Why restrict the number of SSIDs on an AP

One of the first things I learned when I started getting into Wi-Fi was that it was best practice to have as few SSIDs as possible. But no more than 4 at the most.

The reason is that beacons and probe response are two types of required wireless management frames that can increase channel utilization. Beacon frames are used by an AP to advertise the SSID. Each AP must send a beacon every 100ms at the lowest supported data rate so all clients can receive it. The data rate is 1Mbps by default with 802.11 2.4Ghz and 6Mbps on 5Ghz. 

Wireless clients can also discover available wireless networks using probe requests. When an AP receives a probe request, it will respond with a probe response for the SSID which contains the wireless capabilities. Probe requests and responses are always sent at the lowest supported data rates with 1Mbps 2.4Ghz and 6Mbps on 5Ghz.

As the number of wireless networks operating on a specific channel increases, so does the number of beacon frames and probe responses. Take a scenario where there are two physical APs on the same channel each with a single SSID. Both APs will transmit one beacon frame every 100 ms and when any client sends a probe request on that channel, each AP will send a probe response. This would not cause much overhead.

However, take the same two physical APs each with 4 SSIDs. Now 8 VAPs are independently sending beacon frames every 100ms and any time a client sends a probe request, 8 probe responses are transmitted. This example does not begin to take into account neighboring Wi-Fi system management frames, wireless data transfers, or non-802.11 interference (such as microwaves and cordless phones). 

WiFi Revolution, a team of wireless experts, has put together an SSID overhead calculator which allows an admin to calculate the amount of overhead based on the number of SSIDs and APs. 

In my experience, I have seen plenty of customers that have ignored this best practice and have put up to 8 SSIDs on an access point per radio. Thinking they need a separate Wireless network for each use case on the network.

So I thought I would investigate and found out for myself and improve my understanding in my home lab what actually is the impact of running multiple SSIDs on an AP and to see what impact this has one

---

Test Equipment

- MacBook Pro 802.11ac with 3 spatial streams

- Ruckus R750 4x4:4 802.11ax AP

- Wi-Fi Explorer

First, let us start with what should I expect with just one SSID Broadcasting.

according to the spreadsheet, as you can see should be 3.2% overhead. looking at Wi-FI Explorer currently at 0%

Now if I add 10 extra SSIDs to the AP we get over 34% utilisation on the channel in 2.4Ghz

and this is with only 3 (MacBook, IPad, and Mobile)devices connect and none of them passing any real amount of traffic. Just imagine if this was in a busy RF environment such as a university campus or even a busy coffee shop. this management overhead would seriously impact the performance of the wireless.

One of the common reasons I get from customers who want to have multiple SSIDs is that they have multiple use cases for the wireless. Such as EPOS, CCTV, Guest, AV, Corporate, BMS just to name a few. They want to keep them separate from each over and not all share the same network and passphrase. My answer to that it depends on what infrastructure they have. If they have a radius and active directory then implement that on an SSID and get radius to return back different VLANs for different user groups. I would highly recommend this for corporate devices. But then third party devices you cant add to your active directories. So I would either use some form a Dynamic Pre Shared (DPSK) that can allow you to have the same WPA2 secure network but each user or device has it's own passphrase which identifies the user profile and drops the device on the correct VLAN. Or if you add the Mac address into your Radius server and have another network that MAC authorizes the device based on it's mac and delivers them to the correct network.

There are also plenty of NAC (Network Access control) software that can automate this for you.