WMM and QoS in WiFi Explained

Why WiFi Needs QoS

WiFi is a shared medium. Every device connected to an access point competes for the same radio channel. Without any prioritization, a laptop downloading a large file and a phone on a voice call get equal treatment. The download saturates the channel, and the voice call stutters because its small, time-sensitive packets get stuck behind bulk data frames.

Quality of Service (QoS) solves this by giving certain traffic types preferential access to the channel. Voice packets get faster access. Video frames get priority over email. Background updates happen when nobody else needs the channel. WiFi's QoS mechanism is called WiFi Multimedia (WMM), and it has been part of the standard since 2004.

The Four Access Categories

WMM defines four Access Categories (ACs), each mapped to different types of traffic:

Voice (AC_VO): The highest priority. Mapped to DSCP values for VoIP traffic. Voice requires low latency (under 30ms one-way) and low jitter, but uses very little bandwidth - typically 30-100 kbps per call. Packets are small (usually under 200 bytes) and arrive at regular intervals.

Video (AC_VI): Second highest priority. Mapped to video streaming and conferencing traffic. Video needs higher bandwidth than voice (1-20 Mbps typically) and is moderately latency-sensitive. Brief stalls cause visible buffering.

Best Effort (AC_BE): The default category. Web browsing, email, file transfers, and any traffic not explicitly classified lands here. Most internet traffic falls into this bucket.

Background (AC_BK): The lowest priority. Mapped to bulk transfers, software updates, and backup traffic. These can tolerate high latency and are deliberately deprioritized so they do not interfere with interactive traffic.

graph TD
    subgraph "WMM Access Categories - Priority Order"
        VO["AC_VO - Voice
Highest priority
VoIP, Wi-Fi calling"] --> VI["AC_VI - Video
High priority
Streaming, video calls"]
        VI --> BE["AC_BE - Best Effort
Default priority
Web, email, general"]
        BE --> BK["AC_BK - Background
Lowest priority
Updates, backups, sync"]
    end
    subgraph "Traffic Classification"
        APP1[VoIP App] -->|DSCP EF| VO
        APP2[Zoom Call] -->|DSCP AF41| VI
        APP3[Web Browser] -->|DSCP 0| BE
        APP4[OS Update] -->|DSCP CS1| BK
    end

WMM sorts traffic into four priority levels - voice gets fastest channel access, background traffic yields to everything else

EDCA Parameters

The mechanism that enforces these priorities is called Enhanced Distributed Channel Access (EDCA). Each access category has its own set of contention parameters that control how aggressively it competes for the channel:

AIFS (Arbitration Inter-Frame Space): The minimum wait time after the channel becomes idle before a device can attempt to transmit. Lower AIFS means the device can start competing sooner. Voice has the shortest AIFS (2 slot times), background has the longest (7 slot times).

CWmin (Minimum Contention Window): The minimum range for the random backoff counter. After waiting AIFS, the device picks a random number between 0 and CWmin. Lower CWmin means shorter average backoff time. Voice uses CWmin=3, while background uses CWmin=15.

CWmax (Maximum Contention Window): The upper bound for the contention window after collisions. When a transmission fails, the contention window doubles up to CWmax. Voice's CWmax is 7, background's is 1023.

TXOP (Transmit Opportunity): The maximum time a device can hold the channel once it wins access. Voice gets a TXOP of 1.504ms (enough for one or two packets). Video gets 3.008ms. Best effort and background get 0 (meaning they can send one frame per channel access).

Contention in Practice

Here is how these parameters play out. The channel goes idle. A voice packet and a background packet are both waiting to transmit.

The voice queue waits AIFS(VO) = 2 slot times, then picks a random backoff between 0 and 3. Its maximum total wait is 2 + 3 = 5 slot times.

The background queue waits AIFS(BK) = 7 slot times, then picks a random backoff between 0 and 15. Its minimum total wait is 7 slot times - already longer than voice's maximum.

Voice wins almost every time. Even when voice traffic is competing against best effort traffic, the shorter AIFS and smaller contention window give voice a statistical advantage. It does not guarantee voice always wins - randomness can occasionally let a lower-priority frame through first - but over many contention cycles, voice traffic consistently gets faster channel access.

graph LR
    subgraph "EDCA Contention Timeline"
        IDLE[Channel Idle] --> AIFS_VO["AIFS VO: 2 slots"]
        IDLE --> AIFS_VI["AIFS VI: 2 slots"]
        IDLE --> AIFS_BE["AIFS BE: 3 slots"]
        IDLE --> AIFS_BK["AIFS BK: 7 slots"]
        AIFS_VO --> CW_VO["CW: 0-3 slots"]
        AIFS_VI --> CW_VI["CW: 0-3 slots"]
        AIFS_BE --> CW_BE["CW: 0-15 slots"]
        AIFS_BK --> CW_BK["CW: 0-15 slots"]
        CW_VO --> TX_VO["Voice transmits first"]
        CW_BK --> TX_BK["Background transmits last"]
    end

Voice traffic starts contending sooner (shorter AIFS) and resolves faster (smaller CW) than background traffic

WMM Is Mandatory

WMM became mandatory for WiFi certification with 802.11n (WiFi 4) in 2009. Every certified WiFi device since then implements WMM. This means every modern network has QoS operating whether the administrator configured it explicitly or not.

The AP advertises its EDCA parameters in beacon frames and probe responses. These parameters can be customized by the administrator. An enterprise network might tighten the voice EDCA parameters to ensure VoIP quality in a dense office. A home router typically uses the default values from the standard.

Clients must follow the EDCA parameters advertised by the AP. A client cannot unilaterally decide to use voice-priority parameters for all its traffic - the AP's advertised parameters define the rules. However, the actual DSCP marking of traffic (which determines which access category a packet uses) is controlled by the client's operating system and applications. A misbehaving or misconfigured application can mark all its traffic as voice priority, effectively cheating the QoS system.

WMM Power Save (U-APSD)

WMM includes a power-save extension called Unscheduled Automatic Power Save Delivery (U-APSD). With U-APSD, the client can sleep and trigger delivery of buffered frames by sending any uplink frame. The AP responds with all buffered downlink frames for that client's access categories that are configured as trigger-enabled.

This is more efficient than legacy PS-Poll because the client does not need to poll each buffered frame individually. One trigger frame from the client causes the AP to deliver all buffered frames in a burst. For VoIP, where traffic is bidirectional and periodic, U-APSD integrates naturally - each uplink voice packet triggers delivery of any waiting downlink voice packets.

The Security Angle

WMM has an important security implication that is often overlooked. Management frames - including deauthentication and disassociation frames - are not subject to EDCA queuing. They bypass the QoS system entirely and are transmitted with the highest possible priority, even above voice traffic.

This means deauth attacks are not slowed by WMM. A deauth frame does not wait in any queue and is not affected by contention parameters. It gets immediate channel access. This is by design - management frames need to be processed urgently for the protocol to function - but it is also why deauth attacks are so effective. The attack frames get priority access to the channel and reach the target almost immediately.

Protected Management Frames (PMF), mandated in WPA3, address this by authenticating management frames so spoofed deauth frames are rejected. But on WPA2 networks without PMF, WMM's design actually helps attackers by ensuring their deauth frames are never delayed by QoS queuing.

WMM and the BLEShark Nano

When the BLEShark Nano scans WiFi networks, the EDCA parameters advertised by each AP are visible in the beacon frame's WMM Information Element. Examining these parameters reveals how the network administrator has configured traffic prioritization.

Non-default EDCA parameters can indicate enterprise-grade network management. Extremely aggressive voice parameters might indicate a VoIP-heavy deployment. Modified best-effort parameters might suggest the administrator is tuning for specific application performance.

For security assessments, the WMM Information Element also reveals whether the AP supports U-APSD (indicated by the QoS Info field). Networks with many U-APSD-capable clients may show distinctive traffic patterns - periodic bursts of uplink-triggered downlink delivery rather than continuous bidirectional traffic.

In the EU region, where the BLEShark Nano disables active deauthentication, understanding WMM helps explain why passive handshake capture timing is unpredictable. Client reconnections - which produce capturable handshakes - are influenced by QoS behavior, power save modes, and band steering decisions that the WMM parameters partially control.