Apple - Jiri Brejcha

Wi-Fi capabilities of all iPhone 17 models and Apple N1 wireless chip

Apple has done a excellent job at seamlessly migrating iPhones 17 from Broadcom to its own N1 wireless networking chip. It packs 2×2 Wi‑Fi 7 (based on 802.11be standard), Bluetooth 6 and Thread. Most users have probably not even noticed, have you?

Executing such a significant change takes some serious efforts, so I asked myself:

What has changed? Do iPhones with N1 chip behave differently from iPhones using Broadcom?
Are all the enterprise features supported?
Do Wi-Fi capabilities of standard iPhone 17 model differ from iPhone 17 Pro Max or iPhone Air?
From over-the-air captures, can I tell if an iPhone uses Broadcom or N1 Wi-Fi chip?
Does power saving work the same way?

Let’s see how many of these questions we can answer.

Consistent Wi-Fi capabilities across all iPhone 17 models

All iPhone 17 models use the same Apple N1 chip. Their Wi-Fi capabilities are fully consistent between iPhone 17, iPhone Air, iPhone 17 Pro, and iPhone 17 Pro Max. But how can I be so sure?

I “profiled” all 4 of the new iPhones on each of the 3 Wi-Fi bands.

WLAN Pi Profiler

Profiler is a Python app that runs on WLAN Pi and its Linux-based operating system. It uses a standard client Wi-Fi adapter, simulates an access point, and it broadcast beacon frames. Profiler pretends to be “the most capable access point” supporting all features and amendments.

As soon as a Wi-Fi client (think iPhone) attempts to join the Profiler SSID, Profiler captures all client’s Wi-Fi capabilities.

iPhone 17 Pro Max ready to connect to Profiler SSID

Finally, Profiler generates a client capability report – coming up in the next section. Beyond that, it also saves packet capture of the Association Request sent by the client device for future analysis.

Josh is the engineer, developer, and bright mind behind Profiler. Send him some kudos if you want the tool useful.

The 2.4 GHz band

With Profiler running on WLAN Pi on channel 11, I captured these Apple N1 capabilities. To remind us, all the iPhone 17 generation phones use the same N1 chip, and report the same Wi-Fi capabilities.

No surprises there, which is great! The usual amendments like 802.11k neighbour report, 802.11r Fast Transition, 802.11v, or 802.11w Protected Management Frames are supported.

The adapter runs in 2×2 MIMO mode, and reports maximum transmit power up to 25 dBm. Note that it indicates support for 6 GHz.

Apple N1 Wi-Fi capabilities in 2.4 GHz band

To put what we have captured for N1 into perspective, iPhone 15 Pro supports up to 21 dBm (not that you want it to run at maximum power).

iPhone 15 Pro Wi-Fi capabilities in 2.4 GHz band

The 5 GHz band

Before we dive into 5 GHz and 6 GHz, I should say that I am in the UK, my Profiler uses GB country code, and the iPhone is aware of its location too. Supported channels and transmit power levels will vary depending on which part of the world you are in.

This time we start Profiler on channel 36 and attempt to connect the iPhone to the Profiler SSID. Few seconds later we get a 5 GHz band report.

Apple N1 Wi-Fi capabilities in 5 GHz band

Here is a quick comparison to iPhone 15 Pro using the same channel. How many differences have you noticed?

iPhone 15 Pro Wi-Fi capabilities in 5 GHz band

The 6 GHz band

Since Profiler doesn’t support 6 GHz AP mode, for this test I brought my own Wi-Fi 7 access point.

I used Profiler to capture iPhone’s association request to this AP using this command sudo profiler –noAP -f 5975. What 6 GHz channel is that? Can you tell by the centre frequency? I wrote a little tool called wifichannel for conversion between frequency and channel number.

N1 supports 6 GHz channel width up to 160 MHz (not that you want to use 160 MHz and let alone 320 MHz in enterprise).

Apple N1 Wi-Fi capabilities in 6 GHz band

Let’s compare N1 profile to iPhone 15 Pro and its Wi-Fi 6E Broadcom silicon.

iPhone 15 Pro Wi-Fi capabilities in 6 GHz band

Now, why does N1 show 802.11r as “Not reported”? That’s a Layer 8 problem. I didn’t have Fast Transition enabled on my AP, and when I noticed it was too late 😊 You can spot “802.11r Off” in the screenshot below and the 160 MHz max channel width captured by the AP.

PCAP or it didn’t happen!

As we mentioned, Profiler also saves Association Requests coming sent by the client devices. Here are PCAPs of iPhone 17 Pro Max associating to Profiler SSID in 2.4 GHz, 5 GHz, and 6 GHz bands.

How to tell from a packet capture what Wi-Fi silicon does an iPhone use?

iPhones 15 Pro and 16 include Broadcom vendor tag in their Association Request frames. iPhones 17 do not.

Association Request frame – N1 vs Broadcom

2 Spatial Streams in Low Power mode

I switched iPhone 17 Pro to Low Power mode, and I was curious to see if it behaves the same way as previous generations. It doesn’t!

Unlike previous generations of iPhones which downshift from 2 spatial streams to 1 spatial stream, iPhone 17 Pro keeps using 2 streams even in Low Power mode. This might be a new behaviour, unless it changes in a future release.

I like it! Regardless of its battery level, the iPhone consistently uses 2 spatial streams. No more drift of Wi-Fi client capabilities over time.

Does iPhone 16 support the optional 4096-QAM Wi-Fi 7 feature?

Apple has just published a new and very useful Wi-Fi specification document which answers this question.

What is 4096-QAM?

It is the latest modulation technique that allows the access point and Wi-Fi client to send even more data over the air than ever before. Effectively, it adds 2 new MCS indexes 12 and 13 and unlocks faster data rates.

4096-QAM MCS indexes, credit to http://mcsindex.net

Achieving it is challenging as it requires very high Signal to Noise Radio (SNR) – that’s very strong signal and low noise. So in practical terms, it is only used quite rarely.

For context, with another client device using Intel BE200 Wi-Fi 7 adapter, I hit MCS 12 with SNR about 60-62 dB. In other words, if my noise floor was -95 dBm, my signal would have to be about -35 dBm.

Does iPhone 16 support it then?

According to the above spec sheet, the maximum Extremely High Throughput (EHT) the iPhone can achieve is MCS 11. 4096-QAM only uses MCS indexes 12 and 13. Check the mcsindex.net site.

So, the answer is no, it doesn’t.

Is it a dealbreaker?

From data rate perspective, even without 4096-QAM, and using 160 MHz wide channel, we are talking 2000+Mbps! Obviously depending on how far you are from the access point.

So I personally can’t complain. I value access to the clean 6 GHz spectrum, low latency and low retransmissions rate over maximum throughput.

My WAN link speed of 900 Mbps is my personal bottleneck and I usually don’t transfer huge amounts of data from the phone.

High Tx (transmit) and Rx (receive) rates

On a laptop, I can imagine 4096-QAM to deliver much more value when it comes to performing backups for moving very large software image or video files. Having said that, don’t forget that there is 2.5, 5 or 10 Gigabit Ethernet for that.

Does iPhone 16 support Wi-Fi 7 Multi-Link Operation (MLO)?

iPhone 16 supports tri-band Wi-Fi 7 and Multi-Link Operation (MLO). More specifically, the Enhanced Multilink Single‐Radio (EMLSR) mode. The client connects using 2 different Wi-Fi bands, only actively uses 1 of them and listens on both bands simultaneously. Let’s enable it on an access point and verify that it works.

We have a 320 MHz channel configured on the 6 GHz radio. This is for experimental purposes only. Please use narrower channel in production to avoid adjacent channel interference with other 6 GHz access points.

From client perspective, the iPhone connects using 160 MHz channel width as that is the maximum it supports.

The tri-band SSID is announced in 2.4 GHz, 5 GHz and 6 GHz bands. It is up to the client device to choose the preferred band. MLO-capable Wi-Fi 7 clients can also enable the MLO feature.

Although iPhone 16 supports MLO, the phone itself doesn’t indicate if MLO is active or not. So our only option is to monitor it from the access point’s side. This is a consumer access point and it doesn’t provide a huge amount of detail. I am hoping to retest this with a proper enterprise-grade AP when I can.

Single band at a time

From the Association Request sent by the iPhone to the access point, we can see that it advertises support for only one band at a time.

⏬ Feel free to download the Association Request Wi-Fi frame and dig deeper.

6 GHz and 2.4 GHz EMLSR MLO mode

With the default settings of the TP-Link Deco BE85 Wi-Fi 7 access point in place, the iPhone establishes MLO using 2.4 GHz and 6 GHz. It actively uses 6 GHz. 2.4 GHz is there for backup purposes.

TP-Link Deco app shows MLO using 2.4 GHz and 6 GHz

The iPhone uses its 160 MHz wide channel capability and actively pushes all data using the 6 GHz channel 69 as I am trying to demonstrate below using Oscium WiPry Clarity spectrum analyser. Check the “waterfall diagram” that shows the top 160 MHz of the 320 MHz channel being busy processing the data transmission.

MLO in action with iPhone primarily using 6 GHz band

The 2.4 GHz link just sits there in the background, unused. Using the same method, I verified that there is no spectrum utilisation whatsoever on the 2.4 GHz channel.

5 GHz and 2.4 GHz EMLSR MLO mode

When we change Preferred Wi-Fi Band setting to 5 GHz, the iPhone establishes 5 GHz active MLO link and 2.4 GHz as backup.

6 GHz and 5 GHz EMLSR MLO mode

Now, how do we force MLO using the two modern bands? For the purposes of the demo, I simply disable 2.4 GHz radio on the access point.

The phone establishes 6 GHz active data connection and uses the 5 GHz band as a backup. How can I be so sure? I watched the spectrum and generated nearly 900 Mbps of data over the wireless link. While the 6 GHz channel shows high utilisation, the 5 GHz channel shows no signs of use.

TP-Link Deco app shows 6 GHz and 5 GHz MLO

On the iPhone, we see active channels 69 in the 6 GHz band. That matches what I’ve just seen using the spectrum analyser.

Active 6 GHz channel 69 using max iPhone 16 channel width 160 MHz

How to trigger MLO band change?

Now, I connect the iPhone using 5 GHz channel. I am going to saturate the channel with other client’s traffic. My hope is that high channel utilisation makes the iPhone stop using the 5 GHz channel and switch to the backup 2.4 GHz channel.

And the result? It correctly detected and reported high channel utilisation, but the MLO band change did not happen.

So channel utilisation on its own did not do the trick for me. Perhaps the algorithm penalises and tries to avoid the 2.4 GHz band which is typically in a much worse condition than 5 GHz? Or high channel utilisation must persist for a longer period of time? Time will tell.

What Wi-Fi 7 chip does iPhone 16 use?

As we have learned previously, iPhone 16 supports channel width up to 160 MHz and indeed supports all three 2.4 GHz, 5 GHz and 6 GHz Wi-Fi bands.

What chipset does it use? To find out we are going to enable Personal Hotspot on the iPhone and see what information we can get from the information elements it broadcasts in its beacons.

As we can see here, iPhone 16 uses Broadcom Wi-Fi 7 chip. That’s about the level of detail we can capture from the beacon frames it sends.

Continue reading

Does the iPhone 16 support Multi-Link Operation? Check this blog post.

Does iPhone 16 support 320 MHz channel width in the 6 GHz Wi-Fi band?

All iPhone 16 models support tri-band Wi-Fi 7 as you might have seen here. But what is the maximum channel width they support in the 6 GHz band?

Although my Wi-Fi 7 access point uses 320 MHz wide channel, the maximum 6 GHz channel width iPhone 16 supports is 160 MHz.

Here is the client view of the world.

iOS Wi-Fi Diagnostics profile provides extra information

Spectrum view

I am using Oscium WiPry Clarity 6 GHz spectrum analyser to see the spectrum. When we run a WAN speed tool Speedtest.net (it is not designed to be a Wi-Fi test tool) to generate some traffic here and see how it utilizes the 160 MHz channel.

Outside of that, I also checked the 2.4 GHz channel. There was no activity there. So that proves that only one of the 2 bands involved in MLO is active at a time.

Only the 6 GHz channel is active during data transfer, 2.4 GHz isn’t actively used

Updated: Apple’s iPhone 16 Wi-Fi specification

New documentation is now available directly from Apple. Note that 160 MHz is the maximum channel width for all models.

iPhone 16 Wi-Fi specification published by Apple

You normally won’t use 320 MHz wide channel anyway in Europe

Having said that, at least in Europe, we only have one 320 MHz wide channel available. So by the time you add a second access point you will have to downgrade to 160 MHz channels or narrower. That is to prevent the 2 APs from stepping on each other’s toes and causing adjacent channel interference. No support for 320 MHz channel width on the iPhone is not really a problem.

If you were considering using 320 MHz channels, or if your vendor uses that as a factory default setting, please be a good citizen and don’t.

Does iPhone 16 support 6 GHz Wi-Fi 7 band?

All iPhone 16 models now support Wi-Fi 7 and come with 2×2 MIMO 2-Spatial Stream radio configuration. But Wi-Fi 7 doesn’t make support of 6 GHz band mandatory. So technically there could be Wi-Fi 7 clients that only support 2.4 GHz and 5 GHz.

Do iPhones 16 support all three 2.4 GHz, 5 GHz and 6 GHz Wi-Fi bands?

I tested a standard non-Pro iPhone 16 model.

It indeed supports all three Wi-Fi bands. Here is a proof of iPhone 16 connected to a Wi-Fi 7 access point using 6 GHz channel 69.

iPhone 16 connected using the 6 GHz Wi-Fi band

Using the My Wi-Fi Apple Shortcut we can look into another level of detail. In this case the iPhone is using the 802.11be Wi-Fi 7 standard to communicate with the access point.

iPhone 16 using Wi-Fi 7 802.11be standard

Association Request

As the iPhone associates to the AP, it announces no support for 320 MHz channel width.

⏬ Feel free to download the Association Request Wi-Fi frame and dig deeper.

No support for 320 MHz channel in Association Request

Continue reading

What Wi-Fi 7 chip does it use? Find out here.

Does it support 320 MHz channel width in the 6 GHz band? Let’s find out.

Does it support Multi-Link Operation? Yes, it does!

Apple iOS Shortcut: Install Wi-Fi diagnostics profile to your iPhone the easy way

Apple developed a diagnostics profile that allows you to monitor and troubleshoot Wi-Fi connectivity. Unfortunately, it is only available for 7 days after installation. After that, it get automatically removed. If you are a Wi-Fi professional, that means that you need to reinstall it every few days. Yes, it always disables when you are on site and need it the most :)

Manual installation of the profile – the hard way

Normally, I would google something along the lines of “Apple Wi-Fi diagnostics profile”, eventually I find the right link, log in, search for the iOS Wi-Fi profile on the Apple Developer website, download the profile, go to Settings > General > Profiles section, and I install it from there.

Wi-Fi diagnostics profile for iOS devices

What if there was a little tool that did most of the above for you?

The easy way

I put together a quick “Wi-Fi Profile” Apple Shortcut that removes some of these steps. Install the shortcut on your phone and it will guide you through the diagnostics profile installation every time you need it. It downloads the profile to your iPhone, lets you approve the installation and voilà, you open Wi-Fi settings and get RSSI measurements, channel details, BSSID and other useful info.

How to add the Shortcut to your phone

Download the latest version from my GitHub and follow the video instructions. Save it your home screen and execute it whenever you want to reenable Wi-Fi diagnostics.

See the shortcut in action

More shortcuts, anyone?

I wrote few other Shortcuts. Perhaps you are connected to a someone’s guest network, and would like to see who their access point vendor is? Your iPhone can tell you.

Or you use 2 iPhones and want to get a reminder when your secondary/test phone’s battery drops below 10%?

Apple iOS Shortcut: Remind me to charge my secondary iPhone

Let me give you one more reason why you should explore the Shortcuts framework on your iOS or macOS device.

Remind me to charge my test phone

I mainly use my primary iPhone, but for testing I use an older iPhone running iOS Beta. Up until now, I struggled to keep the test phone charged. Typically I would pull it out of the bag and … you know the rest of this story, right?

I put together this quick but very useful shortcut. Whenever charge level drops below 10 %, the secondary phone will automatically send me an iMessage with a reminder. That’s it. Simple. Useful.

Recharge reminder automatically sent to me via iMessage from the secondary device

How does it work

Simply create a new Shortcut on the secondary iOS device, using the Shortcuts app. Select Send Message action and enter your iMessage details.

Now, in the Automation section, configure the trigger that executes this action. Set it to run whenever battery level drops below 10 %.

Then hit Done.