WLAN Medium Contention – #CWAP6

Accounts for 10% of the CWAP knowledge domain areas, approx. 6/60 questions

Medium Contention :Protocols that allow large number of devices to effectively share the wireless channel. All AP & STAs will contend with each other on a common transmission medium.

CSMA / CA – The AP/STAs (802.11) use carrier sense multiple access with collision avoidance as opposed to collision detection used by the Ethernet (802.3) realm.

802.11 devices must avoid multiple devices transmitting simultaneously over a shared medium which can cause failed transmissions. Wireless mediums cannot detect collision but find ways to avoid them. Collision handling is not straight forward and may be time consuming at times. Hence one of the reasons that 802.11(WLANs) have much lower throughput-to-data rate ratio than 802.3(Wired LANs).

CSMA/CA uses DCF (Distributed Coordination Function)  for non-QoS WLANs & HCF (Hybrid Coordination Function) for QoS WLANs using EDCA (Enhanced Distributed Channel Access).

There are two carrier sense protocols used by the stations to indicate whether a channel is busy or idle.

  • Physical Carrier Sense, also known as CCA (Clear Channel Assessment)
  • Virtual Carrier Sense, also known as NAV (Network Allocation Vector)

Both QoS & non-QoS use either of the above protocols for transmitting data.

CCA (Layer 1) > Identify whether the channel is unused and available prior to the packet transmission.

  • Channel Occupied = State of Busy ~ Energy Detection Levels.
  • Channel Clear = State of Idle

Apply to 802.11 modulation, if the AP or STA is too far away to detect any transmission at requisite energy level, the CCA may go into the idle state even though the channel is still occupied.

NAV (Layer 2) > is a timer that counts down toward zero(0). When a device has a NAV value greater than zero, the device says quiet. Once the NAV = 0, the medium is considered clear.

As discussed earlier, CCA may fail to keep other devices on the channel quiet (Too far transmitting device, obstruction, interference), the design of the NAV keeps APs and stations quiet.

Duration value in the 802.11 header set the NAV values for AP and STAs.

It is vital for the AP and STA to stay with the RSSI data range in order to successfully demodulate a transmitted frame so that the Duration/ID field in the header can be accurately set.

Interframe Spaces

When 2 or more STAs begin frame transmission at the same time in the idle environment, collisions are bound to happen. Hence we have additional medium contention protocols beyond CCA & NAV. These protocols must keeps AP and STAs quiet like CCA/NAV & also allow differentiated medium access.

IFS is the quiet period that AP & STA must wait before any 802.11 frame transmission.

TIPS to Remember!

  • If the contention has been completed, then a reduced IFS (RIFS) or short IFS (SIFS) will be used. Most cases it is SIFS but RIFS is only used between consecutive frames transmitted by 802.11n device.
  • If the contention/arbitration is not determined, then arbitration IFS (AIFS) or DCF IFS (DIFS) will be used. The AIFS is used for WLANs that support 802.11e QoS, and the DIFS is used for WLANs that do not support 802.11e QoS.
  • If an AP or STA has received a corrupted frame as defined by having an incorrect FCS, then extended IFS will be used.
  • PCF IFS (PIFS) is part of PCF and therefore not used in real world. (May be ignored for CWAP prep!)
  • 802.11 FHSS network use 50ms slot time.
  • Steps involved for a STA to go through before starting the frame transmission in the wireless medium (Source : 802.11 Arbitration CWNP White Paper)
FIGURE 3 
— Arbitration Flowchart 
is clear 
idle F 
"S inte rval 
it one is 
timer one slot. 
to 
(NAV) 
Is NAV O• 
Transmit Frame

SIFS >

  • Foundation of all IFSs.
  • 10ms for 802.11b/g/n (2.4GHz)
  • 16ms for 802.11a/n (5GHz).
  • It is used after contention/arbitration is completed. Exception being 802.11n device using MIMO to transmit frames then RIFS is used.

RIFS >

  • Simplest IFS to understand.
  • Length is always the same 2ms.
  • Only for devices which use 802.11n/MIMO.
  • It precedes for only “data” frame.

DIFS >

  • Designed to force AP and STA with ordinary data in the queue to stay quiet for enough time to allow QoS frames to have access to the channel.
  • It is used when arbitration process has not yet completed.
  • DIFS is equal to length of SIFS + 2 slot times. Slot times are quiet periods, similar to IFS.
  • They are equal to 9ms for 802.11a/n/ac operating in 5GHz and 802.11g/n with 2.4GHz.
  • The 20ms slot is used if the HT or ERP is used with long preamble and 802.11b/g/n 2.4 GHz DSSS.
  • The short preamble is default setting when HT or ERP is used.

EIFS >

  • Designed to give AP and STA a chance to retransmit after a failed frame.
  • This happens when AP/STA failed to receive ACK after transmission.
  •  EIFS = SIFS + DIFS plus the time taken acknowledge the frame to transmit.
  • 802.11b/g/n(2.4GHz) using DSSS= 364ms, 802.11a/n(5GHz) & 802.11g/n (2.4GHz) = 160ms. EIFS is the longest of the IFS.

Near/Far Problem : STA closer to AP may cause problem to STA at far. When data is transmitted between AP and nearby STAs they can use higher data rate than far stations. (This is why STA dynamically switch their data rates downward when moving away from the AP). The frame therefore will appear to be corrupt even though it was successfully transmitted. The far STA have to stay quiet for an EIFS at the beginning of the arbitration process, while the near STA will be allowed to use the shorter DIFS.

PIFS > Equal to one slot time + 1 SIFS and it is designed to give AP the chance to send the beacon in order to begin the CFP (Contention Free Period). In real-world the PIFS is only used with Channel Switch Announcement frame, which is one of the Action frames from 802.11h.

RANDOM BACKOFF

The mechanism which prevents collision by differentiating 802.11 channel access is the Random Backoff. Unlike the IFS, the random backoff is not static. It is the period of time that changes based on a random number chosen by AP or STA.

AP and STA stay quiet during the random backoff by randomly choosing a number of slot times and then counting down until the number of slot times equal to zero. Transmission resumes after slot time equals zero.

  • For the random backoff to work, there must be an upper and lower limit to the number of slot times that ca be chosen.
  • The lower limit is always 0. The upper limit for the random backoff is equal to the contention window (CW). 
  • The CW is derived from the equation 2x – 1, where x is a value that increments with each failed frame. For DSSS-based networks, x starts at 5, which results in a CW of 31. For OFDM-based networks, x starts at 4, which results in a CW value of 15. For both DSSS and OFDM-based networks, the x value stops incrementing at 10, which results in a CW value of 1023.
  • Failed frames cause the contention window to grow exponentially. More quiet time means a less efficient channel thus causing latency and throughput issues.
Immediate access when 
Medium is idle DIFS or AlFSti1 
Busy Medium 
Defer Access 
AIFS 
AIFS(iJ 
DIFS 
PIFS 
SIFS 
Contention Window 
Backoff Slots 
Slot time 
Next Frame 
Select Slot and Decrement Backoff as long 
as medium is idle 
Figure 2.4: The DCF Operation Overview

QoS FRAMES

AIFS >

  • Used by QoS enabled STA to transmit all data, management, PS-Poll, RTS, CTS (when not transmitted as response to RTS), Block Ack Req and Block Ack (when not transmitted as a response to Block Ack Req).
  • Slot times in AIFS is called as AIFSN (slot number).
  • 802.11e specifies Voice (AV_VO), Video (AV_VI), Background (AV_BK) & Best Effort (AV_BE).
  • Video and Voice = 2 Slot times
  • Best Effort = 3 Slot times
  • Background = 7 Slot times
  • Calculate AIFS for a given Access Category = AIFSN[AC] x Slot Time x SIFSTime

TXOP

  • Transmit Opportunity or TXOP is the amount of time a STA can send frames when it has won contention for the wireless medium. This is in relation to EDCA (Enhanced Distributed Channel Access).
  • When a STA sends QoS data, it must first contend for the access to the wireless medium.
  • STAs perform CCA and determine if the channel is idle. It must have its NAV set to 0. Then it must wait for the appropriate InterFrame Spacing.
  • Then it would wait for the contention window to complete. CW has 4 categories as discussed in the previous section. Each category has different TXOP.
IEEE Std 802.11-2016 
IEEE Standard for Information Technolog—ocal and Metropolitan Area Networks—Specific Requirements 
part 1 1: Wreless LAN MAC and PHY Specifications 
Table 9-137—Default EDCA parameter Set element parameter values if dot110CBActivated is false 
T.xop limit 
AC BK 
AC BE 
AC VI 
AC VO 
aCW min 
ac Wmin 
(aCWmin + I 
(a CWmin+ 
CW max 
a CWmax 
a CWmax 
ac Wmin 
(a C Wmin+ I 
denned 
in Clauw IS 
16 
3.264 ms 
3.2"ms 
6.016 ms 
Fm, PHYS 
Clause 17, 
Clauw IS, 
19. 
2.52Sms 
2.52Sms 
4.096 ms 
2.080 ms 
For denned 
in 22 
22.56 ms 
(BCU. 60r7 
MHz). 
16.92 ms 
(BCU. S MHz) 
1128 ms 
(BCU 60r7 
MHz). 
S.46ms(BCU: 
S MHz) 
Other 
PHYs

Key 802.11 Frames – CWAP#3

This post covers the important 802.11 Frames which can help in performing the analysis and troubleshoot any issues related to WLAN networks. I have referenced Wireshark filters for the ease of each frame.

Beacon (1000, Subtype : 8) (wlan.fc.type_subtype == 0x08)

  • Used to announce the Basic Service Set (BSS) for the Client (STAs).
  • Transmitted by AP every 100 time units.  1 TU = 1024 microseconds. Default is 102.4 m/s
  • To reduce any potential overhead, TU values might need adjustment in some cases where multiple SSIDs exist on AP radio.
IEEE 8ø2.11 wireless LAN 
Fixed parameters (12 bytes) 
Timestamp: 5304013374 
Beacon Interval: ø. 1024øø (Seconds) 
Capabilities Information: exø421 
Tagged 
Tag : 
Tag : 
Tag : 
Tag 
Tag: 
Tag : 
Tag : 
Tag: 
Tag: 
Tag : 
Tag : 
Tag : 
parameters (144 bytes) 
SSID parameter set: Hob—guest 
supported Rates 12(B), 18, 24(B), 36, 48, 54, [Mbit/secl 
DS Parameter set: Current Channel: 1 
: Traffic Indication map (TIM): DTIM ø of ø bitmap 
Country Information: Country Code NZ, Environment Any 
ERP Information 
Vendor Specific: Microsoft Corp.: H%/WME: Parameter Element 
HT capabilities (8ø2.11n DI. 10) 
HT Information (8ø2.11n DI. lø) 
QBSS Load Element 802. lie CCA version 
Extended Capabilities (8 octets) 
Vendor Specific: Ruckus Wireless

Probe Request and Probe Response (0100, 0101 Subtype : 4 & 5) (wlan.fc.type_subtype == 0x4 or wlan.fc.type_subtype ==0x5)

  • Used for active scanning
  • STAs send the probe request, AP sends the probe response.
  • Amount of probing may be able to be reduced by adjusting the roaming aggressiveness on the client.
  • Probe request are sent to broadcast address (DA – ff:ff:ff:ff:ff:ff:ff)
  • Directed probe request are when STA sending probe request may specify the SSID they are looking, like in example below.
IEEE 8ø2.11 Probe Request, Flags: ..... ...C 
Type/Subtype: Probe Request (øxeeø4) 
Frame Control Field: ex4øoe 
. ..øø = Version: e 
eløø 
ø . — Type: Management frame (e) 
= Subtype: 4 
Flags: øxee 
. øøø oøøø eøøø eeøø = Duration: e microseconds 
Receiver address: Broadcast ff) 
Destination address: Broadcast ff:ff) 
Transmitter address: (fc:fc:48:5e:2b:33) 
Source address: Apple_5e:2b:33 (fc: fc:48: 
BSS Id: Broadcast (ff:ff:ff:ff:ff:ff) 
= Fragment number: ø 
eeøø 
0101 eøøø løøl 
= Sequence number: 1289 
Frame check sequence: øxda049ff4 (unverified] 
(FCS Status: Unverified] 
IEEE 8ø2.11 wireless LAN 
v Tagged parameters (141 bytes) 
Tag: SSID parameter set: Hob—wireless 
Tag Number: SSID parameter set (e) 
Tag length: 12 
SSID: Hob—wi re less 
Tag: Supported Rates 1, 2, 5.5, 11, (Mbit/sec) 
Tag Number: Supported Rates (1) 
Tag length: 4 
Suppo rted Rates: 1 (exø2) 
Suppo rted Rates: 2 (exø4) 
Suppo rted Rates: 5.5 (øxøb) 
Suppo rted Rates: 11 (ex16) 
Tag: Extended Supported Rates 6, 9, 12, 18, 24, 
Tag Number: Extended Suppo rted Rates (5ø) 
Tag length: 8 
36, 
48, 
54, 
(mbit/sec) 
Extended 
Extended 
Extended 
Extended 
Supported 
Supported 
Supported 
Supported 
Rates: 
Rates : 
Rates: 
Rates: 
6 (øxec) 
g (øx12) 
12 (øx18) 
18 (øx24)
  • The SSID value can also be set to 0, SSID field is present, but empty. This is called Wildcard SSID or null probe request, e.g. below
IEEE 8ø2.11 Probe Request, Flags: ..... ...C 
Type/Subtype: Probe Request (øxeeø4) 
Frame Control Field: ex4øoe 
. ..øø = Version: e 
eløø 
ø . — Type: Management frame (e) 
= Subtype: 4 
Flags: øxee 
. øøø oøøø eøøø eeøø = Duration: e microseconds 
Receiver address: Broadcast ff) 
Destination address: Broadcast ff:ff) 
Transmitter address: (fc:fc:48:5e:2b:33) 
Source address: Apple_5e:2b:33 (fc: fc:48: 
BSS Id: Broadcast (ff:ff:ff:ff:ff:ff) 
= Fragment number: ø 
eeøø 
0101 eøøø løøl 
= Sequence number: 1289 
Frame check sequence: øxda049ff4 (unverified] 
(FCS Status: Unverified] 
IEEE 8ø2.11 wireless LAN 
v Tagged parameters (141 bytes) 
Tag: SSID parameter set: Hob—wireless 
Tag Number: SSID parameter set (e) 
Tag length: 12 
SSID: Hob—wi re less 
Tag: Supported Rates 1, 2, 5.5, 11, (Mbit/sec) 
Tag Number: Supported Rates (1) 
Tag length: 4 
Suppo rted Rates: 1 (exø2) 
Suppo rted Rates: 2 (exø4) 
Suppo rted Rates: 5.5 (øxøb) 
Suppo rted Rates: 11 (ex16) 
Tag: Extended Supported Rates 6, 9, 12, 18, 24, 
Tag Number: Extended Suppo rted Rates (5ø) 
Tag length: 8 
36, 
48, 
54, 
(mbit/sec) 
Extended 
Extended 
Extended 
Extended 
Supported 
Supported 
Supported 
Supported 
Rates: 
Rates : 
Rates: 
Rates: 
6 (øxec) 
g (øx12) 
12 (øx18) 
18 (øx24)
  • Probe requests are always sent on the lowest supported data rates. In above examples they are sent at 1 Mb/s.
  • Probe response contain the requested information elements that may have been requested by the probing station. .e.g. below

Authentication & Deauthentication Frames (1011, subtype :11, 12) (wlan.fc.type_subtype == 0xb,  wlan.fc.type_subtype==0xc)

  • Used to authenticate to an AP to prepare association or roaming
  • Used to remove the AID (Authentication ID) and deauthenticate with an AP.
  • Frame body consists of
    • Authentication Algorithm Number – 0 for Open System and 1 for Shared Key
    • Authentication Transaction Sequence Number – Indicate current status of progress
    • Status Code – 0 for Success,1 for Unspecified failures
    • Challenge Text  Used in Shared Key Authentication frame 2 & 3
IEEE 802.11 Authentication, Flags: ..... ...C 
Type/ Subtype: Authentication (OxØØØb) 
v Frame Control Field: OxbØØØ 
00 
1011 
= Version: 
00.. = Type: Management frame (0) 
= Subtype: 11 
Flags: ØXØØ 
.øøø 0001 0011 1010 
= Duration: 314 microseconds 
Receiver address: RuckusWi_4f:d3:c8 (2c:5d:93:4f:d3:c8) 
Destination address: RuckusWi_4f:d3:c8 c8) 
Transmitter address: SamsungE_2d:6Ø:91 (5c:51:81:2d:6Ø:91) 
Source address: 
BSS Id: 
. øøøø 
= Fragment number: 
1101 1001 0001 
= Sequence number: 3473 
Frame check sequence: Oxa186b162 [unverified] 
[FCS Status: Unverified] 
IEEE 802.11 wireless LAN 
v Fixed parameters (6 bytes) 
Authentication Algorithm: Open System (0) 
Authentication SEQ: Ox0ØØ1 
Status code: Successful (Ox0ØØ0)



137 
•33: ab 
24. ø 
8ø2. 11 
—55 dBm 
• 33 : ab 
138 
• a4:2e 
8ø2 . 11 
24. 
139 
•a4:2e 
8ø2.11 
140 
•a8:33 
•a4:2e 
8ø2 . 11 
24.0 
141 
lø. 644498 
lø. 645173 
lø. 645190 
lø. 646791 
lø. 646843 
Cisco 
5e:a7 
bf. 
:ec. 
5e:a7 
:ec. 
Cisco_bf. 
Cisco 
bf. 
(øø-. 
8ø2.1 
58 
112 
58 
277 
58 
—52 
—41 
2 
d Bm 
d Bm 
d Bm 
Ack 
Authentication 
Ack 
Association Request 
Ack 
CWAP-TEST 
24. 
132 
132 
132 
132 
Acknowledgement, Flags=..... 
Authentication, SN=1032, FN=ø, Flags=. 
Acknowledgement, Flags=..... 
Association Request, SN=2097, FN=ø, Flags=. 
Acknowledgement, Flags=..... 
SSID=CWAP-TEST

Association and Disassociation Frames (0000, subtype =0)(0001 subtype =1) wlan.fc.type_subtype==0 or wlan.fc.type_subtype==10

  • Simple 4-frame exchange (authentication request, ACK, authentication response & ACK) used to enter the authenticated and associated state with the AP.
  • After Association STA may either use the network (open system authentication) or begin the 802.1x/EAP authentication process if used.
  • The Disassociation frame is used to change from authenticated/associated state to “authenticated not associated state”. They contain a reason for disassociation. In case of below frame the reason code is unspecified reason.
802.11 radio information 
PHY type: 8ø2. lla (5) 
Turbo type: Non—turbo (ø) 
Data rate: 12.0 Mb/s 
channel: 108 
Frequency: 554%Hz 
Signal strength (dBm): —84dBm 
Noise level (dBm): —89dBm 
Signal/noise ratio (dB): 5dB 
TSE timestamp: 6964589ø3 
(Du ration: 44gsl 
IEEE 8ø2.11 Disassociate, Flags: ..... ...C 
Type/Subtype: Disassociate (øxøeea) 
Frame Control Field: exaøøø 
..øø = Version: e 
lølø 
= Type: management frame (e) 
= Subtype: lø 
Flags: øxee 
.øøø oøøø eø11 eeøø = Duration: 48 microseconds 
Receiver address: SamsungE_2d:øe:4ø (4c:66:41:2d:øø:4ø) 
Destination address: SamsungE_2d:øø:4e (4c:66: 41:2d 
Transmitter address: (2c:5d: 72:5c) 
source address: 72:5c) 
BSS Id: 
Fragment number: ø 
. eeøø = 
eøøø eøøø eløl 
= Sequence number: 5 
Frame check sequence: øx8043a47a [unverified] 
(FCS Status: Unverified] 
IEEE 8ø2.11 wireless LAN 
v Fixed parameters (2 bytes) 
Reason code: Unspecified reason 
( øxøool)

Reassociation Request and Response Frames – (0010, subtype : 2) (0011, subtype : 3) (wlan.fc.type_subtype == 0x2 or wlan.fc.type_subtype ==0x3)

  • These frames are used to roam to another AP within the ESS (extended service set) or to reconnect after brief disconnection.
  • The reassociation response frame will also include an AID for the STA and the status code indicating the reassociation success or failure.
8ø2.11 radio information 
Data rate: 7.0 Mb/s 
channel: 108 
Signal strength (percentage): 78* 
IEEE 8ø2.11 Reassociation Request, Flags: op.PR.F. 
Type/Subtype: Reassociation Request (Oxøø02) 
Frame Control Field: ex2øda 
eølø 
. .øø = Version: e 
= Type: management frame (e) 
= Subtype: 2 
Flags: øxda 
Duration/ID: 5391 (reserved) 
Receiver address: 
Destination address: 89: ba (c9:6a: 
Transmitter address: al:2a:51:84:9b:9e (al:2a:51:84:9b:9e) 
source address: 
BSS Id: 79) 
STA address: 
= Fragment number: ø 
ooøø 
— Sequence number: 1860 
0111 eløø eløø - 
HT control (+HTC): øx2473a9cd 
WEP parameters 
Initialization Vector: øx952d2a 
Key Index: ø 
WEP ICV: exac6532aø (not verified) 
Data (1514 bytes) 
Data: 73a428øa537ø8af4618Ø23beb54d94ba647d7ø892c5øc22cm 
(Length: 1514]

RTS / CTS – (1011, Subtype : 11), (1100, Subtype : 12) (wlan.fc.type_subtype == 0x2 or wlan.fc.type_subtype ==0x3)

  • RTS and CTS frames are used to clear the medium for transmission of larger frames.
  • The Duration Field in RTS/CTS is very important.
    • SIFS (Short Interframe Space) – Amount of time in m/s required for a wireless interface to process a received frame and to respond with resoonse frame.
    • RTS duration = SIFS(3) + CTS +  Data +  ACK(1)
    • CTS duration = SIFS(2) + Data + ACK(1)
info rmat 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 24.0 Mb/s 
Channel: 6 
Frequency: 2437MHz 
Signal strength (dBm) 
: -42dBm 
Noise level (dBm) 
: -96dBm 
Signal/noise ratio (dB): 54dB 
TSE timestamp: 94735155 
(Du ration: 28gs) 
IEEE 8ø2.11 Request-to-send, Flags: ..... ...C 
Type/Subtype: Request—to—send (exøølb) 
Frame Control Field: exb4øø 
. .øø = Version: e 
løll 
= Type: Control frame (1) 
= Subtype: 11 
Flags: øxee 
.øøø oøøø løll eelø = Duration: 178 microseconds 
Receiver address: RuckusWi_cf:cf:d8 (2c:5d:93:cf:cf :d8) 
Transmitter address: 
Frame check sequence: øxbde58b2c (unverified] 
(FCS Status: Unverified]
802.11 radio information 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 24.0 Mb/s 
Channel: 1 
Frequency: 2412MHz 
Signal strength (dBm) 
: -83dBm 
Noise level (dBm) 
: -90dBm 
Signal/noise ratio (dB): 7dB 
TSE timestamp: 92681566 
[Du ration: 64gs) 
IEEE 8ø2.11 Clear-to-send, Flags: .pm.R.FTC 
Type/Subtype: Clear—to—send (øx001c) 
Frame Control Field: exc66b 
. .10 = Version: 2 
= Type: Control frame (1) 
. — Subtype: 12 
lløø - 
Flags: øx6b 
Duration/ID: 11803 (reserved) 
Receiver address: 
Frame check sequence: øx1b21827a (unverified] 
(FCS Status: Unverified]
  • CTS-to-self > is another method of performing NAV (Network Allocation Vector) distribution that use only CTS frames. It is used strictly as a protection mechanism for mixed mode environment.

Acknowledgement Frames (ACK)(1011, Subtype : 13) (wlan.fc.type_subtype == 0x1d)

  • These frames are sent right after data/management frames to inform(ack) the transmitter.
  • With ACK frame, the transmitter assumes the frame was lost due to the corruption from interface or some other issue, and so retransmits the frame.
  • ACK frame includes Frame Control, Duration, RA and FCS subfields
802.11 radio information 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 12.0 Mb/s 
Channel: 11 
Frequency: 2462MHz 
Signal strength (dBm) 
: -85dBm 
Noise level (dBm) 
: -90dBm 
Signal/noise ratio (dB): 5dB 
TSE timestamp: 91694972 
[Du ration: 32gs) 
IEEE 8ø2.11 Acknowledgement, Flags: .C 
Type/Subtype: Acknowledgement (exøøld) 
Frame Control Field: exd4ee 
. .øø = Version: e 
1101 
= Type: Control frame (1) 
= Subtype: 13 
Flags: øxoe 
.øøø oøøø eøøø eeøø = Duration: e microseconds 
Receiver address: (fc: 
Frame check sequence: øx66678fb7 (unverified] 
[FCS Status: Unverified]
  • Duration Field value is set to : Duration Value of previous frame + ACK(1) + SIFS(1)

Null Data & PS-Poll Frames (0100 Subtype : 4) (wlan.fc.type_subtype == 0x24) or (wlan.fc.type_subtype == 0x1a)

  • Null Data Frames  are used to notify an AP that the STA is awake and able to receive the frames. 
  • It is simply a data frame with no date in the Frame Body field.
8ø2.11 radio 
info rmation 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 24.0 Mb/s 
Channel: 11 
Frequency: 2462MHz 
Signal strength (dBm) 
: -88dBm 
Noise level (dBm) 
: -96dBm 
Signal/noise ratio (dB): 8dB 
TSE timestamp: 54ø37578 
(Du ration: 92gsl 
IEEE 8ø2.11 Nutt function (No data), Flags: o.m. .MFTC 
Type/Subtype: Nutt function (No data) (øxee24) 
Frame Control Field: ex4ba7 
.. 11 = Version: 3 
Type: Data frame (2) 
lø.. = 
eløø 
= Subtype: 4 
Flags: øxa7 
Duration/ID: 11355 (reserved) 
Receiver address: 1b: 
Transmitter address: ce:2f :9e 
Destination address: 89:ae:ø6:4e:6d:7e (89:ae:ø6:4e:6d:7ø) 
source address: by: 13: 
= Fragment number: 12 
lløø 
1110 lløl eølø 
= Sequence number: 3794 
Frame check sequence: øxa0bff4b1 [unverified] 
(FCS Status: Unverified]
  • PS-Poll on the other hand are used to notify the AP that the client STA is awake and available for buffered frames.
  • STA indicate the power save mode using the Power Management bit the Frame Control field. When a STA is in PM mode = 1 it alternates between awake and sleep states.
v 8ø2.11 radio information 
PHY type: 8ø2. lig (6) 
Short preamble: True 
Proprietary mode: None (0) 
Data rate: 24.0 Mb/s 
Channel: 11 
Frequency: 2462MHz 
Signal strength (dBm): —88dBm 
Noise level (dBm) 
: -96dBm 
Signal/noise ratio (dB): 8dB 
TSE timestamp: 54143357 
(Du ration: 1ø4gsl 
IEEE 8ø2.11 Power-save poll, Flags: 
...P.M.TC 
Type/Subtype: Power—Save pott (exøøla) 
Frame Control Field: exa415 
..øø = Version: e 
= Type: Control frame (1) 
= Subtype: lø 
lølø 
Flags: øx15 
. løø eløø lløø eløl = Duration: 17605 microseconds 
Receiver address: fc. 
•55 
BSS Id: 
Transmitter address: 24. 
•f5:e8 
(unverif iedl 
Frame check sequence: øxb471eø46 
(FCS Status: Unverified]
  • AP may send buffered data frames to the client in two ways.
    • If the data belongs to legacy power-save queue, transmission follows the legacy power save.
    • If the data belongs to WMM Power Save queue, data frames are downloaded according to a trigger-and-delivery mechanism.

Useful Links for this Post :

Wireless Optimization Tips!

 I have taken into account for a general hospital system where “patient tracking” application is used by doctors and nurses to capture/update patience information.  Patients/Visitors use wireless for their private use along with other hospital staff using wireless network for their day to day work chores. In some instances there might be IoT devices which might include patience monitoring devices/beds which will require seamless wireless network connectivity.

Wi-Fi Optimization

  1. Ensure simulated site survey is conducted for determining the number of AP required
  2. Optimize capacity-in-the-air on existing WIFI infrastructure by enabling more non-overlapping channels, globally reduce AP transmit power levels.
  3. Leverage 5GHz (802.11a/ac) connectivity where possible for critical devices/applications and set SSIDs to single band, preferred. 5GHz has less room for interference when compared to 2.4GHz. Encourage greater use of 5GHz capable devices.
  4. Standardize on common 802.11 data rates to encourage more predictable WIFI connectivity experience and remove 802.11b legacy data rates.
  5. Plan to reduce the overall number of wireless networks. Upto 4 SSID is a good practice.
  6. Set public WIFI SSIDs to 2.4GHz so that they do not interfere with critical 5GHz SSID frequency and clients.
  7. Enable DFS channels UNII2 and UNII-2e will provide greater capacity in the air. Verify site/hospital is not close to Airport/Shipping vessels and Aviation office etc.
  8. Enable 802.11k for optimized roaming on all the possible SSID used.