| CAPWAP Control Channel | RFC 5415 §2 | UDP 5246 | DTLS (mandatory) | Carries all AP management: configuration, firmware, event notifications, station management. Uses reliable transport (ACK mechanism). | WTP-ID, Session-ID, Seq-Number, Message-Type, elements | Control channel always encrypted with DTLS. Certificate or pre-shared key auth. |
| CAPWAP Data Channel | RFC 5415 §2 | UDP 5247 | DTLS (optional) | Carries 802.11 data frames between AP (WTP) and WLC in split-MAC or local-MAC mode. Optional DTLS for data. | 802.11 frame encapsulated in CAPWAP Data header | Many deployments: data channel unencrypted (relies on 802.11 CCMP/GCMP encryption of payload). |
| Discovery (Step 1) | RFC 5415 §9.1 | UDP 5246 broadcast/multicast/unicast | None (pre-DTLS) | WTP sends Discovery-Request to find WLC. WLC responds with Discovery-Response listing capabilities. | Discovery-Request: WTP-Board-Data, WTP-Descriptor, WTP-Frame-Tunnel-Mode
Discovery-Response: AC-Descriptor, AC-Name, CAPWAP-Control-IPv4/6 | Discovery via: broadcast (local subnet), DHCP option 43 (option-code 138), DNS (_capwap._udp.domain), or static config. |
| DTLS Handshake (Step 2) | RFC 4347 DTLS | UDP 5246 | DTLS TLS 1.2 | Establishes encrypted control channel. AP (WTP) authenticates WLC certificate. WLC validates AP cert (or PSK). | TLS ClientHello, ServerHello, Certificate, CertVerify, Finished | AP and WLC exchange X.509 certificates. Certificate pinning common in vendor implementations. |
| Join Request (Step 3) | RFC 5415 §9.2 | UDP 5246 (DTLS) | DTLS | AP sends Join-Request with capabilities. WLC validates and accepts or rejects AP. | Join-Request: Location-Data, WTP-Name, WTP-MAC-Type, WTP-Radio-Info, WTP-Descriptor, Image-ID
Join-Response: Result-Code (0=success), AC-Name, ECN-Support | Join-Response includes Result-Code. Common failure: certificate mismatch, WLC capacity reached, unauthorized WTP serial. |
| Configuration (Step 4) | RFC 5415 §9.3 | UDP 5246 (DTLS) | DTLS | WLC pushes full radio configuration to AP: SSID, channel, power, security, WMM, rates, etc. | Configuration-Status-Request → Configuration-Status-Response
Configuration-Update-Request → Configuration-Update-Response
Includes: 802.11 IE, SSID, WPA-Security, Channel, TxPower, WMM-EDCA | AP applies configuration and reports back. Ongoing Configuration-Update for live changes. |
| Image Download (optional) | RFC 5415 §12 | UDP 5247 (data) | Optional DTLS | WLC pushes new firmware image to AP. AP validates hash and reboots. | Image-Data, Image-Identifier, Initiate-Download
Progress: 0-100%
Image-Download-Request → Image-Data → Reset-Request | Triggered if AP firmware != WLC expected version. Can take 5-15 min. Staged rollout supported. |
| Keep-Alive / Echo | RFC 5415 §9.7 | UDP 5246 (DTLS) | DTLS | AP sends Echo-Request every dot11CAPWAPMaxRetransmit interval. WLC responds with Echo-Response. No response = tunnel failure. | Echo-Request: Timestamp (optional)
Echo-Response: mirrors request | Default interval: 30 s. Failure threshold: 3-5 missed echoes. On failure: AP resets DTLS, restarts discovery. |
| Change-State-Event | RFC 5415 | UDP 5246 (DTLS) | DTLS | AP reports state changes: radio up/down, STA association/disassociation, channel change (DFS). | Change-State-Event-Request: WTP-Event-Info (radio failure, radar detected, etc.) | DFS radar detection triggers Change-State-Event with new channel. WLC may push new channel config. |
| Station Mapping | RFC 5416 §6 | UDP 5246 (DTLS) | DTLS | WLC tracks which STA (by MAC) is associated to which AP and radio. Used for roaming, load balancing. | IEEE-802.11-Station-Session-Entry: STA-MAC, WTP-Radio-Id, BSSID, Session flags | In central-MAC mode, WLC makes all 802.11 decisions. In local-MAC mode, AP handles locally, reports to WLC. |