testing. The Operating Class table can be found in the standard at Table E-4. There are Global Operating Classes and separate country defined Operating Classes.

From a Wireshark perspective:

From the Wireshark capture, we can see two Neighbor AP Information Fields. Expanding this field displays the operating channel number of the AP and its BSSID for the device to send probe requests and association to.

We can also determine if this SSID is also the same one being broadcasted from the band in which this beacon originated from, which was captured on 2.4 GHz channel 1, under the BSS Parameters. You’ll also notice if Multiple BSSID is being used.

Thoughts

The Reduced Neighbor Report will be critical for Wi-Fi 6E AP discovery. The Mist AP does not do FILS in 6 GHz which would mean a device would need to use the RNR to discover APs operating in 6 GHz. Additionally, some devices will still prefer 5 GHz and may not even do a passive scan on any 6 GHz channels, therefore relying on RNRs.

So what happens if you have a 6 GHz-only SSID but still maintain a different 2.4 GHz and 5 GHz SSID? I created a 6 GHz-only SSID, Mando. The BSSID from AP2 ended in 3e81. The RNR will contain multiple TBTT Information Headers within the Neighbor AP Information Field.