6 GHz Discovery: How Clients Find a 6 GHz AP
Compare a passive scan of every 6 GHz channel, preferred scanning channels and Reduced Neighbor Reports, with FILS Discovery and unsolicited probe responses: how long each takes to find the AP, and the pros and cons.
How to use this tool controls and what to look for
Set up the AP and the client, then compare how long each way of finding a 6 GHz AP takes.
Controls to change
- AP's primary 6 GHz channel: put the primary channel on or off a preferred scanning channel (PSC).
- Same AP also has 2.4/5 GHz radios (sends an RNR there): let the AP advertise its 6 GHz channel on the other bands.
- AP also sends: add FILS Discovery frames or unsolicited probe responses, or send Beacons only.
- The client is looking for: choose A saved network or Any network.
- Scan order: scan Channel by channel, upwards, or in Any order (average).
- 6 GHz spectrum: choose 500 MHz (e.g. Thailand, EU) or 1200 MHz (e.g. US).
- ▶ Play in real time: watch the scan happen at real speed.
What to look for
- A passive scan of every 6 GHz channel is the slowest and uses the most battery.
- Scanning only the PSCs covers a quarter of the channels, so a 6 GHz-only AP should put its primary channel on a PSC.
- A Reduced Neighbor Report on 2.4 or 5 GHz is the fastest: the client goes straight to the right channel.
- FILS Discovery frames and unsolicited probe responses every 20 TU make the AP quicker to find, at a small airtime cost.
About this tool
In 6 GHz a client may not send the usual wildcard probe request, and there can be up to 59 channels, so finding an AP by scanning every channel can take seconds. This tool compares three ways a client finds a 6 GHz AP: a passive scan of every channel, a scan of only the 15 preferred scanning channels (PSCs), and the shortcut most clients use, a Reduced Neighbor Report (RNR) heard on 2.4 or 5 GHz. It also shows what the AP can send between beacons (FILS Discovery frames or unsolicited probe responses), with timelines, a comparison and the pros and cons of each.
What you'll learn
- Why a 6 GHz client can't send a wildcard probe request, and what it may send instead
- What the preferred scanning channels are and why a 6 GHz-only AP should put its primary channel on one
- How a Reduced Neighbor Report on 2.4 or 5 GHz lets a client go straight to the right 6 GHz channel
- The difference between beacons, FILS Discovery frames and unsolicited probe responses for being found
Common questions
How do Wi-Fi clients find 6 GHz networks?
Mostly through the Reduced Neighbor Report: a tri-band AP lists its 6 GHz radio (channel, BSSID and short SSID) in every 2.4 and 5 GHz beacon and probe response, so the client goes straight to that channel. Clients also scan the 15 preferred scanning channels, where APs with no 2.4/5 GHz radio should be. Few scan all 6 GHz channels, because that can take several seconds.
What is a PSC in 6 GHz?
A preferred scanning channel: every fourth 20 MHz channel in 6 GHz (5, 21, 37 and so on up to 229), 15 in all. Clients that scan 6 GHz directly check these first, and the standard says an AP without co-located 2.4/5 GHz radios should use one as its primary channel.
Do I need FILS Discovery or unsolicited probe responses?
Not on a tri-band AP, whose clients learn about the 6 GHz radio from the RNR. An AP that only has a 6 GHz radio and wants to be found quickly must send a FILS Discovery frame, an unsolicited probe response or a beacon at least every 20 TU, so a scanning client hears it within about 20 ms.
Free for private and educational use. This interactive model is a simplified teaching aid and may contain mistakes. It is provided as is, without warranty. Use it to understand the concepts, not as a substitute for a site survey, vendor documentation or professional design advice.