Cisco Aironet 4800

Cisco · ceiling-mount access point with a third radio · AIR-AP4800

what it is

An 802.11ac Wave 2 access point that, besides two serving radios, has a third radio dedicated solely to listening plus a separate BLE radio and an antenna array for locating devices.

The enclosure is rectangular, not square: 220 × 251 mm and 73 mm thick, weighing 2.5 kg. Antennas are internal only — the manufacturer does not offer an external-antenna variant, which is why the part number has no i or e letter.

Why a third radio. An ordinary access point reports what it hears on its own operating channel — because on the others it is either transmitting or not listening. A radio dedicated to listening scans the band independently of the other two, so it sees interference and foreign networks also on channels where none of our own access points operate. That is the difference between "there is a problem on channel 44" and "we know which channel is free".

The controller describes this radio as a "Receive Only Radio" in the monitor role. Spectrum analysis then covers 28 channels — 13 in the 2.4 GHz band and 15 in 5 GHz, including DFS channels — without switching the whole access point into monitor mode and without taking the other radios away from clients.

Connections as in the 3800 series: an mGig 100/1000/2500/5000 Mb/s port, an auxiliary port, console port, USB and a 48 V power jack. Powered via PoE+, drawing up to 31 W with full functionality.

A power-planning pitfall that the manufacturer states outright: on older 802.3af power (15.4 W) the device will come up, but in a reduced mode. The symptom is then the worst possible — the hardware works, just worse, and nothing reports the lack of power.

Watch the part number — and this is the most important thing on this page. The second-to-last segment is the regulatory domain, i.e. the country; for Poland the correct one is -E. The domain is assigned to each radio separately, not to the device as a whole — and that is where the pitfall lies.

A radio in the wrong domain does not transmit at all. A unit AIR-AP4800-K-K9 under a controller set to Poland reports its 5 GHz radio as enabled but non-operational, with transmit power 0 dBm. The controller rejects every attempt to configure that radio — including an attempt to disable it. The 2.4 GHz radio has a matching domain and works normally, so the device looks healthy and serves clients.

Reception still works: the third radio also listens in the 5 GHz band, because the block applies to transmitting. A -K unit is therefore a weak access point and a good spectrum sensor.

It is not suitable for a wireless bridge (mesh), and this is not a setting waiting to be found. Bridge mode requires manual 5 GHz radio settings that the controller will not accept; moving the bridge to 2.4 GHz is allowed only for the root access point of the bridge; and the root role is given only to an access point already running in bridge mode. The chain closes in a circle.

The domain letter is on the enclosure label and on the box — when buying hardware on the secondary market it is worth looking at it before the price.

what we read from it

Everything we read from the other Cisco access points, plus three layers they do not have.

The common set:

• Channel utilization separately on 2.4 and 5 GHz, broken down into transmit and receive, noise floor, operating channel and transmit power with whether they are set automatically.
• Radio neighbors, radar events and DFS channel changes.
• Coverage, interference, load and noise ratings issued by the controller.
• Link state, frame and CRC errors, uptime of the tunnel to the controller, number of clients.

What the third radio adds:

• Air quality rating separately in each band — a single number telling how much of the band is eaten by interference, including interference that is not Wi-Fi.
• Number of detected interference sources in each band.

What the controller role adds, when the device performs it:

• Rogue access points: how many are visible, how many have their own clients and how strong the strongest signal is. This is the basis for discussing whether someone has placed a rogue access point on the network.
• Wireless intrusion detection events — access point impersonation, management frame protection, signature match counters.
• Authentication statistics: accepts, rejects and the number of servers that respond. A sudden rise in rejects shows up here earlier than in user reports.
• Client signal quality in aggregate: average and worst signal level, signal-to-noise ratio, lowest data rate, number of devices in the process of joining and number of excluded ones.
• Radio automation decisions — when channels and when power levels were last recalculated.
• CPU and memory load, clock synchronization and reboot reason.
• Number of crash files. Inconspicuous, yet it tells directly whether the device has been quietly crashing.

port layout

The visible face has no ports at all — only one status indicator, roughly at mid-width and slightly below mid-height.

All connections are on the narrow edge, in order from the left: security cable slot, console port, USB port, auxiliary port, main mGig port, cable guide clip and 48 V power jack. The layout is the same as in the 3800 series — the positions of all seven elements differ by at most one percentage point of the enclosure width.

what to watch out for

• An access point rejected by the controller still listens. A unit that fails to finish joining because of a mismatched domain can be the loudest detector of foreign networks. The number of access points reporting observations then diverges from the list of joined access points — and this is not an error.
• The aggregate rogue access point list does not give the network name (SSID). The name and encryption are returned only by a detailed query — one per rogue access point.

what we cannot read

• Temperature — the device does not expose it.
• Device location results. The antenna array is in the hardware, but location is a separate system, not a reading from the access point.
• A list of clients with names — aggregate statistics are visible, not a roster of people.

full parameter list

A full parameter list for this model is not here yet — the ones described above are those we have read and verified. A missing list does not mean the device exposes nothing more.