Wi-Fi 7 Multi-Link Operation:
How Multi-Link Setup Actually Works
A frame-by-frame walkthrough of the setup exchange between a Non-AP MLD and an AP MLD — the handshake that makes simultaneous multi-band operation possible.
01 What Is Multi-Link Operation?
Wi-Fi 7 (IEEE 802.11be) introduces Multi-Link Operation (MLO) — arguably the most architecturally significant change to 802.11 since the original standard. MLO allows a Wi-Fi 7 device and access point to simultaneously use multiple radio bands — 2.4 GHz, 5 GHz, and 6 GHz — as a single logical connection, rather than picking one band and staying there.
But simultaneous multi-band operation doesn't happen automatically. Two devices must negotiate which links are available, what parameters each link uses, and which links are accepted or rejected. That negotiation is the Multi-Link Setup exchange, and it's what this post breaks down step by step.
A Multi-Link Device (MLD) is the logical umbrella entity in Wi-Fi 7. Each MLD contains multiple affiliated STAs (client side) or affiliated APs (infrastructure side) — one per radio link. You negotiate with the MLD; the individual affiliated STAs/APs are the radios that carry the actual frames.
02 The Players: AP MLD vs Non-AP MLD
The diagram shows a three-link setup with six participants arranged into two logical entities:
Image Credit:Dr.Shrikanth @Wi-Fi Now Congress
Your Wi-Fi 7 laptop, phone, or device — three radios, one logical identity.
Your Wi-Fi 7 AP — all three bands presented as a single logical unit.
AP 2 and AP 3 are non-setup link APs — their capabilities are described within the setup exchange on AP 1, not through separate negotiations. A single (Re)Association transaction covers all three links.
03 The Setup Exchange, Phase by Phase
The overall flow follows a familiar pipeline — discover → probe → authenticate → associate → secure — but each step in MLO carries significantly more information than in legacy Wi-Fi.
Beacon Frames [B] — Passive Discovery on Each Link
The AP MLD broadcasts Beacon frames independently on each affiliated AP (2.4 GHz, 5 GHz, 6 GHz). Each beacon includes an RNR (Reduced Neighbor Report) element listing the other affiliated APs of the same MLD. This lets a non-AP MLD discover all links of an AP MLD from a single beacon, without needing to scan every band separately.
"Not an ML" Probe Request/Response [B & cB] — Per-Link Probing (Optional)
Before committing to ML setup, the non-AP MLD may send legacy (non-ML) probe requests to each AP individually.
(ML) Probe Request/Response [IB & cB] — Multi-Link Probe
Now the non-AP MLD sends a proper Multi-Link probe request ([IB] = individually addressed broadcast). This frame includes the Multi-Link element in the frame body. The AP MLD responds with an ML Probe Response carrying MLD capabilities, MLD MAC Address, link IDs, and operational parameters for all affiliated APs in a single response. This replaces what would have been three separate probe cycles in legacy Wi-Fi.
Authentication Frames [I] — Single-Link Authentication
Authentication in MLO happens on a single link only (the setup link). The [I] flag means individually addressed. Open System or SAE (WPA3) frames are exchanged between STA 1 ↔ AP 1. The other radios do not independently authenticate — the credential is bound at the MLD level, not per-radio.
(Re)Association Request/Response [I] — The Core of MLO Setup
This is where Multi-Link Setup is formally negotiated. The (Re)Association Request includes a Multi-Link element listing all links the client wants to set up, each with its own link ID and per-link capabilities. The AP MLD responds indicating which links are accepted and which are rejected, plus operational parameters for each accepted link. Importantly, setup can be performed on any link — not just the 2.4 GHz anchor.
4-Way Handshake [I] — Key Derivation for the MLD
The EAPOL 4-way handshake derives a Pairwise Transient Key (PTK) scoped to the MLD as a whole — not to individual links. The same security context covers all links. Frame protection on non-setup links uses the same derived keys established here.
The diagram specifically notes "Multi-link setup can be performed on any link." This means the (Re)Association can take place on 5 GHz or 6 GHz just as validly as on 2.4 GHz. The "setup link" is whichever link carries the Association frames — not necessarily the lowest band.
04 The (Re)Association Response: Accept or Reject Per Link
"In the (Re)Association Response frame, the AP MLD shall indicate the requested link(s) that are accepted and the requested link(s) that are rejected for (re)setup — and the capabilities and operational parameters of the requested link(s)."
— IEEE 802.11be (Wi-Fi 7 Specification)
This is a per-link accept/reject model. If a non-AP MLD requests three links but the AP MLD can't support the 6 GHz link at that moment — say, DFS radar was detected, or the radio is at capacity — it can reject that link and accept the other two. The client ends up with a two-link MLO session and can re-request the 6 GHz link later via re-association.
What the Response Contains Per Accepted Link
For each accepted link, the (Re)Association Response includes the Link ID, BSS Parameters Change Count, operating channel, supported data rates, and any link-specific constraints such as punctured channels under 802.11be's preamble puncturing. For rejected links, a reason code is included so the client understands why and can handle the situation gracefully.
05 Single AID Assignment — Why It Matters
"An AP MLD shall assign a single AID to a non-AP MLD upon successful multi-link setup."
— IEEE 802.11be
In legacy 802.11, an Association Identifier (AID) is assigned per association — effectively per-radio. With MLO the rule is simple: one non-AP MLD = one AID, regardless of how many links are established. This has meaningful downstream implications:
-
1TIM Efficiency: The AP only needs to set a single bit in the TIM bitmap for the entire MLD. Buffered frames can be delivered on any available link — the AP doesn't need to track which band the client is listening on separately.
-
2Power Management: A single power management state at the MLD level covers all links. The non-AP MLD signals sleep/awake for the MLD — not per radio — simplifying AP buffering logic significantly.
-
3Address Management: While each affiliated STA/AP may have a distinct MAC address, the MLD itself has a single MLD MAC address used for RSNA key management — maintaining logical unity across all links.
06 MLO vs Legacy Wi-Fi: Feature Comparison
| Feature | Legacy 802.11 | Wi-Fi 7 MLO (802.11be) |
|---|---|---|
| Simultaneous multi-band | No | Yes |
| Association per-band | Yes | Single MLD association |
| AID per device | 1 per association | 1 per MLD (all links) |
| Authentication scope | Per-radio | Per-MLD (single auth) |
| PTK (security key) scope | Per-association | Per-MLD (shared key) |
| Per-link accept/reject | No | Yes |
| Setup link flexibility | N/A | Any link can be setup link |
| Probe for all bands | 3 separate probes | 1 ML probe → all bands |
| TIM bitmap | 1 bit per association | 1 bit per MLD |
07 Engineer's Takeaway
The Multi-Link Setup exchange is deceptively compact for what it accomplishes. A single (Re)Association transaction — carrying the Multi-Link element — replaces what would previously have required three entirely separate association lifecycles across three bands. The resulting session is one logical entity with one AID, one PTK, and coordinated power management.
From a troubleshooting perspective, this changes things considerably. When you capture a Wi-Fi 7 association in Wireshark (or a Ruckus support capture), look for the Multi-Link element inside the (Re)Association Request to understand which links are being requested and in what configuration. The corresponding Response will tell you exactly which links were accepted, which were rejected, and the channel/capability context for each.
For network designers: MLO setup doesn't require all three bands to be collocated on the same physical AP. A distributed AP MLD architecture is possible — but it adds coordination complexity. For typical enterprise deployments, the assumption is that all affiliated APs of a single MLD share backhaul and control-plane context.
1. The AP MLD's (Re)Association Response is your ground truth — it defines exactly which links are live and their operational parameters.
2. A single AID per MLD unifies TIM bits, power management, and addressing across all links — simplifying the AP's client state machine.
3. Non-ML probing (Phase 2) is a legitimate discovery path — a client doesn't have to use ML probes; it can probe each AP individually and still complete ML setup via the Association frames.
MLO is the feature that finally makes "all three bands, all the time" a reality in Wi-Fi — and the Multi-Link Setup exchange is the handshake that makes it possible. If you're studying for CWAP, expect to see this sequence in detail. If you're deploying Wi-Fi 7, understanding this exchange will be indispensable when associations don't behave as expected.
As always — capture everything, trust the frames.
Comments
Post a Comment