QUICK SURF NETWORK
Unleashing Digital Excellence
Marlowe Estate · Independent Audit
32 Access Points.
Fourteen Rooms With No Usable Signal.
14 Cold Rooms
Zero VLANs
IDS/IPS Off
15 of 30 Radios on Ch 6
Double NAT
Spectrum Fixed Free of Charge
Rebuilt to a Segmented Design
QSN was engaged to survey a large private villa where the family had persistent Wi-Fi complaints despite a substantial existing installation. This is not a QSN deployment — it was designed and installed by a third party, and we were called in only to measure it. Over a single visit we walked all four levels on the approved shop drawings, recorded live radio measurements point-by-point, and rendered the results as heat maps. The finding was blunt: there are not enough access points, and they are in the wrong places. Thirty-two units are installed, yet only nine to twelve reach usable strength on any floor — the rest are weak signals bleeding through slabs from other levels, adding interference rather than coverage. This case study documents what measurement revealed that a device count could not.
32
APs Installed
30 ONLINE · 2 REMOVED
9–12
APs Actually Usable
PER FLOOR · ≥−67 dBm
14
Cold-Spot Rooms
ACROSS 4 LEVELS
0
VLANs Configured
ONE FLAT /23
15/30
Radios on Channel 6
2.4 GHz CONTENTION
110
Client Devices
ONE BROADCAST DOMAIN
🗄
Companion · Interactive Model
Inside the 37U Core Rack — Interactive 3D
The main network cabinet QSN built at the estate, modelled device by device at its real U position. Orbit it, zoom in and pull it apart — gateway, 10 GbE aggregation core, access switching, online UPS and rear power distribution, with elevations and the full bill of materials.
Open the 3D rack →
Method — What a Measured Survey Actually Involves
01
Walked all four levels
Basement, Ground, First and Roof each surveyed on the approved shop drawings, recording live radio measurements at every survey point — not estimated from a floor plan.
02
Measured what devices see
The survey records signal from the villa’s own access points and every neighbouring network in range — the same radio environment the family’s phones and consoles actually experience.
03
Rendered heat maps
Readings interpolated into colour maps so coverage, interference and dead zones are visible at a glance rather than buried in tables.
04
Compared against the design
Results checked against the approved shop drawings that define where access points were meant to be installed — separating design failure from installation failure.
The Yardstick — What “Good” Means in dBm
Signal Strength Bands
−67 dBm is the accepted design minimum
−30 to −50
Excellent · beside an AP
−50 to −60
Very good · 4K & gaming
−60 to −67
Good · design minimum
−67 to −75
Weak · calls stutter
Below −75
Poor · drops & hunting
Why the maps looked healthy and the villa did not
Signal peaks strongly right beside each access point, which makes a heat map look convincing at first glance. Away from those points the level falls into the marginal band across most of the floor area, and fourteen rooms fall to cold-spot level. Each floor hears 22–25 access points, but only 9–12 reach usable strength — the remainder are weak signals bleeding through concrete slabs from other floors. They add interference, not coverage.
Floor by Floor — Audible vs Usable
Cold spots in the games room, kitchen and treatment room. The games room is the highest-demand space in the villa and currently the worst served. Coverage concentrates around circulation areas rather than occupied rooms.
Best-served level, yet still only 12 of 25 audible APs are usable. Cold spots across the office, pantry, service kitchen and store. The service wing falls away as a continuous weak band. The drawing itself already proposed a repeater there — the gap was known before we arrived.
Highest peak reading in the villa sits beside the widest marginal area — strong at the AP, weak in the rooms. Six cold rooms including the principal bedroom suite, three bathrooms and a child’s bedroom. The suite is served by legacy radio modes: a capability gap on top of a coverage gap.
Weakest level overall — only 3 access points reach −60 dBm or better. Cold spot confirmed in the roof lounge. Coverage is delivered mainly by spill-over from the floor below rather than by dedicated roof units. Thinnest provision in the building.
Cold Zones — Fourteen Rooms Below Usable Level
Where the Network Simply Isn’t
Confirmed by measurement, not by complaint
Games room · Kitchen · Treatment room
Office · Pantry / charging room · Service kitchen · Store
Principal bedroom · Two en-suite bathrooms · Guest bathroom · Child’s bedroom · Dressing room
These are not marginal readings
Bathrooms, dressing rooms and service areas sit behind tiled walls and stone that absorb signal heavily, and none has a nearby access point. Several adjoin one another — the principal bedroom, its bathroom and the dressing room form a single zone — so one correctly placed unit can serve a group. The number of access points required follows from a predictive design, not from counting rooms. That distinction is the entire difference between engineering a network and buying hardware.
Second Problem — Channel Planning
Radios Queuing for the Same Airtime
Separate from coverage · layered on top of it
!2.4 GHz · 15 of 30 radios on channel 6
CONTENTION!5 GHz · 21 of 30 radios packed into 149–161
CROWDED!DFS range 100–144 · carrying only 2 radios
UNUSED!6 GHz · capable hardware, no traffic observed
IDLE
Why this compounds the coverage problem
2.4 GHz has only three non-overlapping channels. With half the villa’s radios sitting on channel 6 they queue for the same airtime instead of working in parallel — adding access points on a saturated channel reduces total throughput rather than increasing it. Meanwhile a large block of clean DFS spectrum sat idle, and four 6 GHz-capable access points were carrying no 6 GHz traffic at all. The estate had already paid for capability it was not using.
Hardware Audit — Four Generations in One Estate
3
Switches
48G / 48-PoE / 24-PoE
Seven of thirty-two units are two standards behind
Five mesh nodes and two legacy access points remain from an earlier generation. Mesh units in particular indicate wireless backhaul patching where structured cabling should have been run — each mesh hop halves available throughput and adds latency. The controller itself displays an advisory that AP deployment density may need improvement: the platform was flagging the problem before anyone measured it.
Configuration Audit — What Was Never Set Up
Controller Configuration State
Capable platform · largely default configuration
×Network segmentation (VLANs)
NONE · ONE FLAT /23×Firewall rules / ACLs
ZERO CONFIGURED×Traffic rules & QoS policy
NONE×Intrusion detection / prevention
OFF×Threat management tier
FREE TIER×Honeypot / deception
NOT DEPLOYED×Zone-based firewall upgrade
PROMPT UNACTIONED×VPN (remote access or site-to-site)
NONE×Self-healing safeguards (SafeOps)
DISABLED · ENABLED BY QSN✓Firmware currency · gateway & APs
UP TO DATE
The Flat Network — Everything on One Wire
One Subnet, 110 Devices, No Boundaries
Cameras · automation · access control · guests
1
Network Total
DEFAULT ONLY
/23
Single Subnet
151 ACTIVE LEASES
32+
Cameras Sharing It
NVR ON SAME DOMAIN
130–190
Mbps Camera Load
CONTINUOUS · 24/7
0
Arbitrating Policies
NO QoS · NO ACL
What sharing one broadcast domain actually means here
Surveillance cameras, the NVR, door-access controllers, home-automation processors, smart appliances, the family’s phones and every guest device sit on the same flat network with nothing between them. Roughly 130–190 Mbps of continuous camera traffic shares the same broadcast domain as gaming and video uploads, and no QoS policy exists to arbitrate. More seriously, a single compromised device — a camera, a smart plug, a guest laptop — has an unobstructed path to every other device on the estate, including access control. Segmentation is the highest-value change available after coverage, and it costs configuration time rather than hardware.
The Circuit — Not the Bottleneck, Still Constrained
Fibre Service Performance
Measured at the gateway
✓Circuit performing to subscribed plan
VERIFIED✓Monthly volume well within plan
HEADROOM OK!Upload is the scarce resource, unmanaged
NO QoS×Upstream NAT detected on WAN · double NAT
STRICT NAT
The circuit was never the problem — and that matters
Households in this situation are routinely sold a bigger internet package. Measurement showed the line delivering to plan, which redirects the money to where the fault actually is. Two constraints remain either side of it: the gateway sits behind a second layer of NAT, a well-known cause of strict NAT types in gaming, failed peer connections and awkward remote access; and with no traffic prioritisation, a single large upload or backup can starve gaming latency with nothing to arbitrate between them.
Immediate Action — Applied Remotely, At No Charge
5 GHz
BEFORE
Radios concentrated in the upper band; the wide DFS range largely idle.
AFTER
Redistributed across the full range, DFS now carrying traffic. Interference at or below 3%, airtime at or below 4.8%.
6 GHz
BEFORE
No 6 GHz activity observed despite capable hardware already on site.
AFTER
Brought into service on all four capable access points at 320 MHz width, opening clean spectrum for modern devices.
2.4 GHz
BEFORE
Half the radios sharing a single channel.
AFTER
Redistributed across channels 1, 6 and 11. Congestion reduced but still high — the band cannot be reduced further until coverage improves.
SSID Bands
BEFORE
The network carrying the most clients was limited to 2.4 GHz alone.
AFTER
Extended to 5 and 6 GHz, giving the largest client group access to the faster, quieter bands.
Why we did work that was outside the agreed scope
Spectrum optimisation sat outside the survey engagement, but it was the one improvement available without hardware, cost or disruption, so QSN applied it remotely at no charge. The 2.4 GHz band remains congested because the number of radios sharing it is itself the constraint — that is addressed by the coverage work, not by channel planning alone. A survey that ends at a list of problems is half a job.
The 2.4 GHz Catch-22 — Why Sequence Matters
01
Done · configuration only
Applied remotely
Main network extended to 5 and 6 GHz so capable devices have somewhere better to go. Channel width confirmed at 20 MHz. Power and radio count deliberately left untouched.
02
Next · add the access points
Hardware
New units serve the cold zones on 5 and 6 GHz. Devices in those rooms stop depending on 2.4 GHz to reach the network at all. This is the step that makes the final column safe.
03
Then · shrink the 2.4 GHz footprint
Tuning
Lower transmit power and switch off surplus 2.4 GHz radios, keeping roughly 8–10 of 30. Disable legacy data rates, enable band steering with a minimum signal threshold.
The trap that catches most remediation attempts
2.4 GHz passes through walls better than 5 or 6 GHz. With coverage currently thin, it is doing real work — carrying devices in rooms the higher bands cannot reach. Reducing its power or switching radios off today would disconnect those devices. The congestion is genuine, but the cure has to come after the coverage, not before it. Getting this order wrong is how a well-intentioned optimisation makes a network worse.
Summary of Findings — Ranked by Impact
01
Fourteen rooms with cold spots
Games room, principal bedroom, offices and several bathrooms and service rooms fall below usable level.
02
Coverage thin despite 32 access points
Only 9–12 APs reach usable strength on any floor; the controller itself flags deployment density.
03
No network segmentation
One flat /23 with no VLANs, ACLs or QoS — cameras, consoles, automation and guests share everything.
04
Double NAT on the WAN
Upstream NAT detected — a common cause of strict NAT types and peer-to-peer failures in gaming.
05
Ageing access points in the mix
7 of 32 units are previous-generation 802.11ac, limiting the areas they serve.
06
Security features not enabled
Intrusion prevention off, threat management on the free tier, no traffic rules configured.
07
6 GHz now in service
Brought online across all capable access points at 320 MHz following the optimisation.
08
Main network now tri-band
Extended to 5 and 6 GHz, moving the largest client group off the most congested band.
09
Channel planning
Redistributed across all three bands; 5 and 6 GHz now clear, 2.4 GHz improved but still congested.
10
Self-healing safeguards now enabled
SafeOps was switched off at the time of survey. Test & Confirm, Device Auto-Recovery, Auto STP Edge and Data Plane Protection have since been enabled by QSN.
Remediation Path — Phase 1 · Close the Coverage Gaps
A
Add coverage to the cold zones
Primary action
Fourteen rooms measured below usable level. Several adjoin, so a correctly placed unit serves more than one room — the count follows from the design, not the room list.
B
Highest-value spaces first
Priority
The games room and principal suite are the most-used spaces in the household and among the worst served. Address these ahead of service areas.
C
Select AP type per zone
Design-led
Wall-plate units suit bathrooms and closets; higher-gain ceiling units cover open areas. Correct selection keeps the number of added units to the minimum the design actually requires.
D
Replace the 802.11ac units
7 of 32
Five mesh nodes and two legacy access points remain from the earlier generation. Replacing them with current units lifts both coverage and capability.
E
Tune transmit power
Config
The channel plan is now optimised. Power tuning follows once new units are in place, so each covers its own zone rather than bleeding across floors.
Remediation Path — Phase 2 · Structural
F
Wire the high-demand positions
Cat 6A drops
Put consoles, gaming PCs and editing workstations on cable. This removes the highest-value traffic from the airspace entirely.
G
Segment the network
VLANs
Split cameras, IoT, guest and trusted devices onto separate VLANs. No segmentation exists today, making this the highest-value configuration change available.
H
Apply traffic prioritisation
QoS policy
Prioritise gaming latency and creator uploads over bulk transfers and camera backhaul on a constrained upload budget.
I
Verify client distribution
Monitoring
With 6 GHz live and the main network tri-band, confirm over subsequent weeks that capable devices settle onto the higher bands rather than holding on to 2.4 GHz.
J
Resolve the double NAT
With the ISP
Moving the ONT to bridge mode, or obtaining a routable WAN address, removes the strict-NAT problems affecting gaming and remote access.
From Audit to Engineered Network — Before & After
The audit above describes what was found. What follows is what replaced it. Following the survey the estate appointed QSN to design and deliver the network properly — not to add hardware to an existing guess, but to rebuild the design from measurement upward. Every access point position was modelled in a predictive survey against measured wall construction before a single cable was pulled. Every switch port was given a purpose. Every segment was given a boundary, and every boundary a rule. Nothing on the “after” side was estimated, inherited or assumed.
BeforeAS FOUND · AT SURVEY
AfterAS DESIGNED & DELIVERED BY QSN
01 · Network Structure
One flat network. No VLANs.
Every device in the estate — surveillance recorders, automation controllers, staff phones, guests, consoles and printers — shared a single broadcast domain. Any device could reach any other device. Broadcast and multicast noise from more than a hundred clients crossed every port and every radio.
➞
01 · Network Structure
Seven purpose-built segments.
Separate networks for trusted household, staff, automation and IoT, service systems, surveillance, guest access and infrastructure management — each with its own addressing, its own DHCP scope and its own security posture. A compromise or a fault in one segment no longer touches the others.
02 · Firewall Policy
No rules. Allow everything.
The gateway was running its factory posture. No traffic rules, no access control lists, no zone policy and no port-level restrictions existed. With nothing segmented there was also nothing to write a rule between.
➞
02 · Firewall Policy
Zone-based policy matrix.
A full source-to-destination zone matrix governing internal, external, gateway, VPN, guest and DMZ traffic, backed by more than seventy active policies. Surveillance reachable only from the segments authorised to view it; guest traffic explicitly blocked from reaching recorders; printing permitted only on the ports printing actually needs.
03 · Threat Detection
Intrusion prevention switched off.
Threat management sat on the free tier with intrusion prevention disabled. No region blocking, no decoy systems and no visibility into what was moving laterally inside the estate.
➞
03 · Threat Detection
Honeypots on every segment.
A decoy host deployed inside all seven networks — any device that begins scanning its own segment reveals itself immediately. Region blocking active in both directions, threat signatures updated daily, and device-and-traffic identification enabled for attribution.
04 · Traffic Prioritisation
No QoS. No shaping.
A backup, a camera stream and a live game were treated identically. On a shared upload budget, bulk transfers were free to starve latency-sensitive traffic — the direct cause of the household’s intermittent lag complaints.
➞
04 · Traffic Prioritisation
Prioritisation policy applied.
Latency-sensitive traffic is explicitly prioritised over bulk transfer and surveillance backhaul, with critical-traffic prioritisation configured at the gateway. Performance under load became a design parameter rather than a matter of luck.
05 · Switching Layer
Unmanaged switches in the path.
Dumb switches were found spliced into the distribution, silently placing everything downstream onto the wrong network. Spanning-tree priorities were left at default, so the root bridge was elected arbitrarily, and two ports were flapping hard enough to drive switch CPU above ninety percent.
➞
05 · Switching Layer
Managed end to end. Every port profiled.
Every unmanaged unit replaced with a managed, PoE-capable switch, homed to a deliberate aggregation core over 10 GbE. Spanning-tree priorities set explicitly so the root is chosen by design, and every single port carries the VLAN profile its device requires — no port is left to default.
06 · Management Plane
Infrastructure on the user network.
Access points, switches and the gateway were addressed on the same network as tablets, televisions and guests. Anyone on the Wi-Fi could reach the management interface of the estate’s own infrastructure.
➞
06 · Management Plane
Dedicated, tagged management network.
All infrastructure migrated onto an isolated management segment, carried tagged across the trunks and unreachable from user networks. Because multiple contractors work in a building of this kind, the migration used per-device overrides with automatic rollback — no device could be stranded by a mistake.
07 · Wi-Fi Design
32 access points. 14 cold rooms.
Units were placed without a predictive design — density where it was easy to cable, nothing where it was hard. Only nine to twelve reached usable strength on any floor; the rest bled weakly through slabs, adding interference instead of coverage. Half the 2.4 GHz radios sat on one channel.
➞
07 · Wi-Fi Design
49 modelled positions. Zero cold rooms.
A predictive survey built from the architectural set and measured wall construction determined every position, every access-point type and every transmit power before installation. Indoor, outdoor and roof areas all modelled. Wall-plate units where rooms are small, higher-gain ceiling units across open spans — the count follows the design, never the other way round.
08 · Hardware Generation
Four generations in one estate.
Seven of thirty-two units were previous-generation 802.11ac, including mesh nodes implying wireless backhaul in positions where structured cable should always have run. Mixed generations meant unpredictable roaming and inconsistent client behaviour.
➞
08 · Hardware Generation
Single current generation. Wired backhaul.
Every 802.11ac unit removed from the estate and every access point fed by its own structured cable — no wireless backhaul anywhere. Serviceable units recovered from replaced positions were re-adopted, verified and reused rather than scrapped, keeping procurement to what the design genuinely required.
09 · Cabling
Unknown, untested, unlabelled.
No test records existed for any run. Several cables were live with no identifiable device on the other end, one port was physically damaged, and suspect runs could not be traced on a finished estate without opening ceilings.
➞
09 · Cabling
Cat 6A solid copper. Every run certified.
Full solid-copper Cat 6A throughout — no copper-clad aluminium anywhere in the estate. Every run pulled to a schedule, terminated, labelled and tested end to end with records issued as a condition of handover. Suspect legacy runs were replaced outright rather than trusted.
10 · Resilience & Recovery
Self-healing safeguards disabled.
Automatic recovery, configuration rollback and edge-port protection were all switched off. A misconfiguration or an unresponsive unit required someone to drive to site. No remote access existed at all.
➞
10 · Resilience & Recovery
Full safeguard suite plus secure remote access.
Configuration test-and-confirm, management VLAN rollback, device auto-recovery, power-port sequencing, edge-port protection, data-plane protection and link debounce all enabled. A VPN service was stood up so the estate can be supported without a site visit.
11 · Verification
None. Nobody had measured anything.
The installation had never been surveyed, before or after. Performance was assessed entirely by complaint — which is why thirty-two access points could coexist with fourteen unusable rooms for years without anyone being able to say why.
➞
11 · Verification
Re-surveyed. Fourteen cold rooms to none.
Every level and the grounds were re-walked on the identical measurement points, with the property clear of other trades so the readings reflect the finished environment. The interior after-maps are plotted on the same tightened scale the predictive design was modelled on, so design and result read directly against each other. Proven against a like-for-like baseline, not asserted.
7
Segments Live
FROM ONE FLAT NETWORK
70+
Firewall Policies
FROM ZERO
7
Honeypots Deployed
ONE PER SEGMENT
49
Modelled AP Positions
PREDICTIVE, NOT GUESSED
0
Unmanaged Switches
EVERY PORT PROFILED
100%
Cat 6A Solid Copper
EVERY RUN TESTED
Reading the Exterior Result — Why It Is Not Plotted Like the Interior
The four interior levels are a like-for-like pair: same points, same instrument, same plotting scale. The grounds are not, and the difference is stated rather than smoothed over.
Different Plotting Floor
The exterior before-map floors at −60 dBm and the after-map at −70 dBm. The after plot therefore renders a band of low signal the before plot could not show at all. The two exterior maps are read individually, not overlaid.
A Floor, Not a Verdict
The exterior baseline was walked with only two outdoor units connected, the remainder having been removed during remodelling. It records what the grounds actually delivered on the day — it is not an assessment of an exterior design, because no exterior design had been surveyed.
Free-Space Physics, Not Wall Loss
Indoors the limiting factor is attenuation through slabs and partitions over short spans. Outdoors it is distance and free-space path loss across driveway, pool deck and perimeter, with the building itself acting as the obstruction. Coverage falls off on a different curve, so the same dBm figure does not carry the same meaning in both environments.
Interpolated, Not Measured
The cooler band across the centre of the exterior map lies over the building footprint, which carries no exterior survey points. That area is interpolated between perimeter readings and must not be read as a measured exterior result.
Stated plainly: the exterior improvement is real and measured at the walked points — the grounds moved from the weakest band across their entirety to the top of the scale including the boundary line — but it is presented as two independent measured walks rather than a matched pair, because the plotting floors differ. Where a comparison cannot be made like for like, we say so instead of presenting it as one.
How QSN Designs — Measured, Modelled, Then Built
01
Measure
Walk the building and record real radio behaviour point by point. Audit the live configuration, not the specification sheet. Nothing is assumed from a device count.
02
Model
Build the property in survey software from the architectural set and measured wall construction, then model coverage per position, per band and per access-point type.
03
Design
Segments, addressing, firewall zones, QoS and port profiles are drawn on paper and issued before anything is configured. Cable schedules follow the design.
04
Build
Cat 6A solid copper, managed switching, tested and labelled runs, staged cutover with a rollback window. Every port profiled, every device documented.
05
Verify
Re-survey on the original measurement points and compare like for like. If it cannot be shown on a chart against the baseline, it is not claimed.
Why the Cable Specification Is Not Negotiable
A network is only ever as good as the copper underneath it. QSN specifies Cat 6 or Cat 6A solid, full-copper cable on every installation — never copper-clad aluminium, which fails under PoE load, runs hot, breaks at the termination and will pass a cheap continuity check while quietly limiting a link for the life of the building. Access points, cameras and PoE switches all draw power through that conductor. On this estate every run was pulled to a published schedule, terminated by our own engineers where third-party terminations could not meet the standard, labelled, and certified end to end with the test records handed over as a condition of acceptance. Suspect legacy runs were not investigated and hoped over — they were replaced.
Cat 6 / 6A Solid Copper
No CCA — Ever
PoE++ Headroom By Design
Every Run Labelled
Certified Test Records Issued
What This Engagement Delivered
4
Levels Surveyed
POINT-BY-POINT · ONE VISIT
14
Cold Rooms Mapped
LOCATED, NOT GUESSED
3
Bands Re-planned
APPLIED AT NO CHARGE
14→0
Cold Rooms Remaining
RE-MEASURED, NOT CLAIMED
The estate arrived at QSN with a familiar complaint: “we have thirty-two access points and the Wi-Fi still doesn’t work.” Measurement showed why — the units were installed without a predictive design, so signal peaks at each access point and falls into the marginal band across the rooms people actually occupy. On top of that sat a channel plan that had never been set, a flat network with no segmentation, and security features that were available but switched off. We fixed everything that could be fixed in configuration, free of charge and outside the agreed scope, and then designed and built the replacement from that evidence — segmented, firewalled, prioritised, managed end to end, and re-cabled in full-copper Cat 6A. Every level and the grounds have since been re-walked on the identical survey points with the site clear of other trades. Fourteen rooms measured below usable level at audit. None remain.
Critical Finding
High
Medium
Addressed by QSN
Measured Value
Structural Recommendation
This case study documents an independent survey of an existing third-party installation. The client, property and installing contractor are not identified; the site name, room labels, network names and all addressing have been changed or withheld. Figures are taken from a single-visit active radio survey and the live controller at the time of assessment. Published for educational purposes as an illustration of survey methodology and common design failures in large residential deployments.
