802.11 WLAN System
802.11 WLAN System
802.11 WLAN System
Introduction
WLAN network basics
Physical layer (radio) technologies
P t
Protocoll architecture
hit t
802.11 MAC protocol
Security protocols in WLANs
Advanced topics in WLANs
Wireless LAN standards
WLAN testing challenges and test metrics
Conclusion
What is a WLAN? What is 802.11?
Pros.. Cons..
Mobility Shared-medium technology –
Compatible with IP networks bandwidth limited by RF
High
g speed
p data connectivity
y spectrum
Unlicensed frequencies Limited number of non-
overlapping channels
Highly secure
Multipath effects indoor
Easy and fast installation
Interference in the 2.4 GHz
Simplicity and 5 GHz bands
Scalability Limited QoS
Very low cost Power control
High overhead MAC protocol
Basic 802.11 Operation
Bridge Mode
Ad-hoc Mode
Scanning
Necessary for keep all the clients synchronized with the AP in order for the
clients to perform functions like power save.
AP periodically transmits special type of frames called Beacon Frames
The beacons contain the timestamp of the AP. The clients synchronize their
clocks with the APs clock using this timestamp.
The AP also uses the beacon to advertise its capabilities
p and this information is
used by the passively scanning clients to make a decision to connect to the AP.
The AP advertises its capabilities in the form of Information Elements (IEs) in
beacon frames
Some of the IEs are: SSID,, channel,, Supported
pp Rates,, WPA IE,, EDCA IE
802.11 Authentication
•The station first needs to be authenticated by the AP in order to join the APs
network.
•802.11 defines two authentication subtypes: Open system and shared key
State Machine
Data Transfer
MAC Layer:
• Provides access to contention based and
contention-free traffic on different kinds of
physical layers.
• MAC layer responsibilities are divided into
MAC sub layer and MAC management sub-layer.
• MAC sub layer defines access mechanisms
and packet formats.
• MAC management sub-layer defines
power management, security and roaming services.
PHY Layer:
• The Physical layer is divided into three sub layers
• The PLCP acts as an adaption layer The PLCP is responsible for CCA and building
packets for different physical layer technologies
• The
Th PMD llayer specifiesifi modulation
d l ti and d coding
di ttechniques
h i
• The PHY management layer takes care of the management issues like channel tuning.
• Station management sub layer is responsible for co-ordination of interactions between the
MAC and PHY layers
The 802.11 PHY (RF) Layer
802.11 b/g
802.11a
Physical Layer Technologies
802.11b
• Supports 1 1, 2
2, 5
5.5
5 and 11 Mbps data
rates in the 2.4 GHz ISM band
• Backward compatible with the original
802.11 DSSS systems.
• Uses Complementary Code Keying
(CCK) modulation for 5.5 and 11Mbps
rates
802 11a
802.11a
•Incompatible with devices operating in 2.4GHz
•Uses OFDM technique and supports Data rates up to 54 Mbps.
•Uses combinations of various modulation and coding rates to achieve the different
PHY rates
Antenna Diversity and Polarization
Antenna Diversity
• Scheme devised to compensate multipath effects by using multiple antennas
• The incoming RF signal is received through one antenna at a time.
• The receiving radio constantly samples the incoming signals from both the antennas to
determine the higher quality signal.
signal
• The receiver radio then chooses to accept the higher quality signal.
• The receiver transmits its next outgoing signal out of the antenna that was last used to
receive an incoming signal because the received signal was a higher quality signal than
f
from th other
the th antenna.
t
Polarization
• Radio wave made up of electric and magnetic fields which are in perpendicular planes to
each
h other
th
• Horizontal polarization when electric field is parallel to ground
• Vertical polarization when electric field is perpendicular to ground
• Antennas that are not polarized in the same way may not be able to communicate with
each other effectively.
The 802.11 MAC (Frame) Layer
Management Frames
• Beacon, Probe request, Probe Response, Authentication, Association Request,
Association Response, Deauthenticate, Disassociate, Reassociation request,
Reassociation response,
Control Frames:
• RTS, CTS, Acknowledgment, PS-Poll
Data Frames:
• Data,
Data Null frame
Inter Frame Spaces (IFS)
The Inter Frame Spaces define the minimum time that a station needs to wait
after it senses the medium free
free.
The concept of IFS was introduced to enable different priority levels for
transmission.
The smaller the IFS, the higher the priority
Various Inter Frame Spaces are defined to assign different priorities (SIFS,
PIFS, DIFS)
Carrier Sensing
Each station senses the channel for an additional random time after detecting the channel as
being idle for a minimum duration of DIFS.
Only if the channel remains idle for this additional random time period, the station is allowed to
initiate the transmission
transmission.
Each station maintains a CW, which is used to determine the number of slot times a station has to
wait before transmission.
A backoff counter is maintained which counts the slots from the random time chosen to zero
downwards.
The Backoff Counter is decreased as long as a slot time is sensed as idle and it is frozen when a
transmission is detected.
As soon as the Backoff Counter reaches the value Zero the station transmits its own frame
After any unsuccessful transmission attempt, another backoff is performed with a doubled size of
the CW.
This reduces the collision probability in case there are multiple stations attempting to access the
channel
Security in 802.11 WLANs
Man-in-the-Middle
Man in the Middle Attack
• A hacker may use an rogue AP to hijack
mobile nodes by sending a stronger
signal than the actual AP is sending to
those nodes.
nodes
• The MC (Mobile Client) then associates
with the rogue AP, sending its data into
the wrong hands.
WLAN Security Solutions
64 and 128 bit keys are used for authentication and encryption of data
WEP protocol is fundamentally weak because it uses a static encryption key.
Motivated attackers can easily crack WEP encryption by using freely
available hacking tools.
The determination and distribution of WEP keys are not defined
No defined mechanism to change the WEP key either per authentication or
periodically for an authenticated connection
No mechanism for central authentication, authorization, and accounting
Server Based Authentication
A possible solution for the security problem is maintaining centralized key servers like a
RADIUS server for centralized key generation and distribution.
This would reduce the overhead off maintaining the key information
f off all the clients at the
AP.
With RADIUS, authentication is user-based rather than device-based, so, for example, a
stolen laptop does not necessarily imply a serious security breach.
RADIUS eliminates the need to store and manage authentication data on every AP on the
WLAN, making security considerably easier to manage and scale.
Steps for Authenticating with RADIUS server
• The WLAN Client (the “Supplicant”) tries to access network. [EAPoL]
• The AP (the “Authenticator”) responds to requests, and will ask client for identity. [EAPoL]
• Client responds with identity to AP [EAPoL]
• AP will forward Access-Request to RADIUS server with the user's identity. [RADIUS]
• RADIUS server will respond with a challenge to AP. The Challenge will indicate the EAP
authentication-type requested by the server [RADIUS]
• AP forwards challengeg to client [[EAPoL]]
• If Client agrees to EAP-type, then negotiation will continue; if not, client will NAK request and suggest
an alternative method. [EAPoL]
• AP forwards response to RADIUS server. [RADIUS]
• If these credentials are correct, the RADIUS server accepts the user. If not, the user is rejected. An
Access-Accept p or Reject
j is sent. [[RADIUS]]
• If authentication succeeds, AP connects client to the network.
Server-based security: 802.1x / 802.11i
Advanced Topics
Load Balancing
• IImportant
t t issue
i in
i areas off heavy
h traffic
t ffi
• In multicell structure having heavy traffic, several co-
located APs can cover the same region to increase the
throughput.
• The clients having load balancing functionality
configured can automatically associate with the AP that
is less loaded and provides the best quality of service.
Rate Adaptation (dynamic rate shifting)
• Speed adjusted dynamically depending on the distance
and the signal strength
• As the distance between the AP and the MC (Mobile
Client) increases, the signal strength will decrease to a
point where the current data rate cannot be maintained .
• when the signal strength decreases the transmitting unit
p its data rate to the next lower data rate in order
will drop
to maintain a reasonable SNR.
Power Management
Roaming can be defined as the client moving between APs advertising the same or similar wireless
network.
Since the WLAN clients are mobile and coverage range of a single AP is limited
limited, roaming happens
whenever the client passes the boundaries of a WLAN cell.
The roaming protocol should be implemented effectively in order to cause very minimal delays during
the handoff.
The clients usually make the roaming decisions by scanning the various available wireless networks at
all times and trying to connect to the best available network
network.
Decision to roam can be made on various factors such as RSSI, Number of missed beacons, SNR,
frame errors etc..
When a decision is made to roam the client can authenticate and associate with the new AP and
continue its data communication through the new AP.
Roaming when security is enabled would involve setting up a new security session with the new AP
Fat AP Vs Thin AP
Fat AP Model
• Standalone APs which perform all 802
802.11
11 MAC and PHY functionalities
functionalities.
• The APs pretty much work independent of each other except for limited inter-access point
communication through IAPP and WDS.
• Fat APs are costly.
Thin AP Model
• The AP only performs the PHY and lower MAC layer functions like ACKing and MAC retries.
• All thin APs connect to a centralized switch and the switch performs all the upper MAC functions like
client connections, security states, encryption keys, QoS policies, bandwidth management etc..
• Advantages
Manage and configure all the APs centrally through a WLAN switch/controller.
The AP hardware is cheaper and in large deployments this can cut a lot of cost.
The wireless switches can enforce network policies, network security and Quality of Service rules
for applications such as IP telephony in a centralized fashion.
Since client connection and security state is maintained by the AP and not the switch, the clients
can seamlessly roam between all the APs connected to the same switch without re-authenticating
with the new AP.
Thin AP model allows implementation of radio resource management
management, load balancing
balancing, rogue AP
detection etc…
Quality of Service (802.11e)
The scope of TGn's objective is to define modifications to the Physical Layer and Medium Access Control
layer (PHY/MAC) that deliver a minimum of 100 Mbps throughput at the MAC SAP.
Increasing the physical transfer rate of wireless systems by using multiple antenna systems for both the
transmitter and the receiver. This technology is referred to as multiple-input multiple-output (MIMO), or
smart antenna systems.
MIMO technology offers the ability to coherently resolve information from multiple signal paths using
spatially separated receive antennas.
Possible use of wider (40MHz) channels to achieve higher data rates
rates.
Use more complex modulation and coding techniques to improve spectral efficiency and hence increase
the data rates.
MAC layer improvements such as aggregating multiple MAC Protocol Data Units (MPDUs) into single PHY
Protocol Data Units (PPDUs).
Acknowledging
g g multiple
p MPDUs with a single
g block acknowledgement
g ((Block ACK)) in response
p to a block
acknowledgement request (BAR)
A Rapidly Evolving Technology
802.11o – Voice over WLAN, faster handoff, prioritize voice traffic over data (in
progress)
802.11p – Using 5.9GHz band for ITS (long range) (in progress)
802.11q – Support for VLAN (in progress)
802.11r – Handling fast handoff when roaming between APs (in progress)
802.11s – Self-healing/self-configuring mesh networks (in progress)
802.11t - Wireless Performance Prediction (in progress)
802.11u - Interworking with External Networks
802 11 - Wireless
802.11v Wi l N
Network
t kMManagementt standard
t d d (i(in progress))
802.11w - Protected Management Frames standard (in progress)
802.11x – Summarize all 802.11 standards, but it is not a standard.
802 11y - Contention Based Protocol Study Group (in progress)
802.11y
WLAN testing
RF level testing
Protocol Conformance Testing
Performance Testing
Interoperability Testing
Functional Testing
Management/Data plane testing
Stress/Load Testing
Scalability Testing
Testing
g QoS support
pp
Testing security protocols
VoIP over WLAN testing
Testing Roaming
Testing Rate Adaptation
Testing mixed mode networks
Testing for protection against security attacks
Deployment Testing, site survey
WLAN Performance Metrics
Primary Metrics
• Primary metrics are defined as the performance metrics that directly affect
the quality of the application layer traffic.
• R-values/MOS score, Jitter, packet loss, number of dropped calls in the
case of voice
• Connection setup time,
time Layer 4 through 7 throughput
throughput, latencies
latencies, frames
loss etc…in the case of other application layer data traffic.
Secondary metrics
• Secondary metrics are defined as the performance metrics at layer 2 that
indirectly affect the performance of any application running on the top of the
layer 2 WLAN protocol.
• Secondary metrics include, Throughput, Frame loss, latency and
forwarding rate at the 802.11 layer
• It can be argued that an AP performing well at layer 2 will perform well at all
the layer above.
Both primary and secondary metrics are considered to be
important for performance testing.
WLAN testing today
Unicast Throughput
Unicast Forwarding Rate
Unicast Packet Loss
U i
Unicastt Latency
L t
Multicast Forwarding Rate *
Multicast Roaming *
TCP Goodput
Power Save Throughput
g p
* available as script
Control Plane / Security Applications
Roaming Benchmark
Roaming Stress
Client Association Database Capacity
AP LLoadd Balancing
B l i *
Connection Stress Test *
Concurrent Connections Test *
Thin AP Failover Test *
802.11 Frame Generator / Attack Generator
AAA Server / RADIUS Authentication capacity *
* available as script
QoS Applications
* available as script
Muni WiFi Mesh Applications
• Supplying service providers and enterprise users with the tools necessary
to make the right choice when selecting WLAN equipment for deployment
in their networks
VeriWave’s Technological Focus