1. Wireless Ethernet IEEE 802.11 Standard Overview Dirk Grunwald Assoc. Professor Dept. of Computer Science University of Colorado, Boulder

2. What’s Covered u High level overview of the 802.11 standard l Motivation l Organization l Station Services l MAC-level protocol l Power Saving

3. Resources

4. u IEEE 802 standards group l http://grouper.ieee.org/groups/802/ http://grouper.ieee.org/groups/802/ l 802.11 Specification is ~$450 or so We have some copies

5. Differences Between WLANs and Wired LANs u Obviously, no wires u Data is broadcast through free space, people can snoop u Vagaries of electromagnetic propagation l Signals are not consistent l Multipath and blocking may cause dead spots, even within open areas u Mobility u The problems that mobility brings

6. Problems Of Mobility u Orders of magnitude slower than fixed network u Higher transmission bit error rates (BER) u Uncontrolled cell population u Difficult to ensure Quality of Service (QoS) u Asymmetric duplex bandwidth u Limited communication bandwidth exacerbates the limitation of battery lifetime.

7. Limitations Imposed by Mobility u Lack of mobility-awareness by applications l Inherently transparent programming model (object-, components-oriented, but not aspect-oriented) l Lack of environment test and set API support u Lack of mobility-awareness by the system l network: existing transport protocols are inefficient to use across heterogeneous mix of fixed/wireless networks l session and presentation: inappropriate for the wireless environment and for mobility l operating systems: lack of env. related conditions and signals “you’ve lost your network” l client/server: unless changed, inappropriate and inefficient

8. 802.11 Design u Seemingly complex, but designed to overcome some of the complications of mobility u Components l The station l Access Point (AP) l Wireless medium l Basic Service Set (BSS) l The Distribution System (DS) l Extended Service Set (ESS) l Station and Distribution Services

9. 802.11 Design u Based on 802.2 LLC protocol l Many similarities with other protocols l Allows “seamless bridging” with other protocols using 802.2 LLC protocols u Supports variety of PHY l IRDA l 2.4 Ghz band 2 Mbit/s FHSS (802.11) 1 / 2 / 5.5 / 11 Mbit/s DSSS (802.11b) l 5.4 Ghz band 24, 54 Mbit/s

10. The station u The station is a component that connects to the wireless medium l Consists of MAC and PHY l Generally represented by a network interface card (NIC) u Station can be mobile, portable or stationary u Each station supports station services such as l Authentication l Deauthentication l Privacy l Deliver of Data l Describe later..

11. The Basic Service Set u A BSS is a set of stations that communicate with one another l Does not refer to a physical area / region u If all the stations are mobile and there is no connection to a wired network, the BSS is called an independent BSS or IBSS l Also called “adhoc mode” l IBSS is typically short-lived (“adhoc”)

12. IBSS Organization

13. IBSS / Adhoc Organization u Stations send messages directly to other stations u Only stations within the transmission range are “in the IBSS” u There’s still an association / disassociation service u There is no centralized coordination for transmission

14. Infrastructure BSS (or just BSS) u When a BSS contains an access point, it’s a BSS l Also called “Infrastructure mode”

15. Infrastructure BSS u In Infrastructure mode, each station sends messages only to the access point u The access point redistributes or retransmits the messages l Both on the wireless network and an associated wired network u Stations must associate with an access point and possibly authenticate themselves u The access point can control when stations transmit l Power savings mode only possible when using an access point

16. Extended Service Set (ESS)

17. Extended Service Set u An ESS is a set of infrastructure BSSs where the AP’s communicate amoung themselves to forward traffic from one BSS to another l Allows movement of stations from one BSS to another u The AP’s communicate via a “distribution system” (DS) l DS may be either wired or wireless l E.g., access points can directly form a distribution system or access points can be connected via a wired network u Access points can “hand-off”

18. Extended Service Set (ESS) Router

19. Inter-ESS Coordination u Inter-Access Point Protocol l Not part of 802.11 & no documentation available l But not rocket science – access points know the IP address of different access points. Access points inform other access points when a station associates. Maps are maintained and messages forwarded u Bridging l Must be on same subnet l If a destination is a broadcast or unknown MAC address, the AP sends it to the wired network l AP records MAC for all stations, grabs all frames with those MACs A B

20. Full IEEE 802.11 Architecture

21. Station Services u Authentication – used to prove identity of one station to another u Deauthentication – eliminate previous authorized user from use of network (security revocation) u Privacy – wired equivalent privacy, similar to that of in- wall wiring u Data Delivery – reliable deliver of data frames from one MAC to another, with minimal duplication or reordering

22. Distribution Services u Association – make a logical connection between a mobile station and an access point. Necessary for the distribution system (DS) to know where and how to deliver data. u Reassociation – as above, but includes information on prior association within the same ESS. u Disassociation – forces a node to associate (again) or to inform an AP that it station longer needs service u Distribution – used by AP to determine if frame should go to current BSS or be send to DS (another AP or portal) u Integration – connects 802.11 to other LAN.

23. Association & Authentication u Each station must maintain two state variables for each other station with which it communicates u Each station may be authenticated with many stations at the same time, but is associated with only one at a time. u There are three classes of frame types – the station must respond to certain classes in different connection states.

24. Relationship Between State Variables and Services State 1 Unauthenticated Unassociated State 3 Authenticated Associated State 2 Authenticated Unassociated Successful Authentication Successful Association or Re-association Class 1 Frames Class 1 & 2 Frames Class 1, 2 & 3 Frames Disassociation Notification DeAuthentication Notification I think this should be “associated”, but both text & standard show “authentication”.

25. Messages u IBSS can only be in State 1, and can thus process data messages. u Normally, data transmission only occurs in State 3. u Stations must be able to react to all message classes in each state, but should only initiate certain message classes according to their state.

26. MAC Layer Functions u Provide reliable data delivery l Hidden node & exposed node problem l Solutions u Fairly control access to shared media l Distributed coordination function l Point coordination function u Protect the data that is delivered l WEP

27. Wireless Ethernet Is Not Ethernet u Can typically on transmit or receive at the same time l Use collision avoidance rather than collision detection u Just because I can hear someone talking doesn’t mean I’ll interfere with the receiver l My signal may be so attenuated by the time it hits them there’s no meaningful interference.

28. Hidden Node Problem In CSMA ABC ABC

29. Exposed Node Problem In CSMA ABC D ABC D

30. 802.11 MACA Protocol u Contention reduction l RTS – Request to send l CTS – Clear to send u Reliability l DATA frame l ACK frame u Reliability frames act as a unit – if you see data, you’re not to transmit until ACK is seen. u Likewise, if you see RTS, you must wait out CTS, DATA and ACK

31. 802.11 MA/CA ABCRTS? ABC CTS! ABC DATA ABC ACK

32. 802.11 MA/CA Protocol u Not all frames must use RTS / CTS l Lots of overhead for small messages l Control entry in MIB (mandated by 802.11) sets message above which CTS/RTS is used – dot11RTSThreshold On Aironet driver – See e.g. /proc/aironet/eth1/Config RTSThreshold: 2312 u Frames carry state that let stations determine when a CTS/DATA/ACK has been dropped or missed. u A failure of the frame exchange protocol detected at the source is treated as a “collision”, and a randomized exponential back off is used to delay retransmission.

33. NAV / Virtual Carrier u Unlikely that all nodes can be heard by each other l How do you know how long to wait for a transmit to finish? l Message sender can’t tell you, you can’t here them u Messages contain a Network Allocation Vector (NAV) l Value that indicates how much time remains before the media is availble u Although you don’t hear sender, you do hear receiver l You listen to NAV and know when to try again

34. Timeline of RTS / CTS & NAV

35. Timing Intervals u Collision avoidance is done using timing intervals u Slot time u SIFS – short interframe space u PIFS – priority interframe space l = SIFS + slot time u DIFS – distributed interface space l = PIFS + slot time u EIFS – extended interface space

36. Some IFS Relationships

37. Media Control u Distributed Control Function l Obviously distributed l Uses media access timing & contention u Point Control Function l PC = Point Controller, always located in access point l PCF operates by stations requesting that the PC register them on a polling list l PC then regularly polls the stations for traffic while delivering traffic l Every station is required to be able to respond to operation of PCF.

38. DCF Operations u When MAC gets request to xmit, check of physical and virtual carrier l Medium not in use for interval of DIFS (or EIFS if previous frame had errors), the MAC can begin transmission l If medium is in use MAC will backoff. Backoff count is decremented each time that physical & virtual carrier indicate no carrier for one slot time. Once backoff has expired, MAC begins transmission. If transmission is not successful, collision has occurred.

39. Model of Contention in DCF Mode

40. PCF Operations u PCF uses PIFS, which is shorter than DIFS to “grab hold” of the media for Contention Free Period (CFP) l Competition for media means that CFP may be delayed from ideal start time. Hence only “near isochronous”. u PC gains access to media and broadcasts a “beacon” frame l Transmitted periodically l Stations can request “contention free service” when a poll request is sent l Each station is capable of receiving frames and ack’ing them. u PC uses NAV to hold onto the media for the needed CFP time

41. PC Polling u PC sends a “contention free poll” (CF-Poll) to stations requesting contention-free service l If station has traffic, it may send one frame for each CF-Poll u Can piggy back both ACK and the CF-Poll on data frames during CFP l “PC Can combine CF-Poll and ACK with data frame as well” hence, PC may be sending a frame to one station, along with a CF-Poll and ACK a frame received from an entirely different station.

42. Holding Media in PCF u NAV is primary mechanism to hold media l Announced in Beacon at beginning of CFP u PIFS is secondary mechanism in case some station did not hear Beacon l During CFP, PC assures no interval on medium less than PIFS. l If response not received within SIFS, PC will send frame before PIFS expires u PC announces end of CF period using a CF-End frame l Once NAV is reset, stations compete using DCF

43. Timeline of PCF & DCF Operations

44. Example of PCF Frame Transfer

45. Station Identifiers u SSID is the service set identify l 32 byte “network name” l Zero length “name” is broadcast ( I.e. any network) u BSSID is the Basic Service Set ID l Shorter numeric value, randomly generated

46. Frame Formats u Data to be delivered is the MSDU == MAC Service Data Unit l Converted into MPDU (MAC Protocol Data Unit) for wire u MAC may fragment an MSDU Addr 4 Frame Control Duration or ID Addr 1 Addr 2 Addr 3 2 Seq. Cntl FrameFCS 2666260-23134

47. Frame Control Addr 4 Frame Control Duration or ID Addr 1 Addr 2 Addr 3 2 Seq. Cntl FrameFCS 2666260-23134 Identifies the frame format Protocol Version TypeSubtype To DS From DS More Frags Is Retry? Pwr Mgt More Data WEPOrder If “11”, using wireless DS Station uses to announce power state after this frame. Frame is buffered at AP for station Strictly ordered service requested

48. Fragment bursts get efficient use of media

49. RTS / CTS with Fragmented MSDU

50. Frame Type & Subtype u Management l (re)Assoc/Auth request / response l Probe request / response l Breacon / Announcment Traffic Indication Message u Control l Power save Poll l RTS / CTS / ACK / CF-End u Data l Various combinations of CF, ACK, Poll, etc u Reserved

51. Duration & Addresses Addr 4 Frame Control Duration or ID Addr 1 Addr 2 Addr 3 2 Seq. Cntl FrameFCS 2666260-23134 During Power Save Poll, this contains the ID of a station to retrieve frames Otherwise, it’s the NAV. Magic value (32768) used to mark a CFP. Units not stated? Following address types: Source address – original (“Pre-DS”) source Destination Address – final destination of frame Transmitter Address – only individual allowed Receiver Address – individual / group BSS Identifier – unique ID for BSS. MAC of AP if infrastructure, else local random address. Frames may contain 1,2,3 or 4 addrs. Uses 48bit address. In that, 1 bit individual / group MAC (for multicast) 1 bit is universal / local (who assigns address – IEEE or local) Only used in wireless DS

52. Power Save Poll u PS poll is 20 bytes u Purpose is to request an AP to deliver frames that are queued on the AP while station was in power save mode. u BSSID identifies AP to which poll is directed (should be associated device)

53. Beacon Frames u Transmitted periodically to allow mobile stations to locate and identify a BSS l Allows device to the BSS (in time & PHY) at any time l I.e., sync clocks & select media u Allows conveys info about buffered frames u Frame contains l Timestamp of stations synchronization timer when frame was transmitted l Beacon interval l Capabilities – SSID, supported rates, one or more PHY parameter sets, optional CFP parameter set, optional IBSS parameter set and optional traffic indication map

54. Probe Request / Response u Used to locate a WLAN with a particular SSID or to locate any WLAN at all. u Contains l SSID of requested WLAN l Supported rates u In BSS, AP will always respond to beacon u In IBSS, station that send last beacon will respond u Probe frame contains almost all the same info as a beacon frame

55. Traffic Indication Map (TIM) u May be from 6 to 256 bytes u Carries information about frames that are buffered at AP u AP buffers all multicast when there are any stations operating in low power mode. u DTIM (Delivery TIM) inform mobile stations when multicast frames that have been buffered at AP will be delivered and how often that delivery will occur. Value is in terms of beacon frames u There’s also a bitmask, indexed by an Association ID (AID) that is assigned at Assoc. Used to indicate if station has messages waiting.

56. Security (WEP) u 2 mechanisms u Set of up to 4 default keys shared by all stations l Distributed to all stations u “Key Mapping” relationship with another station l Key mapping lets you create a key used only with a single other station. Not required in standard.

57. Authentication u Normally between station & AP u 2 Mechanisms u “Open System Authentication” l For people who do not use WEP l Authentication always works u “Shared Key Authentication” l Shared WEP key l Uses WEP to encrypt and decrypt a “challenge text” l Mobile station A sends identity assertion to B, B sends text to A, A encrypts, returns to B, B decrypts and returns success / failure. l Only authenticates A to B, not B to A.

58. Hacking Authentication u Rogue could adopt SSID of the ESS u Announce presence through beacon u Stations attempt to authenticate u Rogue always replies with success

59. Association u Association request includes information on the capabilities of a station, etc. u Policies and standards for accepting an association not specified in standard

60. Power Management in IBSS u Power management fully distributed in IBSS u Station enters low power mode turns of receiver and transmitter l Must complete handshake with any other station and set the power mode bit u Station must awake to receive every beacon u Must stay away after the beacon to receive the ATIM (adhoc traffic announcement message window) u Other stations announce frames during that window

61. Sending Frames to Power Managed IBSS u To send, you must estimate power saving state of station (based on last frame) u If you think it’s asleep, you wait until next ATIM period and send an ATIM frame. You can’t xmit until you get ACK on ATIM. u Multicast frames also announced during ATIM u May require several attempts until an ATIM is acknowledged

62. Power Management in IBSS u AP keeps info on power modes of all stations l Much greater power savings u Stations do no wake for every beacon, and can tell AP how many beacon periods they will be in sleep mode u Mobile station must also awake for multicast frames, as specified by AP in DTIM. If you want multicast, you must wake up for every DTIM. u An AP that is a PC will use CFP to deliver buffered frames

63. Synchronization u AP announces time in beacon frame u All stations set to that time. Within a room, it’s close enough to synchronized u In IBSS, station that starts BSS will begin by resetting timer and then transmitting that and setting retransmit time. l This establishes basic beacon

64. Beacon Transmission in IBSS

65. Infrastructure Power Management Operation (no PCF Operating)

66. Power Management in an IBSS Basic Operation