Oh. Oh, this is a good one. Settle in.

My cousin calls me in March. "Can you handle the Wi-Fi for the wedding?" she says. Handle the Wi-Fi. Like it's a thing you just handle. Like it's a garden hose you point at a bush. She has no idea. Nobody ever has any idea. And that is honestly beautiful.

The venue: a converted barn in rural Virginia. Gorgeous. Fairy lights, mason jars, exposed timber — the full pastoral aesthetic at full commercial markup. The internet situation: a single DSL line, 12 megabits down, 1.5 up, shared between the venue's point-of-sale system, the security cameras, and two hundred wedding guests who were absolutely going to post every moment of this event to Instagram in real-time whether the infrastructure was ready for them or not. Nature finds a way. So do guests at an open bar.

Now here's where it gets exciting. Any normal person rents a mobile hotspot. Maybe two. Done. But we're not watching a normal person here. We're watching a network engineer in his natural habitat, presented with an underserved RF environment and a two-day window to do something about it. Watch carefully. This is rare.

I arrived two days early with a rental car that I had, and I want to be accurate about this, completely filled. Three Ubiquiti UniFi APs. A managed switch. A pfSense box on a mini-PC. A hundred feet of outdoor-rated Cat6. A Verizon LTE failover unit. Cable ties. Velcro strips. A ladder. And a directional antenna that had been sitting in my gear locker for four months waiting for exactly this kind of opportunity. You always bring the directional antenna. Always. Someday you will understand why.

The venue coordinator came outside to watch me unload. There was a look on her face. The look said: I was told this was a simple Wi-Fi setup. The look asked: why does this man have a ladder. She inquired if I was setting up for a concert. I told her no, just guest connectivity. She did not appear to find this reassuring. I moved on. There was work to do.

Step one: site survey. Always the site survey. You do not simply deploy radio equipment into an unknown RF environment — that's like a wildlife photographer showing up without scouting the habitat first. I walked the entire property with a spectrum analyzer, reading the land. The barn: excellent. Old dry wood, minimal RF absorption, predictable propagation paths. Gorgeous bone structure on this venue, honestly. The catering tent: a metal-framed structure that was going to produce multipath reflections I'd need to account for. And the DJ setup, over in the corner, was going to be throwing interference across the entire 2.4 GHz band once it spun up. I noted this. I planned around it. This is what separates the prepared from the people who spend their wedding reception blaming the venue for bad signal.

Now watch the deployment. Access point one goes on the main ceiling beam — covering the ceremony and primary reception floor, clean line of sight to the dance area, beautiful. Access point two on a post at the catering tent perimeter, angled to serve the outdoor seating without fighting the metal frame for reflection dominance. Access point three behind the bar, and here's the thing about the bar that people always underestimate: the bar is going to have the highest concurrent device density at any wedding reception, full stop. People drink, they get on their phones, it is an immutable law of social physics. You put an AP behind the bar. You always put an AP behind the bar.

Three SSIDs. Guest network: "HappilyEverLANded" — my cousin picked the name, I merely configured it, and I will not apologize for it because the captive portal was genuinely cute. Five megabit per-device cap, fair queuing, social media traffic in its own prioritized lane because uploads were coming whether I liked it or not. Staff and vendor SSID: separate VLAN, higher bandwidth ceiling, photographer gets a dedicated QoS class because she was uploading tethered RAW files to cloud backup in real-time and honestly, respect, that is a professional. The bar's payment terminals get priority above everything else because no one experiences network latency more acutely than a person who just ordered a drink. Third SSID: monitoring only. Hidden. Mine. You'll hear more about this one.

The cellular failover unit was configured to cut over if the DSL line dropped. During the two-day setup window, the DSL line dropped twice. Rural Virginia, ladies and gentlemen. Absolute shit connectivity, but at least she's honest about it.

By the time the guests started arriving, that barn had better network infrastructure than most small-to-medium businesses operating today. Grafana dashboard running on my laptop showing real-time throughput, channel utilization, device counts, and latency. Peak concurrent connections during the ceremony: 187. Average latency across the entire event: 12 milliseconds. DSL failed once during the reception; the LTE failover took over in 800 milliseconds flat. Nobody at that wedding noticed the cutover. Not one person. That 800 milliseconds is a personal record and I have spent time being quietly proud of it at odd moments ever since.

Everything is perfect. Everything is running beautifully. And then the toasts start.

The best man tells a story about the groom getting trapped in a revolving door for six minutes during a work trip to Chicago. It is, objectively, one of the funniest stories I have ever heard told at a wedding, and forty people immediately try to upload video of it simultaneously. The DSL line goes from 60% utilization to 98% in about four seconds. I'm watching the metrics spike on my dashboard like a seismograph reading a very localized earthquake, doing mental bandwidth math, when something on the monitoring SSID catches my eye.

A new device. On the staff VLAN. Not a vendor device. Not one I provisioned. A laptop. And my IDS signature is flagging it for — here it is — network reconnaissance activity. SYN scan pattern. Target: the bar's payment processing terminal.

Some asshole at this wedding is running Nmap against the point-of-sale system. At a wedding. In a goddamn suit. During the toasts.

The MAC address traces to a table near the back. The groom's college roommate. He's just sitting there, jacket on, champagne glass in front of him, completely calm, quietly scanning the venue's payment infrastructure on a network I built and currently have full visibility into. This is actually a little impressive. Wrong, but impressive. The tradecraft is there. The situational awareness is not.

I walked over. I leaned down. I said, quietly, in a register that didn't carry past his immediate personal space: "You're running a SYN scan against the payment terminal from a network I have full packet capture on. That can stop now, or I can explain to the bride why I'm removing someone from her reception." He closed the laptop. He did not look at me again for the rest of the evening. That was fine. The metrics looked great for the rest of the night. Peak concurrent connections: 187. Zero incidents. Zero.

Teardown took two hours the next morning. Every cable coiled and labeled. Every AP bagged. Every mount point left clean. I lost one zip tie above the main beam that I couldn't reach once the ladder was loaded, and it haunts me in a small but specific way.

My cousin sent a thank-you card. It said: "Thanks for the Wi-Fi, you absolute psycho." It's framed on my wall. Next to the CCNP certificate. It is, in many ways, more meaningful.

The venue coordinator called a week later and asked if I did corporate events. I do now.

— gh0stwire, 2026