Spectrum Analyzer – CWAP#13

Spectrum Analyzer – comprises of 15% syllabus for CWAP-403 exam. You can roughly expect around 9 questions from this section. Spectrum Analyzers range in price from a few hundred $ to thousands. They are not free to use like in the case of Wireshark etc..

I was unable to source spectrum analyzers easily and ended up not reading thoroughly on this topic My first attempt for CWAP-403 exam did not achieve the required passing score. I scored 44% on this section, hence I am writing this blog post to strengthen my understanding and also for those who are on the lookout for studying and understanding the concepts. The knowledge that is tested around this section comprises mainly around the terminologies related to Spectrum Analyzers and the understanding the patterns in tables/layouts displayed in the application.

The terminologies include Duty Cycle, Sweep Cycle, FFT, Resolution Bandwidth, Utilization, Domains and a few more. An understanding is required to demonstrate that one is able to locate the interfering devices and recognizing patterns using various Spectrum Analyzer applications.

A few known concepts before diving into Spectrum Analysis.

Cycle / Wavelength : A wave form which starts at the center, climbs in energy to the highest point, called the peak; returns to the center; then drops to the weakest point, called the trough and then continues till it finally attenuates and looses the energy. Wavelength is often measured from peak to the next peak.

Amplitude : Determined by the height, force or power of the wave.

Wavelength 
Amplitude 
One cycle

Frequency: Number of cycles within one second. E.g. 2.4GHz generates 2.4 billion times of cycles every second.

λ = Wavelength
C = Speed of light (186000 miles per second)
2.4 GHz = 12.5cm
5 GHz = 6cm

Free Space Path Loss (FPSL) – Loss of signal as it travels through free space. This is a theoretical value, as in the real world, there may be many obstacles, reflection, scatter which need to be accounted when estimating the signal at a location. FPSL is based on inverse square law, originally developed by Isaac Newton. You don’t need to know below formula for the exam.

FSPL = 36.6 + (20log10(f)) + (20log10(d))
FSPL = path loss in dB
f = frequency in MHz, d = distance in miles between antenna

RF Mathematics

dB is logarithmic ratio of values

  • We add gains +3dB = x2
  • We subtract losses -3dB = /2
  • We add gains +10dB = x10
  • We subtract losses -10dB = /10
  • dBm is power measurement relative to 1mW
  • dBi is the forward gain of an antenna compared to istropic antenna.

RSSI

  • RSSI is a metric that is specified by measuring the amount of energy associated with the bits received via wireless NIC.

Noise Floor

  • Background level of radio energy that exist in a medium on a specific channel which is analyzed.

SNR

  • SNR can be presented as a dB value or as the difference between the RSSI(signal) and the noise floor(noise). High SNR is better performance.

Receive Sensitivity

Receive Sensitivity refers to the power level of an RF signal required to be successfully received by the receiver radio.

Wireless NICs

  • Use Antenna and coding filter to keep out of unwanted RF and bits.
  • Will use some of the specific information gleaned from the RF to bit transition process to actually add info to the wireless frame.
  • The additional information is added to the receiving station and known as Radiotap Header.
  • All the info shown on the Radiotap Header is in reference to “receiving station” and “not transferring station”

The Hardware

  • Mobile / Integrated
  • Mobile spectrum analyzers like protocol analyzers use the adapters present in laptops.
  • Integrated spectrum analyzers use APs to monitor the RF.
  • Popular mobile analyzers include AirMagnet, Spectrum XT, Metageek Wi-Spy DBx etc..
  • Integrated spectrum example may include Cisco Clean Air software to pull spectrum data from the AP.

The Software

  • Three popular applications available for mobile analysis, they are AirMagnet Spectrum XT, Metageek Chanalyzer, Cisco Spectrum Expert.

Spectrum Analysis Terminology

Duty Cycle

  • Duty Cycle indicates the fraction of time a resource is busy.
  • FFT (Fast Fourier Transform) Duty Cycle measurements are important way to determine potential interference/impact of an RF transmitter on WLAN operations. Duty cycle measures the amount of time in which the amplitude is above some arbitrary threshold. Threshold can vary from each software. (such as -95dBm, or 15dB above noise floor or -75dBm).

Sweep Cycles

  • In higher end spectrum analysis tools, a sweep is measured as a single scan of the bandwidth span. So if one is measuring 100 MHz of spectrum, a sweep is how long it takes to scan that 100 MHz band a single time.
  • For e.g. a real-time FFT plot shows amplitude (Y axis) plotted over frequency (X axis). Within the real-time FFT chart, there may be a trace for the maximum amplitude over the last sweep or possibly a “max hold” over all previous sweeps. When the plot updates after the next sweep, the data will be refreshed with new information and will be relative to the previous sweep.

Resolution Bandwidth

  • RBW is a reference to the smallest frequency that can be resolved by the receiver.
  • RBW should be low enough to resolve spectral components of the transmission being measured.

Waterfall Plots

  • Same data from FFT plot but adding the time dimension.
  • A waterfall plot is a three-dimensional plot in which multiple curves of data, typically spectra, are displayed simultaneously.
Waterfall plot using Chanalyzer

Wi-Fi Integration

As spectrum analysis tools have improved and developed, more emphasize is given on data reporting and analysis have moved tighter integration and correlation with Wi-Fi information.

RF Signature Characteristics

  1. Shape
  2. Patterns
  3. Uniqueness
  4. Frequency
  5. Pulse vs. Constant
  6. Duty Cycle
  7. Frequency Hopping

I have not documented individual interference examples from various sources. This is nicely documented on the metageek website and you can click here for references.

Other useful references

Zigbee
FFT Spectrum Analysis

EXAM MOMENT: When locating devices, use a directional antenna to aid in the location of the signal source. Study about Duty Cycles, FFT, Swept Spectrogram and other interference patterns.

CWAP Reference Guide so far… #CWAP12

I’ve tried to condense my notes from the study for CWAP-403 exam. The exam consists of lot of details which need to be learnt if you have not done enough capturing and analyzing 802.11 wireless frames before.

  1. CWAP 403 – Start > Introductory blog
  2. 802.11 Mac Header explained
  3. Key 802.11 Frames
  4. Troubleshooting WLAN issues #mindmap
  5. PHY Layer
  6. WLAN medium contention
  7. 802.11 Frame Exchanges (Security)
  8. How to capture WLAN Frames?
  9. Troubleshooting WLAN issues with 802.11 Frames
  10. 802.11n | HT Operations
  11. 802.11ac | VHT Operations
  12. Spectrum Analysis

PHY Layer – CWAP#5

This chapter accounts for 10% of the Knowledge Domain in the CWAP exam. Approx. 6/60 questions!

Exam Moment from the Book : It is not important, for the CWAP exam, that you know all the details of the variations of the PHY preambles; however, you should know that the preamble adds extra overhead to the communications and that older devices may introduce a preamble that reduces performance overall and forces all devices in the BSS to communicate based on that long preamble.

CS/CCA

Carrier Sense > State of STA where it is ready to transmit or receive packets/signals

Clear Channel Assessment > Identify whether the channel is unused and available prior to the packet transmission

Transmit (Tx) > Upon checking if the wireless medium is available the STA needs to transmit a frame which is enabled by CS/CCA process. Unlike ethernet the wireless frames cannot transmit and receive the frames at the same time.

Receive (Rx) > The transmitting STA will precede the data portion of the frame with a preamble.  It contains a binary strings that the receiving station can identify and synchronise with , essentially alerting the receiving station to the transmission. The preamble also includes a Start Frame Delimiter field, which the receiving station uses to identify the beginning of the frame. An ACK frame Is sent with the entire frame is received.

Upper : Physical Layer Convergence Procedure (PLCP) 
Lower : Physical Medium Dependant (PMD) 
MSDU (MAC service Data Unit) 
MPDU + MSDU 
MAC header and trailer are added,'removed 
creates PLC? Protocol Data Unit (PPDIJ) from MAC sublayer. 
MPDU is handed down to the PHY referred as PLCP Service 
Data Unit (PLC?) 
PMD modulates and transmits the data as bits.

PMD > transmits the data as RF modulated 1s and 0s. When receiving , the PMD listens to the RF and passes the received data up to the PLCP sublayer.
PLCP Protocol Data Unit> When PLCP receives PSDU, it then prepares PPDU. PLCP adds a preamble + PHY header to the PSDU.

PLCP Preamble > String of 0/1 bits that are used to synchronise incoming transmissions. IEEE 802.11-2007 standard defines 3 different PPDUs.

Long PPDU > 144 bit PLCP Preamble, 128 bit Sync field + 16 bit Start of Frame Delimiter (SFD).

Short PPDU > 72 bit PLCP Preamble, 56 bit Sync field and 16 bit SFD

OFDM PLCP Preamble >10 short symbols + 2 long symbols

PLCP Header > Long & Short PLCP Headers are both 48 bits log and contain 4 fields (Signal(8) + Service(8) + Length(16) + CRC(16).

PPDIJ 
PLC? Preamble 
PLC? Header 
PSDU 
OFDM PLC? 
Long PPDIJ 
Short PPDIJ 
Long Header 
Short Header

802.11n PPDUs

FIGURE 2.5 
Greenfield 
802.11n PPDU formats 
L-STF 
L-STF 
GFSTF 
L-LTF 
L-LTF 
HT-LTFI 
I-SIG 
I-SIG 
HT-SIG 
HT-SIG 
HT-LTFI 
L=Legacy (non-HT) 
STF=Short Training held 
LTF=Long Training Field 
SIG-Signal 
HT=High Throughput 
GF=Greenfield

Non-HT Legacy PPDU

  • Consists of Preamble(Short/Long symbols)
  • Mandatory for 802.11n radios and transmissions can occur in only 20MHz channels.
  • Effectively same format used by legacy 802.11a/g radios.


HT-Mixed PPDU

  • 802.11n amendment
  • Likely be most commonly used format as it supports HT + Legacy 802.11a/g.
  • Transmission can occur in both 20MHz and 40MHz channels

HT-Greenfield PPDU

  • 2nd of the two new PPDU formats defined by 802.11n.
  • Not compatible with legacy 802.11 radios, only the HT Radios can communicate with this format.
  • Can transmit using 20MHz and 40MHz fields.

Data Field

The data field portion of PPDU is the PSDU. In easy terms, the data field is the 802.11 MAC frame.

Key 802.11 Frames – CWAP#3

This post covers the important 802.11 Frames which can help in performing the analysis and troubleshoot any issues related to WLAN networks. I have referenced Wireshark filters for the ease of each frame.

Beacon (1000, Subtype : 8) (wlan.fc.type_subtype == 0x08)

  • Used to announce the Basic Service Set (BSS) for the Client (STAs).
  • Transmitted by AP every 100 time units.  1 TU = 1024 microseconds. Default is 102.4 m/s
  • To reduce any potential overhead, TU values might need adjustment in some cases where multiple SSIDs exist on AP radio.
IEEE 8ø2.11 wireless LAN 
Fixed parameters (12 bytes) 
Timestamp: 5304013374 
Beacon Interval: ø. 1024øø (Seconds) 
Capabilities Information: exø421 
Tagged 
Tag : 
Tag : 
Tag : 
Tag 
Tag: 
Tag : 
Tag : 
Tag: 
Tag: 
Tag : 
Tag : 
Tag : 
parameters (144 bytes) 
SSID parameter set: Hob—guest 
supported Rates 12(B), 18, 24(B), 36, 48, 54, [Mbit/secl 
DS Parameter set: Current Channel: 1 
: Traffic Indication map (TIM): DTIM ø of ø bitmap 
Country Information: Country Code NZ, Environment Any 
ERP Information 
Vendor Specific: Microsoft Corp.: H%/WME: Parameter Element 
HT capabilities (8ø2.11n DI. 10) 
HT Information (8ø2.11n DI. lø) 
QBSS Load Element 802. lie CCA version 
Extended Capabilities (8 octets) 
Vendor Specific: Ruckus Wireless

Probe Request and Probe Response (0100, 0101 Subtype : 4 & 5) (wlan.fc.type_subtype == 0x4 or wlan.fc.type_subtype ==0x5)

  • Used for active scanning
  • STAs send the probe request, AP sends the probe response.
  • Amount of probing may be able to be reduced by adjusting the roaming aggressiveness on the client.
  • Probe request are sent to broadcast address (DA – ff:ff:ff:ff:ff:ff:ff)
  • Directed probe request are when STA sending probe request may specify the SSID they are looking, like in example below.
IEEE 8ø2.11 Probe Request, Flags: ..... ...C 
Type/Subtype: Probe Request (øxeeø4) 
Frame Control Field: ex4øoe 
. ..øø = Version: e 
eløø 
ø . — Type: Management frame (e) 
= Subtype: 4 
Flags: øxee 
. øøø oøøø eøøø eeøø = Duration: e microseconds 
Receiver address: Broadcast ff) 
Destination address: Broadcast ff:ff) 
Transmitter address: (fc:fc:48:5e:2b:33) 
Source address: Apple_5e:2b:33 (fc: fc:48: 
BSS Id: Broadcast (ff:ff:ff:ff:ff:ff) 
= Fragment number: ø 
eeøø 
0101 eøøø løøl 
= Sequence number: 1289 
Frame check sequence: øxda049ff4 (unverified] 
(FCS Status: Unverified] 
IEEE 8ø2.11 wireless LAN 
v Tagged parameters (141 bytes) 
Tag: SSID parameter set: Hob—wireless 
Tag Number: SSID parameter set (e) 
Tag length: 12 
SSID: Hob—wi re less 
Tag: Supported Rates 1, 2, 5.5, 11, (Mbit/sec) 
Tag Number: Supported Rates (1) 
Tag length: 4 
Suppo rted Rates: 1 (exø2) 
Suppo rted Rates: 2 (exø4) 
Suppo rted Rates: 5.5 (øxøb) 
Suppo rted Rates: 11 (ex16) 
Tag: Extended Supported Rates 6, 9, 12, 18, 24, 
Tag Number: Extended Suppo rted Rates (5ø) 
Tag length: 8 
36, 
48, 
54, 
(mbit/sec) 
Extended 
Extended 
Extended 
Extended 
Supported 
Supported 
Supported 
Supported 
Rates: 
Rates : 
Rates: 
Rates: 
6 (øxec) 
g (øx12) 
12 (øx18) 
18 (øx24)
  • The SSID value can also be set to 0, SSID field is present, but empty. This is called Wildcard SSID or null probe request, e.g. below
IEEE 8ø2.11 Probe Request, Flags: ..... ...C 
Type/Subtype: Probe Request (øxeeø4) 
Frame Control Field: ex4øoe 
. ..øø = Version: e 
eløø 
ø . — Type: Management frame (e) 
= Subtype: 4 
Flags: øxee 
. øøø oøøø eøøø eeøø = Duration: e microseconds 
Receiver address: Broadcast ff) 
Destination address: Broadcast ff:ff) 
Transmitter address: (fc:fc:48:5e:2b:33) 
Source address: Apple_5e:2b:33 (fc: fc:48: 
BSS Id: Broadcast (ff:ff:ff:ff:ff:ff) 
= Fragment number: ø 
eeøø 
0101 eøøø løøl 
= Sequence number: 1289 
Frame check sequence: øxda049ff4 (unverified] 
(FCS Status: Unverified] 
IEEE 8ø2.11 wireless LAN 
v Tagged parameters (141 bytes) 
Tag: SSID parameter set: Hob—wireless 
Tag Number: SSID parameter set (e) 
Tag length: 12 
SSID: Hob—wi re less 
Tag: Supported Rates 1, 2, 5.5, 11, (Mbit/sec) 
Tag Number: Supported Rates (1) 
Tag length: 4 
Suppo rted Rates: 1 (exø2) 
Suppo rted Rates: 2 (exø4) 
Suppo rted Rates: 5.5 (øxøb) 
Suppo rted Rates: 11 (ex16) 
Tag: Extended Supported Rates 6, 9, 12, 18, 24, 
Tag Number: Extended Suppo rted Rates (5ø) 
Tag length: 8 
36, 
48, 
54, 
(mbit/sec) 
Extended 
Extended 
Extended 
Extended 
Supported 
Supported 
Supported 
Supported 
Rates: 
Rates : 
Rates: 
Rates: 
6 (øxec) 
g (øx12) 
12 (øx18) 
18 (øx24)
  • Probe requests are always sent on the lowest supported data rates. In above examples they are sent at 1 Mb/s.
  • Probe response contain the requested information elements that may have been requested by the probing station. .e.g. below

Authentication & Deauthentication Frames (1011, subtype :11, 12) (wlan.fc.type_subtype == 0xb,  wlan.fc.type_subtype==0xc)

  • Used to authenticate to an AP to prepare association or roaming
  • Used to remove the AID (Authentication ID) and deauthenticate with an AP.
  • Frame body consists of
    • Authentication Algorithm Number – 0 for Open System and 1 for Shared Key
    • Authentication Transaction Sequence Number – Indicate current status of progress
    • Status Code – 0 for Success,1 for Unspecified failures
    • Challenge Text  Used in Shared Key Authentication frame 2 & 3
IEEE 802.11 Authentication, Flags: ..... ...C 
Type/ Subtype: Authentication (OxØØØb) 
v Frame Control Field: OxbØØØ 
00 
1011 
= Version: 
00.. = Type: Management frame (0) 
= Subtype: 11 
Flags: ØXØØ 
.øøø 0001 0011 1010 
= Duration: 314 microseconds 
Receiver address: RuckusWi_4f:d3:c8 (2c:5d:93:4f:d3:c8) 
Destination address: RuckusWi_4f:d3:c8 c8) 
Transmitter address: SamsungE_2d:6Ø:91 (5c:51:81:2d:6Ø:91) 
Source address: 
BSS Id: 
. øøøø 
= Fragment number: 
1101 1001 0001 
= Sequence number: 3473 
Frame check sequence: Oxa186b162 [unverified] 
[FCS Status: Unverified] 
IEEE 802.11 wireless LAN 
v Fixed parameters (6 bytes) 
Authentication Algorithm: Open System (0) 
Authentication SEQ: Ox0ØØ1 
Status code: Successful (Ox0ØØ0)



137 
•33: ab 
24. ø 
8ø2. 11 
—55 dBm 
• 33 : ab 
138 
• a4:2e 
8ø2 . 11 
24. 
139 
•a4:2e 
8ø2.11 
140 
•a8:33 
•a4:2e 
8ø2 . 11 
24.0 
141 
lø. 644498 
lø. 645173 
lø. 645190 
lø. 646791 
lø. 646843 
Cisco 
5e:a7 
bf. 
:ec. 
5e:a7 
:ec. 
Cisco_bf. 
Cisco 
bf. 
(øø-. 
8ø2.1 
58 
112 
58 
277 
58 
—52 
—41 
2 
d Bm 
d Bm 
d Bm 
Ack 
Authentication 
Ack 
Association Request 
Ack 
CWAP-TEST 
24. 
132 
132 
132 
132 
Acknowledgement, Flags=..... 
Authentication, SN=1032, FN=ø, Flags=. 
Acknowledgement, Flags=..... 
Association Request, SN=2097, FN=ø, Flags=. 
Acknowledgement, Flags=..... 
SSID=CWAP-TEST

Association and Disassociation Frames (0000, subtype =0)(0001 subtype =1) wlan.fc.type_subtype==0 or wlan.fc.type_subtype==10

  • Simple 4-frame exchange (authentication request, ACK, authentication response & ACK) used to enter the authenticated and associated state with the AP.
  • After Association STA may either use the network (open system authentication) or begin the 802.1x/EAP authentication process if used.
  • The Disassociation frame is used to change from authenticated/associated state to “authenticated not associated state”. They contain a reason for disassociation. In case of below frame the reason code is unspecified reason.
802.11 radio information 
PHY type: 8ø2. lla (5) 
Turbo type: Non—turbo (ø) 
Data rate: 12.0 Mb/s 
channel: 108 
Frequency: 554%Hz 
Signal strength (dBm): —84dBm 
Noise level (dBm): —89dBm 
Signal/noise ratio (dB): 5dB 
TSE timestamp: 6964589ø3 
(Du ration: 44gsl 
IEEE 8ø2.11 Disassociate, Flags: ..... ...C 
Type/Subtype: Disassociate (øxøeea) 
Frame Control Field: exaøøø 
..øø = Version: e 
lølø 
= Type: management frame (e) 
= Subtype: lø 
Flags: øxee 
.øøø oøøø eø11 eeøø = Duration: 48 microseconds 
Receiver address: SamsungE_2d:øe:4ø (4c:66:41:2d:øø:4ø) 
Destination address: SamsungE_2d:øø:4e (4c:66: 41:2d 
Transmitter address: (2c:5d: 72:5c) 
source address: 72:5c) 
BSS Id: 
Fragment number: ø 
. eeøø = 
eøøø eøøø eløl 
= Sequence number: 5 
Frame check sequence: øx8043a47a [unverified] 
(FCS Status: Unverified] 
IEEE 8ø2.11 wireless LAN 
v Fixed parameters (2 bytes) 
Reason code: Unspecified reason 
( øxøool)

Reassociation Request and Response Frames – (0010, subtype : 2) (0011, subtype : 3) (wlan.fc.type_subtype == 0x2 or wlan.fc.type_subtype ==0x3)

  • These frames are used to roam to another AP within the ESS (extended service set) or to reconnect after brief disconnection.
  • The reassociation response frame will also include an AID for the STA and the status code indicating the reassociation success or failure.
8ø2.11 radio information 
Data rate: 7.0 Mb/s 
channel: 108 
Signal strength (percentage): 78* 
IEEE 8ø2.11 Reassociation Request, Flags: op.PR.F. 
Type/Subtype: Reassociation Request (Oxøø02) 
Frame Control Field: ex2øda 
eølø 
. .øø = Version: e 
= Type: management frame (e) 
= Subtype: 2 
Flags: øxda 
Duration/ID: 5391 (reserved) 
Receiver address: 
Destination address: 89: ba (c9:6a: 
Transmitter address: al:2a:51:84:9b:9e (al:2a:51:84:9b:9e) 
source address: 
BSS Id: 79) 
STA address: 
= Fragment number: ø 
ooøø 
— Sequence number: 1860 
0111 eløø eløø - 
HT control (+HTC): øx2473a9cd 
WEP parameters 
Initialization Vector: øx952d2a 
Key Index: ø 
WEP ICV: exac6532aø (not verified) 
Data (1514 bytes) 
Data: 73a428øa537ø8af4618Ø23beb54d94ba647d7ø892c5øc22cm 
(Length: 1514]

RTS / CTS – (1011, Subtype : 11), (1100, Subtype : 12) (wlan.fc.type_subtype == 0x2 or wlan.fc.type_subtype ==0x3)

  • RTS and CTS frames are used to clear the medium for transmission of larger frames.
  • The Duration Field in RTS/CTS is very important.
    • SIFS (Short Interframe Space) – Amount of time in m/s required for a wireless interface to process a received frame and to respond with resoonse frame.
    • RTS duration = SIFS(3) + CTS +  Data +  ACK(1)
    • CTS duration = SIFS(2) + Data + ACK(1)
info rmat 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 24.0 Mb/s 
Channel: 6 
Frequency: 2437MHz 
Signal strength (dBm) 
: -42dBm 
Noise level (dBm) 
: -96dBm 
Signal/noise ratio (dB): 54dB 
TSE timestamp: 94735155 
(Du ration: 28gs) 
IEEE 8ø2.11 Request-to-send, Flags: ..... ...C 
Type/Subtype: Request—to—send (exøølb) 
Frame Control Field: exb4øø 
. .øø = Version: e 
løll 
= Type: Control frame (1) 
= Subtype: 11 
Flags: øxee 
.øøø oøøø løll eelø = Duration: 178 microseconds 
Receiver address: RuckusWi_cf:cf:d8 (2c:5d:93:cf:cf :d8) 
Transmitter address: 
Frame check sequence: øxbde58b2c (unverified] 
(FCS Status: Unverified]
802.11 radio information 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 24.0 Mb/s 
Channel: 1 
Frequency: 2412MHz 
Signal strength (dBm) 
: -83dBm 
Noise level (dBm) 
: -90dBm 
Signal/noise ratio (dB): 7dB 
TSE timestamp: 92681566 
[Du ration: 64gs) 
IEEE 8ø2.11 Clear-to-send, Flags: .pm.R.FTC 
Type/Subtype: Clear—to—send (øx001c) 
Frame Control Field: exc66b 
. .10 = Version: 2 
= Type: Control frame (1) 
. — Subtype: 12 
lløø - 
Flags: øx6b 
Duration/ID: 11803 (reserved) 
Receiver address: 
Frame check sequence: øx1b21827a (unverified] 
(FCS Status: Unverified]
  • CTS-to-self > is another method of performing NAV (Network Allocation Vector) distribution that use only CTS frames. It is used strictly as a protection mechanism for mixed mode environment.

Acknowledgement Frames (ACK)(1011, Subtype : 13) (wlan.fc.type_subtype == 0x1d)

  • These frames are sent right after data/management frames to inform(ack) the transmitter.
  • With ACK frame, the transmitter assumes the frame was lost due to the corruption from interface or some other issue, and so retransmits the frame.
  • ACK frame includes Frame Control, Duration, RA and FCS subfields
802.11 radio information 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 12.0 Mb/s 
Channel: 11 
Frequency: 2462MHz 
Signal strength (dBm) 
: -85dBm 
Noise level (dBm) 
: -90dBm 
Signal/noise ratio (dB): 5dB 
TSE timestamp: 91694972 
[Du ration: 32gs) 
IEEE 8ø2.11 Acknowledgement, Flags: .C 
Type/Subtype: Acknowledgement (exøøld) 
Frame Control Field: exd4ee 
. .øø = Version: e 
1101 
= Type: Control frame (1) 
= Subtype: 13 
Flags: øxoe 
.øøø oøøø eøøø eeøø = Duration: e microseconds 
Receiver address: (fc: 
Frame check sequence: øx66678fb7 (unverified] 
[FCS Status: Unverified]
  • Duration Field value is set to : Duration Value of previous frame + ACK(1) + SIFS(1)

Null Data & PS-Poll Frames (0100 Subtype : 4) (wlan.fc.type_subtype == 0x24) or (wlan.fc.type_subtype == 0x1a)

  • Null Data Frames  are used to notify an AP that the STA is awake and able to receive the frames. 
  • It is simply a data frame with no date in the Frame Body field.
8ø2.11 radio 
info rmation 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 24.0 Mb/s 
Channel: 11 
Frequency: 2462MHz 
Signal strength (dBm) 
: -88dBm 
Noise level (dBm) 
: -96dBm 
Signal/noise ratio (dB): 8dB 
TSE timestamp: 54ø37578 
(Du ration: 92gsl 
IEEE 8ø2.11 Nutt function (No data), Flags: o.m. .MFTC 
Type/Subtype: Nutt function (No data) (øxee24) 
Frame Control Field: ex4ba7 
.. 11 = Version: 3 
Type: Data frame (2) 
lø.. = 
eløø 
= Subtype: 4 
Flags: øxa7 
Duration/ID: 11355 (reserved) 
Receiver address: 1b: 
Transmitter address: ce:2f :9e 
Destination address: 89:ae:ø6:4e:6d:7e (89:ae:ø6:4e:6d:7ø) 
source address: by: 13: 
= Fragment number: 12 
lløø 
1110 lløl eølø 
= Sequence number: 3794 
Frame check sequence: øxa0bff4b1 [unverified] 
(FCS Status: Unverified]
  • PS-Poll on the other hand are used to notify the AP that the client STA is awake and available for buffered frames.
  • STA indicate the power save mode using the Power Management bit the Frame Control field. When a STA is in PM mode = 1 it alternates between awake and sleep states.
v 8ø2.11 radio information 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 24.0 Mb/s 
Channel: 11 
Frequency: 2462MHz 
Signal strength (dBm): —88dBm 
Noise level (dBm) 
: -96dBm 
Signal/noise ratio (dB): 8dB 
TSE timestamp: 54143357 
(Du ration: 1ø4gsl 
IEEE 8ø2.11 Power-save poll, Flags: 
...P.M.TC 
Type/Subtype: Power—Save pott (exøøla) 
Frame Control Field: exa415 
..øø = Version: e 
= Type: Control frame (1) 
= Subtype: lø 
lølø 
Flags: øx15 
. løø eløø lløø eløl = Duration: 17605 microseconds 
Receiver address: fc. 
•55 
BSS Id: 
Transmitter address: 24. 
•f5:e8 
(unverif iedl 
Frame check sequence: øxb471eø46 
(FCS Status: Unverified]
  • AP may send buffered data frames to the client in two ways.
    • If the data belongs to legacy power-save queue, transmission follows the legacy power save.
    • If the data belongs to WMM Power Save queue, data frames are downloaded according to a trigger-and-delivery mechanism.

Useful Links for this Post :

How did I Decipher 802.11 Frames! #CWAP-2

Main Objective: To successfully transfer every bit of information(data) from one device to another.

802.11 MAC HEADER

Let us now go through the basics of the frame header and the components. I have captured a simple beacon (management) frame using Wireshark.

I will briefly explain each of the fields. Notice the number in the bracket refers to the bytes. For memory 1 Byte = 8 bits. 🙂

802.11 Beacon frame capture
Frame Control Field dissection

Frame Control > 16 bits | 2 Bytes – contains 11 subfields as displayed in the above examples. Considering the amount of valuable information contained in 802.11 Frame Control sub-fields is mind-boggling

Protocol Version (2 bits): For now, always set to 0 by default. Changes in the version are expected in the future.

Type: Management (0,0), Data(1,0), Control(0,1), Extension Frame(1,1)*only available with 802.11D

Sub Type (4 bits): There are different kinds of management, control and data frames. Therefore the 4-bit Subtype field is required to differentiate. The above examples have Beacon & ACK subtypes.

To DSif set to “1” – Frame going from STA > Distribution System (DS)
From DSif set to “1” – Frame going from DS > STA


To DS = 0, From DS = 0  > Management or Control frames where it does not go to DS, Can be STA to STA communication in an ADHOC/IBSS setup.
To DS =0, From DS = 1 > Downstream traffic from AP to the STA.
To DS =1, From DS = 0 > Upstream traffic from STA to AP
To DS =1, From DS = 1 > Data frame using 4 MAC header format, usually occurs in WDS or Mesh Network
.

More Fragments – If set to “1” it is usually preceded by another fragment of current MSDU or MMPDU to follow.

Retry – 0 or 1. 1 is for retransmissions. Lot of 1’s may indicate a network with a lot of retry rate due to some issue. The issues can impact the performance by increased application/network latency thereby degrading user experience.

Power Management – if set to “1”, STA is using power save mode.

More Data: if set to “1” it indicates that the AP or STA is holding more frames for the STA to which the current frame is targeted.

Protected Frame – if set to “1” it indicates payload is encrypted.

Order – If set to “1” in any non-QoS data frame when a higher layer has requested that the data be sent using strictly ordered CoS, which tells the receiving STA to process the frames in order.

Duration/ID > 2 Bytes | 16 bits – May be used for 2 purposes, it may contain the duration of the frame. Secondly, it may contain association identifier (AID) of the STA that transmitted the frame.

Address 1,2,3 and 4: Each address contains 6bytes/48 bits of data.

SA > Source Address
DA > Destination Address
TA > Transmitting Address
RA > Receiving Address
BSSID >

Sequence Control Field (2 Bytes/16 bits): Divided into 4-bit fragment number and a 12-bit sequence number. Used when MSDUs are fragmented. 802.11-2016 allows for fragmentation of frames.

QoS Control Field: (2 Bytes/16 bits): Only used in MAC header of QoS frames. Sometimes referred to as WMM (Wi-Fi Multimedia) which provides traffic prioritization.

HT Control Field (4 bytes/32 bits): Parameters related to HT & VHT operations. Only used in Management + QoS control frames.

Frame Body: Contains the actual MSDU payload to be transmitted.

FCS: (Frame check sequence field 4Bytes/32 Bits) – Final field on the frame header. Also known as Trailer as the word says. Used to detect errors in communication.

CWAP 403 – Start >

I will be summarising each chapter on the Certitrek Publishing – Official Study Guide for CWAP 403 Exam.

I’ve learned plenty of concepts from the first chapter – 802.11 – The Protocol. This is one of the chapters which you have to read and learn. One may not learn the contents of this chapter directly while working or experience this in his/her day today. Following the posts should give you a fair idea of what the chapter entails and get close to fulfilling the exam requirements. You still have to go through the book multiple times and revise the concepts discussed in the CWNA exam to fully grasp the knowledge required for this exam.

OSI Layers

(APSTNDP) – For the purpose of our CWAP exam we will be concentrating our efforts on layer 1-4 only. More so we have to aim at learning layers 1 and 2 as IEEE 802.11 is focussed around them.

IEEE 802.3(Ethernet) & 802.11 (WLAN) operate primarily at Layers 1 & 2 of the OSI model. The Internet Engineering Task Force (IETF) operates at Layer 3 & 4.

Layer 4 is typically TCP/UDP. TCP is a connection-oriented protocol that uses a 3-way handshake, whereas UDP is a connectionless protocol typically used in time-sensitive applications where occasionally dropping packets is better than waiting.

Layer 3 is typically IP with the exception of WAN related protocols like HDLC, ATM, Frame Relay, etc.

Layer 2 (Data Link layer) – This is subdivided into MAC(lower) + LLC (upper). Frames are organized and meaningful collection of bits that are prepended and appended to upper-layer data within the network communications. When Network layer 3 sends data to the Data-Link layer (2), the data is handed off to the LLC and becomes known as MSDU (MAC Service Data Unit). The MSDU consists of data payload that contains the IP packet + some LLC data. When LLC sends the MAC service data unit info to the MAC sublayer, the MAC header information gets added in a MAC Protocol Data Unit (MPDU).

Layer 1 (PHY) – Physical Medium can be RF, Light Waves, Fibre cables. Capabilities include encoding, modulation, demodulation, timing & signals. This layer is subdivided into PLCP (Physical Layer Convergence protocol – Upper) & PMD (Physical Medium Dependent). The PLCP sublayer prepares the frame for transmission by taking the frame from the MAC sublayer and creating the PLCP Protocol Data Unit (PPDU).


802.11 Physical Layers

Protocol Year (adopted) Frequency Channel Width (MHz) MIMO PHY
802.11az Late 2021 60 GHz      
802.11ay 2020 60 GHz 8000 MU-MIMO EDMG
802.11ax Late 2019 2.4 or 5GHz 20,40,80, 160 MU-MIMO HEW
802.11ac wave2 2015 5 GHz 20,40,80, 160 MU-MIMO VHT
802.11ac wave1 2014 5 GHz 20,40,80 SU-MIMOVHT
802.11n 2009 2.4 or 5 GHz 20,40 SU-MIMOHT
802.11g 2003 2.4 GHz 20 N/A ERP
802.11a 1999 5 GHz 22 N/A OFDM
802.11b 1999 2.4 GHz 20 N/A HR-DSSS
802.11 Prime 1997 2.4 GHz 22 N/A DSSS

Modulation is the process of imposing bits on a transmission medium. I have detailed the keying methods useful in understanding the basics of Modulation here. Also, refer to mcsindex.com for numbers related to Modulation and Coding. We will be exploring in detail about this in the forthcoming chapters which entail about PHY Layers and Technologies.

Troubleshooting Methods

The industry troubleshooting methods e.g. from Cisco, Microsoft or CompTIA are not tested on the CWAP exam. The CWAP exam objectives list the following troubleshooting actions.

  • Define the Problem
  • Identify the Scale of the Problem
  • Identity Probable Causes
  • Capture and Analyze the Data (Most of the CWAP concentrated here)
  • Observe the Problem
  • Choose appropriate Remedial Steps.
  • Document the Problem and Resolution.

Special Thanks to Rasika as I’ve learned a lot from his blogs.

Summary of the 802.11 Mac Header

Network Layer – IP header is added.
Data Link Layer – MAC header is added.
Physical Layer – PHY header is added.


Data is eventually transmitted as individual bits at the Physical layer.

BIT > 0/1, Octet > Byte of data.
Data Link Layer – LLC (802 based networks), MAC

MAC Service Data Unit > When network layer sends data to the Data Link layer, the data is handed off to the LLC and becomes MSDU

MSDU = IP Packet + Some LLC Data.

Only 802.11 Data Frames carry MSDU – Ratification 802.11n-2009, introduced A-MSDU

MSDU = 2304 Octets, A-MSDU = up to 7935 Octets.

MAC Protocol Data Unit > When the LLC sublayer sends MSDU to the MAC sublayer, the MAC header info is added to identify it.

MPDU = MAC Header + Frame Body(MSDU) + FCS (Trailer)
A-MPDU > transmissions are created by transmitting multiple MPDUs as one PHY frame as opposed to A-MSDU transmissions, which are created by passing MSDUs down the PHY layer as single MPDU.

Physical Layer comprises of PLCP & PMD – PLCP prepares the frame for transmission by taking the frame MAC sublayer and creating the PLCP Protocol Data Unit.

PPDU = PLCP + Frame from Mac Layer.

PLCP Service Data Unit > Pretty much like MPDU at PHY layer.
PLCP = PPDU + PSDU

CWNA Certification Journey

CWNA

I managed to get my CWNA certification today, this was my 2nd attempt. The first attempt was a failure a few months ago.

Failed Attempt: 53%

Passed Attempt: 82%

Below are a few tips which I would like to share so that you get most for this certification.

It would be quite beneficial if you already work for a Network/Wireless service provider or Manage wireless network for a company. Being in such a position certainly pays and gives room for joining the pieces of this puzzle.

This course will require some monetary investment. I managed to get some certification videos. Though the videos are for old CWNA course but majority of the conceptual stuff does not change for new revision. Here is the link > https://www.udemy.com/certified-wireless-network-administrator-cwna/

There are no video training courses available on CBT nuggets or INE as of today. I did check with CBT Nuggets via twitter but they do not have any official dates for the.

So back to the actual course curriculum. It would be highly beneficial to check the course outline and objectives – https://www.cwnp.com/uploads/cwna-107-objectives-2017.pdf You can check the differences from CWNA 106 so that you can prepare better https://www.cwnp.com/uploads/cwna-107-what-changed-2017.pdf

If would be good a good buy to get the new sybex CWNA official study guide > https://www.wiley.com/WileyCDA/WileyTitle/productCd-1119425786,miniSiteCd-SYBEX.html

This one is quite a thick book with over 1000 pages. I guess this book will be used throughout your career in wireless as a reference guide and a starting point for everything wireless. Some great work by the 2 David(s) Westcott & Coleman. When you buy the book you also get online flash cards + practice test questions valid for 1 year which you can use for further strengthen your knowledge.

Would be great and worth downloading the common terms used in the exam/book for the CWNA – https://www.cwnp.com/wp-content/uploads/pdf/cwnp_exam_terms.pdf

I read almost 1-2 chapters per week. The book might give you a feeling of information overload every once in a while. Another resource which I used during the preparation were some podcasts listed below.

  1. CleartoSend – https://www.cleartosend.net/
  2. WLAN Professional – https://www.wlanpros.com/
  3. Packet Pushers – https://packetpushers.net/
  4. WiFi for Beginners – https://wififorbeginners.com/category/podcast/

Twitterati (Twitterverse/Twitter users) – Would highly recommend you to join and follow the wireless enthusiasts. Thankful to the wireless online community! Many of them have a vast industry experience and certifications which go a long way in helping and coaching someone who is new to the wireless domain.

Slack Groups to recommended –
wi-fipros.slack.com
cleartosend.slack.com

All the best with your CWNA Study and the Exam! Please buy the exam voucher directly form CWNP website  (https://www.cwnp.com/cwna107v/) rather than going directly via PearsonVue. I saved $50USD by doing so.

I am on to the next Adventure of CWAP and will try and blog more often about the learnings from the course study.

CWNA – Chapter 2 Summary & Exam Essentials

CWNA Chapter 2 – IEEE 802.11 Standards and Amendments.

“Defined” means the amendment either no longer exists or it was rolled into the existing (or prior versions) 802.11-2007 spec. “Defines” means it is a ratified amendment that will be rolled into 802.11-2011. “Will define” means it is a work in progress and not yet amended.

802.11-1997 (sometimes called 802.11 “prime”) — the original 802.11 specifications included the base functionality along with FHSS and DSSS PHYs.

802.11a — Defined OFDM usage in 5 GHz with data rates up to 54 Mbps.
802.11b —Defined 5.5 and 11 Mbps with HR/DSSS in 2.4 GHz.
802.11c — Defined MAC bridging for 802.11. Was incorporated into 802.1D.

802.11-1999 rolled up 802.11 prime with new enhancements.

802.11d — Defined 802.11 operation in new regulatory domains.
802.11e — Defined QoS
802.11F — Recommended Inter-Access Point Protocol (IAPP) for interoperability of different vendor products. Was not used by anyone and is now withdrawn.

Note: A capital letter designates a recommended practice standalone standard (similar to 802.1X). A lowercase letter designates an amendment to a parent standard. Hence, 802.11F was designed to be a standalone document (and also happened to be a recommended practice), not a part of the full 802.11 standards. This is often a confusing topic in standards naming.

802.11g — Defined ERP PHY, which introduces data rates up to 54 Mbps in 2.4 GHz.

802.11-R2003 rolled up 802.11-1999 and prior amendments, excluding 802.11e.

802.11h — Defined Dynamic Frequency Selection (DFS) for radar detection and avoidance in some 5 GHz bands. Also defined Transmit Power Control (TPC) for managing client transmit power.
802.11i — Defined security enhancements including TKIP, CCMP, and use of 802.1X with WLANs.
802.11j — Defined 4.9 – 5 GHz operation in Japan.

802.11-2007 rolled up 802.11-R2003 with prior amendments.

802.11k — Defines radio resource management processes for RF data collection and sharing.
802.11l — Due to potential confusion between an “l” (letter) and “1” (number), 802.11l was bypassed.
802.11m — Was used as a maintenance amendment that updated inaccuracies, omissions, and ambiguities.
802.11n — Defines High Throughput (HT) PHY with MCS rates up to 600 Mbps in 2.4 GHz and 5 GHz.
802.11o — For similar reasons as 802.11l, 802.11o was bypassed. ‘Is that an “o” (letter) or a “0” (number)? I don’t know, let’s just skip it.’
802.11p — Defines wireless access for the vehicular environment (WAVE).
802.11q — Due to potential confusion with 802.1Q, 802.11q was bypassed.
802.11r — Defines fast BSS transitions (fast secure roaming). Maybe one of these days we’ll use it.
802.11s — Will define 802.11 mesh internetworking.
802.11T — Specified a way to test wireless performance prediction. Remember, capital letters are recommended practices standalone standards. 802.11T was canceled.
802.11u — Will define internetworking with external networks, such as cellular.
802.11v — Will define enhancements for network management.
802.11w — Defines protected management frames to prevent some security vulnerabilities.
802.11x — 802.11 technologies as a whole are often referred to as 802.11x, so this amendment was bypassed.
802.11y — Defines use of OFDM in 3650-3700 MHz.
802.11z —Defines enhancements to Direct Link Setup, which no one uses.
802.11aa — Will define enhancements to video transport streams.
802.11ab —Was bypassed to avoid confusion with devices using 802.11a and 802.11b PHY technologies, which are often abbreviated as 802.11ab.
802.11ac — Will define Very High Throughput (VHT) with gigabit speeds, building on 802.11n MIMO technology.
802.11ad — Will define short range Very High Throughput (VHT) in the 60 GHz spectrum.
802.11ae — Will define enhancements for QoS management.
802.11af — Will define the usage of Wi-Fi in newly opened TV whitespace frequencies.
802.11ag — Similar to 802.11ab, 802.11ag was skipped to avoid confusion with devices using 802.11a and 802.11g PHY technologies, which are often abbreviated as 802.11ag.
802.11ah — Will define the usage of Wi-Fi in frequencies below 1 GHz. Also used as an expression of Wi-Fi pleasure. 802.11…ah!
802.11ai — Will define FILS (fast initial link setup). Designed to address challenges in high-density environments which a large number of mobile users face.
802.11aj – Will define modifications to the IEEE 802.11ad-2012 amendment’s PHY and MAC layer to provide support to the Chinese Millimeter Wave (CMMW).
802.11ak – Will define amendment to General Link for use in bridged networks.
802.11aq – Will define delivery of network service information prior to the association of stations on 802.11 networks.
802.11ax – Will define HE(High Efficiency). Expected to be next big PHY enhancement to the 802.11 standards. Operate in both 2.4/5GHz.
802.11ay – Will define improvement of an 802.11ad amendment providing faster speeds.
802.11az – TBC