Interoperability rests on a stack of institutions — and it usually fails at the borders between them.

Short form: IEEE writes local-network rules (the 802 family; Wi-Fi is 802.11). IETF writes internet protocol rules (routing, transport, security, management). ITU coordinates world spectrum and telecom policy. Alliances (Wi-Fi Alliance, the 3GPP ecosystem) certify that products actually work together.

Wi-Fi moved from "one fast link" to "share the air well with many users".

The generations (Table 2.1)

The IEEE 802.11 data frame (Table 2.2)

Short form: a Wi-Fi data frame is not "Ethernet over radio". It adds direction bits, air-time reservation, sequence numbers, QoS and up to four addresses. Header sizes: 24 bytes basic · 26 with QoS · 30 with a fourth address · 32 with both · +4 if HT control.

Certification and compatibility

Short form: backward compatibility protects investment but drags efficiency — old rates waste air time and old clients hold the security floor down. Judge a standard by its transition cost, not only its lab numbers.

Separate capability (what a standard can do) from suitability (what the job needs).

Short form: the 3GPP family — LTE, LTE-Advanced, NB-IoT, LTE-M, 5G NR — are complete end-to-end systems for wide-area managed mobility. IoT standards trade throughput for battery life, range and simplicity.

Seeing a network name is not a connection. Five steps stand between "signal nearby" and "usable internet".

Scanning: passive vs active

Short form: passive = quietly listen for beacons — saves battery and air time but waits for beacon timing. Active = send probe requests — faster answers, costs air time, and reveals more about what the client is looking for.

Smart devices shrink the search: they remember known SSIDs, preferred channels and neighbour lists instead of sweeping the whole spectrum. In dense environments this matters, because scanning itself consumes air time that could carry user data.

Association — and the trap right after it

Short form: association creates the logical attachment and binds you to policy — capabilities negotiated, identifiers recorded, VLAN / QoS / security expectations decided. But association is not working service.

Authentication asks who you are. Enforcement decides what you may reach.

PANA — authentication over IP

Short form: PANA (Protocol for Carrying Authentication for Network Access) carries EAP over UDP/IP instead of over the link. Roles: PaC (client), PAA (authentication agent), EP (enforcement point — the gate), with an AAA server (RADIUS / Diameter) behind. It is not DHCP and not encryption.

1. The PaC discovers or is configured with a reachable PAA.
2. PaC and PAA establish a PANA session and run an EAP conversation chosen for the deployment.
3. If EAP succeeds, the PAA records the authorised session and gives the EP what it needs to admit the traffic.
4. The EP changes its packet filters so authorised traffic passes.
5. Session lifetime, reauthentication, termination and liveness checks refresh or withdraw the permission.

Enforcement — identity becomes service reality

Short form: after login the network translates identity into treatment — VLAN assignment, traffic shaping, captive-portal logic, policy segmentation. Admission is never a plain yes/no: it is "yes, into this segment, at this service level, monitored this closely."

Moving without dropping: fast handoffs, fresh address mappings, and sessions that survive subnet borders.

Layer 2 mobility

Short form: reassociate to a new AP fast, keeping link state. Speed depends on neighbour-discovery quality, reassociation efficiency, key reuse or transfer, and the client's willingness to leave the current AP at the right moment.

ARP — the small protocol that glues it together

Short form: ARP maps an IPv4 address to a MAC address inside one broadcast domain. Broadcast "who has 10.0.5.1?" → the owner replies (usually unicast) with its MAC → the answer is cached. The first target after joining is normally the default gateway, because most traffic leaves the subnet through it.

Why it matters for mobility: roaming changes the radio attachment point while the client keeps the same IP and gateway. The ARP cache may stay valid, but the infrastructure must relearn where that MAC is now reachable. Switches, controllers and APs update forwarding state as frames appear from the new attachment point; gratuitous ARP announces or refreshes a mapping after movement, failover or address reassignment. Stale state sends packets down the old path — users experience voice gaps, frozen video, delayed transactions.

Layer 3 mobility

Short form: cross a routed boundary and receive a new address, and applications may read that as a session failure rather than movement. L3 mobility preserves the session's logical identity with anchors, tunnels or optimised state transfer.

Worked roaming example — the 150 ms handoff

Design starts by turning vague wishes into numbers you can test against.

Service objectives

Short form: coverage area, user density, application mix, throughput, mobility support, resiliency — all written as measurable statements. "Good coverage" guides nothing; "voice and cloud access for 120 concurrent users per lecture hall with bounded roaming interruption" drives real decisions.

Environmental constraints

Short form: walls, floors, reflective surfaces, weather, power availability, spectrum regulation and existing systems all limit what is buildable. Constraints work at three scales:

The link budget says whether the signal arrives. Capacity says whether it is enough for everybody.

Coverage design

Short form: use Eq 4.1 to decide AP density, antenna type and expected edge performance — then verify with a survey, because real environments deviate from theoretical path-loss models. Read it as margin design, not signal-presence design (this is Eq 1.2 again).

Capacity dimensioning

Short form: estimate concurrent users, average demand, peak load and protocol overhead. Capacity is harder than coverage because it depends on behaviour as much as physics.

Plan channels across the whole interference domain — then prove the design with measurements, not faith.

Channel reuse

Short form: assign channels so neighbouring cells do not overlap on the same frequency. The classic 2.4 GHz picture is the three non-overlapping channels 1 · 6 · 11 repeated across the floor plan.

Interference management

Short form: interference comes from neighbouring cells, non-network emitters, and hidden nodes. Effective designs layer their defences rather than relying on one tool.

Post-deployment validation

Short form: validation = active tests + passive monitoring + roaming assessment + application-specific measurements. It closes the loop between assumptions and reality.

Strong validation combines infrastructure evidence (signal levels, retry rates, channel occupancy, roaming times) with user-experience evidence (does the application actually work?). And it is iterative: pilot findings feed back into channel plans, AP placement and policy before full rollout.

Worked classroom design

80 students, laptops, web + cloud + periodic video. Predictive survey gives P_t = 17 dBm, G_t = 3 dBi, G_r = 0 dBi, L_p = 76 dB, L_m = 6 dB.

Radio does not stop at the wall. Anyone inside propagation range is already standing inside your network's edge.

Passive threats

Short form: traffic analysis, metadata collection, and interception of weakly protected frames. Hard to detect because the attacker never transmits.

Even when the payload is encrypted, an observer still learns from frame timing, traffic volume, identifiers and roaming patterns. In a hospital, bursts near a ward reveal operational tempo; in a factory, repeating telemetry cycles reveal the process. So metadata deserves protection too.

Active threats

Short form: deauthentication abuse, replay, impersonation, protocol downgrade, denial of service. The attacker injects, modifies or suppresses communication, so integrity and availability are directly hit.

The story of Wi-Fi crypto is one long lesson: a cipher name is not a security architecture.

WPS — convenience that changes the threat model

Short form: Wi-Fi Protected Setup lets a device join without typing the passphrase. PIN mode uses a short numeric PIN; push-button mode opens a short enrolment window. Both create an alternate path into a network whose passphrase may be strong.

WEP — the cautionary tale

Short form: RC4 stream cipher + a static shared key + a 24-bit IV sent in the clear + a CRC-32 integrity check. Every one of those four choices failed.

The shared static key problem: the same WEP key sits on the AP and on every client, typed in manually. One lost laptop, one departing employee, one leaked value — and the whole WLAN key must be changed everywhere. Key slots did not give per-user or per-session separation.

WPA2 and AES-CCMP

Short form: WPA2 replaces WEP's structure with AES-CCMP and, crucially, separates the long-term credential from the temporary session keys. Fresh working keys are derived during association, tied to one client, one AP, one session.

Long form of the acronym: Advanced Encryption Standard with Counter Mode and Cipher Block Chaining Message Authentication Code Protocol. AES is the block cipher; counter mode turns it into a keystream for confidentiality; CBC-MAC produces a MIC for integrity.

TKIP was the bridge: it kept RC4-era hardware working and added per-packet key mixing plus a better integrity check than WEP — but it was a transition, not the goal. A WPA2 network should avoid legacy mixed modes, because the WLAN is only as strong as the weakest protection policy permits.

Personal vs Enterprise

The three roles, and who checks the password

In WPA2-Enterprise the client is the supplicant, the AP is the authenticator, and RADIUS is the authentication server. The AP mostly relays: EAP travels over the air inside EAPOL, and the AP wraps it in RADIUS toward the server. Credentials live in an identity system — a RADIUS user database, LDAP, Active Directory, a certificate authority/PKI, MDM or an MFA service.

The four-way handshake

Short form: before it starts, both sides already hold the PMK (from the passphrase, or from EAP). The handshake proves both sides possess it without sending it, derives a fresh PTK, installs data keys, and delivers the GTK for broadcast/multicast.

WPA3-Enterprise is not just a cipher upgrade — it is a posture: managed credentials, key establishment hardened against known attack paths, and protected management frames that reduce spoofing and session disruption. A campus laptop can be required to validate the institution's authentication server before credentials are exchanged, and policy can differ by staff/student/contractor after success. Treat WPA3 as part of identity governance, not a checkbox.

Who vouches for whom — and how far a compromise is allowed to travel.

EAP — a family, not a protocol

Short form: EAP carries authentication between supplicant, authenticator and authentication server. The AP mostly relays; the identity platform decides. Methods split into two families: certificate-first, and tunnel-first then inner credentials.

PANA security considerations

Short form: PANA carries EAP over IP (Ch 3), so the strength of the decision is the strength of the chosen EAP method. Once a PANA security association exists, protected messages resist modification and replay — but PANA authenticates access signalling; it does not encrypt user traffic or remove denial-of-service risk.

EDHOC — key exchange for tiny devices

Short form: Ephemeral Diffie-Hellman Over COSE — a compact authenticated key exchange for constrained devices and links (sensors, meters, actuators, LoRaWAN). Three messages, binary CBOR encoding, fresh ephemeral keys every run.

1. Initiator proposes cryptographic parameters and sends an ephemeral Diffie-Hellman public value.
2. Responder sends its own ephemeral public value plus authentication evidence.
3. Initiator completes authentication and key confirmation → shared secret material, often exported to OSCORE so CoAP messages stay protected end-to-end through proxies and gateways.

Segmentation and policy enforcement

Short form: segmentation limits the blast radius. Authenticated connectivity must not imply unrestricted reachability.

Raw events matter less than their operational context — and containment should be as narrow as it can be while still working.

Detection

Short form: rogue AP detection, channel anomaly analysis, failed-authentication correlation, traffic-baseline deviation. Combine radio evidence with network telemetry — attacks that look ambiguous from one vantage point become obvious when correlated.

WIDS listens for rogue APs, spoofed management frames, odd probe behaviour, devices on prohibited channels. WIPS adds enforcement: classify a device as unauthorised, trigger containment, coordinate across sensors and controllers.

Port mirroring (SPAN) — seeing the wired side

Short form: tell the switch to copy packets from a port, VLAN or subinterface to an analyzer port running Wireshark — without sitting inline with production traffic. Useful for DHCP failures, ARP spoofing, odd DNS, malware callbacks, MQTT traffic, or checking that clients land in the expected VLAN.

1. Identify the uplink/access port connecting the AP or Wi-Fi router to the wired network.
2. Decide direction: ingress, egress, or both.
3. Use a dedicated destination port for the analyzer — not one carrying ordinary traffic.
4. Capture in a controlled window; record time, source port, SSID/VLAN under test and the client device.
5. Remove the mirror session afterwards so it stops consuming switch resources and exposing data.

Response

Short form: isolation → credential revocation → forensic capture → service restoration. Written procedures cut confusion because the team already knows which steps preserve evidence, which contain spread, and which restore service.

Then disciplined recovery: preserve controller logs, radio captures, client events and inventory records; re-onboard from trusted state; rotate keys and credentials; validate restored configuration; communicate with affected users.

Worked example — the evil twin on the staff SSID

A department on two floors runs staff, student, guest and lab-instrument SSIDs. Users report intermittent disconnections near the meeting rooms; admins see failed authentications rising in the same area. It could be congestion, a software defect, or an attack.

1. Radio evidence: sensors confirm repeated deauthentication frames on the affected channels.
2. Controller logs: staff devices drop from legitimate APs, then try to reassociate with an unknown transmitter advertising a familiar name.
3. Inventory: switch records show no authorised AP on the expected wired ports → the device is rogue and independently connected.
4. Conclusion: correlating radio + identity + inventory separates an evil-twin campaign from ordinary interference.
5. Containment: review credentials from suspicious events, confirm certificate validation is still enforced on managed devices, apply WIPS classification/suppression where policy allows, and physically inspect the floor to remove the hardware.
6. Blast radius: because guest and lab systems are segmented from staff, exposure stays limited even if some users associated.
7. Recovery: rotate potentially exposed credentials, reinforce onboarding guidance, re-check neighbouring APs so coverage and roaming remain healthy.

An LPWAN is judged by how long a small device can sit unattended and still be heard from far away. Peak speed barely matters.

Coverage and battery beat throughput

Short form: broadband wireless is graded on speed and latency. LPWAN is graded on range, battery life and cost per device, so it gives up throughput on purpose. Design starts from the application's reporting pattern, not from the radio's bit rate.

Traffic characteristics

Short form: small payloads, sent rarely, mostly uplink. A device wakes, measures, sends and goes back to sleep. Timing can be periodic (smart meter), event-driven (alarm) or a mix (asset tracker that changes behaviour when it moves).

• Overhead matters more than usual. With a few bytes of payload, headers, joins, ACKs and retries can eat a large share of airtime and energy.
• The right question is how much useful information you get per unit of battery energy and airtime, not how many bits per second the link can carry.
• Periodic vs alarm-driven: a river sensor with a 12-byte hourly reading values endurance and reach. A vaccine cold-chain monitor sends routine updates too, but the rare alarm must arrive reliably and on time.

Preamble and CAD

Short form: a low-power receiver cannot stay awake all the time. The preamble is a known pattern at the start of a frame that lets a receiver notice a packet, line up its timing and get ready for the payload. CAD (channel activity detection) is a very short wake-up to check whether such a pattern is on the air. Nothing there, back to sleep. Something there, stay awake and receive.

• Longer preamble → easier for a sleepy receiver to catch, but more transmitter airtime and energy.
• More frequent CAD → quicker response to downlink, but more receiver energy.
• Less frequent CAD → saves power, but needs a longer preamble or risks missed packets.

Worked numbers: CAD every 2 s with 20 ms awake costs 20/2000 = 1% of time. Every 1 s it costs 20/1000 = 2%, so receiver listening cost doubles. In return the preamble might drop from 1.2 s to about 0.6 s, which saves transmitter airtime. Tune CAD interval and preamble length together.

Energy: Eq 6.1

Short form: L = E_battery / P_avg. With a fixed battery, lifetime goes up only when average power goes down. Average power is a weighted mix of sleep, sensing, transmit, receive and retries, so what you control is how often and how long the expensive states happen.

• Poor link quality causes retransmissions, which raise average power. A winter fade can break an 8-year battery target.
• Levers: transmit less, process locally and send only meaningful events, avoid downlink dependence, keep coverage margin so retries stay rare.

The real split is who owns the network. Unlicensed means you run it yourself. Cellular means an operator runs it for you.

Unlicensed LPWAN

Short form: low barrier to entry. You place gateways where you need coverage, on your own schedule, with no operator. Good for factories, campuses, ports, farms and utilities that want local control. The price is uncertainty: shared spectrum means unpredictable interference, and regulatory duty-cycle limits cap how often you can transmit and how freely you can send acknowledgments.

• LoRaWAN performance depends on gateway placement, spreading-factor behaviour and channel occupancy. A campus energy-metering project may need only a few well-placed gateways; a dense city with many independent systems needs more tuning.
• Treat radio planning as an ongoing operational task, not a one-time install.

Cellular LPWAN (NB-IoT, LTE-M)

Short form: licensed spectrum (less outside interference), operator-run sites for wide reach, and built-in subscriber identity for managing huge fleets. Chosen when devices are spread across regions or move, and you would rather buy a managed service than build gateways.

• NB-IoT: low-rate, stationary or delay-tolerant devices that need deep coverage and tight energy use. Think a gas meter in a basement.
• LTE-M: somewhat higher data rate, lower latency, mobility support. Think a medical asset tracker being carried around.
• Costs: dependence on operator coverage, tariffs and network evolution; module certification and SIM provisioning are more involved.

LPWAN is an end-to-end pipeline. A packet that reaches the gateway has not yet reached a working service.

The pipeline

Short form: three concerns kept apart. Field communication (simple, low-energy devices), network coordination (gateways turn weak sporadic transmissions into steady upstream traffic; the server handles identity, deduplication, security policy and queuing) and application integration. A good radio link can still end in a failed service if the backend routing, event processing or security is poor.

MQTT and ECHONET Lite over Wi-Fi

• MQTT: publish/subscribe. Devices publish to named topics on a broker; applications subscribe. Sensors and consumers are decoupled. Over Wi-Fi the path is 802.11 frame → IP → TCP → MQTT, so Wi-Fi quality still affects delay, loss recovery, battery and reconnects. Local broker = low latency and works through Internet outages; cloud broker = easy wide-area integration; hybrids bridge selected topics.
• ECHONET Lite: an application protocol for home automation and energy. Appliances are objects with properties a controller can read, write or get notified about (air conditioners, batteries, EV chargers, meters). Wi-Fi is only the IP path. Local discovery and control matter because it should work without the cloud.
• Security for ECHONET: Wi-Fi encryption keeps outsiders off the radio link but does not decide which authenticated client may control which appliance. Put energy devices on an IoT segment, restrict controllers, disable unneeded remote access, update firmware, monitor discovery/control traffic, and authenticate both sides of any cloud gateway.
• Why Wi-Fi at all? More throughput and lower delay than LPWAN, at the cost of more energy and denser infrastructure.

Monitoring applications

Short form: water level, soil moisture, air quality, tank fill, pump status and equipment temperature change over minutes or hours, so breadth (many cheap points) beats high-rate streams from a few. Keep ordinary telemetry and critical exception events distinct even when they share a fleet: an hourly tank report can still need an urgent overflow alarm.

Scalability

Short form: capacity depends on gateway density, channel occupancy, acknowledgment policy and uplink/downlink asymmetry, not on coverage radius alone. Assess both energy and airtime efficiency.

• Uplink bias: LPWANs are built for devices that report. Downlink windows are scarcer, cost more airtime and depend on when a device is awake. So commands, firmware updates and acknowledgment-heavy workflows scale badly.
• Pilot trap: 50 devices rarely collide, 50,000 do. Synchronised reporting (rush hour for parking sensors) creates bursts. Fix by staggering transmissions, placing gateways well, ACKing sparingly, and planning from the mature-deployment traffic model.

Broadband is a hierarchy. Many slow customer links feed a metro aggregation network, which feeds a fast IP core. Fiber is what holds the layers together.

Why fiber is the structural backbone

Short form: whatever the last-mile medium is (copper, coax, radio), the traffic of many users has to move over metropolitan distances, and only optical fiber does that economically. Fiber gives huge bandwidth, low attenuation, immunity to electromagnetic interference and long reach without regeneration. It also separates the cable plant's life (decades) from the electronics' life (upgrade by swapping optics, wavelengths or split strategy).

Access networks

Short form: access connects users to the provider edge. Options are fiber, cable, DSL, fixed wireless and PON. Fiber to the home also holds up over long local-loop distances where copper would collapse.

Connectors are a service issue

Short form: connector type, polish and cleanliness change insertion loss and reflection, so they change whether a subscriber has service.

Aggregation vs core

• Aggregation: consolidates traffic from many access segments and enforces subscriber policy. Uses Ethernet over fiber, wavelength services or packet-optical transport to connect access nodes, broadband network gateways and regional service edges.
• Core: large-scale transport, interconnection and reachability across regions or nations.
• DWDM: several wavelengths on one fiber pair multiply capacity without new cable, e.g. adding mobile backhaul or data-center interconnect later.
• Resilience: ring, mesh and dual-homed topologies over fiber let traffic reroute after a cut, if restoration was designed in.

Fiber does not remove sharing. It moves the bottleneck and changes its timescale.

Oversubscription: Eq 7.1

Short form: O = (N × R_access) / R_uplink. N subscribers each sold R_access, sharing an uplink of R_uplink. O = 1 means the uplink could carry everyone at full rate. O > 1 relies on statistical multiplexing, because not everyone is busy at once.

• It happens at several places: PON upstream slots, aggregation rings toward the metro core, uplink wavelengths.
• Plan by asking where contention will occur, how bursty traffic is across tiers, and how much headroom to keep for growth and protection.

Subscriber edge

Short form: the gateway or ONT/ONU does framing, traffic classification, address translation and service demarcation. On fiber it converts light to Ethernet or voice, takes part in provisioning, and exposes optical power, loss margin and registration state as diagnostics.

"Internet keeps dropping" could be indoor Wi-Fi congestion, a failing residential gateway, a dirty connector, bend loss in the drop cable, or a splitter path upstream. The edge is both a network boundary and an optical maintenance boundary, so staff need both skill sets.

Layers working together

Short form: Ethernet, MPLS, IP and optical transport are integrated, and coordination between them decides fault tolerance, scalability and operational difficulty. A fiber cut shows up first as an optical alarm, then an Ethernet link failure, then a routing convergence event. Being able to connect those quickly is operational maturity.

• The optical layer can give wavelengths or protected circuits to separate services (residential Internet, business Ethernet, mobile backhaul, video) over one regional fiber plant.
• Route length, regeneration and protection topology influence latency, synchronisation and upgrade timing for sensitive services such as mobile transport.

BGP is a policy system that happens to carry routes. The preferred path is the one your policy likes, not necessarily the shortest.

Basics

Short form: an autonomous system (AS) is a network under one routing policy, with an AS number. Inside an AS, an IGP (OSPF, IS-IS) computes routes. BGP tells other ASes which prefixes you can reach. BGP speakers peer over TCP.

A long-lived session carries only incremental changes, which is what makes large-scale exchange practical. A session reset means a lot of relearning.

eBGP vs iBGP

Path-vector and attributes

Short form: a route carries the AS_PATH (list of ASes it passed). A router that sees its own AS in the path rejects it, which gives interdomain loop prevention. The receiver applies import policy, selects a best path, then applies export policy before telling anyone else. BGP spreads selected outcomes, not every path it knows.

• Typical provider policy: prefer customer routes over peer or transit routes, stop one customer becoming transit for another, steer outbound traffic to a preferred upstream.
• Withdrawal and convergence: a withdrawn prefix makes each peer redo selection and policy, possibly passing through several intermediate paths before things settle. Bad churn is flapping.
• Safeguards: prefix and AS-path filters, max-prefix limits, protected sessions, careful community handling, monitoring origin changes, route-origin validation. Without them: route leaks and prefix hijacks.
• BGP and MPLS split the work: BGP decides which routes and service info get distributed (including VPN routes between PE routers). MPLS carries the packets over labeled paths.

MPLS forwards on a short label chosen at the edge instead of looking up the destination IP at every hop.

Push, swap, pop

• FEC: a class of packets that get the same forwarding treatment. The ingress LER decides it, using destination prefix, interface, VPN, QoS class or TE policy.
• LER (edge) pushes and pops. LSR (inside) reads the top label and swaps it. The label indexes a table, so no longest-prefix lookup in transit. A label is not an address and does not replace IP routing.
• LSP is the directional labeled path. Return traffic can take a different one.
• Tables: FEC-to-NHLFE (entering packets), incoming label map (labeled packets), NHLFE (outgoing interface, next hop, operation).
• Penultimate-hop popping: the router before the egress removes the outer label, saving the egress a lookup.

Label stack and BGP/MPLS VPN

Short form: outer label gets the packet across the core to the right egress PE. Inner label picks the VPN (VRF) or customer attachment there. Core P routers only read the outer label, so they do not hold customer routes. CE routers exchange routes with PE routers, each PE keeps one VRF per VPN, and BGP distributes the VPN routes between PEs.

Traffic engineering

Short form: shortest-path routing may pile everything on the cheapest path while another path sits idle. A TE LSP is explicitly routed with constraints (bandwidth, policy, latency, links to include or avoid). RSVP-TE signals such tunnels and reserves resources.

• Better utilisation and service support, but it creates state that must be monitored, protected and recomputed after failures.
• It is a network-wide planning tool, not a guarantee that each packet gets better QoS.
• MPLS depends on healthy IP routing, label distribution and operations. An optical failure underneath can break many LSPs at once, so watch adjacencies, bindings, LSP state, loss, latency and transport alarms together.

Pick the access technology by medium, strength and challenge. FTTH/PON is the high-capacity, high-civil-cost end. Hybrids reach fiber step by step.

FTTH/PON topology

Short form: the OLT launches light downstream; the splitter divides it with no field power; each ONT converts to Ethernet/voice/video. Upstream is coordinated in time so subscribers do not overlap. Responsibility split (ex 10): feeder = shared provider section back to the OLT, splitter = passive branch point and where split ratio and loss are decided, ONT/drop = subscriber demarcation and local service handoff.

Optical budget

Short form: every passive element eats power. Total path loss has to stay comfortably inside what the transceiver pair supports. Margin = (Tx power − Rx sensitivity) − total loss.

• Operations: few powered field parts means fewer failures, but faults at connectors, bends, splitter paths and registration need optical diagnostic skill (power readings, event traces, OLT telemetry). Document splitter locations and port assignments carefully.
• Adoption matters: 32 homes with 6 active behave differently from 32 homes all on multi-gigabit tiers at evening peak.
• Upgrades: move to a faster PON generation by changing OLT/ONT and optics, but the passive plant, splitters and wavelength plan must stay compatible during migration.

Fiber-centric and hybrid

• Fiber-centric: high capacity, low attenuation, long upgrade horizon. The cable can stay in the ground while you improve modulation, wavelengths or PON standard. Justified when long-term demand pays for the high upfront cost (open-access municipal network, new suburb that later also does business and small-cell backhaul). Optical budget and construction quality still decide whether gigabit marketing is real.
• Hybrid (HFC, fiber-to-the-cabinet): fiber deep into the network, existing coax or copper for the last segment. Cheaper and faster, a good transition, but users feel the weakest segment and pressure to push fiber closer keeps growing. In HFC, shrink the homes per node over time.

Everything downstream rests on the forecast. Bad demand assumptions are expensive to undo once fiber is in the ground.

The design flow

Forecasting

Short form: combine demographics, adoption, historical demand and competition. Segment first, because apartments, low-density suburbs, industrial parks, student housing and rural towns behave differently. A new network replacing poor service adopts fast; an overbuild in a market with several fast operators grows slowly unless price or service differs.

• Plan for busy-hour traffic, not the daily average. The busy hour drives uplink sizing, aggregation and oversubscription risk.
• Turn customer counts into time-varying traffic models rather than one aggregate bit rate.
• Over-forecast strands capital in unused feeder and oversized equipment. Under-forecast leaves bottlenecks. Look for the defensible middle supported by data.

Service tiers and SLAs

Short form: a tier defines nominal throughput, latency target, support commitments and extras. An SLA adds contractual restoration targets, maintenance windows and escalation. Tiers are engineering commitments, not sales labels.

• Best-effort residential can lean on statistical sharing. Premium low-latency business circuits cannot.
• Promising symmetric multi-gigabit affects access technology, aggregation headroom, optical budget and CPE.
• Three tiers on one plant (entry, premium residential, business with uptime and response guarantees) still differ in design: the business tier may need reserved capacity, stronger monitoring and faster repair.
• Marketing that outruns the engineering model leads to unhappy customers, regulatory trouble or overload.

You can raise availability by failing less often or by repairing faster. A good design uses both.

Availability: Eq 8.1

Short form: A = MTBF / (MTBF + MTTR). Higher MTBF and lower MTTR both raise A.

• Raise MTBF: fiber route diversity, quality construction, environmental hardening, equipment redundancy.
• Lower MTTR: spares strategy, clear documentation, quick alarm correlation, disciplined repair workflow.
• Moderate redundancy plus strong operations is usually cheaper than pure duplication.

Physical topology

Short form: star, ring, tree and mesh affect cost, expansion and survivability. A tree is cheap but a feeder cut has a large failure domain. Rings and dual-homing cost more but cut outage time and affected customers. Geography decides what is buildable: roads, poles, rivers, rail, ducts, permits.

• Node placement (cabinets, splitters, aggregation points, COs) sets reach, optical loss, repair access and expansion room. Too few nodes: long runs and hard repairs. Too many: site cost, power and complexity.
• In fiber designs route length, splice count, connector count and split strategy all consume optical margin.
• A suburban ring survives a cut but needs more trenching than a tree. Long rural feeders reduce site count but may leave no margin for later split expansion.

Logical topology

Short form: the service view on top: which traffic shares a forwarding domain, how subscribers are authenticated and isolated, how business is separated from residential, how rerouting works. It can differ a lot from the physical shape because of tunnels, virtual circuits and overlays.

• Two customers on the same fiber can be in totally different services with different addressing, QoS and policy.
• VLANs, MPLS constructs, tunnels and policy routing allow this, but add complexity. It must still be understandable during an outage.
• Example: physical metro ring, logical star flows into centralised subscriber gateways. Or an open-access network with shared passive fiber and separate wholesale environments per retailer.

The technically best design is not always the one you can finance, build and keep running.

CAPEX, OPEX and upgrade path

Short form: CAPEX is civil works, fiber, active gear, sites, power and CPE. OPEX is crews, leased facilities, energy, software, spares and support. Saving in one often inflates the other, so make the trade-off explicit early. Outside plant is expensive to rebuild while electronics are cheap to upgrade, which is why fiber-heavy can win despite the sticker price. A staged hybrid can still be right if it gets revenue flowing to fund deeper upgrades.

Phased rollout

Short form: build the high-demand zones or strategic corridors first (dense neighbourhoods, business districts, anchor institutions, routes with existing duct). Lower initial cost and early revenue, but later areas may feel treated unfairly, and quick temporary decisions in phase one can become technical debt.

• Plan transitions: don't put early neighbourhoods on a convenient temporary aggregation design that hurts later.
• Pair it with clear communication, scalable backbone planning and a dated roadmap for underserved districts.
• Phased vs full immediate (ex 2): phased = cash and crews spread out, learning between phases, uneven coverage. Full = uniform service and no interim compromises, but huge capital, permit and resource demand, and more exposure to forecast error.

Operational readiness

Short form: design ends when the network can be run confidently in normal and abnormal conditions, not at commissioning. Without it MTTR grows regardless of how elegant the design is.

• Inventory: fiber paths, splitters, ports, ONTs, routers, power.
• Monitoring: correlate optical alarms, transport faults and customer impact.
• Field procedures: installation, connector cleaning, labelling, testing, escalation, repair.
• Spares: line cards, OLT port modules, power supplies, ONT models on hand.
• Documentation: so a technician can identify the right splitter path or cabinet patching.

Quality of service means predictable performance for each kind of application. You measure it with delay, jitter, loss, availability and throughput, and you read them together, never one at a time.

Why metrics at all

Short form: metrics turn "the network feels bad" into targets an operator can measure. A service can show high average throughput and still feel poor if delay swings or loss forces retransmission. Everything is relative to the application class: a cloud backup tolerates delay and jitter, a voice call does not, streamed video tolerates some loss if it can buffer, and a real-time control system tolerates almost none.

Delay and jitter

Short form: delay is the time for a packet to cross the network. Jitter is how much that delay varies. Voice and interactive video are sensitive to both.

• Where delay comes from: propagation over the medium, serialization onto links, forwarding decisions in devices, and waiting in queues.
• Queuing is the swingy part: it depends on how many packets compete for one output at that moment. The same network feels fine at noon and laggy at the evening peak with the same distances and routes.
• Why jitter hurts: a receiver can absorb a modest fixed delay, but irregular arrival forces a bigger buffer or causes glitches, freezes and distortion. Two paths with the same average delay can feel very different.
• Examples: a video call with plenty of downstream speed still has awkward overlap if upstream queuing creates delay spikes. An online game uses little bandwidth yet is very sensitive to latency variation.

Loss and throughput

Short form: loss hurts the application directly, and it also lowers throughput indirectly because TCP shrinks its window and retransmits. So the two must be judged together.

• Causes of loss: physical errors, buffer overflow, policing actions, path instability. On shared access and aggregation links, congestion-driven loss matters most.
• Peak is not sustained: a speed test on an idle line is not the rate you get at busy hour. Effective throughput depends on protocol overhead, contention, queue occupancy, retransmissions and how well the transport recovers.
• Moderate speed with low loss and stable latency can beat a faster line with unstable queues.

QoS exists because broadband is shared. Classify traffic, mark it, schedule it and manage queues, with a small number of classes you can actually verify.

Why differentiate at all

Short form: best effort is simple and fair, but mixed traffic has very different sensitivity to delay and loss, so some controlled prioritization becomes necessary. The skill is to help critical traffic without starving the rest, and without building a scheme nobody can troubleshoot: few meaningful classes, mapped consistently, tied to measurable objectives.

Equation 9.1: where the delay comes from

• Propagation dominates → the problem is distance or route length.
• Transmission dominates → link rate is the limit.
• Processing dominates → device architecture or feature load.
• Queuing dominates → the most controllable term at broadband bottlenecks, which is why QoS centres on classification, scheduling, shaping and queue management.

Classification and marking

Short form: classification decides what a packet belongs to (application, subscriber policy, contract). Marking writes the intended treatment into a field so downstream devices can apply it consistently.

• Classify by port numbers, deep packet inspection, subscriber identity, virtual interface, access line, or markings from trusted devices.
• Trust boundary: if you accept every marking blindly, subscribers mark everything high priority. Providers rewrite, validate or constrain markings at the service edge, trusting managed business equipment and reclassifying unmanaged residential traffic.
• Example: managed residential voice is classified at the gateway and marked for a low-latency queue while web and streaming stay in less urgent classes.

Scheduling and queue management

Short form: a scheduler picks which queued packet goes next when several classes wait for the same output. Queue management decides how full the queues are allowed to get before that.

• Bufferbloat: huge unmanaged buffers absorb bursts but add excessive delay under sustained load. AQM can greatly improve interactive performance even if peak throughput barely changes.
• Evening scenario: a video stream, a cloud backup and a voice call share the upstream. Unmanaged, the backup fills buffers and voice waits too long. With a modest low-latency treatment for voice and controlled queue occupancy for bulk data, the same line works without stopping the backup.

QoS works only when policy, measurement and operations stay aligned. Pick a few classes, prove they work under load, and keep tuning.

Traffic classes

Short form: Table 9.1 is a starting framework, not a template. Providers merge or split classes to suit their mix (a carrier with mobile backhaul and enterprise VPNs may define stricter real-time and assured classes than a small residential ISP). Each class should mean one distinct operational intention.

Measurement and verification

Short form: a policy that looks sensible in a config file is not proven. Measure with synthetic tests, flow telemetry, queue statistics and user-experience indicators, and watch class-specific drops, queue occupancy, latency variation and representative applications, not just interface utilisation.

• Verify the priority queue carries the intended traffic and that lower classes stay usable.
• Synthetic traffic shows whether the treatment appears during congestion. Passive telemetry shows whether real traffic behaves the same over time.
• Example: total loss is low, yet video meetings are bad at busy hours. Queue telemetry shows delay-sensitive traffic misclassified into the same congested class as bulk uploads.

Policy trade-offs

Short form: too much traffic in the high class makes "priority" meaningless and hurts the others. Too little differentiation leaves real-time traffic exposed to bulk congestion. The aim is to distribute impairment according to service value, tuned from live data.

• On consumer broadband many traffic types share one line under end-user control, and finite capacity means ideal performance for every app cannot be guaranteed.
• Example: a real-time class first protects voice, then grows to include lots of interactive video and starves ordinary traffic. The fix is rarely to drop priority altogether: refine classification, add class limits or improve queue management.
• Revisit policy with operational data, complaint patterns, new application mixes and changing service tiers. QoS is an ongoing process, not a one-time configuration.