I’ve tried to condense my notes from the study for CWAP-403 exam. The exam consists of lot of details which need to be learnt if you have not done enough capturing and analyzing 802.11 wireless frames before.
- CWAP 403 – Start > Introductory blog
- 802.11 Mac Header explained
- Key 802.11 Frames
- Troubleshooting WLAN issues #mindmap
- PHY Layer
- WLAN medium contention
- 802.11 Frame Exchanges (Security)
- How to capture WLAN Frames?
- Troubleshooting WLAN issues with 802.11 Frames
- 802.11n | HT Operations
- 802.11ac | VHT Operations
- Spectrum Analysis (Still to come)
This blog post will be focusing on 802.11ac in particular. We visited the aspects of 802.11n in the last blog post.
802.11ac introduced the VHT (Very High Throughput) along with some core technological advancement like MU-MIMO, 256 QAM addition & support for 80MHz/160MHz channels. One of the key differences also lie in the support of only 5GHz band. So there is still a dependency on 802.11n for 2.4Ghz support, however the upcoming 802.11ax will support both 2.4GHz and 5GHz.
Multi-user MIMO
- One of the greatest potential of 802.11ac
- Prior to this all the 802.11 standards used single user.
- If there are two receivers located in sufficiently different directions, a beamformed transmission may be sent to each of them at the same time.
- Enables better spatial reuse. As per the below example, the MU-MIMO builds on small-cell approach by enabling even more tightly packed networks. As a result AP can send independent transmissions within its own coverage area. Just as 802.3(Ethernet) reduces collision domains, MU-MIMO intends to reduce spatial contention of transmissions.
802.11ac Wave 1 and 2 – The first wave of 802.11ac products will be driven by the enthusiasm for higher speeds. APs will typically have three stream capabilities, but with 802.11ac providing 80 MHz channels and 256-QAM modulation, the speed will go from 450 Mbps to 1.3 Gbps. The second wave of 802.11ac products will add even wider channels and possibly even multi-user MIMO support, as outlined in the figure below.
The PHY
#Channels
- OFDM based transmission, 802.11ac divides the channel into OFDM sub carriers each 312.5kHz
- To increase throughput, 802.11ac introduces two new channel widths. Supports 80MHz and further added 160MHz channel option for even higher speeds.
- 802.11ac channels have exactly the same shape as previous OFDM channels (802.11a,g,n)
MCS & GI
- MCS Index tends to be much simpler than 802.11n. First 7 are mandatory and others are supported.
- 802.11ac retains the ability to select a shortened OFDM guard interval if both Tx and Rx are capable of processing it. The GI shrinks from 800ns to 400ns, providing a 10% boost in the throughput.
VHT Signal Fields
The purpose of the Signal Field is to help the receiver decode the data payload, which is done by describing the parameters used for transmission. 802.11ac separates into Signal A and Signal B fields. For CWAP purposes this has not been dealt in depth. There are 2 parts in VHT Signal A field are referred as VHT-SIG-A1 & VHT-SIG-A2.
SIGNAL A
- Bandwidth
- 0 – 20MHz, 1 – 40MHz, 2- 80MHz & 3 – 160MHz
- STBC
- If the payload is encoded with STBC (Space-time block coding may be used when the number of radio chains exceed the number of spatial streams, it tx a single data stream across 2 spatial streams.) for extra robust-ness, this field is set to 1, otherwise will be 0.
- Group ID
- Frames to AP > group ID =0
- Frames sent to STA Client > group ID = 63
- Number of space-time streams
- Starts from 0, e.g. if field is set to 3, then there are 4 space time streams.
- Partial AID
- Last 9 bits of the BSSID.
- Transmit power save forbidden
- Field will be 0, if AP in network allows client to power off radios when they have opportunity to transmit frames. Otherwise will be 1.
- Short GI – Field set to 1 for 400ns, 0 for otherwise.
- Short GI disambiguation – Extra symbol may be required denoting 1 or 0 for not required.
- Coding – Field is 0 when convolutional coding is used to protect the data field, 1 when LDPC is used.
- LDPC Extra Symbol – Field is set to 1 if extra symbol is required.
- MCS – MCS Index value of the payload.
- Beamformed – If matrix is applied to the transmission, the bit is set to 1 otherwise set to 0.
- CRC – Error correction
- Tail – 6 zeros are included to terminate the convolutional coder that protects the Signal A field.
SIGNAL B
- Used to setup the data rate, as well as tune in the MIMO reception.
- VHT Signal B Length (17, 19 or 21 Bits)
- Reserved bits – Set to 1.
- Tail bits
![< IEEE 802.11ac Figure 22-19—VHT-SIG-A2 structure >
32
83
84-87
SU VHT-MCS/MU[1-3] coding
SU VHT-MCS
eam
Formed
Formed
Rese rved
Variable
818-823
BIO-B17
u
Composite Name
SU Name
MU Name
Bits
8 us
L-STF
BO-BI
Composite Name
SU Name
MU Name
Bits
Coding
OFDM PHY Modulation
MU[2]
Coding
MUC3]
Rese rved
Coding
VHT Modulation
Bus
L-LTF
83
4us
VHT
L-SIG
84 ag
8 us
VHT-SIG-A
NSTS
MUCO]
NSTS
Bus
BIO-B2
NSTS/Partial AID
Partial AID
822
823
MU[I]
NSTS
MU[2]
N STS
MUC3]
N STS
< IEEE 802.1 lac Figure 22-18—
VHT-SIG
-Al structure >](https://i0.wp.com/keepcalmandping.online/wp-content/uploads/2020/02/image-17.png?w=1600&ssl=1)
Air Magnet Pro can help you scan through the PHY frames
The MAC
Frame aggregation was introduced in 802.11n, 802.11ac however adds an interesting new take on the aggregation. All frames transmitted use the aggregated MPDU (A-MPDU) format. Even the single frame transmitted in one shot is transmitted as aggregate frame.
Management Frames
- VHT Capabilities Information element.
- VHT Operations Information element
NOTE: Greenfield mode was offered with 802.11n. The efficiency gains from greenfield mode were often lost because airtime-devouring CTS-to self
messages were required before transmitting in the greenfield mode. As a result, greenfield mode was removed from 802.11ac.
Beamforming Basics
- As 802.11ac beamforming is based on explicit channel measurements, both the transmitter and receiver must support it.
- Any device that shapes its transmitted frames is called beamformer, receiver of such frames is called beamformee.
- The AP initiates frame exchange with the STA, which helps it to measure the channel. The result of the channel measurement is a derivation of the steering matrix.
- Steering Matrix describes how to setup each element of transmitter’s antenna system to precisely overlap transmissions to reach farther.
- To steer transmissions in a particular direction, a beamformer will subtly alter what is transmitted by each array. A simple phase shift can alter/steer the transmission.
Null Data Packet (NDP) – Standardizes beamforming methods. 802.11ac method of beamforming is termed as null data packet sounding. Sounding is the term used to denote the process performed by the transmitter to acquire channel state information (CSI) from each of the different users by sending training symbols and waiting for the receivers to provide explicit feedback containing a measure of the channel.
VHT beamformer shall initiate a sounding feedback sequence by transmitting VHT NDP announcement frame followed by a VHT NDP after a SIFS.
SU Beamforming
- Begins with the beamformer sending a NDP announcement packet followed by NDP. The NDP has fixed known format. The beamformee receives the NDP, analyzes it and computes back in form of feedback matrix. The feedback matrix is sent in reply to the NDP in the form of compressed beamforming frame (CBF).
MU Beamforming
- As opposed to Tx to one device, MU-MIMO Aps are capable of simultaneously transmitting data to multiple device groups.
- The key distinction between them is that with MU-MIMO beamforming and beamformer requires a response from all beamformees in order to conclude channel sounding.
- The CBF packet is 802.11 action frame which contains a channel matrix that specifies the CSI for each client. The CBF is the largest contributor to the overhead caused by MU-MIMO transmission and is size is determined by
- Channel Width
- Number of radio chain pairs
- Bit count of each CSI unit
Recommended Reading
Cisco 802.11ax White Paper
Wifi Certified 6 Highlights
802.11 Framing in Detail
802.11ac Channel Planning
802.11ac VHT PHY
Research Paper on VHT MU-MIMO
802.11ac – A Survival Guide
The blog post will cover the topics related to High Throughput Throughput technologies in conjunction with the exam objectives laid down for CWAP-403 exam. 802.11 Frame Exchanges cover 25% of the knowledge domain required for the exam. Analysing HT & VHT transmission methods are one of the sub topics under this section. I will be focusing on the HT/802.11n type in this blog, apparently it has gone a little longer than i thought. There are certain section which might take further reading from 802.11n Survival Guide if you are keen.
802.11n ~ High Throughput
- Ratified Sep 2009
- Clause 20 technology, backward compatible with HR-DSSS (Clause 18), OFDM (Clause 17).
- Can be used for both 2.4GHz & 5GHz bands.
MIMO Enhancements
- Transmit Beamforming (TxBF) – Tx(Transmitter) Radios multiple antenna can transmit in the best direction of the Rx (Receiver).
- Spatial Multiplexing (SM) – Tx multiple radios at the same time with each unique stream containing different data.
- Space-Time Block Coding(STBC) – Transmitting redundant copies of data stream from different antenna thereby increasing the signal quality.
- Antenna Selection (ASEL) – Increase signal diversity by dynamic selection of antennas.
Spatial Multiplexing
- Takes advantage of multipath (when signal tends to reflect, scatter, diffract or refract).
- Multiple streams follow different paths to the receiver because of the space between the transmitting antenna is known as spatial diversity and is also called as spatial multiplexing.
- When using SM, both Tx and Rx should participate and be MIMO systems.
![FIGURE 10.2
-123456789“
MuItiple spatial streams
мно
-123456789“
ммо
c]ient](https://i1.wp.com/keepcalmandping.online/wp-content/uploads/2020/02/image-8.png?w=1600&ssl=1)
HT Channels
- Use 20 MHz OFDM channels.(NON-HT)
- Each 20MHz OFDM channel contains 64 subcarriers which are each 312.5 KHz wide and can be separately modulated.
- First 6 & Last 5 sub carriers are null as they act like guard band for the channel + center subcarrier is also null. This leaves 52 subcarriers.
- Out of 52, 48 transmit data while 4 used in dynamic calibration between Tx and Rx.
- 20MHz OFDM channels (HT)
- Each 20MHz OFDM channel has 56 subcarriers, 52 transmit data, 4 are used for calibration between Tx and Rx.
- 40 MHz Channels
- Use 114 OFDM subcarriers, 108 transmit data, 6 are used for calibration.
- A 40MHz channel doubles the frequency bandwidth available for transmission of the data.
- A 40MHz channel used by HT radios essentially 2x 20MHz OFDM channels bonded together.
Modulation and Coding Scheme (MCS Index)
- Value that describes the number of spatial streams, modulations (BPSK, QPSK, 16-QAM or 64-QAM and further) and error correction code used in Tx.
- 802.11n supports equal modulation, in which all SS are transmitted in same manner, and unequal modulation, in which the spatial streams may be modulated differently.
- 802.11n defines 77 different combinations of modulation and coding.
- There are 8 mandatory MCS for 20 MHz HT channels.
Guard Interval (GI)
- The GI is the space between the symbols being transmitted.
- May be confused with IFS, the GI is there to eliminated inter-symbol interference where is referred to as ISI.
- ISI happens when echoes from one symbol interfere with another.
- A good rule of thumb specifies that GI should be 4x the highest multipath delay spread. When 802.11a was designed, designers used conservative value of 200ns for the delay speed, and choose to make the GI 800ns.
HT PHY
I’ve discussed this topic in details under this blog post.
Wi-Fi Alliance
- Before the 802.11n amendment was ratified, the HT technology was already being certified and sold. The Wi-Fi alliance had developed a vendor certification program called Wi-Fi CERTIFIED 802.11n draft 2.0. The Cert Program as name suggested, certified products against the amendment. Draft 2.0 supports a max data rate of 300Mbps which is half max data rate specified in ratified document.
- Details about the Wi-Fi certified “n” features can be found here
HT Control Field
- The 802.11n amendment adds a new field in 802.11 MAC header, called the HT Control Field. It is 4 octets long and follows QoS control field in 802.11 MAC header.
- Any MPDU that contains an HT control field is referred to as +HTC MPDU.
The Order Bit – The 802.11n amendment uses the existing but relatively unused order bit in the Frame Control field of the MAC header to indicate the presence of an HT Control Field in QoS data & management frames. Original purpose of this bit was to indicate that data muse be sent using a strict ordered class of service.
Control Wrapper Frame – is/are described using the carried frame name + HTC, for example RTS+HTC or CTS+HTC
HT Control Field Format – figure below shows the format of HT Control field. (Honestly some of the stuff went way over my head but might have to figure this out by looking at a few pcaps & studying them :|)
Link Adaptation Control (16 bits) 
- TRQ – Training Request > Set to 1 to request the responder to transmit a sounding PPDU. Set to 0 to indicate that the responder is not requested to transmit a sounding PPDU.
- MAI (MCS Request (MRQ) or ASEL Indicator) – When set to “14”, it is an ASEL indicater which indicates that you would interpret the MFB/ASELC subfield as an ASEL command.
- MFSI – MCS Feedback Sequence Identifier- A MCS Feedback (MFB) frame is sent in response to a MCS Request.
- MFB/ASELC – MCS feedback and Antenna Selection Command -When ASEL indicator is present, the MFB/ASELC subfield interpreted as ASELC subfield. Otherwise it is interpreted as MFB subfield. A value of 127 indicates that no feedback is present
Calibration Position (2 bits)
- Set to 0 indicates this is not a calibration frame.
- Set to 1 indicates calibration start.
- Set to 2 indicates sounding response.
- Set to 3 indicates sounding complete.
Calibration Sequence – Each of the four packets within the calibration exchange will have the same sequence number.
CSI/Steering – When using sounding frames to transmit feedback about the channel, the Channel State
Information (CSI)/Steering subfield identifies the type of feedback being used.
NDP Announcement – indicates that an NDP will be transmitted after the frame. It is set to 1 to indicate that an NDP will follow; otherwise, it is set to 0. NDP are used to send sounding PPDU when no other data needs to be transmitted. If a frame transmitted that require an immediate response and also has the TRQ=1 (request for sounding PPDU) then receiver can either transmit the MPDU response withing a sounding PPDU or send the response MPDU with the NDP Announcement bit set to 1, indicating that NDP will be transmitted following the current PPDU.
Reverse Direction Protocol – 802.11n amendment which improves the efficiency of data transfer between STAs.
HT Action Frames & Information Elements
Information Elements
HT Capabilities, HT Operations, 20/40 BSS Coexistence & Overlapping BSS Scan Parameters,
HT Capabilities Element
- Can be seen in Beacon, Probe Req/Response, Association Req/Response & Reassoc Req/Response.
- You can figure out the MCS values supported by the 802.11n AP from this section in the pcap.
- Determine A-MPDU parameters
HT Operation Element
- STA operation within an HT BSS environment.
- Found in Beacon, Reassociation Response, and Probe Response frames transmitted by an AP.
HT information elements
- Primary Channel, Secondary Channel Offset and STA channel width.
– When the Supported Channel Width Set subfield is equal to 1(as in above), indicating a 20/40 MHz BSS, then the Primary Channel field indicates the primary channel number.
– Secondary Channel – Directly above or below the primary channel.
- Protection Mechanisms – To ensure backward compatibility with older 802.11 a/b/g radios, an HT access point will operate in one of four protection modes. 00 in above pcap example.
- RIFS mode – The 802.11e QoS amendment introduced the capability for a transmitting radio to send a burst of frames during a transmit opportunity (TXOP). (prohibited in above pcap case).
- Basic MCS Set – Last in Operations element, similar to MCS set field in HT Capabilities Element.
For Further Reading
I have pen down a some troubleshooting scenarios which I’ve come across while studying for CWAP exam.
To begin with,
Management Frames > Foundation of how wireless radios detect, join and operate on WLAN.
Control Frames > Frames which control the delivery of Data frames.
Data Frames > Carry actual data payload from/to layers 3-7.
Some scenarios which frames can provide an insight for.
- Client Roaming Observations – In some cases, there might be some issues with clients not able to perform seamless roaming or the roaming might be delayed when client moves from one AP to another. In some cases we may need to find which type of roaming method are supported by the AP to diagnose other issues. Let’s see how the frames can help.
- To find the roaming handoff time from one AP to another we have to examine the frames from type > Reassociation Type to the completion of 4-way handshake. E.g. frame below
- Total roaming time can be calculated by subtracting the EAPOL M4 time (0.105180) with Reassociation Request Frame(.003857)= .101323 ~ approx. 101ms
- Type of roaming method can be deduced from the Tagged Parameters set in 802.11 Wireless LAN section. Below example uses Over-the-air Fast BSS, value of 1 will denote it using Over-the-DS BSS.
- Management Retries – Generally anything under 20% of Management retries in the network is considered OK or acceptable. There is no set vendor recommended management retry. In a prod environment it is bound to have certain % of retries even if the AP or Client placement/AP Tx Power/Interference and Channel settings are set to optimal. In any case anything over constant 20% retries could indicate some concerns in the WLAN environment which need investigation.
- We can also check this on the Wireshark IO graphs as below to highlight the management retries. Below network has lot of management retries and needs further investigation
- Duration/ID field
- 16 bits in length, used for virtual carrier-sense, legacy power management & contention-free period.
In the below RTS frame, the duration value is 2048ms. The radio is asking for permission to reserve airtime to pending transmission. The receive radio can allow or deny this request. But higher duration value can indicate the delays it is causing in allowing/denying the request. This can cause some weird behavior in client operation, may also cause disruption in network services. We have to closely check the change log on the WLAN environment. If this is a result of some WLAN controller/AP software update or other updates which may cause the issues. Also NOTE: Please check the device and not always high duration value can be a problem.
![IEEE 8ø2.11 Request-to-send, Flags: ..... ...C
Type/Subtype: Request—to—send (Oxøølb)
v Frame Control Field: exb40e
. .øø = Version: 0
= Type: Control frame (1)
= Subtype: 11
løll
Flags:
øxoo
. .øø = DS status: Not leaving DS or network is operating in AD—HOC mode (To DS:
ø . — More Fragments: This is the last fragment
— Retry: Frame is not being retransmitted
- PWR MGT: STA wilt stay up
. = More Data: No data buffered
. — Protected flag: Data is not protected
Order flag: Not strictly ordered
.øøø løøø oøøø ooøø -
Duration: 2ß48 microseconds
Receiver address: App 92:ga)
Transmitter address: 7a:8a:2ø:øf:bg:6f
Frame check sequence: øx4d4e67bf (unverified]
[FCS Status: Unverified]
e From DS: e)
(exø)](https://i0.wp.com/keepcalmandping.online/wp-content/uploads/2020/02/image-3.png?w=1600&ssl=1)
- Null Data Frames / Power Management
The null data frames are in fact not null as per their description. They can help in troubleshooting few WLAN issues. Null data is categorised under control frame. It is only transmitted from a STA/Client. The sole purpose is to carry power management frames controlled field. The power management bit will either be set to 0 or 1. Below are the examples.
STA = 0, it is informing AP that it(STA) is In active power state (awake) and transmission of frames from AP to STA should be normal.
STA =1, is informing AP that it is going offline and any frames that come into the AP from this STA should be buffered at the AP till the STA returns and sends a NULL frame of 0, active state.
PSM > Power Save Mode allows the client STA to go into sleep mode. It can essentially turn of the NIC functions including the radio thereby consuming less battery and conserving it. Some devices can benefit from this but there are some which may have aggressive power save mode options. So one needs to check the client driver details to troubleshoot any issues relating to client.
Some known issues with Power Management are described in below links
Another reason why client STA may inform AP about changing the bit to 1 is when it is roaming. Suppose client has reached the roaming limits of the AP it was connected to and wants to switch to the nearby one, in order to to this it may go off the channel sending the buffer frames signal to AP and resume its connection.
This blog post will focus on tools I’ve used for performing Wireless Frame Captures. I’ve been largely dependent on Macbook for capturing the wireless frames. I would highly suggest you for sourcing a Macbook for frame capture as Windows PC option involves getting a third party WLAN pcap which is not cheap. Thank you Apple for making it possible to capture frames natively on Mac.
The Hardware
- Macbook Pro
Other Utilities Required/Recommended.
- Wireshark is available as free tool to download. It is highly recommended to optimize it using the wireless configuration profiles available at Metageek. This is our primary tool for capturing and analyzing the frames.
It is recommended to add (Absolute Time, Relative Time & Delta Time) values on the Wireshark as it is important when analyzing the wireless frame analysis. In roaming scenarios, one may need to acquire the time it took for a client to move between one AP to another.
- Airtool is also available for free. This tool is not mandatory but good to have. Since it is free, then why not? It helps capture frames on few mouse clicks and helping you easily move them analyze them on wireshark or via online (Packets)
- Packets (Arista) – Phenomenal tool for analyzing the frames. Birds eye view of various frame types in the wireless environment, management retries, problem clients etc. Free account available up to 100MB of pcap (more than sufficient for your CWAP studies).
- WiFi Explorer – Highly Recommended if you can purchase, the professional version costs around $20 USD. Can really help with identifying the WLAN discovery and metrics of the environment.
- If you own an iPhone or iPad, one can configure Wi-FI Diagnostics on the phone. Thanks for George Stefanick for explaining it so nicely.
Accounts for 10% of the CWAP knowledge domain areas, approx. 6/60 questions
Medium Contention :Protocols that allow large number of devices to effectively share the wireless channel. All AP & STAs will contend with each other on a common transmission medium.
CSMA / CA – The AP/STAs (802.11) use carrier sense multiple access with collision avoidance as opposed to collision detection used by the Ethernet (802.3) realm.
802.11 devices must avoid multiple devices transmitting simultaneously over a shared medium which can cause failed transmissions. Wireless mediums cannot detect collision but find ways to avoid them. Collision handling is not straight forward and may be time consuming at times. Hence one of the reasons that 802.11(WLANs) have much lower throughput-to-data rate ratio than 802.3(Wired LANs).
CSMA/CA uses DCF (Distributed Coordination Function) for non-QoS WLANs & HCF (Hybrid Coordination Function) for QoS WLANs using EDCA (Enhanced Distributed Channel Access).
There are two carrier sense protocols used by the stations to indicate whether a channel is busy or idle.
- Physical Carrier Sense, also known as CCA (Clear Channel Assessment)
- Virtual Carrier Sense, also known as NAV (Network Allocation Vector)
Both QoS & non-QoS use either of the above protocols for transmitting data.
CCA (Layer 1) > Identify whether the channel is unused and available prior to the packet transmission.
- Channel Occupied = State of Busy ~ Energy Detection Levels.
- Channel Clear = State of Idle
Apply to 802.11 modulation, if the AP or STA is too far away to detect any transmission at requisite energy level, the CCA may go into the idle state even though the channel is still occupied.
NAV (Layer 2) > is a timer that counts down toward zero(0). When a device has a NAV value greater than zero, the device says quiet. Once the NAV = 0, the medium is considered clear.
As discussed earlier, CCA may fail to keep other devices on the channel quiet (Too far transmitting device, obstruction, interference), the design of the NAV keeps APs and stations quiet.
Duration value in the 802.11 header set the NAV values for AP and STAs.
It is vital for the AP and STA to stay with the RSSI data range in order to successfully demodulate a transmitted frame so that the Duration/ID field in the header can be accurately set.
Interframe Spaces
When 2 or more STAs begin frame transmission at the same time in the idle environment, collisions are bound to happen. Hence we have additional medium contention protocols beyond CCA & NAV. These protocols must keeps AP and STAs quiet like CCA/NAV & also allow differentiated medium access.
IFS is the quiet period that AP & STA must wait before any 802.11 frame transmission.
TIPS to Remember!
- If the contention has been completed, then a reduced IFS (RIFS) or short IFS (SIFS) will be used. Most cases it is SIFS but RIFS is only used between consecutive frames transmitted by 802.11n device.
- If the contention/arbitration is not determined, then arbitration IFS (AIFS) or DCF IFS (DIFS) will be used. The AIFS is used for WLANs that support 802.11e QoS, and the DIFS is used for WLANs that do not support 802.11e QoS.
- If an AP or STA has received a corrupted frame as defined by having an incorrect FCS, then extended IFS will be used.
- PCF IFS (PIFS) is part of PCF and therefore not used in real world. (May be ignored for CWAP prep!)
- 802.11 FHSS network use 50ms slot time.
- Steps involved for a STA to go through before starting the frame transmission in the wireless medium (Source : 802.11 Arbitration CWNP White Paper)
SIFS >
- Foundation of all IFSs.
- 10ms for 802.11b/g/n (2.4GHz)
- 16ms for 802.11a/n (5GHz).
- It is used after contention/arbitration is completed. Exception being 802.11n device using MIMO to transmit frames then RIFS is used.
RIFS >
- Simplest IFS to understand.
- Length is always the same 2ms.
- Only for devices which use 802.11n/MIMO.
- It precedes for only “data” frame.
DIFS >
- Designed to force AP and STA with ordinary data in the queue to stay quiet for enough time to allow QoS frames to have access to the channel.
- It is used when arbitration process has not yet completed.
- DIFS is equal to length of SIFS + 2 slot times. Slot times are quiet periods, similar to IFS.
- They are equal to 9ms for 802.11a/n/ac operating in 5GHz and 802.11g/n with 2.4GHz.
- The 20ms slot is used if the HT or ERP is used with long preamble and 802.11b/g/n 2.4 GHz DSSS.
- The short preamble is default setting when HT or ERP is used.
EIFS >
- Designed to give AP and STA a chance to retransmit after a failed frame.
- This happens when AP/STA failed to receive ACK after transmission.
- EIFS = SIFS + DIFS plus the time taken acknowledge the frame to transmit.
- 802.11b/g/n(2.4GHz) using DSSS= 364ms, 802.11a/n(5GHz) & 802.11g/n (2.4GHz) = 160ms. EIFS is the longest of the IFS.
Near/Far Problem : STA closer to AP may cause problem to STA at far. When data is transmitted between AP and nearby STAs they can use higher data rate than far stations. (This is why STA dynamically switch their data rates downward when moving away from the AP). The frame therefore will appear to be corrupt even though it was successfully transmitted. The far STA have to stay quiet for an EIFS at the beginning of the arbitration process, while the near STA will be allowed to use the shorter DIFS.
PIFS > Equal to one slot time + 1 SIFS and it is designed to give AP the chance to send the beacon in order to begin the CFP (Contention Free Period). In real-world the PIFS is only used with Channel Switch Announcement frame, which is one of the Action frames from 802.11h.
RANDOM BACKOFF
The mechanism which prevents collision by differentiating 802.11 channel access is the Random Backoff. Unlike the IFS, the random backoff is not static. It is the period of time that changes based on a random number chosen by AP or STA.
AP and STA stay quiet during the random backoff by randomly choosing a number of slot times and then counting down until the number of slot times equal to zero. Transmission resumes after slot time equals zero.
- For the random backoff to work, there must be an upper and lower limit to the number of slot times that ca be chosen.
- The lower limit is always 0. The upper limit for the random backoff is equal to the contention window (CW).
- The CW is derived from the equation 2x – 1, where x is a value that increments with each failed frame. For DSSS-based networks, x starts at 5, which results in a CW of 31. For OFDM-based networks, x starts at 4, which results in a CW value of 15. For both DSSS and OFDM-based networks, the x value stops incrementing at 10, which results in a CW value of 1023.
- Failed frames cause the contention window to grow exponentially. More quiet time means a less efficient channel thus causing latency and throughput issues.
QoS FRAMES
AIFS >
- Used by QoS enabled STA to transmit all data, management, PS-Poll, RTS, CTS (when not transmitted as response to RTS), Block Ack Req and Block Ack (when not transmitted as a response to Block Ack Req).
- Slot times in AIFS is called as AIFSN (slot number).
- 802.11e specifies Voice (AV_VO), Video (AV_VI), Background (AV_BK) & Best Effort (AV_BE).
- Video and Voice = 2 Slot times
- Best Effort = 3 Slot times
- Background = 7 Slot times
- Calculate AIFS for a given Access Category = AIFSN[AC] x Slot Time x SIFSTime
TXOP
- Transmit Opportunity or TXOP is the amount of time a STA can send frames when it has won contention for the wireless medium. This is in relation to EDCA (Enhanced Distributed Channel Access).
- When a STA sends QoS data, it must first contend for the access to the wireless medium.
- STAs perform CCA and determine if the channel is idle. It must have its NAV set to 0. Then it must wait for the appropriate InterFrame Spacing.
- Then it would wait for the contention window to complete. CW has 4 categories as discussed in the previous section. Each category has different TXOP.
I am attempting to put a mind map of WLAN issues. I will look forward at expanding each one of the classifications in the revisions of this blog.
This post covers the important 802.11 Frames which can help in performing the analysis and troubleshoot any issues related to WLAN networks. I have referenced Wireshark filters for the ease of each frame.
Beacon (1000, Subtype : 8) (wlan.fc.type_subtype == 0x08)
- Used to announce the Basic Service Set (BSS) for the Client (STAs).
- Transmitted by AP every 100 time units. 1 TU = 1024 microseconds. Default is 102.4 m/s
- To reduce any potential overhead, TU values might need adjustment in some cases where multiple SSIDs exist on AP radio.
Probe Request and Probe Response (0100, 0101 Subtype : 4 & 5) (wlan.fc.type_subtype == 0x4 or wlan.fc.type_subtype ==0x5)
- Used for active scanning
- STAs send the probe request, AP sends the probe response.
- Amount of probing may be able to be reduced by adjusting the roaming aggressiveness on the client.
- Probe request are sent to broadcast address (DA – ff:ff:ff:ff:ff:ff:ff)
- Directed probe request are when STA sending probe request may specify the SSID they are looking, like in example below.
![IEEE 8ø2.11 Probe Request, Flags: ..... ...C
Type/Subtype: Probe Request (øxeeø4)
Frame Control Field: ex4øoe
. ..øø = Version: e
eløø
ø . — Type: Management frame (e)
= Subtype: 4
Flags: øxee
. øøø oøøø eøøø eeøø = Duration: e microseconds
Receiver address: Broadcast ff)
Destination address: Broadcast ff:ff)
Transmitter address: (fc:fc:48:5e:2b:33)
Source address: Apple_5e:2b:33 (fc: fc:48:
BSS Id: Broadcast (ff:ff:ff:ff:ff:ff)
= Fragment number: ø
eeøø
0101 eøøø løøl
= Sequence number: 1289
Frame check sequence: øxda049ff4 (unverified]
(FCS Status: Unverified]
IEEE 8ø2.11 wireless LAN
v Tagged parameters (141 bytes)
Tag: SSID parameter set: Hob—wireless
Tag Number: SSID parameter set (e)
Tag length: 12
SSID: Hob—wi re less
Tag: Supported Rates 1, 2, 5.5, 11, (Mbit/sec)
Tag Number: Supported Rates (1)
Tag length: 4
Suppo rted Rates: 1 (exø2)
Suppo rted Rates: 2 (exø4)
Suppo rted Rates: 5.5 (øxøb)
Suppo rted Rates: 11 (ex16)
Tag: Extended Supported Rates 6, 9, 12, 18, 24,
Tag Number: Extended Suppo rted Rates (5ø)
Tag length: 8
36,
48,
54,
(mbit/sec)
Extended
Extended
Extended
Extended
Supported
Supported
Supported
Supported
Rates:
Rates :
Rates:
Rates:
6 (øxec)
g (øx12)
12 (øx18)
18 (øx24)](https://i1.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-2.png?w=1600&ssl=1)
- The SSID value can also be set to 0, SSID field is present, but empty. This is called Wildcard SSID or null probe request, e.g. below
![IEEE 8ø2.11 Probe Request, Flags: ..... ...C
Type/Subtype: Probe Request (øxeeø4)
Frame Control Field: ex4øoe
. ..øø = Version: e
eløø
ø . — Type: Management frame (e)
= Subtype: 4
Flags: øxee
. øøø oøøø eøøø eeøø = Duration: e microseconds
Receiver address: Broadcast ff)
Destination address: Broadcast ff:ff)
Transmitter address: (fc:fc:48:5e:2b:33)
Source address: Apple_5e:2b:33 (fc: fc:48:
BSS Id: Broadcast (ff:ff:ff:ff:ff:ff)
= Fragment number: ø
eeøø
0101 eøøø løøl
= Sequence number: 1289
Frame check sequence: øxda049ff4 (unverified]
(FCS Status: Unverified]
IEEE 8ø2.11 wireless LAN
v Tagged parameters (141 bytes)
Tag: SSID parameter set: Hob—wireless
Tag Number: SSID parameter set (e)
Tag length: 12
SSID: Hob—wi re less
Tag: Supported Rates 1, 2, 5.5, 11, (Mbit/sec)
Tag Number: Supported Rates (1)
Tag length: 4
Suppo rted Rates: 1 (exø2)
Suppo rted Rates: 2 (exø4)
Suppo rted Rates: 5.5 (øxøb)
Suppo rted Rates: 11 (ex16)
Tag: Extended Supported Rates 6, 9, 12, 18, 24,
Tag Number: Extended Suppo rted Rates (5ø)
Tag length: 8
36,
48,
54,
(mbit/sec)
Extended
Extended
Extended
Extended
Supported
Supported
Supported
Supported
Rates:
Rates :
Rates:
Rates:
6 (øxec)
g (øx12)
12 (øx18)
18 (øx24)](https://i1.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-3.png?w=1600&ssl=1)
- Probe requests are always sent on the lowest supported data rates. In above examples they are sent at 1 Mb/s.
- Probe response contain the requested information elements that may have been requested by the probing station. .e.g. below
Authentication & Deauthentication Frames (1011, subtype :11, 12) (wlan.fc.type_subtype == 0xb, wlan.fc.type_subtype==0xc)
- Used to authenticate to an AP to prepare association or roaming
- Used to remove the AID (Authentication ID) and deauthenticate with an AP.
- Frame body consists of
- Authentication Algorithm Number – 0 for Open System and 1 for Shared Key
- Authentication Transaction Sequence Number – Indicate current status of progress
- Status Code – 0 for Success,1 for Unspecified failures
- Challenge Text Used in Shared Key Authentication frame 2 & 3
![IEEE 802.11 Authentication, Flags: ..... ...C
Type/ Subtype: Authentication (OxØØØb)
v Frame Control Field: OxbØØØ
00
1011
= Version:
00.. = Type: Management frame (0)
= Subtype: 11
Flags: ØXØØ
.øøø 0001 0011 1010
= Duration: 314 microseconds
Receiver address: RuckusWi_4f:d3:c8 (2c:5d:93:4f:d3:c8)
Destination address: RuckusWi_4f:d3:c8 c8)
Transmitter address: SamsungE_2d:6Ø:91 (5c:51:81:2d:6Ø:91)
Source address:
BSS Id:
. øøøø
= Fragment number:
1101 1001 0001
= Sequence number: 3473
Frame check sequence: Oxa186b162 [unverified]
[FCS Status: Unverified]
IEEE 802.11 wireless LAN
v Fixed parameters (6 bytes)
Authentication Algorithm: Open System (0)
Authentication SEQ: Ox0ØØ1
Status code: Successful (Ox0ØØ0)](https://i0.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-4.png?resize=521%2C417&ssl=1)
Association and Disassociation Frames (0000, subtype =0)(0001 subtype =1) wlan.fc.type_subtype==0 or wlan.fc.type_subtype==10
- Simple 4-frame exchange (authentication request, ACK, authentication response & ACK) used to enter the authenticated and associated state with the AP.
- After Association STA may either use the network (open system authentication) or begin the 802.1x/EAP authentication process if used.
- The Disassociation frame is used to change from authenticated/associated state to “authenticated not associated state”. They contain a reason for disassociation. In case of below frame the reason code is unspecified reason.
![802.11 radio information
PHY type: 8ø2. lla (5)
Turbo type: Non—turbo (ø)
Data rate: 12.0 Mb/s
channel: 108
Frequency: 554%Hz
Signal strength (dBm): —84dBm
Noise level (dBm): —89dBm
Signal/noise ratio (dB): 5dB
TSE timestamp: 6964589ø3
(Du ration: 44gsl
IEEE 8ø2.11 Disassociate, Flags: ..... ...C
Type/Subtype: Disassociate (øxøeea)
Frame Control Field: exaøøø
..øø = Version: e
lølø
= Type: management frame (e)
= Subtype: lø
Flags: øxee
.øøø oøøø eø11 eeøø = Duration: 48 microseconds
Receiver address: SamsungE_2d:øe:4ø (4c:66:41:2d:øø:4ø)
Destination address: SamsungE_2d:øø:4e (4c:66: 41:2d
Transmitter address: (2c:5d: 72:5c)
source address: 72:5c)
BSS Id:
Fragment number: ø
. eeøø =
eøøø eøøø eløl
= Sequence number: 5
Frame check sequence: øx8043a47a [unverified]
(FCS Status: Unverified]
IEEE 8ø2.11 wireless LAN
v Fixed parameters (2 bytes)
Reason code: Unspecified reason
( øxøool)](https://i1.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-6.png?w=1600&ssl=1)
Reassociation Request and Response Frames – (0010, subtype : 2) (0011, subtype : 3) (wlan.fc.type_subtype == 0x2 or wlan.fc.type_subtype ==0x3)
- These frames are used to roam to another AP within the ESS (extended service set) or to reconnect after brief disconnection.
- The reassociation response frame will also include an AID for the STA and the status code indicating the reassociation success or failure.
![8ø2.11 radio information
Data rate: 7.0 Mb/s
channel: 108
Signal strength (percentage): 78*
IEEE 8ø2.11 Reassociation Request, Flags: op.PR.F.
Type/Subtype: Reassociation Request (Oxøø02)
Frame Control Field: ex2øda
eølø
. .øø = Version: e
= Type: management frame (e)
= Subtype: 2
Flags: øxda
Duration/ID: 5391 (reserved)
Receiver address:
Destination address: 89: ba (c9:6a:
Transmitter address: al:2a:51:84:9b:9e (al:2a:51:84:9b:9e)
source address:
BSS Id: 79)
STA address:
= Fragment number: ø
ooøø
— Sequence number: 1860
0111 eløø eløø -
HT control (+HTC): øx2473a9cd
WEP parameters
Initialization Vector: øx952d2a
Key Index: ø
WEP ICV: exac6532aø (not verified)
Data (1514 bytes)
Data: 73a428øa537ø8af4618Ø23beb54d94ba647d7ø892c5øc22cm
(Length: 1514]](https://i0.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-7.png?w=1600&ssl=1)
RTS / CTS – (1011, Subtype : 11), (1100, Subtype : 12) (wlan.fc.type_subtype == 0x2 or wlan.fc.type_subtype ==0x3)
- RTS and CTS frames are used to clear the medium for transmission of larger frames.
- The Duration Field in RTS/CTS is very important.
- SIFS (Short Interframe Space) – Amount of time in m/s required for a wireless interface to process a received frame and to respond with resoonse frame.
- RTS duration = SIFS(3) + CTS + Data + ACK(1)
- CTS duration = SIFS(2) + Data + ACK(1)
![info rmat
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 24.0 Mb/s
Channel: 6
Frequency: 2437MHz
Signal strength (dBm)
: -42dBm
Noise level (dBm)
: -96dBm
Signal/noise ratio (dB): 54dB
TSE timestamp: 94735155
(Du ration: 28gs)
IEEE 8ø2.11 Request-to-send, Flags: ..... ...C
Type/Subtype: Request—to—send (exøølb)
Frame Control Field: exb4øø
. .øø = Version: e
løll
= Type: Control frame (1)
= Subtype: 11
Flags: øxee
.øøø oøøø løll eelø = Duration: 178 microseconds
Receiver address: RuckusWi_cf:cf:d8 (2c:5d:93:cf:cf :d8)
Transmitter address:
Frame check sequence: øxbde58b2c (unverified]
(FCS Status: Unverified]](https://i2.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-8.png?w=1600&ssl=1)
![802.11 radio information
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 24.0 Mb/s
Channel: 1
Frequency: 2412MHz
Signal strength (dBm)
: -83dBm
Noise level (dBm)
: -90dBm
Signal/noise ratio (dB): 7dB
TSE timestamp: 92681566
[Du ration: 64gs)
IEEE 8ø2.11 Clear-to-send, Flags: .pm.R.FTC
Type/Subtype: Clear—to—send (øx001c)
Frame Control Field: exc66b
. .10 = Version: 2
= Type: Control frame (1)
. — Subtype: 12
lløø -
Flags: øx6b
Duration/ID: 11803 (reserved)
Receiver address:
Frame check sequence: øx1b21827a (unverified]
(FCS Status: Unverified]](https://i0.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-9.png?w=1600&ssl=1)
- CTS-to-self > is another method of performing NAV (Network Allocation Vector) distribution that use only CTS frames. It is used strictly as a protection mechanism for mixed mode environment.
Acknowledgement Frames (ACK)(1011, Subtype : 13) (wlan.fc.type_subtype == 0x1d)
- These frames are sent right after data/management frames to inform(ack) the transmitter.
- With ACK frame, the transmitter assumes the frame was lost due to the corruption from interface or some other issue, and so retransmits the frame.
- ACK frame includes Frame Control, Duration, RA and FCS subfields
![802.11 radio information
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 12.0 Mb/s
Channel: 11
Frequency: 2462MHz
Signal strength (dBm)
: -85dBm
Noise level (dBm)
: -90dBm
Signal/noise ratio (dB): 5dB
TSE timestamp: 91694972
[Du ration: 32gs)
IEEE 8ø2.11 Acknowledgement, Flags: .C
Type/Subtype: Acknowledgement (exøøld)
Frame Control Field: exd4ee
. .øø = Version: e
1101
= Type: Control frame (1)
= Subtype: 13
Flags: øxoe
.øøø oøøø eøøø eeøø = Duration: e microseconds
Receiver address: (fc:
Frame check sequence: øx66678fb7 (unverified]
[FCS Status: Unverified]](https://i2.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-10.png?w=1600&ssl=1)
- Duration Field value is set to : Duration Value of previous frame + ACK(1) + SIFS(1)
Null Data & PS-Poll Frames (0100 Subtype : 4) (wlan.fc.type_subtype == 0x24) or (wlan.fc.type_subtype == 0x1a)
- Null Data Frames are used to notify an AP that the STA is awake and able to receive the frames.
- It is simply a data frame with no date in the Frame Body field.
![8ø2.11 radio
info rmation
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 24.0 Mb/s
Channel: 11
Frequency: 2462MHz
Signal strength (dBm)
: -88dBm
Noise level (dBm)
: -96dBm
Signal/noise ratio (dB): 8dB
TSE timestamp: 54ø37578
(Du ration: 92gsl
IEEE 8ø2.11 Nutt function (No data), Flags: o.m. .MFTC
Type/Subtype: Nutt function (No data) (øxee24)
Frame Control Field: ex4ba7
.. 11 = Version: 3
Type: Data frame (2)
lø.. =
eløø
= Subtype: 4
Flags: øxa7
Duration/ID: 11355 (reserved)
Receiver address: 1b:
Transmitter address: ce:2f :9e
Destination address: 89:ae:ø6:4e:6d:7e (89:ae:ø6:4e:6d:7ø)
source address: by: 13:
= Fragment number: 12
lløø
1110 lløl eølø
= Sequence number: 3794
Frame check sequence: øxa0bff4b1 [unverified]
(FCS Status: Unverified]](https://i0.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image.png?w=1600&ssl=1)
- PS-Poll on the other hand are used to notify the AP that the client STA is awake and available for buffered frames.
- STA indicate the power save mode using the Power Management bit the Frame Control field. When a STA is in PM mode = 1 it alternates between awake and sleep states.
![v 8ø2.11 radio information
PHY type: 8ø2. lig (6)
Short preamble: True
Proprietary mode: None (0)
Data rate: 24.0 Mb/s
Channel: 11
Frequency: 2462MHz
Signal strength (dBm): —88dBm
Noise level (dBm)
: -96dBm
Signal/noise ratio (dB): 8dB
TSE timestamp: 54143357
(Du ration: 1ø4gsl
IEEE 8ø2.11 Power-save poll, Flags:
...P.M.TC
Type/Subtype: Power—Save pott (exøøla)
Frame Control Field: exa415
..øø = Version: e
= Type: Control frame (1)
= Subtype: lø
lølø
Flags: øx15
. løø eløø lløø eløl = Duration: 17605 microseconds
Receiver address: fc.
•55
BSS Id:
Transmitter address: 24.
•f5:e8
(unverif iedl
Frame check sequence: øxb471eø46
(FCS Status: Unverified]](https://i0.wp.com/keepcalmandping.online/wp-content/uploads/2020/01/image-11.png?w=1600&ssl=1)
- AP may send buffered data frames to the client in two ways.
- If the data belongs to legacy power-save queue, transmission follows the legacy power save.
- If the data belongs to WMM Power Save queue, data frames are downloaded according to a trigger-and-delivery mechanism.
Useful Links for this Post :
Main Objective: To successfully transfer every bit of information(data) from one device to another.
802.11 MAC HEADER
Let us now go through the basics of the frame header and the components. I have captured a simple beacon (management) frame using Wireshark.
I will briefly explain each of the fields. Notice the number in the bracket refers to the bytes. For memory 1 Byte = 8 bits. 🙂
Frame Control > 16 bits | 2 Bytes – contains 11 subfields as displayed in the above examples. Considering the amount of valuable information contained in 802.11 Frame Control sub-fields is mind-boggling
Protocol Version (2 bits): For now, always set to 0 by default. Changes in the version are expected in the future.
Type: Management (0,0), Data(1,0), Control(0,1), Extension Frame(1,1)*only available with 802.11D
Sub Type (4 bits): There are different kinds of management, control and data frames. Therefore the 4-bit Subtype field is required to differentiate. The above examples have Beacon & ACK subtypes.
To DS – if set to “1” – Frame going from STA > Distribution System (DS)
From DS – if set to “1” – Frame going from DS > STA
To DS = 0, From DS = 0 > Management or Control frames where it does not go to DS, Can be STA to STA communication in an ADHOC/IBSS setup.
To DS =0, From DS = 1 > Downstream traffic from AP to the STA.
To DS =1, From DS = 0 > Upstream traffic from STA to AP
To DS =1, From DS = 1 > Data frame using 4 MAC header format, usually occurs in WDS or Mesh Network.
More Fragments – If set to “1” it is usually preceded by another fragment of current MSDU or MMPDU to follow.
Retry – 0 or 1. 1 is for retransmissions. Lot of 1’s may indicate a network with a lot of retry rate due to some issue. The issues can impact the performance by increased application/network latency thereby degrading user experience.
Power Management – if set to “1”, STA is using power save mode.
More Data: if set to “1” it indicates that the AP or STA is holding more frames for the STA to which the current frame is targeted.
Protected Frame – if set to “1” it indicates payload is encrypted.
Order – If set to “1” in any non-QoS data frame when a higher layer has requested that the data be sent using strictly ordered CoS, which tells the receiving STA to process the frames in order.
Duration/ID > 2 Bytes | 16 bits – May be used for 2 purposes, it may contain the duration of the frame. Secondly, it may contain association identifier (AID) of the STA that transmitted the frame.
Address 1,2,3 and 4: Each address contains 6bytes/48 bits of data.
SA > Source Address
DA > Destination Address
TA > Transmitting Address
RA > Receiving Address
BSSID >
Sequence Control Field (2 Bytes/16 bits): Divided into 4-bit fragment number and a 12-bit sequence number. Used when MSDUs are fragmented. 802.11-2016 allows for fragmentation of frames.
QoS Control Field: (2 Bytes/16 bits): Only used in MAC header of QoS frames. Sometimes referred to as WMM (Wi-Fi Multimedia) which provides traffic prioritization.
HT Control Field (4 bytes/32 bits): Parameters related to HT & VHT operations. Only used in Management + QoS control frames.
Frame Body: Contains the actual MSDU payload to be transmitted.
FCS: (Frame check sequence field 4Bytes/32 Bits) – Final field on the frame header. Also known as Trailer as the word says. Used to detect errors in communication.