Switch IP Address – Why Do Switches and Access Points Have IP Addresses?

So, first of all, TCP is two-way protocol. If there's data travelling one way, you'll have data travelling the other way as well even if only just for the ACKs. You are correct however, that client MAC doesn't change.

The AP association/reassociation/leaving are quite interesting, and it's actually very chatty before AP and Your host assume they have a 'link up' between each other - sometimes it's 'only' four frames being exchanged, but with more security, it's usually whole discussion taking place over wireless. Take a look here for technical description of the process from 802.11 side: http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116493-technote-technology-00.html

Roaming itself became also quite complex process, with natural push to provide seamless mobility for the host roaming. Take a look at 802.11r if You're interested in the details: https://en.wikipedia.org/wiki/IEEE_802.11r-2008

As put in Cisco Networking for Dummies article on Multiple SSIDs with a Single Access Point (AP) (link)

The Service Set Identifier (SSID) defines what is thought of as the wireless network. So if you have an SSID that is called Apple and your neighbor’s SSID is called Orange, people can connect to either the Apple or Orange wireless network. You would expect that the Apple wireless network is not connected to the same wired network as the Orange wireless network.

So you can mistakenly think of those two SSIDs being associated with different physical networks.

In addition to multiple access points broadcasting or using the same SSID, a single access point can also use multiple SSIDs. Granted, using multiple SSIDs makes sense only if the AP allows you to map each one to a different network connection. This mapping would typically be accomplished through the use of VLAN tagging.

If the user’s device associates with a particular SSID, this traffic is then passed to the network switch destined for a specific VLAN. This switch allows each network to have a different set of security standards surrounding it.

For example, you may have a wireless network, CorpSSID, which uses certificate-based authentication via WPA2 and AES encryption while using the same APs to provide a second wireless network, GuestSSID, which uses only WEP.

Even though you are providing two wireless networks, you can isolate guest traffic from the rest of the corporate network and allow the guest devices to use only some services, such as allowing them through the firewall to get out to the Internet on ports 80 and 443.