Wi-Fi MAC Layer: Scanning, Authentication, Association, and Data Transmission Processes

UsingWi‑Fias an example, theMAC layeris the "network access manager" that sits above the PHY/Baseband and decides how a device joins a network, gains access to the medium, exchanges frames, retries lost packets, and maintains connectivity.

A simplified Wi‑Fi stack looks like:

Application TCP/IP ↓ 802.11 MAC ↓ 802.11 PHY/Baseband ↓ RF ↓ Antenna

The MAC layer performs:

• Scanning

• Authentication

• Association

• Security key exchange

• Data transmission

• Retransmission

• Roaming

• Power saving

Let's walk through what happens when an ESP32-S31 connects to a Wi‑Fi AP.

Step 1: Scanning

Before connecting, the STA (station, e.g., ESP32) must discover available APs.

Passive Scan

The STA simply listens.

APs periodically send:

Beacon Frame

containing:

SSID Channel BSSID Security Mode Supported Rates Capabilities

Example:

SSID: HomeWiFi Channel: 6 Security: WPA2

Active Scan

The STA sends:

Probe Request

Example:

Who has SSID "HomeWiFi"?

AP replies:

Probe Response

At this stage, the MAC is handling management frames.

STA -------------------> Probe Request STA <------------------- Probe Response

Step 2: Authentication

Historically, 802.11 defined an authentication procedure before association.

Open System Authentication

Today this is the most common.

STA sends:

Authentication Request `

AP replies:

Authentication Response (Status = Success)

STA AP Authentication Request -----> <------- Authentication Response

This doesnotyet verify the Wi‑Fi password.

It simply says:

You may proceed to associate.

Step 3: Association

Now the station asks to join the AP.

Association Request

Contains:

SSID Supported Data Rates Capabilities QoS Features HT/VHT/HE Capabilities

Example:

I support: 802.11n MCS0~MCS7 WPA2 QoS

Association Response

AP replies:

Association ID (AID) Status Capabilities

Example:

AID = 0x0021 Status = Success

At this point:

STA is associated

but encrypted data is still unavailable.

STA AP Assoc Req -------------> <------- Assoc Resp

Step 4: WPA/WPA2/WPA3 Security

Now comes the real security process.

For WPA2-PSK the famous:

4-Way Handshake

occurs.

Goal

Both sides derive:

PTK (Pairwise Transient Key)

used to encrypt traffic.

Message 1

AP sends:

ANonce

Message 2

STA sends:

SNonce MIC

Message 3

AP sends:

Install Key GTK

Message 4

STA acknowledges.

AP STA M1 ANonce ------------> <---- M2 SNonce M3 GTK -------------> <---- M4 ACK

After this:

Encrypted traffic enabled

Now IP traffic can start.

Step 5: DHCP

This is above the MAC layer but happens immediately afterward.

DHCP Discover DHCP Offer DHCP Request DHCP ACK

Now the device obtains:

IP Address Gateway DNS

Example:

192.168.1.105

Step 6: Data Transmission

Once connected, the Wi‑Fi MAC handles frame delivery.

Example:

TCP Packet

becomes:

802.11 Data Frame

containing:

MAC Header Payload FCS

MAC Addressing

Each device has:

48-bit MAC Address

Example:

ESP32: 84:FC:E6:12:34:56 AP: 18:E8:29:AA:BB:CC

The MAC layer inserts source and destination addresses into every frame.

CSMA/CA

Wi‑Fi MAC must share the air with other devices.

Unlike Ethernet:

Can't detect collisions reliably

So Wi‑Fi uses:

CSMA/CA

Carrier Sense Multiple Access with Collision Avoidance.

Example:

Device A wants to send.

MAC first listens.

Channel Busy?

If yes:

Wait Random Backoff Retry

If no:

Transmit

Listen ↓ Busy? ↓ Wait ↓ Backoff ↓ Transmit

This logic is entirely MAC-level.

ACK and Retransmission

After every unicast frame:

Receiver sends ACK.

STA ---------- Data ----------> <------ ACK -----------

If no ACK arrives:

Retransmit `

The MAC maintains:

Retry Counter Sequence Number Duplicate Detection

This happens below TCP/IP.

Power Save

For battery devices, the MAC supports sleeping.

AP periodically indicates:

Buffered packets waiting.

through beacon information.

Station behavior:

Sleep Wake Check Beacon Retrieve Data Sleep Again

This is one reason Wi‑Fi IoT devices can save power.

Roaming

When signal quality drops:

RSSI ↓

the MAC scans for another AP.

Example:

AP1 -> AP2

The MAC performs:

Re-authentication Re-association Key Updates

while trying to keep connectivity.

Inside an ESP32-S31

Very roughly:

Application ↓ TCP/IP Stack ↓ Wi-Fi MAC ├─ Scanning ├─ Authentication ├─ Association ├─ Security ├─ ACK ├─ Retries ├─ Power Save └─ Roaming ↓ Wi-Fi Baseband ├─ OFDM ├─ Modulation ├─ Encoding └─ Synchronization ↓ RF ├─ 2.4 GHz LO ├─ PA ├─ LNA └─ Antenna

A useful rule of thumb

• MACdecideswho can talk, when to talk, and who we're talking to.

• Basebandconverts packets into Wi‑Fi symbols and vice versa.

• RFconverts those symbols into actual 2.4 GHz radio waves.

So when you see logs like:

wifi: scan start wifi: authentication success wifi: association success wifi: connected

those events are primarily being driven by theWi‑Fi MAC layer, while the baseband and RF are the engines that physically move the bits through the air.