Quiz Entry - updated: 2026.07.14
What is CAPWAP, what are the two tunnels it creates, and what is the Split-MAC architecture?
CAPWAP (Control And Provisioning of Wireless Access Points) enables a WLC (Wireless LAN Controller) to manage multiple APs (Access Points) via two UDP (User Datagram Protocol) tunnels: control (UDP 5246, encrypted with DTLS — Datagram Transport Layer Security) for management, and data (UDP 5247, optionally encrypted) for client traffic. Split-MAC (Split Media Access Control) divides responsibilities between the AP and the WLC.
* CAPWAP split-MAC: AP RF, WLC control. *
* The two CAPWAP tunnels (5246 control, 5247 data). *
CAPWAP basics:
- IEEE (Institute of Electrical and Electronics Engineers) standard protocol — based on LWAPP (Lightweight Access Point Protocol) plus DTLS security
- Creates encrypted tunnels between each AP and the WLC
- Works over both IPv4 (IP — Internet Protocol — protocol 17) and IPv6 (IP protocol 136)
The two CAPWAP tunnels:
| Tunnel | UDP Port | Encryption | Carries |
|---|---|---|---|
| Control | 5246 | DTLS (always on) | Management: config, firmware, AP status |
| Data | 5247 | DTLS (off by default, requires license) | Client traffic between AP and WLC |
Split-MAC architecture — who does what:
| AP Handles (real-time) | WLC Handles (centralized) |
|---|---|
| Beacons and probe responses | Authentication |
| Packet acknowledgments and retransmissions | Association and re-association (roaming) |
| Frame queuing and prioritization | Security policy enforcement |
| MAC (Media Access Control) layer data encryption/decryption | RF (Radio Frequency) management (channel, power) |
| QoS (Quality of Service) policies | |
| Firmware updates |
DTLS encryption:
- Control channel: DTLS enabled by default — management traffic is always encrypted
- Data channel: DTLS disabled by default — requires a special license to enable
- This means by default, client data travels unencrypted in the CAPWAP tunnel (but is still encrypted by WPA2 — Wi-Fi Protected Access 2 — at the wireless layer)
Go deeper:
RFC 5415 — CAPWAP Protocol Specification (IETF — Internet Engineering Task Force) — canonical spec: control/data channels and the Split-MAC encapsulation of 802.11 frames between the WTP (Wireless Termination Point, the AP) and the AC (Access Controller, the WLC).