Roaming

1. Roaming

2. Module contents • Scan • Sweep • Association • Authentication • Roaming • IAPP • Mobile IP

3. Scan • Access-Point and Station need to be established on same frequency in order to communicate • Access-Points operate on a fixed frequency (selected from an allowed set of channels) • Stations dynamically “tune” the radio to the channel of the Access-Point • Process is called Scanning

4. Scan IEEE 802.11 defines two methods: • Passive Scanning • Station switches to a given channel and listens for incoming beacons from Access-Point • Active Scanning • Station switches to a given channel and issues a “Probe Request” • Access-Point replies with a “Probe Response” • ORiNOCO PC Cards use active scanning

5. Sweep • A series of scans on different channels is called a “Sweep” • A Sweep uses a “channel-list” that contains the channels to scan • There are two type of sweeps: • “Full Sweep” • All channels in the “channel-list” are scanned • “Short Sweep” • A sub-set of the “channel-list” is used to perform the scan

6. Sweep • “Short Sweep” will speed up the roaming process • Subset of channel lists contains • Active channels • Channels that have been found to be used before since the station has been switched on • Most likely channels • Channels that have likely channel separation from active channels (more than two channels away from active one) • Example: If channel 5 is active, channel 2 and 8 are likely. Channel 3, 4, 6 and 7 are unlikely as they are to close to channel 5 and will not be scanned • Takes 5 .. 50 ms per Channel (depending on activity) • For empty cell (single station in the cell) 5 ms • Busy cell up to 50 ms

7. SweepHow much time is involved? • Sweep time depends on: • Number of channels used in the network • The amount of medium occupation (how busy is the cell) • The presence of overlapping networks • Sweep in a single channel network takes longer than roaming in a 3-channel network • Short list in a single-channel network consists of 7-9 channels (on 11 channel PC card) • Active channel 1, short list channels 1, 4-11 (total 9 channels) • Active channel 11, short list channels 11, 1-8 (total 9 channels) • Active channel 6, short list channels 6, 1-3, 9-11 (total 7 channels) • Short list in a multi-channel network consists of 3 channels • Active channels 1, 6, 11, short list channels 1, 6, 11 (total 3 channels) • Sweep time • Single channel network 35 - 180 ms • Multi-channel network 15 - 150 ms

8. Association Station that needs connection to a network initiates “Initial Association” sequence: • Execute a full sweep • Select AP with best communications quality, that matches the value for “network name” (= SSID). • If “network name” set to “ANY” and Access-Point is not set to “closed” • Station send “Association Request” • AP enters the Station in its Association Table (and assigns an “Association Code” to it) • AP-1000 or AP-500 enters the station in its bridge table

9. AP-1000, AP2000 or AP-500 ORiNOCO PC-Card Bridge learn table STA-1 2 Association table STA-2 2 STA-1 STA-2 Intra-BSS Relay Associate Associate Association BSS-A STA-1 STA-2

10. Authentication • Stations authenticate at each Access-Point once right after their first association to the Access-Point • A roaming station may need to re-authenticate at the Access-oint that it is roaming to, even though it has been authenticated by the Access Point it roams away from future implementations of IAPP will pass authentication information as part of the hand-over protocol

11. Authentication Authentication schemes (to be explained in module on security): • IEEE 802.11 defined: • Open System Authentication • Shared Key Authentication (based on WEP) • RADIUS Based MAC authentication • Based on MAC address of ORiNOCO PC Card registered in centrally kept Access Control list • IEEE 802.1x based: • Uses EAP (Extensible Authentication Protocol) • Implemented in AP2000 • Requires RADIUS server for authentication • Requires EAP enabled clients (such as Microsoft Windows/XP)

12. RoamingChanging APs • Roaming involves switching of a STA to another AP as result of • STA moving away from current AP • Interference on the current channel • Current AP has ceased operation • Channel of the current AP is busier than alternative available channels • The initiative for changing to another AP is taken by the Station, based on: “Combined Communications-Quality & Load” (CCQL) • CCQL is determined by: • SNR (Signal to Noise Ratio) on path with current Access-Point: • Running Average Signal Level from Beacon receptions • Running Average Noise Level from all receptions in current channel • Load on the channel operated by the AP • Result of Sweep (when Searching): • SNR of Probe Responses

13. AP-2 AP-1 AP-3 RoamingLoad balancing • Multiple APs, set to different, non-overlapping channels covering the same area can increase overall capacity • Load balancing involves distributing stations over available channels, by invoking “roaming” • Stations can change AP’s based on “high load” conditions on the channel reported by the current AP • Triggered by threshold check on beacon reception • Periodic sweep (using short scan list), once a minute

14. RoamingLoad balancing Beacon Message Time stamp Beacon Interval Capability Info SSID Supported rates DS Param. set TIM Vendor specific LB info • “Cell-load” is calculated by AP and communicated to stations • “Cell-load” is determined by sampling “Modem Utilization” by the PC Card and calculating an “Exponentially Weighted Moving Average” (EWMA) over the sampled data • EWMA is translated to % of use and sent to stations as part of the Beacon and Probe Response • Stations will include “Cell-load” in their “roaming decision” by inclusion in the determination of the CCQL (Combined Comms Quality & Load) 8 bytes 2 bytes 2 bytes 2-34 bytes 3-11 bytes 3 bytes 6-256 bytes 6 bytes Vendor specific LB info Agere Element ID Length Agere OUI Load Average Noise level OUI = Organizationally Unique Identifier 1 byte 1 byte 3 bytes 1 byte 1 byte Probe Response Time stamp Beacon Interval Capability Info SSID Supported rates DS Param. set Vendor specific LB info 8 bytes 2 bytes 2 bytes 2-34 bytes 3-11 bytes 3 bytes 6 bytes

15. RoamingCCQL (Combined Comms Quality & Load) • Indicator to trigger Station to look for other AP • Determined by: • Signal level of received Beacons • Noise level as measured by the station • Channel-load information as passed by the AP (in Beacons and Probe Responses) • Noise level around the AP as measured by the AP (in Beacons and Probe Responses) • Roaming Weight: • .50 - “Not Searching” • .25 - “Cell Search” • .125 - “Out of Range” CCQL = SL- Max(Nlap,Nlsta) - weightroam*loadAP

16. STA ... Informs current AP to buffer traffic during Sweep (PM buffering) Blocks its own transmissions during Sweep Scans Multiple Channels limited to Active (or Likely-to-be-Active) Channels learns during sweeps 3 channels on each side of an Active channel are considered “Not Likely” Uses Active Scanning (Probe Requests) RoamingCell Search State

17. RoamingSwitching to new Access-Point • Switching based on “delta-SNR”: • SNR of Probe Responses compared to SNR current Access-Point • When CQ drops below “Cell Search Threshold” new Access-Point should already been identified • Station also enters “cell-search” when it misses 4 or more Beacons in a row: • Busy cell • Form of load balancing

18. RoamingOut of range condition • When no Access-Point present acceptable to station: • Station will stay associated • Station will fall back to lower bit-rate • Eventually loss of association • Out of Range Threshold is Carrier Detect Threshold (influenced by AP Density parameter) • Station will scan all channels in full sweep every 10 seconds (versus short sweep in Cell Search Mode)

19. RoamingHand-over STA … • First retrieves buffered frames from current Access-Point • Then re-associates with new Access-Point AP … • Uses Inter Access Point Protocol (IAPP) • over the Distribution System that connects the APs • to inform old Access-Point of the event and allow it to change the association table • to update filter tables in intermediate bridges • IAPP uses UDP/IP, so works over routers, but ….. roaming over routers requires Mobile IP • Old Access-Point dumps (any remaining) buffered frames for STA

20. IAPPProtocol IAPP protocol elements: • WMP (WaveLAN Management Protocol) Station Announce • one-directional protocol to signal a re-association of a mobile station • Announce Protocol (Implemented AP-2000, not in AP-500, AP-1000) • Protocol used by an AP to identify itself to other APs and to obtain information on other APs in the same area • Hand-over Protocol (Implemented AP-2000, not in AP-500, AP-1000) • bi-directional message exchange between AP’s when initiated when a mobile station re-associates

21. Hand-over Message with STA source address Bridge AP AP port1 port2 Re-association STA IAPP WMP Station Announce • At hand-over, a message is sent from new AP to old AP, using the MAC address of the mobile station as Source Address • Causes bridges and switches in between the two APs to learn that the mobile station has changed location and these bridges will update their tables accordingly • Some switches may act differently and reflect the movement of the mobile station as an address violation

22. IAPPAnnounce Protocol 1. At startup AP transmits a so-called "Announce request” (IP Multicast Destination Address) using defined UDP/IP group addressing. 2. APs that are part of the same network and are already operational will respond with a so-called "Announce response”, containing: • IP address of the replying AP • BSSID of the replying AP

23. IAPPAnnounce Protocol (cont’d) 3. The new AP uses the data in the reply to build a BSSID-to-IP conversion table to relate the BSSID, (used by the roaming station to identify its "old" AP) to the IP address of the "old" AP Future implementations will carry items, such as • the name of the AP, to be used to identify APs in the "Site Monitor" display • authorization information regarding the mobile station in case a centrally based Authentication scheme is used. 4. After an appropriate time interval, when all responses are received, the "new" AP will issue an "Announce response" to indicate its operational status. • The "new" AP will (as will all APs) re-issue the "Announce response" to keep informing all participating APs about any changes in the status.

24. IAPPHand-over Protocol 1. When the mobile station moves away from its "old" AP, it issues a Re-associate Request to a "new" AP, 2. The "new" AP will return a Re-association Response when it accepts the roaming station. The AP service for the mobile station starts at this point in time 3. The "new" AP sends a Hand-over Request to the old AP (via the Distribution System). IP address of old AP is determined based on BSSID carried in the Re-association Request 4. When the Hand-over Response received, the hand-over is considered to be completed.

25. IAPPHand-over in 802.1x environment • When STA is operates under IEEE 802.1x security, hand-over response will contain authentication information concerning the station • Account information from RADIUS server concerning the station to avoid having to re-initiate Authentication • New WEP keys will be established between the AP and STA after hand-over

26. Mobile IPRoaming over Routers • Mobility has more impact, since MAC level learning is not sufficient • Station changes NETWORK ADDRESS because Sub-net changes • Moving STAs translates to continuously changing network topology • Two provisions are required: • hand-over messages need to be IP messages • “Mobile” IP must be in place • Mobile IP is not a single standard and still in progress • RFC’s 2002, 2003, 2004, 2005, 2006, 2344 • various Internet Drafts

27. Routed LANs / Mobile IP Server Home Agent Foreign Agent Router Router AP AP STA= Mobile Node Mobile IPRouted LANs

28. Routed LANs / Mobile IP Server Home Agent Foreign Agent Router Router AP AP • Station registers at Foreign Agent • Foreign Agent informs Home Agent • Traffic TO station flows via Home Agent and Foreign Agent- several “encapsulation” techniques are defined- optimization via “REDIRECT” warning to Correspondent Node (Server) • Traffic FROM station is routed directly STA Mobile IPRouted LANs

29. Module summary • Scan • Sweep • Association • Authentication • Roaming • IAPP • Mobile IP

30. Your Mobile Broadband Connection