1. Greenfield Mode and DFS
September 2006
doc.: IEEE /1458r0
March 2007
Greenfield Mode and DFS
Date:
Authors: Brett Douglas, Greg Corsetto and Doug Chan
Notice: This document has been prepared to assist IEEE It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein.
Release: The contributor grants a free, irrevocable license to the IEEE to incorporate material contained in this contribution, and any modifications thereof, in the creation of an IEEE Standards publication; to copyright in the IEEE’s name any IEEE Standards publication even though it may include portions of this contribution; and at the IEEE’s sole discretion to permit others to reproduce in whole or in part the resulting IEEE Standards publication. The contributor also acknowledges and accepts that this contribution may be made public by IEEE
Patent Policy and Procedures: The contributor is familiar with the IEEE 802 Patent Policy and Procedures < ieee802.org/guides/bylaws/sb-bylaws.pdf>, including the statement "IEEE standards may include the known use of patent(s), including patent applications, provided the IEEE receives assurance from the patent holder or applicant with respect to patents essential for compliance with both mandatory and optional portions of the standard." Early disclosure to the Working Group of patent information that might be relevant to the standard is essential to reduce the possibility for delays in the development process and increase the likelihood that the draft publication will be approved for publication. Please notify the Chair as early as possible, in written or electronic form, if patented technology (or technology under patent application) might be incorporated into a draft standard being developed within the IEEE Working Group. If you have questions, contact the IEEE Patent Committee Administrator at
Douglas, B., et al.
Joonsuk Kim, Broadcom Corp.

2. Outline Legacy Networks and DFS GF Transmissions & Radar Pulses
March 2007
Outline
Legacy Networks and DFS
GF Transmissions & Radar Pulses
Mesh Architecture
Lab Experiment
Denial of Service Attack
Motion
This submission addresses CIDs 323, 411, 1659, 1660, 2971
Douglas, B., et al.

3. Legacy Networks and DFS
March 2007
Legacy Networks and DFS
By the end of 2007, In the U.S, ETSI, and Japan, 5 GHz networks operating from channel 52 through channel 140 must use DFS.* This represents most of the 5 GHz band in those regulatory domains.
Legacy a networks have no concept of Greenfield mode. GF transmissions look like short bursts of radar energy to them.
There has been a good deal of concern that GF transmissions will cause radar detection events and cause legacy networks to abandon channels.
* The requirements vary slightly from country to country.
Douglas, B., et al.

4. GF Transmissions and Radar Pulses
March 2007
GF Transmissions and Radar Pulses
APs with DFS must detect radars and move to another channel in order to avoid interfering with them.
These radar transmissions have the following characteristics to a 5 GHz receiver
The received signal is not recognizable to the a PHY
Short duration
Periodic
Greenfield voice transmissions have the following characteristics to a 5 GHz receiver
Douglas, B., et al.

5. Mesh Network Architecture
March 2007
Mesh Network Architecture
Mesh vendors have chosen to provide mesh access in the 2.4 GHz band because they want to be able to serve the highest percentage of customers with clients.
There are few channels in the 2.4 GHz band, and lots of interference. The 5 GHz band offers a large number of relatively clean channels. Therefore many mesh vendors use the 5 GHz band for backhaul.
At least 5 of the leading mesh manufacturers use this architecture.
Douglas, B., et al.

6. GF Transmissions and Mesh Backhaul
March 2007
GF Transmissions and Mesh Backhaul
A single voice call using GF transmissions could bring down a mesh tree while it changes channel.
A small number of GF Access Points using efficient channel selection can totally occupy the 5 GHz band and cause a mesh network outage.
Legacy non-mesh a networks will suffer similar problems when they detect GF transmissions and are forced to change channels.
Douglas, B., et al.

7. Experiment: Transmit Signal
March 2007
Experiment: Transmit Signal
Transmit Signal:
Metalink n MATLAB reference transmitter
MCS7 – 65 Mbps
100 byte payload
Packet Duration: ~40 usec
Signal Generator and RF Upconversion.
Frequency: 5560 MHz
Douglas, B., et al.

8. Experiment Test Scenario
March 2007
Experiment Test Scenario
A Single Voice Call:
20 msec CODEC
100 total packets per second
ACKS and call signaling were not included in the experiment.
A Cisco 1510 Mesh Node was the target of the interference.
The 1510 was chosen for the test because it shares the same receiver hardware with the majority of 5 GHz access points and mesh nodes deployed worldwide.
Douglas, B., et al.

9. Experiment: Results
March 2007
The following text shows a debug log from the 1510 Receiver
wlanEnableDFS: Enabling radar detection features
>> Radar detected - 6 pulses, frequency 2767 Period matched for width match
WARNING! WARNING! WARNING! directPulses: Found width matching radar, pulsewidth = 0
WARNING! WARNING! WARNING! Radar interference is detected.
WARNING! WARNING! WARNING! directPulses: Found width matching radar, pulsewidth= 0
After a small number of radar detection events, the mesh AP moved off the channel.
This experiment was repeated with varying packet lengths and pulse repetition frequencies, and the results were the same.
Douglas, B., et al.

10. A Simple Denial of Service Attack
March 2007
A Simple Denial of Service Attack
Equipment Required:
A laptop computer with an n Greenfield transmitter and some degree of programmability in the MAC.
Software Modifications Required:
Program the n Greenfield transmitter to send out a few GF packets in one 5 GHz channel, move on to the next channel where DFS is required, and repeat.
The Attack:
Once the laptop is operating in this mode, walk around a 5 GHz deployment, or approach a root-AP in a mesh deployment.
The Results:
You bring down the legacy infrastructure or the mesh tree.
Douglas, B., et al.

11. Questions Received So Far
March 2007
Questions Received So Far
Is this a particular problem associated with the Cisco 1510 receiver?
No, we chose the Cisco 1510 because it shares a common receiver with a large fraction of a wireless LAN infrastructure devices deployed in the 5 GHz band.
Aren’t there other interferers in those bands that will cause the same problems?
There are weather radars and military radars already deployed that will cause true radar detection events.
These frequency bands are just opening up to other traffic that implements Dynamic Frequency Selection. To the best of my knowledge, a radios are the first to implement DFS and occupy those bands in large numbers.
There is definitely a concern that other non radios will implement DFS and occupy that band causing false radar detections. However we have not seen it yet.
If Greenfield mode is deployed in those bands, we are consciously deploying radios by the millions, tens of millions, or hundreds of millions, that will cause false radar detection events on the a radios deployed today.
Douglas, B., et al.

12. March 2007
Straw Poll
Greenfield transmissions shall be disallowed in channels and regulatory domains where DFS is required until:
1. Acceptable methods of conveying Legacy a OBSS information to all the GF transmitting APs and their associated GF transmitting clients have been approved as IEEE draft text.
2. Acceptable methods of conveying Legacy a OBSS information to GF transmitting clients in an Ad Hoc network have been approved as IEEE draft text.
3. The vendor implementations of these solutions have been proven not to cause radar detection events on legacy a receivers.
Douglas, B., et al.