Wireless LAN networks Haakon Bryhni haakon@bryhni Nunatak AS / University of Oslo

1. Wireless LAN networks Haakon Bryhni haakon@bryhni.com Nunatak AS / University of Oslo INF 5050, 28.3.2014

2. Overview of Wireless LAN concepts Frequency Hopping and Direct Sequence Spread Spectrum Carrier sense, Collision avoidance and Fragmentation

3. WLAN architecture Figure source: Siemens

4. Layering means encapsulation Source: Siemens, Regel

5. Wireless properties • Media • Interference and noise • Quality varies over space and time • Shared with ”unwanted” WiFi devices • Shared with non-802 devices (unlicenced spectrum) • Full connectivity cannot be assumed • Hidden node problem • Mobility • Variation in link reliability • Battery usage: power management • Seamless connections • Security • Multiple international regulatory requirements

6. Peer-to-Peer communication Source: Siemens, Regel

7. Extended Service Set (2 BSS) • Access Points (AP) and stations (STA) • BSS (Basic Service Set) – a set of stations controlled by a single coordination function. • Distribution system interconnects multiple cells via access points (typically an ethernet switch) • Extends wireless coverage and enables roaming. Source: Siemens, Regel

8. WLAN Network topologies

9. Direct Sequence Spread Spectrum Efficient modulation technique and good signal/noise properties. Phase Shift Keying: 1 Mbit/s: Differential Binary PSK, 2 Mbit/s: Differential Quadrant PSK. 3 colocated channels available in the 2.4 GHz ISM band Jamming/interference affects Signal/Noise ratio for entire channel

10. Direct Sequence Spread Spectrum Source: Siemens, Regel

11. Non-overlapping DSSS channels in the ISM band

12. Graphical representation of Wi-Fi channels in 2.4 GHz band

13. Frequency Hopping Spread Spectrum FHSS uses 79 frequency channels between 2.4 GHz and 2.438 GHz, 1 MHz channel spacing. Modulation is Freqency Shift Keying: 1 Mbit/s: 2 level Gaussian FSK, 2 Mbit/s: 4 level Gaussian FSK.

14. FHSS Interference avoidance

15. Colocated FHSS systems High number of colocated systems (practical limit is about 15 in the 2.4 GHz ISM band) High resistance to jamming/interference

16. Access mechanism: Carrier Sense Multiple Access with Collision Avoidance Distributed Inter Frame Space Stations listen before transmission - if medium is free for more than DIFS; transmit If not; use backoff mechanism. Exponential backoff window increase with retransmissions.

17. Virtual Carrier Sense(Problem: All stations do not “hear” each other) RTS = Ready To Send CTS = Clear To Send NAV = Network Allocation Vector Stations exchange duration information using short frames (RTS/CTS). Other stations recognize medium as busy for the said duration. Source: Siemens, Regel

18. Active Scanning Source: Siemens, Regel

19. Fragmentation • Long fragments - higher probability of error • Microwave ovens interfere (4ms / 4ms duty cycle) • Collision recovery is less expensive if we use fragmentation. • Retransmission of fragments MSDU Hdr Body CRC Hdr Body CRC Hdr Body CRC

20. Overview of Wireless LAN technologies ”The 802.11 alphabet soup”

21. Key wireless standards in the WLAN Alphabet soup • 802.11a – 5 GHz - 802.11a uses OFDM to define a total of 8 non-overlapping 20 MHz channels across the 2 lower bands. By comparison, 802.11b uses 3 non-overlapping channels. • 802.11b – 2.4 GHz • 1 Mbit/s Binary Phase Shift Keying BPSK • 2 Mbit/s Quadrature Phase Shift Keying (QPSK) • 5.5 Mbit/s QPSK + Complementary Code Keying (CCK) 4 bit/carrier • 11 Mbit/s QPSK + Complementary Code Keying (CCK) 4 bit/carrier • 802.11g – 2.4 GHz - The mandatory modulation/access modes are the same CCK (Complementary Code Keying) mode used by 802.11b (hence the compatibility) – 11 Mbit/s and the OFDM (Orthogonal Frequency Division Multiplexing) mode used by 802.11a – 54 Mbit/s • 802.11n – 100 Mbit/s adding multiple-input multiple-output (MIMO) and many other newer features. • 802.11e – QoS (See also Wireless Multimedia Extentions). as of June 2003 is a draft standard that defines a set of Quality of Service enhancements for LAN applications, in particular the 802.11 WiFi standard. The standard is considered of critical importance for delay-sensitive applications, such as Voice over Wireless IP and Streaming Multimedia. • IEEE 802.16 is working group number 16 of IEEE 802, specialising in point-to-multipoint broadband wireless access. It also is known as WiMAX, an acronym that stands for Worldwide Interoperability for Microwave Access. 2 to 11 GHz range.

22. IEEE 802.11 Working Groups • IEEE 802.11 - THE WLAN STANDARD was original 1 Mbit/s and 2 Mbit/s, 2.4 GHz RF and infrared [IR] standard (1997), all the others listed below are Amendments to this standard, except for Recommended Practices 802.11F and 802.11T. • IEEE 802.11a - 54 Mbit/s, 5 GHz standard (1999, shipping products in 2001) • IEEE 802.11b - Enhancements to 802.11 to support 5.5 and 11 Mbit/s (1999) • IEEE 802.11c - Bridge operation procedures; included in the IEEE 802.1D standard (2001) • IEEE 802.11d - International (country-to-country) roaming extensions (2001) • IEEE 802.11e - Enhancements: QoS, including packet bursting (2005) • IEEE 802.11F - Inter-Access Point Protocol (2003) Withdrawn February 2006 • IEEE 802.11g - 54 Mbit/s, 2.4 GHz standard (backwards compatible with b) (2003) • IEEE 802.11h - Spectrum Managed 802.11a (5 GHz) for European compatibility (2004) • IEEE 802.11i - Enhanced security (2004) WPA2 • IEEE 802.11j - Extensions for Japan (2004) • IEEE 802.11-2007 - A new release of the standard that includes amendments a, b, d, e, g, h, i & j. (July 2007) • IEEE 802.11k - Radio resource measurement enhancements (2008) • IEEE 802.11n - Higher throughput improvements using MIMO (multiple input, multiple output antennas) (November 2009) • IEEE 802.11p - WAVE - Wireless Access for the Vehicular Environment (such as ambulances and passenger cars) • IEEE 802.11r - Fast roaming Working "Task Group r" - (2008) • IEEE 802.11s - Mesh Networking, Extended Service Set (ESS) (working - Jul 2010?) • IEEE 802.11T - Wireless Performance Prediction (WPP) - test methods and metrics Recommendation cancelled • IEEE 802.11u - Interworking with non-802 networks (for example, cellular) (proposal evaluation - Mar 2010?) • IEEE 802.11v - Wireless network management (early proposal stages - Sept 2010?) • IEEE 802.11w - Protected Management Frames (early proposal stages - 2009?) • IEEE 802.11y - 3650-3700 MHz Operation in the U.S. (2008) • IEEE 802.11z - Extensions to Direct Link Setup (DLS) (Aug 2007 - Dec 2011) • IEEE 802.11aa - Robust streaming of Audio Video Transport Streams (Mar 2008 - May 2011) • IEEE 802.11mb - Maintenance of the standard. Expected to become 802.11-2010. (ongoing) • IEEE 802.11ac - Very High Throughput <6GHz (Sep 2008 - Dec 2012) • IEEE 802.11ad - Extremely High Throughput 60GHz

23. Primary WLAN standards

24. Wireless Security • WEP – Wired Equivalent Privacy – original security model, has shown weaknesses. • WPA - WPA uses Temporal Key Integrity Protocol (TKIP) as the protocol and algorithm to improve security of keys used with WEP. It changes the way keys are derived and rotates keys more often for security. It also adds a message-integrity-check function to prevent packet forgeries. WEP and WPA use only the RC4 stream cipher. • 802.11i - (also known as WPA2). Standardized 24. juni 2004, and supersedes WEP), which was shown to have severe security weaknesses. 802.11i makes use of the Advanced Encryption Standard (AES) block cipher • Private – Shared key • Enterprise – RADIUS integration

25. Types of unauthorized access * 1.1 Accidental association * 1.2 Malicious association * 1.3 Ad-hoc networks - e.g. “Free Public Wifi” * 1.4 Non-traditional networks - e.g. Bluetooth * 1.5 Identity theft (MAC spoofing) * 1.6 Man-in-the-middle attacks * 1.7 Denial of service * 1.8 Network injection * 1.9 Caffe Latte attack - Flooding using ARP to obtain WEP

26. 802.11i WLAN authentication

27. Summary Source: Veriwave