Wireless Archives - Page 2 of 4

January 7, 2020January 29, 2020 jeetk CWAP|Networking|Wireless

Key 802.11 Frames – CWAP#3

This post covers the important 802.11 Frames which can help in performing the analysis and troubleshoot any issues related to WLAN networks. I have referenced Wireshark filters for the ease of each frame.

Beacon (1000, Subtype : 8) (wlan.fc.type_subtype == 0x08)

Used to announce the Basic Service Set (BSS) for the Client (STAs).
Transmitted by AP every 100 time units. 1 TU = 1024 microseconds. Default is 102.4 m/s
To reduce any potential overhead, TU values might need adjustment in some cases where multiple SSIDs exist on AP radio.

IEEE 8ø2.11 wireless LAN
Fixed parameters (12 bytes)
Timestamp: 5304013374
Beacon Interval: ø. 1024øø (Seconds)
Capabilities Information: exø421
Tagged
Tag :
Tag :
Tag :
Tag
Tag:
Tag :
Tag :
Tag:
Tag:
Tag :
Tag :
Tag :
parameters (144 bytes)
SSID parameter set: Hob—guest
supported Rates 12(B), 18, 24(B), 36, 48, 54, [Mbit/secl
DS Parameter set: Current Channel: 1
: Traffic Indication map (TIM): DTIM ø of ø bitmap
Country Information: Country Code NZ, Environment Any
ERP Information
Vendor Specific: Microsoft Corp.: H%/WME: Parameter Element
HT capabilities (8ø2.11n DI. 10)
HT Information (8ø2.11n DI. lø)
QBSS Load Element 802. lie CCA version
Extended Capabilities (8 octets)
Vendor Specific: Ruckus Wireless

Probe Request and Probe Response (0100, 0101 Subtype : 4 & 5) (wlan.fc.type_subtype == 0x4 or wlan.fc.type_subtype ==0x5)

Used for active scanning
STAs send the probe request, AP sends the probe response.
Amount of probing may be able to be reduced by adjusting the roaming aggressiveness on the client.
Probe request are sent to broadcast address (DA – ff:ff:ff:ff:ff:ff:ff)
Directed probe request are when STA sending probe request may specify the SSID they are looking, like in example below.

IEEE 8ø2.11 Probe Request, Flags: ..... ...C
Type/Subtype: Probe Request (øxeeø4)
Frame Control Field: ex4øoe
. ..øø = Version: e
eløø
ø . — Type: Management frame (e)
= Subtype: 4
Flags: øxee
. øøø oøøø eøøø eeøø = Duration: e microseconds
Receiver address: Broadcast ff)
Destination address: Broadcast ff:ff)
Transmitter address: (fc:fc:48:5e:2b:33)
Source address: Apple_5e:2b:33 (fc: fc:48:
BSS Id: Broadcast (ff:ff:ff:ff:ff:ff)
= Fragment number: ø
eeøø
0101 eøøø løøl
= Sequence number: 1289
Frame check sequence: øxda049ff4 (unverified]
(FCS Status: Unverified]
IEEE 8ø2.11 wireless LAN
v Tagged parameters (141 bytes)
Tag: SSID parameter set: Hob—wireless
Tag Number: SSID parameter set (e)
Tag length: 12
SSID: Hob—wi re less
Tag: Supported Rates 1, 2, 5.5, 11, (Mbit/sec)
Tag Number: Supported Rates (1)
Tag length: 4
Suppo rted Rates: 1 (exø2)
Suppo rted Rates: 2 (exø4)
Suppo rted Rates: 5.5 (øxøb)
Suppo rted Rates: 11 (ex16)
Tag: Extended Supported Rates 6, 9, 12, 18, 24,
Tag Number: Extended Suppo rted Rates (5ø)
Tag length: 8
36,
48,
54,
(mbit/sec)
Extended
Extended
Extended
Extended
Supported
Supported
Supported
Supported
Rates:
Rates :
Rates:
Rates:
6 (øxec)
g (øx12)
12 (øx18)
18 (øx24)

The SSID value can also be set to 0, SSID field is present, but empty. This is called Wildcard SSID or null probe request, e.g. below

Probe requests are always sent on the lowest supported data rates. In above examples they are sent at 1 Mb/s.
Probe response contain the requested information elements that may have been requested by the probing station. .e.g. below

Authentication & Deauthentication Frames (1011, subtype :11, 12) (wlan.fc.type_subtype == 0xb, wlan.fc.type_subtype==0xc)

Used to authenticate to an AP to prepare association or roaming
Used to remove the AID (Authentication ID) and deauthenticate with an AP.
Frame body consists of
- Authentication Algorithm Number – 0 for Open System and 1 for Shared Key
- Authentication Transaction Sequence Number – Indicate current status of progress
- Status Code – 0 for Success,1 for Unspecified failures
- Challenge Text Used in Shared Key Authentication frame 2 & 3

IEEE 802.11 Authentication, Flags: ..... ...C
Type/ Subtype: Authentication (OxØØØb)
v Frame Control Field: OxbØØØ
00
1011
= Version:
00.. = Type: Management frame (0)
= Subtype: 11
Flags: ØXØØ
.øøø 0001 0011 1010
= Duration: 314 microseconds
Receiver address: RuckusWi_4f:d3:c8 (2c:5d:93:4f:d3:c8)
Destination address: RuckusWi_4f:d3:c8 c8)
Transmitter address: SamsungE_2d:6Ø:91 (5c:51:81:2d:6Ø:91)
Source address:
BSS Id:
. øøøø
= Fragment number:
1101 1001 0001
= Sequence number: 3473
Frame check sequence: Oxa186b162 [unverified]
[FCS Status: Unverified]
IEEE 802.11 wireless LAN
v Fixed parameters (6 bytes)
Authentication Algorithm: Open System (0)
Authentication SEQ: Ox0ØØ1
Status code: Successful (Ox0ØØ0)

137
•33: ab
24. ø
8ø2. 11
—55 dBm
• 33 : ab
138
• a4:2e
8ø2 . 11
24.
139
•a4:2e
8ø2.11
140
•a8:33
•a4:2e
8ø2 . 11
24.0
141
lø. 644498
lø. 645173
lø. 645190
lø. 646791
lø. 646843
Cisco
5e:a7
bf.
:ec.
5e:a7
:ec.
Cisco_bf.
Cisco
bf.
(øø-.
8ø2.1
58
112
58
277
58
—52
—41
2
d Bm
d Bm
d Bm
Ack
Authentication
Ack
Association Request
Ack
CWAP-TEST
24.
132
132
132
132
Acknowledgement, Flags=.....
Authentication, SN=1032, FN=ø, Flags=.
Acknowledgement, Flags=.....
Association Request, SN=2097, FN=ø, Flags=.
Acknowledgement, Flags=.....
SSID=CWAP-TEST

Association and Disassociation Frames (0000, subtype =0)(0001 subtype =1) wlan.fc.type_subtype==0 or wlan.fc.type_subtype==10

Simple 4-frame exchange (authentication request, ACK, authentication response & ACK) used to enter the authenticated and associated state with the AP.
After Association STA may either use the network (open system authentication) or begin the 802.1x/EAP authentication process if used.
The Disassociation frame is used to change from authenticated/associated state to “authenticated not associated state”. They contain a reason for disassociation. In case of below frame the reason code is unspecified reason.

802.11 radio information
PHY type: 8ø2. lla (5)
Turbo type: Non—turbo (ø)
Data rate: 12.0 Mb/s
channel: 108
Frequency: 554%Hz
Signal strength (dBm): —84dBm
Noise level (dBm): —89dBm
Signal/noise ratio (dB): 5dB
TSE timestamp: 6964589ø3
(Du ration: 44gsl
IEEE 8ø2.11 Disassociate, Flags: ..... ...C
Type/Subtype: Disassociate (øxøeea)
Frame Control Field: exaøøø
..øø = Version: e
lølø
= Type: management frame (e)
= Subtype: lø
Flags: øxee
.øøø oøøø eø11 eeøø = Duration: 48 microseconds
Receiver address: SamsungE_2d:øe:4ø (4c:66:41:2d:øø:4ø)
Destination address: SamsungE_2d:øø:4e (4c:66: 41:2d
Transmitter address: (2c:5d: 72:5c)
source address: 72:5c)
BSS Id:
Fragment number: ø
. eeøø =
eøøø eøøø eløl
= Sequence number: 5
Frame check sequence: øx8043a47a [unverified]
(FCS Status: Unverified]
IEEE 8ø2.11 wireless LAN
v Fixed parameters (2 bytes)
Reason code: Unspecified reason
( øxøool)

Reassociation Request and Response Frames – (0010, subtype : 2) (0011, subtype : 3) (wlan.fc.type_subtype == 0x2 or wlan.fc.type_subtype ==0x3)

These frames are used to roam to another AP within the ESS (extended service set) or to reconnect after brief disconnection.
The reassociation response frame will also include an AID for the STA and the status code indicating the reassociation success or failure.

8ø2.11 radio information
Data rate: 7.0 Mb/s
channel: 108
Signal strength (percentage): 78*
IEEE 8ø2.11 Reassociation Request, Flags: op.PR.F.
Type/Subtype: Reassociation Request (Oxøø02)
Frame Control Field: ex2øda
eølø
. .øø = Version: e
= Type: management frame (e)
= Subtype: 2
Flags: øxda
Duration/ID: 5391 (reserved)
Receiver address:
Destination address: 89: ba (c9:6a:
Transmitter address: al:2a:51:84:9b:9e (al:2a:51:84:9b:9e)
source address:
BSS Id: 79)
STA address:
= Fragment number: ø
ooøø
— Sequence number: 1860
0111 eløø eløø -
HT control (+HTC): øx2473a9cd
WEP parameters
Initialization Vector: øx952d2a
Key Index: ø
WEP ICV: exac6532aø (not verified)
Data (1514 bytes)
Data: 73a428øa537ø8af4618Ø23beb54d94ba647d7ø892c5øc22cm
(Length: 1514]

RTS / CTS – (1011, Subtype : 11), (1100, Subtype : 12) (wlan.fc.type_subtype == 0x2 or wlan.fc.type_subtype ==0x3)

RTS and CTS frames are used to clear the medium for transmission of larger frames.
The Duration Field in RTS/CTS is very important.
- SIFS (Short Interframe Space) – Amount of time in m/s required for a wireless interface to process a received frame and to respond with resoonse frame.
- RTS duration = SIFS(3) + CTS + Data + ACK(1)
- CTS duration = SIFS(2) + Data + ACK(1)

info rmat
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 24.0 Mb/s
Channel: 6
Frequency: 2437MHz
Signal strength (dBm)
: -42dBm
Noise level (dBm)
: -96dBm
Signal/noise ratio (dB): 54dB
TSE timestamp: 94735155
(Du ration: 28gs)
IEEE 8ø2.11 Request-to-send, Flags: ..... ...C
Type/Subtype: Request—to—send (exøølb)
Frame Control Field: exb4øø
. .øø = Version: e
løll
= Type: Control frame (1)
= Subtype: 11
Flags: øxee
.øøø oøøø løll eelø = Duration: 178 microseconds
Receiver address: RuckusWi_cf:cf:d8 (2c:5d:93:cf:cf :d8)
Transmitter address:
Frame check sequence: øxbde58b2c (unverified]
(FCS Status: Unverified]

802.11 radio information
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 24.0 Mb/s
Channel: 1
Frequency: 2412MHz
Signal strength (dBm)
: -83dBm
Noise level (dBm)
: -90dBm
Signal/noise ratio (dB): 7dB
TSE timestamp: 92681566
[Du ration: 64gs)
IEEE 8ø2.11 Clear-to-send, Flags: .pm.R.FTC
Type/Subtype: Clear—to—send (øx001c)
Frame Control Field: exc66b
. .10 = Version: 2
= Type: Control frame (1)
. — Subtype: 12
lløø -
Flags: øx6b
Duration/ID: 11803 (reserved)
Receiver address:
Frame check sequence: øx1b21827a (unverified]
(FCS Status: Unverified]

CTS-to-self > is another method of performing NAV (Network Allocation Vector) distribution that use only CTS frames. It is used strictly as a protection mechanism for mixed mode environment.

Acknowledgement Frames (ACK)(1011, Subtype : 13) (wlan.fc.type_subtype == 0x1d)

These frames are sent right after data/management frames to inform(ack) the transmitter.
With ACK frame, the transmitter assumes the frame was lost due to the corruption from interface or some other issue, and so retransmits the frame.
ACK frame includes Frame Control, Duration, RA and FCS subfields

802.11 radio information
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 12.0 Mb/s
Channel: 11
Frequency: 2462MHz
Signal strength (dBm)
: -85dBm
Noise level (dBm)
: -90dBm
Signal/noise ratio (dB): 5dB
TSE timestamp: 91694972
[Du ration: 32gs)
IEEE 8ø2.11 Acknowledgement, Flags: .C
Type/Subtype: Acknowledgement (exøøld)
Frame Control Field: exd4ee
. .øø = Version: e
1101
= Type: Control frame (1)
= Subtype: 13
Flags: øxoe
.øøø oøøø eøøø eeøø = Duration: e microseconds
Receiver address: (fc:
Frame check sequence: øx66678fb7 (unverified]
[FCS Status: Unverified]

Duration Field value is set to : Duration Value of previous frame + ACK(1) + SIFS(1)

Null Data & PS-Poll Frames (0100 Subtype : 4) (wlan.fc.type_subtype == 0x24) or (wlan.fc.type_subtype == 0x1a)

Null Data Frames are used to notify an AP that the STA is awake and able to receive the frames.
It is simply a data frame with no date in the Frame Body field.

8ø2.11 radio
info rmation
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 24.0 Mb/s
Channel: 11
Frequency: 2462MHz
Signal strength (dBm)
: -88dBm
Noise level (dBm)
: -96dBm
Signal/noise ratio (dB): 8dB
TSE timestamp: 54ø37578
(Du ration: 92gsl
IEEE 8ø2.11 Nutt function (No data), Flags: o.m. .MFTC
Type/Subtype: Nutt function (No data) (øxee24)
Frame Control Field: ex4ba7
.. 11 = Version: 3
Type: Data frame (2)
lø.. =
eløø
= Subtype: 4
Flags: øxa7
Duration/ID: 11355 (reserved)
Receiver address: 1b:
Transmitter address: ce:2f :9e
Destination address: 89:ae:ø6:4e:6d:7e (89:ae:ø6:4e:6d:7ø)
source address: by: 13:
= Fragment number: 12
lløø
1110 lløl eølø
= Sequence number: 3794
Frame check sequence: øxa0bff4b1 [unverified]
(FCS Status: Unverified]

PS-Poll on the other hand are used to notify the AP that the client STA is awake and available for buffered frames.
STA indicate the power save mode using the Power Management bit the Frame Control field. When a STA is in PM mode = 1 it alternates between awake and sleep states.

v 8ø2.11 radio information
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 24.0 Mb/s
Channel: 11
Frequency: 2462MHz
Signal strength (dBm): —88dBm
Noise level (dBm)
: -96dBm
Signal/noise ratio (dB): 8dB
TSE timestamp: 54143357
(Du ration: 1ø4gsl
IEEE 8ø2.11 Power-save poll, Flags:
...P.M.TC
Type/Subtype: Power—Save pott (exøøla)
Frame Control Field: exa415
..øø = Version: e
= Type: Control frame (1)
= Subtype: lø
lølø
Flags: øx15
. løø eløø lløø eløl = Duration: 17605 microseconds
Receiver address: fc.
•55
BSS Id:
Transmitter address: 24.
•f5:e8
(unverif iedl
Frame check sequence: øxb471eø46
(FCS Status: Unverified]

AP may send buffered data frames to the client in two ways.
- If the data belongs to legacy power-save queue, transmission follows the legacy power save.
- If the data belongs to WMM Power Save queue, data frames are downloaded according to a trigger-and-delivery mechanism.

Useful Links for this Post :

Wireshark 802.11 Display Filters

802.11 Mgmt : Association Req/Response

December 10, 2019January 29, 2020 jeetk CWAP|Networking|Wireless

How did I Decipher 802.11 Frames! #CWAP-2

Main Objective: To successfully transfer every bit of information(data) from one device to another.

802.11 MAC HEADER

Let us now go through the basics of the frame header and the components. I have captured a simple beacon (management) frame using Wireshark.

I will briefly explain each of the fields. Notice the number in the bracket refers to the bytes. For memory 1 Byte = 8 bits. 🙂

Frame Control > 16 bits | 2 Bytes – contains 11 subfields as displayed in the above examples. Considering the amount of valuable information contained in 802.11 Frame Control sub-fields is mind-boggling

Protocol Version (2 bits): For now, always set to 0 by default. Changes in the version are expected in the future.

Type: Management (0,0), Data(1,0), Control(0,1), Extension Frame(1,1)*only available with 802.11D

Sub Type (4 bits): There are different kinds of management, control and data frames. Therefore the 4-bit Subtype field is required to differentiate. The above examples have Beacon & ACK subtypes.

To DS – if set to “1” – Frame going from STA > Distribution System (DS)
From DS – if set to “1” – Frame going from DS > STA

To DS = 0, From DS = 0 > Management or Control frames where it does not go to DS, Can be STA to STA communication in an ADHOC/IBSS setup.
To DS =0, From DS = 1 > Downstream traffic from AP to the STA.
To DS =1, From DS = 0 > Upstream traffic from STA to AP
To DS =1, From DS = 1 > Data frame using 4 MAC header format, usually occurs in WDS or Mesh Network.

More Fragments – If set to “1” it is usually preceded by another fragment of current MSDU or MMPDU to follow.

Retry – 0 or 1. 1 is for retransmissions. Lot of 1’s may indicate a network with a lot of retry rate due to some issue. The issues can impact the performance by increased application/network latency thereby degrading user experience.

Power Management – if set to “1”, STA is using power save mode.

More Data: if set to “1” it indicates that the AP or STA is holding more frames for the STA to which the current frame is targeted.

Protected Frame – if set to “1” it indicates payload is encrypted.

Order – If set to “1” in any non-QoS data frame when a higher layer has requested that the data be sent using strictly ordered CoS, which tells the receiving STA to process the frames in order.

Duration/ID > 2 Bytes | 16 bits – May be used for 2 purposes, it may contain the duration of the frame. Secondly, it may contain association identifier (AID) of the STA that transmitted the frame.

Address 1,2,3 and 4: Each address contains 6bytes/48 bits of data.

SA > Source Address
DA > Destination Address
TA > Transmitting Address
RA > Receiving Address
BSSID >

Sequence Control Field (2 Bytes/16 bits): Divided into 4-bit fragment number and a 12-bit sequence number. Used when MSDUs are fragmented. 802.11-2016 allows for fragmentation of frames.

QoS Control Field: (2 Bytes/16 bits): Only used in MAC header of QoS frames. Sometimes referred to as WMM (Wi-Fi Multimedia) which provides traffic prioritization.

HT Control Field (4 bytes/32 bits): Parameters related to HT & VHT operations. Only used in Management + QoS control frames.

Frame Body: Contains the actual MSDU payload to be transmitted.

FCS: (Frame check sequence field 4Bytes/32 Bits) – Final field on the frame header. Also known as Trailer as the word says. Used to detect errors in communication.

November 20, 2019January 29, 2020 jeetk CWAP|Networking|Wireless

CWAP 403 – Start >

I will be summarising each chapter on the Certitrek Publishing – Official Study Guide for CWAP 403 Exam.

I’ve learned plenty of concepts from the first chapter – 802.11 – The Protocol. This is one of the chapters which you have to read and learn. One may not learn the contents of this chapter directly while working or experience this in his/her day today. Following the posts should give you a fair idea of what the chapter entails and get close to fulfilling the exam requirements. You still have to go through the book multiple times and revise the concepts discussed in the CWNA exam to fully grasp the knowledge required for this exam.

OSI Layers

(APSTNDP) – For the purpose of our CWAP exam we will be concentrating our efforts on layer 1-4 only. More so we have to aim at learning layers 1 and 2 as IEEE 802.11 is focussed around them.

IEEE 802.3(Ethernet) & 802.11 (WLAN) operate primarily at Layers 1 & 2 of the OSI model. The Internet Engineering Task Force (IETF) operates at Layer 3 & 4.

Layer 4 is typically TCP/UDP. TCP is a connection-oriented protocol that uses a 3-way handshake, whereas UDP is a connectionless protocol typically used in time-sensitive applications where occasionally dropping packets is better than waiting.

Layer 3 is typically IP with the exception of WAN related protocols like HDLC, ATM, Frame Relay, etc.

Layer 2 (Data Link layer) – This is subdivided into MAC(lower) + LLC (upper). Frames are organized and meaningful collection of bits that are prepended and appended to upper-layer data within the network communications. When Network layer 3 sends data to the Data-Link layer (2), the data is handed off to the LLC and becomes known as MSDU (MAC Service Data Unit). The MSDU consists of data payload that contains the IP packet + some LLC data. When LLC sends the MAC service data unit info to the MAC sublayer, the MAC header information gets added in a MAC Protocol Data Unit (MPDU).

Layer 1 (PHY) – Physical Medium can be RF, Light Waves, Fibre cables. Capabilities include encoding, modulation, demodulation, timing & signals. This layer is subdivided into PLCP (Physical Layer Convergence protocol – Upper) & PMD (Physical Medium Dependent). The PLCP sublayer prepares the frame for transmission by taking the frame from the MAC sublayer and creating the PLCP Protocol Data Unit (PPDU).

802.11 Physical Layers

Protocol	Year (adopted)	Frequency	Channel Width (MHz)	MIMO	PHY
802.11az	Late 2021	60 GHz
802.11ay	2020	60 GHz	8000	MU-MIMO	EDMG
802.11ax	Late 2019	2.4 or 5GHz	20,40,80, 160	MU-MIMO	HEW
802.11ac wave2	2015	5 GHz	20,40,80, 160	MU-MIMO	VHT
802.11ac wave1	2014	5 GHz	20,40,80	SU-MIMO	VHT
802.11n	2009	2.4 or 5 GHz	20,40	SU-MIMO	HT
802.11g	2003	2.4 GHz	20	N/A	ERP
802.11a	1999	5 GHz	22	N/A	OFDM
802.11b	1999	2.4 GHz	20	N/A	HR-DSSS
802.11 Prime	1997	2.4 GHz	22	N/A	DSSS

Modulation is the process of imposing bits on a transmission medium. I have detailed the keying methods useful in understanding the basics of Modulation here. Also, refer to mcsindex.com for numbers related to Modulation and Coding. We will be exploring in detail about this in the forthcoming chapters which entail about PHY Layers and Technologies.

Troubleshooting Methods

The industry troubleshooting methods e.g. from Cisco, Microsoft or CompTIA are not tested on the CWAP exam. The CWAP exam objectives list the following troubleshooting actions.

Define the Problem
Identify the Scale of the Problem
Identity Probable Causes
Capture and Analyze the Data (Most of the CWAP concentrated here)
Observe the Problem
Choose appropriate Remedial Steps.
Document the Problem and Resolution.

Special Thanks to Rasika as I’ve learned a lot from his blogs.

Summary of the 802.11 Mac Header

Network Layer – IP header is added.
Data Link Layer – MAC header is added.
Physical Layer – PHY header is added.

Data is eventually transmitted as individual bits at the Physical layer.

BIT > 0/1, Octet > Byte of data.
Data Link Layer – LLC (802 based networks), MAC

MAC Service Data Unit > When network layer sends data to the Data Link layer, the data is handed off to the LLC and becomes MSDU

MSDU = IP Packet + Some LLC Data.

Only 802.11 Data Frames carry MSDU – Ratification 802.11n-2009, introduced A-MSDU

MSDU = 2304 Octets, A-MSDU = up to 7935 Octets.

MAC Protocol Data Unit > When the LLC sublayer sends MSDU to the MAC sublayer, the MAC header info is added to identify it.

MPDU = MAC Header + Frame Body(MSDU) + FCS (Trailer)
A-MPDU > transmissions are created by transmitting multiple MPDUs as one PHY frame as opposed to A-MSDU transmissions, which are created by passing MSDUs down the PHY layer as single MPDU.

Physical Layer comprises of PLCP & PMD – PLCP prepares the frame for transmission by taking the frame MAC sublayer and creating the PLCP Protocol Data Unit.

PPDU = PLCP + Frame from Mac Layer.

PLCP Service Data Unit > Pretty much like MPDU at PHY layer.
PLCP = PPDU + PSDU

August 14, 2019January 29, 2020 jeetk CWNA|Wireless

CWNA Certification Journey

I managed to get my CWNA certification today, this was my 2nd attempt. The first attempt was a failure a few months ago.

Failed Attempt: 53%

Passed Attempt: 82%

Below are a few tips which I would like to share so that you get most for this certification.

It would be quite beneficial if you already work for a Network/Wireless service provider or Manage wireless network for a company. Being in such a position certainly pays and gives room for joining the pieces of this puzzle.

This course will require some monetary investment. I managed to get some certification videos. Though the videos are for old CWNA course but majority of the conceptual stuff does not change for new revision. Here is the link > https://www.udemy.com/certified-wireless-network-administrator-cwna/

There are no video training courses available on CBT nuggets or INE as of today. I did check with CBT Nuggets via twitter but they do not have any official dates for the.

So back to the actual course curriculum. It would be highly beneficial to check the course outline and objectives – https://www.cwnp.com/uploads/cwna-107-objectives-2017.pdf You can check the differences from CWNA 106 so that you can prepare better https://www.cwnp.com/uploads/cwna-107-what-changed-2017.pdf

If would be good a good buy to get the new sybex CWNA official study guide > https://www.wiley.com/WileyCDA/WileyTitle/productCd-1119425786,miniSiteCd-SYBEX.html

This one is quite a thick book with over 1000 pages. I guess this book will be used throughout your career in wireless as a reference guide and a starting point for everything wireless. Some great work by the 2 David(s) Westcott & Coleman. When you buy the book you also get online flash cards + practice test questions valid for 1 year which you can use for further strengthen your knowledge.

Would be great and worth downloading the common terms used in the exam/book for the CWNA – https://www.cwnp.com/wp-content/uploads/pdf/cwnp_exam_terms.pdf

I read almost 1-2 chapters per week. The book might give you a feeling of information overload every once in a while. Another resource which I used during the preparation were some podcasts listed below.

CleartoSend – https://www.cleartosend.net/
WLAN Professional – https://www.wlanpros.com/
Packet Pushers – https://packetpushers.net/
WiFi for Beginners – https://wififorbeginners.com/category/podcast/

Twitterati (Twitterverse/Twitter users) – Would highly recommend you to join and follow the wireless enthusiasts. Thankful to the wireless online community! Many of them have a vast industry experience and certifications which go a long way in helping and coaching someone who is new to the wireless domain.

Slack Groups to recommended –
wi-fipros.slack.com
cleartosend.slack.com

All the best with your CWNA Study and the Exam! Please buy the exam voucher directly form CWNP website (https://www.cwnp.com/cwna107v/) rather than going directly via PearsonVue. I saved $50USD by doing so.

I am on to the next Adventure of CWAP and will try and blog more often about the learnings from the course study.

July 19, 2019July 19, 2019 jeetk Wireless

QoS Overview

Wireless has somehow made it to the human needs pyramid and has become mission-critical for most of the business around the world. Proper RF and QoS design is the only way to ensure real-time apps have acceptable QoE (Quality of Experience).

The wireless environments are half duplex shared medium they are quite susceptible to collisions. One of the biggest challenges for 802.11 networks is that there is no way to detect that the collision even occured.

802.11e was introduced to bring QoS to Wi-Fi

• EDCA was introduced by IEEE 802.11e in 2005, and has been adopted by the Wi-Fi Alliance as Wireless Multimedia (WMM)
• WMM is now a mandatory part of modern Wi-Fi
• 802.11a/b/g are based on DCF (no QoS) • 802.11n/ac are based on EDCA (QoS is supported)

NOTE: The post describes about QoS in general and can be applied to any networking realm.

Latency, Jitter, and Loss

The quality of a network transmission is a result of three things:

■ Latency
■ Jitter
■ Loss

Latency is how long it takes for a packet to be received by the endpoint after it is sent from the source. Latency is also referred to as delay. Asymmetrical tunneling after a Layer 3 roaming event between controllers can introduce delay. Again, symmetrical mobility tunneling is the recommended configuration.

Delay can be broken into two parts:

■ Fixed delay: The time it takes to encode and decode the packets and the time it takes for the packet to traverse the network.

■ Variable delay: Caused by network conditions. If the network is highly utilized at certain times of the day, the variable delay would be higher at those times than others.

Jitter is the value that results from the difference in end-to-end latency between packets. If a packet takes 50 ms to traverse the network and the next packet takes 100 ms, you have a jitter value of 50 ms.

Loss is simply the ratio of packets that are successfully received by the endpoint to those that were sent by the transmitter.

Correct Packet Marking

Depending on the traffic flow of a packet, traffic can be classified or tagged. This can be used to prioritise the packet thereby impacting the traffic flow. Efforts should be made to ensure that QoS policies are applied end to end which means from WLAN Controller > Core Switch Ports > Access Switch Ports > AP Ports.

Upstream and Downstream QoS

As discussed above, it is important to understand the terminology and direction of the traffic flow to and from the AP and the controller. You have both upstream and downstream QoS:

Radio downstream: Traffic leaving the AP and traveling to the WLAN clients.

Radio upstream: Traffic leaving the WLAN clients and travelling to the AP. Enhanced Distributed Channel Access (EDCA) rules provide upstream QoS settings for WLAN clients

Network downstream: Traffic leaving the controller travelling to the AP. QoS can be applied at this point to prioritize and rate-limit LWAPP/CAPWAP traffic to the AP.

Wi-Fi Multimedia

WMM is a certification that applies to both clients and APs. The features are taken from the 802.11e draft.

Each of the four WMM queues competes for the wireless bandwidth available on the channel. Four queues namely – Background, Best Effort, Video, Voice. WMM uses Enhanced Distributed Coordination Function (EDCF) for handling the queue traffic. If more than one frame from different access categories collides internally, the frame with the higher priority is sent. The lower-priority frame adjusts its backoff parameters as though it had collided with a frame external to the queuing mechanism.

April 26, 2019January 29, 2020 jeetk CWNA|Networking|Wireless

CWNA – Chapter 2 Summary & Exam Essentials

CWNA Chapter 2 – IEEE 802.11 Standards and Amendments.

“Defined” means the amendment either no longer exists or it was rolled into the existing (or prior versions) 802.11-2007 spec. “Defines” means it is a ratified amendment that will be rolled into 802.11-2011. “Will define” means it is a work in progress and not yet amended.

802.11-1997 (sometimes called 802.11 “prime”) — the original 802.11 specifications included the base functionality along with FHSS and DSSS PHYs.

802.11a — Defined OFDM usage in 5 GHz with data rates up to 54 Mbps.
802.11b —Defined 5.5 and 11 Mbps with HR/DSSS in 2.4 GHz.
802.11c — Defined MAC bridging for 802.11. Was incorporated into 802.1D.

802.11-1999 rolled up 802.11 prime with new enhancements.

802.11d — Defined 802.11 operation in new regulatory domains.
802.11e — Defined QoS
802.11F — Recommended Inter-Access Point Protocol (IAPP) for interoperability of different vendor products. Was not used by anyone and is now withdrawn.

Note: A capital letter designates a recommended practice standalone standard (similar to 802.1X). A lowercase letter designates an amendment to a parent standard. Hence, 802.11F was designed to be a standalone document (and also happened to be a recommended practice), not a part of the full 802.11 standards. This is often a confusing topic in standards naming.

802.11g — Defined ERP PHY, which introduces data rates up to 54 Mbps in 2.4 GHz.

802.11-R2003 rolled up 802.11-1999 and prior amendments, excluding 802.11e.

802.11h — Defined Dynamic Frequency Selection (DFS) for radar detection and avoidance in some 5 GHz bands. Also defined Transmit Power Control (TPC) for managing client transmit power.
802.11i — Defined security enhancements including TKIP, CCMP, and use of 802.1X with WLANs.
802.11j — Defined 4.9 – 5 GHz operation in Japan.

802.11-2007 rolled up 802.11-R2003 with prior amendments.

802.11k — Defines radio resource management processes for RF data collection and sharing.
802.11l — Due to potential confusion between an “l” (letter) and “1” (number), 802.11l was bypassed.
802.11m — Was used as a maintenance amendment that updated inaccuracies, omissions, and ambiguities.
802.11n — Defines High Throughput (HT) PHY with MCS rates up to 600 Mbps in 2.4 GHz and 5 GHz.
802.11o — For similar reasons as 802.11l, 802.11o was bypassed. ‘Is that an “o” (letter) or a “0” (number)? I don’t know, let’s just skip it.’
802.11p — Defines wireless access for the vehicular environment (WAVE).
802.11q — Due to potential confusion with 802.1Q, 802.11q was bypassed.
802.11r — Defines fast BSS transitions (fast secure roaming). Maybe one of these days we’ll use it.
802.11s — Will define 802.11 mesh internetworking.
802.11T — Specified a way to test wireless performance prediction. Remember, capital letters are recommended practices standalone standards. 802.11T was canceled.
802.11u — Will define internetworking with external networks, such as cellular.
802.11v — Will define enhancements for network management.
802.11w — Defines protected management frames to prevent some security vulnerabilities.
802.11x — 802.11 technologies as a whole are often referred to as 802.11x, so this amendment was bypassed.
802.11y — Defines use of OFDM in 3650-3700 MHz.
802.11z —Defines enhancements to Direct Link Setup, which no one uses.
802.11aa — Will define enhancements to video transport streams.
802.11ab —Was bypassed to avoid confusion with devices using 802.11a and 802.11b PHY technologies, which are often abbreviated as 802.11ab.
802.11ac — Will define Very High Throughput (VHT) with gigabit speeds, building on 802.11n MIMO technology.
802.11ad — Will define short range Very High Throughput (VHT) in the 60 GHz spectrum.
802.11ae — Will define enhancements for QoS management.
802.11af — Will define the usage of Wi-Fi in newly opened TV whitespace frequencies.
802.11ag — Similar to 802.11ab, 802.11ag was skipped to avoid confusion with devices using 802.11a and 802.11g PHY technologies, which are often abbreviated as 802.11ag.
802.11ah — Will define the usage of Wi-Fi in frequencies below 1 GHz. Also used as an expression of Wi-Fi pleasure. 802.11…ah!
802.11ai — Will define FILS (fast initial link setup). Designed to address challenges in high-density environments which a large number of mobile users face.
802.11aj – Will define modifications to the IEEE 802.11ad-2012 amendment’s PHY and MAC layer to provide support to the Chinese Millimeter Wave (CMMW).
802.11ak – Will define amendment to General Link for use in bridged networks.
802.11aq – Will define delivery of network service information prior to the association of stations on 802.11 networks.
802.11ax – Will define HE(High Efficiency). Expected to be next big PHY enhancement to the 802.11 standards. Operate in both 2.4/5GHz.
802.11ay – Will define improvement of an 802.11ad amendment providing faster speeds.
802.11az – TBC

April 25, 2019January 29, 2020 jeetk CWNA|Networking|Wireless

CWNA – Chapter 1 Summary & Exam Essentials

Overview of Wireless Standards, Organisations and Fundamentals.

4 Key organisations involved with wireless networking industry

– FCC and other regulatory domains (ITU-R (ACMA (Australia)) (ARIB(Japan)) – FCC regulates communication from/to/within US. Both licensed and unlicensed communications are typically regulated in the following 5 areas

– Frequency, Bandwidth, Maximum power of the intentional radiator (IR), Maximum equivalent isotropically radiated power (EIRP), Use (indoor and/or outdoor), Spectrum sharing rules.

– IEEE – 802.11 working group is responsible for creating WLAN standard.

– IETF – International community of people whose goal is to make the internet work better.

– Wi-Fi Alliance – Global, non-profit organisation of more than 550 member companies devoted in making the wireless communication better. Its main task is to ensure interoperability of WLAN products by providing certification testing.

ISO – international Organisation for Standardisation.

OSI model – Open Systems Interconnection (APSTNDP)

Application Layer 7- WWW browsers, NFS, SNMP, Telnet, HTTP, FTP
Presentation Layer 6 – Include encryption, ASCII, TIFF, GIF, JPEG, MPEG, etc..
Session Layer 5 – NFS, NetBIOS names, RPC, SQL
Transport Layer 4 – TCP, UDP
Network Layer 3 – Provides switching and routing technologies, creates logical paths, known as virtual circuits.
Data Link Layer 2 -The MAC layer and the Logical link control (LLC) layer. IEEE 802.3, ATM, Frame Relay.
Physical Layer 1 – Cables, Ethernet, Fibre, etc.

The 802.11-2016 standard defines communication mechanism only at the Physical and the MAC sublayer of the Data-Link layer of the OSI model.

Communications Terminology

Simplex – Device is either capable of transmitting or receiving.
Half-Duplex- Capable of transmitting and receiving but not at the same time. Only 1 device can transmit at a time.
Full- Duplex – Capable of transmitting and receiving at the same time.

Radio Frequency Fundamentals

1. Amplitude – Height, force, or the power of the wave.
2. Wavelength – Distance between similar points on two back to back waves.

Frequency – Describes a behaviour of waves. How fast the wave travels, or more specifically how many waves are generated over a period of time, is known as frequency.

Phase – is a relative term. It is the relationship between 2 waves with the same frequency

Keying Methods – Some more explanation here.

1. Amplitude-Shift Keying
2. Frequency-Shift Keying
3. Phase-Shift Keying.

EXAM ESSENTIALS

1. Know the 4 Industry Organisations
2. Understand core, distribution and access layer
3. Explain the difference between simplex, half-duplex, and full duplex.
4. Understand Wavelength, Frequency, Amplitude & Phase.
5. Keying Methods.

March 18, 2019January 13, 2020 jeetk Networking|Wireless

Cisco – Mobility Express Experience

A couple of days ago I bumped into an opportunity to setup Cisco Mobility Express for one of the clients. Cisco has enabled to accomplish a mobility solution which can hep you deploy wireless LAN networks and be able to manage WLAN with APs on the network acting as the controller. Here’s how Cisco describes it in layman’s terms –

“Mobility Express integrates wireless LAN (WLAN) controller functions into the Cisco Aironet 3800, 2800, 1850, 1830, 1815, 1560 and 1540 Series Access Points. As such, Mobility Express is the latest in a series of Cisco efforts to turn WLAN controllers into a software function that any network component can host. Cisco controller capabilities also can be housed in standalone appliances (Cisco Wireless LAN Controllers, or WLCs), Cisco switches, Cisco routers, a private cloud, and a public cloud.”

I started with first AP to be converted to mobility express. In my case I’ve used a Cisco 3800 indoor AP. You will either need a POE+ capable switch or a POE+ injector. In case you only have POE injector the configuration is still possible but radios will receive insufficient POE to power up and cannot test the solution. You can convert the AP to mobility express but radios won’t receive enough power to start up.

Also remember that – When trying to convert to Mobility Express Image the Access point must not join and existing WLC in your network

Download Mobility Express image from www.cisco.com. You will need a Cisco account and valid entitlement to download this image. Connect Console and Ethernet cables into their correct interface ports, Ethernet will also be used to power through the use of a Power injector. Plug Ethernet cable from network switch into data port of POE power injector unit and apply power to POE injector. Login to AP via console with username and password : Cisco

Check that the AP has been assigned a IP address from the DHCP server on your network. Identify that an IP address has been assigned to the AP. In my case I configured a DHCP on the switch and let the AP receive a newly assigned lease. Setup your TFTP server, (for this I will using Tftpd64) and browse to the folder that contains the Mobility Express image

In the Command line of the LAP enter the following to download and change the configuration to Mobility Express.

AP#ap-type mobility-express tftp://<TFTP Server IP>/<path to tar>/file

The transfer will now start and wait for it to complete. Once completed issue the command “reboot” on the AP to make sure that it starts extracting the file it has downloaded and apply the new mobility express software. Once the software is applied it will go through the CLI setup wizard.

enter “yes” to terminate the auto install

Enter your required configuration items in the config wizard.

Enter all the details with regards to the management interface IP, netmask, default gateway etc. Setup the SSID and provisioning. These settings can also be done at the later stage when you access the GUI. The AP will reboot with the settings.

I managed to add 3 APs in the network and complete the setup.

March 13, 2019March 13, 2019 jeetk Technology|Wireless

Everything I know about 5G!

5G is 5th Generation of Wireless Technology.
5G is Software defined network.
10x faster than 4G, 2hour film – 3G – 26 hours, 4G – 6hours, 5G – around 4 seconds.
Response times faster – 4G – 0.045 m/s, 5G – 0.01 m/s.
Foundation for ViR, IoT, Autonomous Driving, Online Gaming is just a start.
Might only start showing in production up late 2019 or early 2020.

TECHNOLOGIES

Millimeter Waves – Millimeter waves are broadcast at frequencies between 30 and 300 gigahertz, compared to the bands below 6 GHz that were used for mobile devices in the past. They are called millimeter waves because they vary in length from 1 to 10 mm, compared to the radio waves that serve today’s smartphones, which measure tens of centimeters in length.

Small Waves – Use mini base stations, small stations to relay signals around obstacles.
While traditional cell networks have also come to rely on an increasing number of base stations, achieving 5G performance will require an even greater infrastructure.

Massive Mimo – Support up-to 100 ports, increase capacity of network by factor of 22 or more. Can cause more obstruction, next point helps.

Beamforming –Base station can send directional signals, focussed stream. Beamforming can help massive MIMO arrays, which are base stations arrayed with dozens or hundreds of individual antennas, to make more efficient use of the spectrum around them.

Full Duplex – Basic antenna can either send or receive at one point, but 5G can give room to send and receive at same time. This is similar to one track train but when it arrives/goes through a station/junction there is a room for another train to pass through on the same line.

October 30, 2018October 30, 2018 jeetk Wireless

WiFi Metrics

I am going to pen down a few of the important wireless metrics. This is to access the environment for any concerns and issues raised around the wireless side of things.

So what should we consider a good, acceptable, or poor Wi-Fi signal strength?

-30 dBm – Maximum signal strength, you are probably standing right next to the access point.
-50 dBm – Anything down to this level can be considered excellent signal strength.
-60 dBm – Good, reliable signal strength.
–67 dBm – Reliable signal strength.The minimum for any service depending on a reliable connection and signal strength, such as voice over Wi-Fi and non-HD video streaming.
-70 dBm – Not a strong signal. Light browsing and email.
-80 dBm – Unreliable signal strength, will not suffice for most services.Connecting to the network.
-90 dBm – The chances of even connecting are very low at this level.

RSSI – each device will have different values and output. There’s no defined way to track the RSSI. Client devices take lot of decisions based upon the RSSI. Wifi bars = one of the ways to determine RSSI. It is not always a good factor though as mac OS X tends to show full bars even though only 1 bar or dBm value around -80. Good numbers around RSSI is -67 for voice, typical connections -70. Location analytics tend to be around -60. Values in dBm. Mention website of RSSI.

SNR – quality of wireless signal. Level of noise impacts the wireless quality. SNR drives which type of modulation is used. It is not the ratio but different between level of noise and the signal received or broadcasted by the AP. Every vendor calculates SNR differently.

Channel utilization – High density environments normally tend to have channel utilization. It reflects the statistics of the environment. How busy our channels are? Also tells when CCI becomes an issue. Turn off some 2.4 radios, lower or higher the power depending on the kind of issue. Data rate – helps in troubleshooting wireless issues. Disable low data rates in the environment. Can disable 1,2, 5.5 data’s rates. Also not advisable to enable high data rate like 24 or 48Mbps.

RETRANSMISSIONS– should not have more than 10% in the environment. Could be caused due to low data rates set in the environment. Hidden nodes can be cause for the issues. Device drivers are also a cause of concern. Retry packet are sent at low data rate. Use Wireshark to track the retry packets. More retires not a healthy environment.

TIMERS– how long does it take the device to associate with AP. One of the metrics to determine. Longer time to join can be an issue. Band steering being enabled 2.4 responses can be delayed and association time will increase. AP that are broadcasting on dfs channels, some client devices do not scan AP on dfs channel. Authentication time also can be slower due to slow responses from radius server. Time to roam can also be factor. This can impact voip/rts traffic.

Limit active SSIDs to <5 : This is a general rule-of-thumb, and should be adjusted based on the vendor/environment and network design and performance requirements. Lower this value even further if you plan on deploying voice over Wi-Fi, perhaps down to 3 or 4 SSIDs max. Useful link