IEEE 802.11 MAC - cpe.ku.ac.th€¦ · IEEE 802.11 MAC Wireless LANs ... 802.11 Station...

IEEE 802.11 MAC

Wireless LANsJune – September 2009

��. ��. �� Assoc. Prof. Anan Phonphoem, Ph.D.

anan.p@ku.ac.th

Intelligent Wireless Network Group (IWING Lab)

http://iwing.cpe.ku.ac.th

Computer Engineering Department

Kasetsart University, Bangkok, Thailand

MAC Layer

• MAC Layer operation

• Contention & contention-free

• Priority frame transmission

• MAC frame structure

• Create MAC frame

• MAC frame Types

• MAC management, control, and data frame

MAC Layer operation

MAC Layer Operations

• Accessing the wireless medium

• IFS

• PCF & DCF

• Joining the network

• Providing authentication and privacy

Joining the network

Startup/Joint the network

• Turn on � discovery phase

• determine AP or other stations exist

• If exist � joint the network, get the following:

• Service Set Id (SSID)

• Timing Synchronization Function (TSF)

• Timer Value

• PHY setup parameters

• Negotiate for connection

• Authentication & Association

Discovery Phase

• Enter scanning mode

• Passive / Active scanning mode

• Passive

• Listen for a Beacon for ChannelTimeperiod

• In Beacon � get the SSID & parameters

• Active

• Transmit a probe frame (including the SSID that wishes to join)

• Wait for a period responded by AP or other stations

802.11 Station Authentication

MAC Layer Operations

• Accessing the wireless medium

• Joining the network

• Providing authentication and privacyProviding authentication and privacy

Authentication

• Open system authentication

• Default mode

• Shared key authentication

• Higher degree of security

• More rigorous frame exchange

• Need to implement WEP

Open System Authentication

Initiating Station Authenticating Station

Authentication FrameAlgorithm = “Open”Seq. No. = 1

Authentication FrameAlgorithm = “Open”Seq. No. = 2Result = accept/Rej

Request

Accept/Reject

Shared Key Authentication

Initiating Station Authenticating Station

Algorithm = “Shared Key”Seq. No. = 1

Algorithm = “Shared Key”Seq. No. = 2Challenge Text

Enrypt Challenge Text

Authen result

Wired Equivalent Privacy

Encryption DecryptionPlain Text Plain Text

Cipher Text

Key Key

Symmetric Encryption

WEP - Encryption

IntegrityAlgorithm

Pseudo-RandomNumber Generator

BitwiseXOR

Secret Key

Plain Text

Cipher Text

Integrity CheckValue (ICV)

Key SequenceIV

WEP Frame

Frame Header

IV Header

Frame BodyICV

TrailerFCS

EncryptedClear Text Clear Text

4 bytes 4 bytes

WEP - Decryption

IntegrityAlgorithm

Pseudo-RandomNumber Generator

BitwiseXOR

Secret Key

Cipher Text

Plain Text

Integrity CheckValue (ICV)

Key Sequence

MAC Layer

• MAC frame structure/Types

• Basic process revisit

MAC frame structure/Types

MAC Frame Structure

FrameBody

0-2312 bytes

4 bytes

Address1

Address2

Address3

Address4

SeqControl

2 bytes 2 bytes 6 bytes 6 bytes 6 bytes 2 bytes 6 bytes

FrameControl

Duration

MAC Header

MAC Frame Structure

Control information being sent from station to station

Duration of waiting before the next frame (Ack/Data Period)

Different types of Addresses

Sequence and fragment numbers

PayloadCRC

FrameBody

0-2312 bytes

4 bytes

Address1

Address2

Address3

Address4

SeqControl

FrameControl

Duration

FrameBody

0-2312 bytes

4 bytes

Address1

Address2

Address3

Address4

SeqControl

FrameControl

Duration

Frame Control Fields

SubType

2 Bits 2 Bits 4bits

Proto.Ver

TypeToDS

FromDS

MoreFrag

PWRMgmt

MoreData

Framecontrol

FrameBody

0-2312 bytes

4 bytes

Address1

Address2

Address3

Address4

SeqControl

FrameControl

Duration

SubType

2 Bits 2 Bits 4bits

Proto.Ver

TypeToDS

FromDS

MoreFrag

PWRMgmt

MoreData

Framecontrol

Frame Control – Type/subtype

00 Mgmt01 Control Frame10 Data Frame11 Reserved

0000 Association Request0001 Association Response1000 Beacon1011 Authentication

SubType

00 Mgmt

Probe Request Frame

http://www.cisco.com/warp/public/cc/pd/witc/ao1200ap/prodlit/wswpf_wp.htm

FC Byte#1

FC Byte#2

Open Authentication Request

(snap shot by Wireshark)

Independent Basic Service Set (IBSS)

• Stand-alone BSS

• No backbone infrastructure

• At least 2 stations

• Ad hoc Network

• Small areaBasic Service Set

Cell Boundary

Extended Service Set (ESS)

• Extending range

• Arbitrary size

• Multiple cells interconnect

• Need Access Point and Distributed system

ACTACT10M100M

1 2 3 4

13 14 15 16

5 6 7 8

17 18 19 20

9 10 11 12

21 22 23 24

UPLINK

123456789101112

131415161718192021222324COLCOL

SWITCH

ACTACT10M100M

1 2 3 4

13 14 15 16

5 6 7 8

17 18 19 20

9 10 11 12

21 22 23 24

UPLINK

123456789101112

131415161718192021222324COLCOL

SWITCH

ACTACT10M100M

1 2 3 4

13 14 15 16

5 6 7 8

17 18 19 20

9 10 11 12

21 22 23 24

UPLINK

123456789101112

131415161718192021222324COLCOL

SWITCH

Distributed System

FrameBody

0-2312 bytes

4 bytes

Address1

Address2

Address3

Address4

SeqControl

FrameControl

Duration

SubType

2 Bits 2 Bits 4bits

Proto.Ver

TypeToDS

FromDS

MoreFrag

PWRMgmt

MoreData

Framecontrol

Frame Control – Address Fields

N/ADASABSSID01

N/ABSSIDDA10

SATARA11

N/ASADA00

Add 4Add 2Add 1

DS: Distribution System

FromDS

Address Example

http://www.cisco.com/warp/public/cc/pd/witc/ao1200ap/prodlit/wswpf_wp.htm

Frame Control Fields

Sender gonna be 1=Sleep (power saving) mode0=Full active mode

1 = retransmit0 = regular

1=Data encrypted0=Other Tx

FrameBody

0-2312 bytes

4 bytes

Address1

Address2

Address3

Address4

SeqControl

FrameControl

Duration

SubType

2 Bits 2 Bits 4bits

Proto.Ver

TypeToDS

FromDS

MoreFrag

PWRMgmt

MoreData

Framecontrol

How to capture WLAN packets?

• To capture WLAN packet in Linux (Ubuntu)• Install Wireshark

• #sudo apt-get install wireshark

• Change your wireless NIC to “monitor” mode• Disable your WLAN card

# ifconfig wlan0 down• Change mode of the wireless NIC card

# iwconfig wlan0 mode monitor• Then up the interface

# ifconfig wlan0 up

• Now start the wireshark

• To stop capturing and start using the regular WLAN• Change mode of the wireless NIC card

# iwconfig wlan0 mode managed

Capture packetLive Demo

MAC Layer

• MAC frame structure/Types

• Basic process revisitBasic process revisit

IEEE 802.11 Basic process

• Authentication

• Association

• Starting an IBSS

• One station is configured to be “ initiating station’’

• Starter send beacons

Frame Control – Address Fields

N/ADASABSSID01

N/ABSSIDDA10

SATARA11

N/ASADA00

Add 4Add 2Add 1

00: All management/control frames 01: Data Frames from AP10: Data Frames to AP11: Data Frames on a wireless bridge

FromDS

DS: Distribution System

DA: Destination AddrSA: Source AddrTA: Transmitter AddrRA: Receiver AddrBSSID: BSS ID same as AP

Traffic Flow

MAC filters frames based on “Addr1”

• In IBSS:

Traffic is sent directly to the destination in BSSAdd1 = MAC add of the destination station

Add2 = MAC add of the source station

Add3 = BSSID (= MAC add of the initiator of the IBSS)

• In ESS:

Outgoing traffic is sent to Access-Point in BSSAdd1 = MAC add of the Access-Point

Add2 = MAC add of the source station

Add3 = MAC add of the destination station

N/ADASABSSID01

N/ABSSIDDA10

SATARA11

N/ASADA00

Add 4Add 2Add 1

Address Fields (To AP)

Client

ACTACT10M100M

1 2 3 4

13 14 15 16

5 6 7 8

17 18 19 20

9 10 11 12

21 22 23 24

UPLINK

1 2 3 4 5 6 7 8 9101112

131415161718192021222324COLCOL

SWITCH

Server

SA/TARA (BSSID)

N/ADASABSSID01

N/ABSSIDDA10

SATARA11

N/ASADA00

Add 4Add 2Add 1

Client � Server

Address Fields (From AP)

Client

ACTACT10M100M

1 2 3 4

13 14 15 16

5 6 7 8

17 18 19 20

9 10 11 12

21 22 23 24

UPLINK

1 2 3 4 5 6 7 8 9101112

131415161718192021222324COLCOL

SWITCH

Server

RA/DATA (BSSID)

N/ADASABSSID01

N/ABSSIDDA10

SATARA11

N/ASADA00

Add 4Add 2Add 1

Server � Client

Address Fields (WDS)

Client

ACTACT10M100M

1 2 3 4

13 14 15 16

5 6 7 8

17 18 19 20

9 10 11 12

21 22 23 24

UPLINK

1 2 3 4 5 6 7 8 9101112

131415161718192021222324COLCOL

SWITCH

Server

N/ADASABSSID01

N/ABSSIDDA10

SATARA11

N/ASADA00

Add 4Add 2Add 1

Client � Server

ACTACT10M100M

1 2 3 4

13 14 15 16

5 6 7 8

17 18 19 20

9 10 11 12

21 22 23 24

UPLINK

1 2 3 4 5 6 7 8 9101112

131415161718192021222324COLCOL

SWITCH

Wireless Bridge

Traffic flow inside BSS

Access PointAccess Point

WaveLAN PC-CardWaveLAN PC-Card

Association table

Inter-BSS Relay

Bridge learn table

STA-1STA-1

Associate

STA-2STA-2

AssociatePacket for STA-2ACK Packet for STA-2

STA-2 2

From WaveLAN Slide

Traffic flow in ESS

STA-1STA-1 STA-2STA-2BSS-A

Backbone

Packet for STA-2

Access Point - AAccess Point - A

Association table

Bridge learn table

Access Point - BAccess Point - B

Association table

Bridge learn table

STA-2 1

2 STA-2

From WaveLAN Slide

Traffic flow in WDS

STA-1STA-1 STA-2STA-2BSS-A

Packet for STA-2

Association table

Bridge learn table

Association table

Bridge learn table

STA-2 2

2 STA-2

Wireless

Backbone

WDS Relay

WDS RelayPacket for STA-2

From WaveLAN Slide

Control Frame : RTS

RA TA FCS

2 bytes 2 bytes 6 bytes 6 bytes 4 bytes

FrameControl

Duration1RTS frame

Frame Tx

Duration1 = CTS + Data + ACK + 3SIFS

Control Frame : CTS

RA FCS

2 bytes 2 bytes 6 bytess 4 bytes

FrameControl

Duration2CTS frame

Frame Tx

Duration1 = CTS + Data + ACK + 3SIFS

NAV Duration2 = Duration1 –CTS - SIFS

Control Frame : ACK

RA FCS

2 bytes 2 bytes 6 bytes 4 bytes

FrameControl

Duration3ACK frame

Frac X

Frac X+1

Ack X+1

Duration = (Frac X+1) +3SIFS +2 ACK

Management Frame: Beacon

• Announce the existence of a network

• Regular intervals

• Allow network management

• AP is responsible

Beacon Frame

Power Conservation

• Mobility relies on batteries

• Frequently recharge is undesirable

• How to save the battery ??• Power down the transceiver

• Power down status• Sleep/Doze/Power saving mode

• Power up status• Active/Awake mode

Power Saving Goal

• Minimizing time spent in the Awake mode

• No scarify for network connectivity

Power conservation in the Infrastructure Mode

• All traffic go through Access Point

• AP is always active (connected to power supply)

• (Associated) Mobile nodes send their status to AP

• AP manages timing for sending data

• AP sends data to the active node

• Periodically announce to sleep nodes if data is waiting (Keep buffering the data)

Power consumption

1.15 W *1 Awake – Idle

0.045 W *2 Doze

1.40 W *1 Awake – Receive packets

1.65 W *1 Awake – Transmit packets

Power ConsumptionMode

*1Mark Stemm and Randy H. Katz, “Measuring and reducing energy consumption of network interfaces in hand-held devices,” IEICE Transactions on

Communications, special Issue on Mobile Computing, vol. E80-B, no. 8, pp. 1125–31, 1997

*2Havinga P.J.M., Smit G.J.M., “Energy-efficient TDMA medium access control protocol scheduling” , Asian International Mobile Computing Conference (AMOC

2000), Nov. 2000.

Power saving

• Doze mode

• Default state

• keep radio off most of the time

• wakeup periodically to check for message

• Sleep mode

• radio in transmit-only standby mode

• radio wake up and send if necessary but cannot receive

Sleep time

• Negotiate in the association process

• “Listen Interval” parameter (#beacon periods)

• Long interval � large buffer needed @AP

• Time up � AP discards buffered frames

Management Frame: TIM

• Traffic Indication Map

• Low-power mode

• TIM is transmitted in the Beacon frame

• AP sends to sleeping station (data is waiting for the sleeping station)

• Each node must wake up to listen for Beacon frame (with TIM included)

Traffic Indication Map (TIM)

• A virtual bitmap

• Each bit for each Association ID (AID)

• “Set” bit = AP has buffered unicast frames for the AID station

• Size = 2008 bits

Frame Retrieval Process

TIM(X,Y) TIM(X,Y) TIM(X) TIM(X,Y) TIM(No)

PS-Poll

Beacon Interval

PS-Poll

X: listen interval = 3Y: listen interval =2

PS = power saving

Other TIM

• Delivery TIM (DTIM)

• Multicast and Broadcast frames

• ATIM (Announcement TIM)

• used in IBSS Beacon Frame

• # of time units between ATIM frames

Power Management in IBSS

ATIM Window

Beacon Interval

BeaconBeacon

Station AStation A

Station B

Transmit ATIM

Receive ACK

Transmit Frame

Receive ACK

Receive ATIM

Transmit ACK

Receive Frame

Transmit ACKSweta Sarkar, 2002

More Data

• Mobile node sends a PS-Poll for a buffered frame

• AP sends back data

• Observed the “More Data” bit in Frame Control

• Sending more PS-Poll if More Data ≠ 0

FrameBody

FCSAddress

1Address

2Address

3Address

ControlFrameControl

Duration/ID

SubType

2 Bits 2 Bits 4bits

Proto.Ver

TypeToDS

FromDS

MoreFrag

PWRMgmt

MoreData

Framecontrol

IEEE 802.11 MAC - cpe.ku.ac.th€¦ · IEEE 802.11 MAC Wireless LANs ... 802.11 Station...

Documents

IEEE 802.11 MAC - Purdue University · PDF fileCS 536 Park IEEE 802.11 MAC −→ CSMA/CA with exponential backoﬀ −→ almost like CSMA/CD −→ drop CD −→ CSMA with explicit

11 Architect. 1 Module contents IEEE 802.11 Terminology IEEE 802.11 MAC Frames Basic processes in IEEE802.11 networks Configuration parameters

Policing 802.11 MAC Misbehaviourshomepages.inf.ed.ac.uk/ppatras/pub/tmc15.pdfpopular IEEE 802.11 speciﬁcation [1] employ a decen-tralised Medium Access Control (MAC) protocol to

IEEE 802.11 Wireless LAN Standard. Medium Access Control-CSMA/CA IEEE 802.11 defines two MAC sublayers Distributed coordination function (DCF) Point coordination

4 MAC Protocols - Freie Universität€¦ · 4. MAC Protocols Prof. Dr. Mesut Güneş Distributed, embedded Systems (DES) ... IEEE 802.11 • IEEE 802.11 ... DIFS ~50µs Distributed

CSE 6590 Wireless LANs and IEEE 802.11 MAC 15 October 2015

Analysis the MAC Protocol of IEEE 802.11 Wireless LAN

Wireless LANs and IEEE 802.11 MAC

IEEE • • • • 802.11 MAC Layer Operation Basic

IEEE 802.11 MAC Protocol for high efficiency MC CDMA WLANs IEEE 802.pdf · Adaptive IEEE 802.11 MAC Protocol for high efficiency MC‐CDMA WLANs 15. FFV Workshop 21. November 2008

IEEE 802.11 – MAC LAYER Maria Papadopouli

An Empirical Analysis of the IEEE 802.11 MAC Layer Handoff Process

IEEE 802.11 (MAC)

Performance Analysis of IEEE 802.11 MAC Protocols in ...plaza.ufl.edu/zhq/publication/Performance80211.pdfPerformance Analysis of IEEE 802.11 MAC Protocols in Wireless LANs Hongqiang

Detecting IEEE 802.11 MAC layer misbehavior in ad hoc ...baras///publications/journals/...104 S. Radosavac et al. / Detecting IEEE 802.11 MAC layer misbehavior in ad hoc networks The

Investigation of the IEEE 802.11 Medium Access Control ...korpe/courses/cs515-fall2002/papers/802-11-mac... · Investigation of the IEEE 802.11 Medium Access Control (MAC) Sublayer

On the impact of IEEE 802.11 mac on traffic ...storage.googleapis.com/wzukusers/user-24581472/documents... · Since the standardization of IEEE 802.11 MAC [13] many research efforts

Vulnerabilidades en la capa MAC de IEEE 802.11 - Hackelarre

IEEE 802.11 Wireless LAN - KAISTheuristic.kaist.ac.kr/cylee/xdatacom/2015_classnotes/G1...Wireless LAN Standards IEEE 802.11 Series A MAC l h b ifi d f IEEE A common MAC layer has

ISRM Partea I: IEEE 802 - pub.ro · 2017. 9. 25. · IP 802.3 MAC 802.3 PHY application TCP 802.3 PHY 802.3 MAC IP 802.11 MAC 802.11 PHY LLC LLC LLC. nivelele 802.11 Subnivel MAC