Origins of the Reduced Neighbor Report
🏘️
The Reduced Neighbor Report is an Information Element used by multi-band APs to inform clients about neighboring BSSIDs and SSIDs.
Objective
The primary objective of the Reduced Neighbor Report (RNR) is to enable clients to discover BSSIDs and SSIDs in 6 GHz by scanning only 2.4 GHz and 5 GHz.
Industry Ready
One of the ways the industry is making this happen is through the Wi-Fi Alliance. The test plan for Wi-Fi 6E includes out-of-band discovery and expects the Reduced Neighbor Report to be present. This means the Wi-Fi Alliance is testing APs for out-of-band discovery behavior. The Reduced Neighbor Report is also a Wi-Fi Optimized Connectivity feature.
Common Misunderstandings
Some bloggers in the WLAN community have stated the Reduced Neighbor Report (RNR) is from 802.11k-2008, but that is not entirely true. 802.11k introduces the ability for clients to explicitly request a neighbor report and then receive a response with roaming candidates of neighboring APs. The Reduced Neighbor Report (RNR) we see in current implementation does not require a specific request-response cycle. 802.11k also does not contain the definition for the RNR Information Element (IE).
What is true is that the idea of the Reduced Neighbor Report (RNR) comes from 802.11k-2008, but the actual definition (IE 201) is not until later, between the 2012 and 2016 rollups. The amendment that first defines the RNR IE is 802.11af-2013 (TV White Spaces).
While 802.11k does not define the RNR IE, 802.11k is still useful for out-of-band discovery. 802.11k can inform clients of 6 GHz neighbors in the neighbor report response. This means you should consider enabling 802.11k on both out-of-band and in-band SSIDs on 6 GHz capable APs. In most cases, you should deploy dual-band SSIDs on 5 GHz and 6 GHz. When the client connects on 5 GHz, the AP can inform the client of 6 GHz neighbors in the neighbor report response and through the RNR IE.
The Reduced Neighbor Report IE is automatically advertised in every beacon and probe response in 2.4 GHz and 5 GHz on capable APs. Note that some vendors are even adding the Reduced Neighbor Report in 6 GHz.
Does this mean that the Reduced Neighbor Report completely solves discovery of 6 GHz networks? No, it does not. The RNR IE is only a helper for what is often the first step of 6 GHz discovery. The RNR is like a seed. After parsing the RNR, a 6 GHz capable client will have to take action and switch its radio from out-of-band to in-band and either actively (probe) or passively (listen) discover on the target channel.
RNR Information Element
The Reduced Neighbor Report (RNR) Information Element (IE) carries some key details about the BSSIDs and SSIDs in 6 GHz:
- BSSID
- SSID via Short SSID (one-way 4-byte CRC of the SSID in 6 GHz)
- Operating class (see Annex E Table E-4 in IEEE 802.11ax-2021 or later for 6 GHz operating classes)
- Operating channel
- BSS Parameters
- If OCT is recommended
- If the neighboring SSID is the same or not as the current frame
- If the neighbor is using Multiple BSSID (MBSSID)
- If the neighbor is the transmitted BSSID or a non-transmitted BSSID (a MBSSID construct)
- If Unsolicited Broadcast Probe Responses are active or not
- If the neighboring BSSID and SSID are co-located or not
- 20 MHz PSD
Please note this list is not exhaustive. Wi-Fi 7 also extends the Reduced Neighbor Report by adding Multi-Link Device (MLD) parameters. Those won’t be covered in this post.
Capable clients can use information from the RNR data to seed discovery of 6 GHz networks.
Here is an example of how the RNR data from 2.4 GHz and 5 GHz scans can be visualized with lswifi -rnr:
FAQ:
Q. Which management frames carry the RNR?
A. Beacons and probe responses.
Q. Will my dual-band 2.4 GHz and 5 GHz AP use the RNR?
A. You will likely need a 6 GHz capable AP.
Q. Does the RNR help for 6 GHz only SSIDs?
A. Yes. A 2.4 GHz or 5 GHz RNR can point to a different SSID in 6 GHz.
Q. Does the RNR speed up 6 GHz discovery?
A. It can. The RNR includes a channel indication and Target Beacon Transmission Time (TBTT) offset which can tell the client exactly which channel to look for and when.
Q. Why would a client parse beacon frames from SSIDs that it doesn’t care about?
A. How does the client know whether or not it cares about a beacon frame or probe response frame without first parsing the frame to determine whether to ignore? The majority of 6 GHz clients will use out-of-band scans to seed 6 GHz discovery.
Q. How is the RNR configured?
A. Automatically on capable APs. Typically on SSIDs with operation on 2.4 GHz and 5 GHz. On a 6 GHz capable multi-band AP, enable an SSID on 2.4 GHz or 5 GHz radio.
Q. Do I need a 6 GHz NIC to detect RNR frames?
A. No. “Legacy” NICs can detect the RNR through existing scans and frames seen in 2.4 GHz and 5 GHz. Try lswifi -rnr in air space with multi-band 6 GHz APs present to see for yourself.
Thanks to Keith Miller for reading drafts of this and Adrián Granados for the additions to the misunderstandings.