Submission doc.: IEEE 11-11/1414r2 November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 1 Probe Request and Response in TGai Date: Authors:

Submission doc.: IEEE 11-11/1414r2 November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 2 Abstract This document describes a technical proposal for TGai which addresses the following phase. AP Discovery

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 3 Conformance w/ TGai PAR & 5C Conformance QuestionResponse Does the proposal degrade the security offered by Robust Security Network Association (RSNA) already defined in ? No Does the proposal change the MAC SAP interface?No Does the proposal require or introduce a change to the architecture?No Does the proposal introduce a change in the channel access mechanism?No Does the proposal introduce a change in the PHY?No Which of the following link set-up phases is addressed by the proposal? (1) AP Discovery (2) Network Discovery (3) Link (re-)establishment / exchange of security related messages (4) Higher layer aspects, e.g. IP address assignment 1

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 4 Time occupied situation in the real case was presented in Doc /1413r0. The time occupied rate will become higher and higher because of Smartphone increasing. Thus, we have to consider reducing needless packet exchanges which occur packet collisions and bigger latency in order to obtain the FILS advantages effectively. Background

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 5 Probe Request / Response In order to search the surrounding APs, a STA receives Beacon and transmit Probe Request in Broadcast. APs transmit Probe Response for responding received Probe Requests in unicast. AP1STAAP2AP3AP4 Probe Request (wildcard) Probe Response

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 6 Example of Probe Request This STA transmits multiple “Probe Request” about every 15 seconds. 5 Probe Requests were observed around time stamp of 104 seconds. * Source MAC address was modified. NoTimesourcedestinationInfo :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2207, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2208, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2209, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2210, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2211, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2212, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2229, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2231, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2232, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2233, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2251, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2252, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2253, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2254, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2255, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2273, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2274, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2275, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2276, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2277, FN=0, Flags= C, SSID=Broadcast :XX:bc:bc:a3:X X BroadcastProbe Request, SN=2278, FN=0, Flags= C, SSID=Broadcast

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 7 Example of Probe Response 3 SSID were responded for probe requests. 26 probe responses were observed for 5 probe requests in Slide 7. NoTime stampsourcedestinationInto Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1983, FN=0, Flags=..m.....C, BI=100, SSID=AAA Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1984, FN=0, Flags=..m.....C, BI=100, SSID=BBB Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1984, FN=0, Flags=..m.R...C, BI=100, SSID=BBB Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1984, FN=0, Flags=..m.R...C, BI=100, SSID=BBB Matsushi_c5:XX:c6 48:XX:bc:bc:XX:2 b Probe Response, SN=1985, FN=0, Flags= C, BI=100, SSID=CCC Matsushi_c5:XX:c6 48:XX:bc:bc:XX:2 b Probe Response, SN=1985, FN=0, Flags=....R...C, BI=100, SSID=CCC Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1989, FN=0, Flags=..m.....C, BI=100, SSID=AAA Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1990, FN=0, Flags=..m.....C, BI=100, SSID=BBB Matsushi_c5:XX:c6 48:XX:bc:bc:XX:2 b Probe Response, SN=1991, FN=0, Flags= C, BI=100, SSID=CCC Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1992, FN=0, Flags=..m.....C, BI=100, SSID=AAA Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1992, FN=0, Flags=..m.R...C, BI=100, SSID=AAA Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1992, FN=0, Flags=..m.R...C, BI=100, SSID=AAA Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1993, FN=0, Flags=..m.....C, BI=100, SSID=BBB Matsushi_c5:XX:c6 48:XX:bc:bc:XX:2 b Probe Response, SN=1994, FN=0, Flags= C, BI=100, SSID=CCC Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1995, FN=0, Flags=..m.....C, BI=100, SSID=AAA Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1995, FN=0, Flags=..m.R...C, BI=100, SSID=AAA Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1995, FN=0, Flags=..m.R...C, BI=100, SSID=AAA Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1995, FN=0, Flags=..m.R...C, BI=100, SSID=AAA Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1996, FN=0, Flags=..m.....C, BI=100, SSID=BBB Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1996, FN=0, Flags=..m.R...C, BI=100, SSID=BBB Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1996, FN=0, Flags=..m.R...C, BI=100, SSID=BBB Matsushi_c5:XX:c1 48:XX:bc:bc:XX:2 b Probe Response, SN=1996, FN=0, Flags=..m.R...C, BI=100, SSID=BBB Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1998, FN=0, Flags=..m.....C, BI=100, SSID=AAA Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1998, FN=0, Flags=..m.R...C, BI=100, SSID=AAA Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1998, FN=0, Flags=..m.R...C, BI=100, SSID=AAA Matsushi_c5:XX:c0 48:XX:bc:bc:XX:2 b Probe Response, SN=1998, FN=0, Flags=..m.R...C, BI=100, SSID=AAA

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 8 Considerations “Probe Request / Response” cause packet flooding even if the STA doesn’t have any connecting capabilities to surrounding APs. Transmitting “Probe Request” every 15 seconds doesn’t help the fast AP discovery. As mentioned in Doc /1413r1, probe responses existed 5 times more than probe requests at that monitored public space. Avoiding needless packets may bring clearer WLAN air circumstances.

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 9 Probe exchanges Assumption-1 If 5 APs are installed in public space, 5 probe responses will be transmitted for a probe request with wildcard SSID. STAAP1AP2AP3AP4AP5 Probe Req. (wildcard SSID) Probe Res. (unicast)

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 10 Probe exchanges Assumption-2 If 5 STAs enter into the same place, 25 probe responses will be transmitted. AP1AP2AP3AP4AP5 STA1STA2STA3STA4STA5

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 11 Probe exchanges Assumption-3 What happens when a crowded train enter into the same place? AP1AP2AP3AP4AP5 STA How many probes will be exchanged???

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 12 Why not use Beacons for AP discovery? Beacon is including the almost same IEs as Probe Response. Beacon is transmitted in every 100 milliseconds. A STA can receive 150 Beacons during transmitting 1 Probe Request, if it would transmit Probe Request in every 15 seconds. It would be sufficient for a STA to discover AP with the target SSID by Beacons. Mobile devices (Smart-phones) are battery consumption critical. So it is preferable for mobile devices not to transmit “Probe Requests”, if possible.

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 13 Is Probe Request with wildcard SSID necessary for AP discovery? Why so? I’m thinking that even Probe Request with a specific target SSID isn’t necessary for AP discovery of public Wi-Fi hotspots. Stealth APs should be discovered by Probe Request/Response exchanges. But it isn’t by Probe Request with wildcard SSID. Open discussion

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 14 I’d like to propose that: TGai compliant STAs shall not use the wildcard SSID in SSID element of “Probe Request”. TGai compliant APs shall not transmit “Probe Response” for “Probe Request” with the wildcard SSID. More TGai compliant devices would be deployed, clearer WLAN circumstances might be realized!! Proposal

Submission doc.: IEEE 11-11/1414r2November 2011 Katsuo Yunoki, KDDI R&D LaboratoriesSlide 15 References doc.: IEEE 11-11/1413r0