The Hidden Terminal Problem and Why 802.11 Reserves the Medium

Two stations sit on opposite sides of an access point. Neither can hear the other; both can hear the AP. Both have a frame to send, both listen, both hear silence, and both transmit at the same instant. The frames arrive at the AP superimposed, the AP’s receiver fails to demodulate either, and both stations wait out an ACK timeout before retrying. Nothing in the sequence was detectable from either sender’s position. Each station correctly observed that the medium was idle in the only place it could observe.

This is the hidden terminal problem, and it is the reason 802.11 does not simply reuse the carrier-sense multiple-access scheme of wired Ethernet.

Carrier sense measures the wrong location

Ethernet’s collision detection works because the medium is a shared conductor. A station transmitting onto a coaxial cable can compare what it sends with what it hears and notice a discrepancy within a few bit times, because the signal from a competing station arrives at its own transceiver with appreciable energy. On radio there is no shared conductor, and the received power falls off roughly with the square of distance in free space and faster in a cluttered environment. Two stations 100 metres apart on either side of an AP may each be well inside the AP’s range while being far outside each other’s.

The asymmetry has three consequences that shape the whole MAC design.

First, a collision happens at the receiver, not at the sender. A station that transmits into a collision has no way to know; it must be told, and the only channel available to tell it is the same one it is using. That is why 802.11 requires an explicit acknowledgement for every unicast data frame, sent after a short fixed interval. The ACK is not an optimisation; it is the only collision signal in the system.

Second, sensing is a threshold test, not a binary one. A station declares the medium busy when the energy on the channel exceeds a threshold, or when it can decode a valid preamble and header. The two tests are different, and a signal strong enough to corrupt a frame can be too weak to decode. Receivers therefore have a busy state that can be wrong in both directions: a distant transmitter may be inaudible but still capable of ruining a frame at the AP, and a nearby transmitter in an adjacent room may be loud enough to silence a station that would not have collided with anything.

Third, the interference graph is not symmetric. If station A can hear station B, B cannot necessarily hear A, because transmit power, antenna gain, and receiver sensitivity differ. Protocols that assume a symmetric neighbourhood, as wired ones effectively do, lose their guarantees.

The reservation handshake

The 802.11 answer is to make the sender reserve the medium at the receiver’s location before sending data. A station with a frame to send transmits a Request to Send frame, 20 bytes, addressed to the AP. The AP replies with a Clear to Send frame, 14 bytes, also broadcast in the sense that every station in its range can decode it. Any station that hears the CTS now knows that somebody it cannot hear is about to transmit, and for how long, and stays quiet.

The mechanism converts a hidden terminal from an invisible interferer into an announced one. Station B, the hidden peer, cannot hear A’s RTS, but it can hear the AP’s CTS, which is transmitted from the AP and carries the duration of the entire exchange. B sets a timer and defers. When the timer expires, B is free to contend again.

Both frames are short on purpose. The RTS travels at a rate every station in the cell can decode — one of the rates in the basic rate set, usually the lowest — so the reservation succeeds even when the channel has degraded enough that data frames would fail. The CTS is sent at the same rate as the RTS, so a station that could not hear the RTS can still decode the reservation.

The exchange costs airtime, and the cost is paid per frame. The payload of a 1500-byte data frame occupies about 222 microseconds at 54 Mbit/s, and with preamble, header, and interframe spaces the exchange is nearer 300 microseconds; an RTS plus CTS at 6 Mbit/s occupies on the order of 100 microseconds including their preambles and the gap between them. For large frames the reservation is cheap insurance. For a 100-byte frame the handshake can cost more than the payload, which is why implementations expose an RTS threshold: frames shorter than the threshold are sent without a reservation. The threshold is a per-interface configuration value, and setting it to a value larger than the maximum frame size disables the handshake entirely, which is the usual configuration on networks where hidden terminals are not a concern.

Virtual carrier sense and the duration field

The CTS is not the only source of reservation information. Every 802.11 frame carries a Duration/ID field of 2 bytes. In the common case the field holds a 15-bit value in microseconds, and it states how long the sender expects the remaining exchange to occupy the medium. A data frame sets it to cover its own transmission plus the SIFS gap plus the ACK. An RTS sets it to cover the RTS, the CTS, the data frame, and the ACK.

Stations that decode a frame header read this value and load it into a network allocation vector, a countdown timer that runs whenever the station is not itself transmitting. While the NAV is nonzero the station treats the medium as busy regardless of what its energy detector reports. This is virtual carrier sense: the reservation is propagated in the frame headers themselves, so stations that can decode any part of the exchange learn about it.

Two details make the NAV work in practice. It counts down in real time rather than in slot time, so a station that hears the tail of an exchange still defers for the correct remainder. And the value 32767 is reserved as a sentinel meaning “no reservation”, used in frames that do not reserve anything, such as a PS-Poll. A receiver that treated that value literally would defer for over 32 milliseconds, so implementations check for it explicitly.

The interaction between physical and virtual carrier sense is a logical OR: the medium is busy if either says so. This is also a failure mode. A station that sets its NAV from a frame it decoded correctly but that was addressed to a different network, on the same channel, will defer for a transmission that will never affect it. Co-channel overlap between neighbouring networks produces exactly this, and the resulting throughput loss is a coordination problem rather than a radio one.

Exposed terminals and the cost of being polite

The handshake has a mirror-image problem. A station that hears the RTS but is not the intended recipient, the exposed terminal, sets its NAV and defers even though its own transmission would have reached a different AP without interfering. The reservation is conservative by construction: it protects the receiver at the price of silencing every station that can hear either party.

This is why RTS/CTS is not the default everywhere. In a dense deployment where every station hears every other, the handshake adds overhead and buys nothing, because physical carrier sense already prevents the collisions it would prevent. In a sparse or oddly shaped deployment — long corridors, warehouses, outdoor point-to-multipoint — the handshake is what makes the network function at all.

There is a cheaper variant used for backwards compatibility. When a network must protect a transmission from stations running an older PHY, the AP can send a CTS to itself, addressed to its own MAC address. The frame reserves the medium for the following exchange without an RTS from anyone, so the announcement costs one frame instead of two. It is a pure announcement, and it protects against stations that would otherwise not understand the modulation of the frame that follows.

Where the mechanism still fails

Three failure modes are worth knowing because they survive the handshake.

The first is a collision between RTS frames. If two stations transmit RTS at the same instant, both are destroyed, and both stations back off by an independent random amount. The handshake reduces the duration of a collision to 20 bytes instead of 1500, but does not eliminate collisions, and under heavy load RTS frames themselves become a significant share of the traffic.

The second is capture. If one signal arrives at the AP much stronger than the other, the receiver may lock onto the stronger one and decode it successfully despite the overlap. The weaker station’s frame is lost, and it will retry with a doubled contention window while the stronger station continues to succeed. Over time the strong station wins a disproportionate share of the medium. This is a physical-layer effect that no MAC-layer reservation prevents.

The third is a reservation that outlives its usefulness. The NAV is set from a header that may itself be corrupt, and a station that decodes a duration field from a damaged frame can defer for a long time on a bogus value. Implementations bound this by only accepting duration values from frames that pass the frame check sequence, and by allowing a station to reset its NAV in defined circumstances, such as after a beacon it can decode announces a different state.

What the handshake implies for everything above it

Because the medium is shared and reservations are announcements rather than enforcement, the throughput of an 802.11 cell depends on how many stations can hear each other, not on how many are associated. Two networks on the same channel in the same room coordinate only through the deference rules, and neither can reserve airtime for a station that is deaf to it.

The remainder of the access procedure, how a station picks the moment to transmit after the medium goes idle and how it recovers from the collisions that remain, is the distributed coordination function described in DCF backoff and the contention window. The frames that carry the reservation are themselves ordinary MAC frames, whose address fields are explained in 802.11 address fields and the distribution system.