Network
Does security cost performance on the arena LAN?
Network: does security cost performance?
Link-layer WPA2 is effectively free. ESP32-C6 and the AP do AES in
hardware — sub-microsecond per packet, a few bytes overhead. It adds no
meaningful latency to 60 Hz UDP. Keep it on: an open SSID lets nearby
devices steal airtime (contention/DoS), which does hurt latency.
Avoid application-layer TLS on the firehose. mbedTLS handshakes +
per-packet MAC cost ESP32 CPU and latency, and are pointless on a trusted
VLAN. Decision 2 means skip app-layer auth/TLS — not skip WPA2.
Net: VLAN + WPA2 + plain UDP/WS inside
= the target closed boundary at the venue, with no meaningful performance drop.
Not there yet: the current dev deployment still exposes public ports
(RISK_AUDIT.md S1) — closing them is the Phase 1 exit. The real WiFi risk is
2.4 GHz airtime (ESP32-C6 is 2.4 GHz only): clean channel, WMM/QoS voice
priority, power-save off, wired backbone, dual-AP split if 16 wands saturate.
Device setup is off the game plane. Wands and anchors expose a local
HTTP admin UI (
/) for WiFi and gateway URL. In the field, connect
to the device’s temporary setup AP (LaserWands-Setup-XXXX) — no
need to be on arena WiFi first. Factory reset reboots into the same flow.