Black Hat Network Monitoring Exposes Roaming Issues with Wi-Fi 7
The Network Operations Center at Black Hat USA 2026 was a collaborative effort between several enterprise partners to provide top-notch network performance, optimization, and security for attendees. Over 150 Wi-Fi 7 Access Points were deployed on-site, supporting over 20,000 attendees.
A large-scale network like this required monitoring to ensure smooth operation and reliable access to core services like AWS, Azure, and GCP. Cisco and Black Hat deployed bespoke ThousandEyes agents, consisting of more than 30 small network monitors strategically placed around the Mandalay Bay Convention Center and Business Hall.
These devices provided critical insight into performance metrics such as DNS, throughput, and cloud response time through a custom dashboard solution. This enabled the NOC team to proactively address issues before users reported them.
During the final three days of Briefings, one of the ThousandEyes nodes experienced degraded download speeds due to roaming issues. Upon investigation, it was found that the client had made a roaming decision and moved to a different Access Point, causing signal loss.
The bgscan variable on the ThousandEyes agents was set to -70 dBm, which meant that the agent wouldn't roam even when an optimal AP was available within a 24-hour window. To resolve this issue, the threshold was raised from -70 dBm to -65 dBm.