This is the landing page for all the wireless related posts on my blog. Majority of the content is towards my study for wireless related certifications like CWNP. The name ‘It Depends!’ is given as it is the majority of the answers or responses to the wireless queries
Spectrum Analyzer - comprises of 15% syllabus for CWAP-403 exam. You can roughly expect around 9 questions from this section. Spectrum Analyzers range in price from a few hundred $ to thousands. They are not free to use like in the case of Wireshark etc..
I was unable to source spectrum analyzers easily and ended up not reading thoroughly on this topic My first attempt for CWAP-403 exam did not achieve the required passing score. I scored 44% on this section, hence I am writing this blog post to strengthen my understanding and also for those who are on the lookout for studying and understanding the concepts. The knowledge that is tested around this section comprises mainly around the terminologies related to Spectrum Analyzers and the understanding the patterns in tables/layouts displayed in the application.
The terminologies include Duty Cycle, Sweep Cycle, FFT, Resolution Bandwidth, Utilization, Domains and a few more. An understanding is required to demonstrate that one is able to locate the interfering devices and recognizing patterns using various Spectrum Analyzer applications.
A few known concepts before diving into Spectrum Analysis.
Cycle / Wavelength : A wave form which starts
at the center, climbs in energy to the highest point, called the peak; returns
to the center; then drops to the weakest point, called the trough and then
continues till it finally attenuates and looses the energy. Wavelength is often
measured from peak to the next peak.
Amplitude : Determined by the height, force or
power of the wave.
Frequency: Number of cycles within one second. E.g. 2.4GHz generates 2.4 billion times of cycles every second.
λ = Wavelength
C = Speed of light (186000 miles per second)
2.4 GHz = 12.5cm
5 GHz = 6cm
Free Space Path Loss (FPSL) - Loss of signal as
it travels through free space. This is a theoretical value, as in the real
world, there may be many obstacles, reflection, scatter which need to be
accounted when estimating the signal at a location. FPSL is based on inverse
square law, originally developed by Isaac Newton. You don't need to know below
formula for the exam.
FSPL = 36.6 + (20log10(f)) + (20log10(d))
FSPL = path loss in dB
f = frequency in MHz, d = distance in miles between antenna
dB is logarithmic
ratio of values
- We add gains +3dB = x2
- We subtract losses -3dB = /2
- We add gains +10dB = x10
- We subtract losses -10dB =
- dBm is power measurement
relative to 1mW
- dBi is the forward gain of an
antenna compared to istropic antenna.
- RSSI is a metric that is specified by measuring the amount of energy associated with the bits received via wireless NIC.
- Background level of radio energy that exist in a medium on a specific channel which is analyzed.
- SNR can be presented as a dB value or as the difference between the RSSI(signal) and the noise floor(noise). High SNR is better performance.
Receive Sensitivity refers to the power level of an RF signal required to be successfully received by the receiver radio.
- Use Antenna and coding filter to keep out of unwanted RF and bits.
- Will use some of the specific information gleaned from the RF to bit transition process to actually add info to the wireless frame.
- The additional information is added to the receiving station and known as Radiotap Header.
- All the info shown on the Radiotap Header is in reference to "receiving station" and "not transferring station"
- Mobile / Integrated
- Mobile spectrum analyzers like protocol analyzers use the adapters present in laptops.
- Integrated spectrum analyzers use APs to monitor the RF.
- Popular mobile analyzers include AirMagnet, Spectrum XT, Metageek Wi-Spy DBx etc..
- Integrated spectrum example may include Cisco Clean Air software to pull spectrum data from the AP.
- Three popular applications available for mobile analysis, they are AirMagnet Spectrum XT, Metageek Chanalyzer, Cisco Spectrum Expert.
Spectrum Analysis Terminology
- Duty Cycle indicates the fraction of time a resource is busy.
- FFT (Fast Fourier Transform) Duty Cycle measurements are important way to determine potential interference/impact of an RF transmitter on WLAN operations. Duty cycle measures the amount of time in which the amplitude is above some arbitrary threshold. Threshold can vary from each software. (such as -95dBm, or 15dB above noise floor or -75dBm).
- In higher end spectrum analysis tools, a sweep is measured as a single scan of the bandwidth span. So if one is measuring 100 MHz of spectrum, a sweep is how long it takes to scan that 100 MHz band a single time.
- For e.g. a real-time FFT plot shows amplitude (Y axis) plotted over frequency (X axis). Within the real-time FFT chart, there may be a trace for the maximum amplitude over the last sweep or possibly a "max hold" over all previous sweeps. When the plot updates after the next sweep, the data will be refreshed with new information and will be relative to the previous sweep.
- RBW is a reference to the smallest frequency that can be resolved by the receiver.
- RBW should be low enough to resolve spectral components of the transmission being measured.
- Same data from FFT plot but adding the time dimension.
- A waterfall plot is a three-dimensional plot in which multiple curves of data, typically spectra, are displayed simultaneously.
As spectrum analysis tools have improved and developed, more emphasize is given on data reporting and analysis have moved tighter integration and correlation with Wi-Fi information.
RF Signature Characteristics
- Pulse vs. Constant
- Duty Cycle
- Frequency Hopping
I have not documented individual interference examples from various sources. This is nicely documented on the metageek website and you can click here for references.
Other useful references
EXAM MOMENT: When locating devices, use a directional antenna to aid in the location of the signal source. Study about Duty Cycles, FFT, Swept Spectrogram and other interference patterns.Read more link text
I've tried to condense my notes from the study for CWAP-403 exam. The exam consists of lot of details which need to be learnt if you have not done enough capturing and analyzing 802.11 wireless frames before.
- CWAP 403 - Start > Introductory blog
- 802.11 Mac Header explained
- Key 802.11 Frames
- Troubleshooting WLAN issues #mindmap
- PHY Layer
- WLAN medium contention
- 802.11 Frame Exchanges (Security)
- How to capture WLAN Frames?
- Troubleshooting WLAN issues with 802.11 Frames
- 802.11n | HT Operations
- 802.11ac | VHT Operations
- Spectrum Analysis
post will be focusing on 802.11ac in particular. We visited the aspects of
802.11n in the last blog post.
introduced the VHT (Very High Throughput) along with some core technological
advancement like MU-MIMO, 256 QAM addition & support for 80MHz/160MHz
channels. One of the key differences also lie in the support of only 5GHz band.
So there is still a dependency on 802.11n for 2.4Ghz support, however the
upcoming 802.11ax will support both 2.4GHz and 5GHz.
- One of the greatest potential of 802.11ac
- Prior to this all the 802.11 standards used single user.
- If there are two receivers located in sufficiently different directions, a beamformed transmission may be sent to each of them at the same time.
- Enables better spatial reuse. As per the below example, the MU-MIMO builds on small-cell approach by enabling even more tightly packed networks. As a result AP can send independent transmissions within its own coverage area. Just as 802.3(Ethernet) reduces collision domains, MU-MIMO intends to reduce spatial contention of transmissions.
802.11ac Wave 1 and 2 - The first wave of 802.11ac products will
be driven by the enthusiasm for higher speeds. APs will typically have three
stream capabilities, but with 802.11ac providing 80 MHz channels and 256-QAM
modulation, the speed will go from 450 Mbps to 1.3 Gbps. The second wave of
802.11ac products will add even wider channels and possibly even multi-user
MIMO support, as outlined in the figure below.
- OFDM based transmission, 802.11ac divides the channel into OFDM sub carriers each 312.5kHz
- To increase throughput, 802.11ac introduces two new channel widths. Supports 80MHz and further added 160MHz channel option for even higher speeds.
- 802.11ac channels have exactly the same shape as previous OFDM channels (802.11a,g,n)
MCS & GI
- MCS Index tends to be much simpler than 802.11n. First 7 are mandatory and others are supported.
- 802.11ac retains the ability to select a shortened OFDM guard interval if both Tx and Rx are capable of processing it. The GI shrinks from 800ns to 400ns, providing a 10% boost in the throughput.
VHT Signal Fields
purpose of the Signal Field is to help the receiver decode the data payload,
which is done by describing the parameters used for transmission. 802.11ac
separates into Signal A and Signal B fields. For CWAP purposes this has not
been dealt in depth. There are 2 parts in VHT Signal A field are referred as
VHT-SIG-A1 & VHT-SIG-A2.
- 0 - 20MHz, 1 - 40MHz, 2- 80MHz & 3 - 160MHz
- If the payload is encoded with STBC (Space-time block coding may be used when the number of radio chains exceed the number of spatial streams, it tx a single data stream across 2 spatial streams.) for extra robust-ness, this field is set to 1, otherwise will be 0.
- Group ID
- Frames to AP > group ID =0
- Frames sent to STA Client > group ID = 63
- Number of space-time streams
- Starts from 0, e.g. if field is set to 3, then there are 4 space time streams.
- Partial AID
- Last 9 bits of the BSSID.
- Transmit power save forbidden
- Field will be 0, if AP in network allows client to power off radios when they have opportunity to transmit frames. Otherwise will be 1.
- Short GI - Field set to 1 for 400ns, 0 for otherwise.
- Short GI disambiguation - Extra symbol may be required denoting 1 or 0 for not required.
- Coding - Field is 0 when convolutional coding is used to protect the data field, 1 when LDPC is used.
- LDPC Extra Symbol - Field is set to 1 if extra symbol is required.
- MCS - MCS Index value of the payload.
- Beamformed - If matrix is applied to the transmission, the bit is set to 1 otherwise set to 0.
- CRC - Error correction
- Tail - 6 zeros are included to terminate the convolutional coder that protects the Signal A field.
- Used to setup the data rate, as well as tune in the MIMO reception.
- VHT Signal B Length (17, 19 or 21 Bits)
- Reserved bits - Set to 1.
- Tail bits
Air Magnet Pro can help you scan through the PHY frames
aggregation was introduced in 802.11n, 802.11ac however adds an interesting new
take on the aggregation. All frames transmitted use the aggregated MPDU
(A-MPDU) format. Even the single frame transmitted in one shot is transmitted
as aggregate frame.
Capabilities Information element.
Operations Information element
Greenfield mode was offered with 802.11n. The
efficiency gains from greenfield mode were often lost because airtime-devouring
required before transmitting in the greenfield mode. As a result, greenfield
mode was removed from 802.11ac.
- As 802.11ac beamforming is based on explicit channel measurements, both the transmitter and receiver must support it.
- Any device that shapes its transmitted frames is called beamformer, receiver of such frames is called beamformee.
- The AP initiates frame exchange with the STA, which helps it to measure the channel. The result of the channel measurement is a derivation of the steering matrix.
- Steering Matrix describes how to setup each element of transmitter's antenna system to precisely overlap transmissions to reach farther.
- To steer transmissions in a particular direction, a beamformer will subtly alter what is transmitted by each array. A simple phase shift can alter/steer the transmission.
Null Data Packet (NDP) - Standardizes
beamforming methods. 802.11ac method of beamforming is termed as null data
packet sounding. Sounding is the term used to denote the process performed by the transmitter to acquire
channel state information (CSI) from each of the different users by sending
training symbols and waiting for the receivers to provide explicit feedback
containing a measure of the channel.
VHT beamformer shall
initiate a sounding feedback sequence by transmitting VHT NDP announcement
frame followed by a VHT NDP after a SIFS.
- Begins with the beamformer sending a NDP announcement packet followed by NDP. The NDP has fixed known format. The beamformee receives the NDP, analyzes it and computes back in form of feedback matrix. The feedback matrix is sent in reply to the NDP in the form of compressed beamforming frame (CBF).
- As opposed to Tx to one device, MU-MIMO Aps are capable of simultaneously transmitting data to multiple device groups.
- The key distinction between them is that with MU-MIMO beamforming and beamformer requires a response from all beamformees in order to conclude channel sounding.
- The CBF packet is 802.11 action frame which contains a channel matrix that specifies the CSI for each client. The CBF is the largest contributor to the overhead caused by MU-MIMO transmission and is size is determined by
- Channel Width
- Number of radio chain pairs
- Bit count of each CSI unit
Recommended ReadingRead more link text
The blog post will cover the topics related to High Throughput Throughput technologies in conjunction with the exam objectives laid down for CWAP-403 exam. 802.11 Frame Exchanges cover 25% of the knowledge domain required for the exam. Analysing HT & VHT transmission methods are one of the sub topics under this section. I will be focusing on the HT/802.11n type in this blog, apparently it has gone a little longer than i thought. There are certain section which might take further reading from 802.11n Survival Guide if you are keen.
802.11n ~ High Throughput
- Ratified Sep 2009
- Clause 20 technology, backward compatible with HR-DSSS (Clause 18), OFDM (Clause 17).
- Can be used for both 2.4GHz & 5GHz bands.
- Transmit Beamforming (TxBF) - Tx(Transmitter) Radios multiple antenna can transmit in the best direction of the Rx (Receiver).
- Spatial Multiplexing (SM) - Tx multiple radios at the same time with each unique stream containing different data.
- Space-Time Block Coding(STBC) - Transmitting redundant copies of data stream from different antenna thereby increasing the signal quality.
- Antenna Selection (ASEL) - Increase signal diversity by dynamic selection of antennas.
- Takes advantage of multipath (when signal tends to reflect, scatter, diffract or refract).
- Multiple streams follow different paths to the receiver because of the space between the transmitting antenna is known as spatial diversity and is also called as spatial multiplexing.
- When using SM, both Tx and Rx should participate and be MIMO systems.
- Use 20 MHz OFDM channels.(NON-HT)
- Each 20MHz OFDM channel contains 64 subcarriers which are each 312.5 KHz wide and can be separately modulated.
- First 6 & Last 5 sub carriers are null as they act like guard band for the channel + center subcarrier is also null. This leaves 52 subcarriers.
- Out of 52, 48 transmit data while 4 used in dynamic calibration between Tx and Rx.
- 20MHz OFDM channels (HT)
- Each 20MHz OFDM channel has 56 subcarriers, 52 transmit data, 4 are used for calibration between Tx and Rx.
- 40 MHz Channels
- Use 114 OFDM subcarriers, 108 transmit data, 6 are used for calibration.
- A 40MHz channel doubles the frequency bandwidth available for transmission of the data.
- A 40MHz channel used by HT radios essentially 2x 20MHz OFDM channels bonded together.
Modulation and Coding Scheme (MCS Index)
- Value that describes the number of spatial streams, modulations (BPSK, QPSK, 16-QAM or 64-QAM and further) and error correction code used in Tx.
- 802.11n supports equal modulation, in which all SS are transmitted in same manner, and unequal modulation, in which the spatial streams may be modulated differently.
- 802.11n defines 77 different combinations of modulation and coding.
- There are 8 mandatory MCS for 20 MHz HT channels.
Guard Interval (GI)
- The GI is the space between the symbols being transmitted.
- May be confused with IFS, the GI is there to eliminated inter-symbol interference where is referred to as ISI.
- ISI happens when echoes from one symbol interfere with another.
- A good rule of thumb specifies that GI should be 4x the highest multipath delay spread. When 802.11a was designed, designers used conservative value of 200ns for the delay speed, and choose to make the GI 800ns.
I've discussed this topic in details under this blog post.
- Before the 802.11n amendment was ratified, the HT technology was already being certified and sold. The Wi-Fi alliance had developed a vendor certification program called Wi-Fi CERTIFIED 802.11n draft 2.0. The Cert Program as name suggested, certified products against the amendment. Draft 2.0 supports a max data rate of 300Mbps which is half max data rate specified in ratified document.
- Details about the Wi-Fi certified "n" features can be found here
HT Control Field
- The 802.11n amendment adds a new field in 802.11 MAC header, called the HT Control Field. It is 4 octets long and follows QoS control field in 802.11 MAC header.
- Any MPDU that contains an HT control field is referred to as +HTC MPDU.
The Order Bit - The 802.11n amendment uses the existing but relatively unused order bit in the Frame Control field of the MAC header to indicate the presence of an HT Control Field in QoS data & management frames. Original purpose of this bit was to indicate that data muse be sent using a strict ordered class of service.
Control Wrapper Frame - is/are described using the carried frame name + HTC, for example RTS+HTC or CTS+HTC
HT Control Field Format - figure below shows the format of HT Control field. (Honestly some of the stuff went way over my head but might have to figure this out by looking at a few pcaps & studying them :|)
Link Adaptation Control (16 bits)
- TRQ - Training Request > Set to 1 to request the responder to transmit a sounding PPDU. Set to 0 to indicate that the responder is not requested to transmit a sounding PPDU.
- MAI (MCS Request (MRQ) or ASEL Indicator) - When set to "14", it is an ASEL indicater which indicates that you would interpret the MFB/ASELC subfield as an ASEL command.
- MFSI – MCS Feedback Sequence Identifier- A MCS Feedback (MFB) frame is sent in response to a MCS Request.
- MFB/ASELC – MCS feedback and Antenna Selection Command -When ASEL indicator is present, the MFB/ASELC subfield interpreted as ASELC subfield. Otherwise it is interpreted as MFB subfield. A value of 127 indicates that no feedback is present
Calibration Position (2 bits)
- Set to 0 indicates this is not a calibration frame.
- Set to 1 indicates calibration start.
- Set to 2 indicates sounding response.
- Set to 3 indicates sounding complete.
Calibration Sequence - Each of the four packets within the calibration exchange will have the same sequence number.
CSI/Steering - When using sounding frames to transmit feedback about the channel, the Channel State
Information (CSI)/Steering subfield identifies the type of feedback being used.
NDP Announcement - indicates that an NDP will be transmitted after the frame. It is set to 1 to indicate that an NDP will follow; otherwise, it is set to 0. NDP are used to send sounding PPDU when no other data needs to be transmitted. If a frame transmitted that require an immediate response and also has the TRQ=1 (request for sounding PPDU) then receiver can either transmit the MPDU response withing a sounding PPDU or send the response MPDU with the NDP Announcement bit set to 1, indicating that NDP will be transmitted following the current PPDU.
Reverse Direction Protocol - 802.11n amendment which improves the efficiency of data transfer between STAs.
HT Action Frames & Information Elements
HT Capabilities, HT Operations, 20/40 BSS Coexistence & Overlapping BSS Scan Parameters,
HT Capabilities Element
- Can be seen in Beacon, Probe Req/Response, Association Req/Response & Reassoc Req/Response.
- You can figure out the MCS values supported by the 802.11n AP from this section in the pcap.
- Determine A-MPDU parameters
HT Operation Element
- STA operation within an HT BSS environment.
- Found in Beacon, Reassociation Response, and Probe Response frames transmitted by an AP.
HT information elements
- Primary Channel, Secondary Channel Offset and STA channel width.
- When the Supported Channel Width Set subfield is equal to 1(as in above), indicating a 20/40 MHz BSS, then the Primary Channel field indicates the primary channel number.
- Secondary Channel - Directly above or below the primary channel.
- Protection Mechanisms - To ensure backward compatibility with older 802.11 a/b/g radios, an HT access point will operate in one of four protection modes. 00 in above pcap example.
- RIFS mode - The 802.11e QoS amendment introduced the capability for a transmitting radio to send a burst of frames during a transmit opportunity (TXOP). (prohibited in above pcap case).
- Basic MCS Set - Last in Operations element, similar to MCS set field in HT Capabilities Element.
For Further ReadingRead more link text