A-10 (Leutert) WLAN 802.11n MIMO Analysis - Sharkfest - Wireshark
A-10 (Leutert) WLAN 802.11n MIMO Analysis - Sharkfest - Wireshark
A-10 (Leutert) WLAN 802.11n MIMO Analysis - Sharkfest - Wireshark
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>WLAN</strong> <strong>802.11n</strong> <strong>MIMO</strong> <strong>Analysis</strong>June 17, 20<strong>10</strong>Rolf <strong>Leutert</strong>Network Consultant & Trainer | <strong>Leutert</strong> NetServices | SwitzerlandSHARKFEST ‘<strong>10</strong>Stanford UniversityJune 14-17, 20<strong>10</strong>Trace files and coloring rules can be copied from circulating memory stickSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Session Agenda• Design Goals for <strong>802.11n</strong>• IEEE <strong>802.11n</strong> physical layer improvements• IEEE <strong>802.11n</strong> MAC layer improvements• Per-Packet Information Header• Analysing ‘Bad BAR’ and ‘Deadlock’ problem• Bandwidth Measurement• Backwards compatibility to a/b/g• Future of <strong>802.11n</strong>SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Design Goals for <strong>802.11n</strong>• IEEE <strong>802.11n</strong> is a proposed amendment to the IEEE802.11-2007 wireless networking standard• Significantly improve PHY layer transmission rateover previous standards, such as 802.11a and802.11b/g with ‘High Throughput’ (HT) options• Increasing the MAC layer transfer rate to achieve aminimum of <strong>10</strong>0 Mbps data throughput• Maintain backward compatibility with existing IEEE<strong>WLAN</strong> legacy solutions (802.11a/b/g)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
How the Goals are achievedA combination of technical functions at PHY and MAClayers are added to the existing 802.11 standard: Increasing the physical transfer rate with newmodulation scheme and timing up to 600Mbps New multi-streaming modulation technique using<strong>MIMO</strong> (multiple input, multiple output antennas) Joining two adjacent channels with Channel bonding Support for frame aggregation A-MPDU & A-MSDU New Block AcknowledgmentsSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
PHY layer improvementsModified OFDMThe number of OFDM data sub-carriers is increasedfrom 48 to 52 which improves the maximumthroughput from 54 to 58.5 MbpsForward Error CorrectionFEC is a system of error control whereby the senderadds redundant data to allow the receiver to detectand correct errors. 3/4 coding rate is improved with5/6 boosting the link rate from 58.5 to 65 MbpsSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
PHY layer improvements (cont.)Shorter Guard Interval (GI)The GI between OFDM symbols is reduced from800ns to 400ns and increases throughput from65 to 72.2 MbpsChannel BondingDoubling channel bandwidth from 20 to 40 MHzslightly more than doubles rate from 72.2 to 150 MbpsSpatial multiplexingSupport of up to four spatial streams (<strong>MIMO</strong>)increases throughput up to 4 times 150 to 600 MbpsSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Channel Bonding (Channel 6 & <strong>10</strong>)Recorded with Wi-Spy® from MetaGeekSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Channel Bonding (Channel 52 & 56)Channel 52 Channel 56Recorded with Wi-Spy® from MetaGeekSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Channel Bonding (configuration)<strong>802.11n</strong> supports bundling of two 20 MHz channelsSelect a control channel # and the channel offsetBoth channels must fit inside allowed frequency rangeA-band does not allow to select channel # manuallyConfiguration on Cisco AP1250Configuration on AirPcap NSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Channel Allocation 5GHz BandSome channels only allowed forinhouse use*New stricter FCC DFS2 rulesvalid off July 20, 2007SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Multi-Streaming Modulation802.11a/g AP(non-<strong>MIMO</strong>)SISO(Single-In, Single-Out)max. 54Mbit/s802.11a/g client(non-<strong>MIMO</strong>)<strong>802.11n</strong> AP(<strong>MIMO</strong>)<strong>802.11n</strong> AP(<strong>MIMO</strong>)MISO(Multiple-In, Single-Out)max. 54Mbit/s<strong>MIMO</strong>(Multiple-In, Multiple-Out)150Mbit/s per spatialstream802.11a/g client(non-<strong>MIMO</strong>)<strong>802.11n</strong> client(<strong>MIMO</strong>)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Modulation Coding Scheme (MCS)<strong>802.11n</strong> introduces a new Modulation Coding Scheme802.11 b/g adapts to channel conditions by selectingthe highest of 12 possible rates from 1 to 54 MbpsThe <strong>802.11n</strong> standard will allow some 77 possibleMCS’ - some compulsory, some optionalMCS selects, based on RF channel conditions, thebest combination of 8 data rates, bonded channels,multiple spatial streams, different guard intervals andmodulation typesSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
MCS Configuration1 spatial stream 2 spatial streamsScreenshot Cisco AP1250SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
MCS Rate ChartSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
MAC layer improvementsFrame Aggregation MechanismsAggregate-MAC Service Data Unit (A-MSDU) wrapsmultiple Ethernet frames in a .11n frame up to 8KBAggregate-MAC Protocol Data Unit (A-MPDU) allowsbursting 802.11 frames up to 64KBA-MPDU is performed in the software whereasA-MSDU is performed in the hardwareBlock AcknowledgementBlock ACK effectively eliminates the need to initiatea new transfer for every MPDUSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
MSDU AggregationMultiple Ethernet frames for a common destinationare wrapped in a single 802.11 frameMore efficient than A-MPDU as only one radio- and802.11 MAC header is appliedWhole frame must be retransmitted if noacknowledgeMultiple Ethernet FramesPreamble EN Header Data Preamble EN Header Data Preamble EN Header DataRadio <strong>802.11n</strong> A-MSDU 1A-MSDU 2Preamble Header MAC Header EN Header Data EN Header DataEN HeaderA-MSDUlastData802.11FCSAggregated MAC Service Data UnitsSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
A-MSDU <strong>Analysis</strong>All trace files made with:• Cisco AIR-AP1252AG-E-K9; S/W 12.4(<strong>10</strong>b)JA• Buffalo WLI-CG-AG300N; Driver 3.0.0.13SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
A-MPDU <strong>Analysis</strong>SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Block-ACK MechanismRather than sending an individual acknowledgefollowing each data frame, <strong>802.11n</strong> introduces thetechnique of confirming a burst of up to 64 frameswith a single Block ACK (BA) frameThe Block ACK even contains a bitmap to selectivelyacknowledge individual frames of a burst(comparable to selective acknowledges of TCP)The use of combined acknowledges can berequested by sending a Block ACK Request (BAR)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Block-ACK Mechanism (cont.)A-MPDUsBlock ACKSequence # 1 2 3 4 61 62 63 64Bitmap (64 bits)Start Sequence # 1 + 1111 1111 …. 1111 1111= 65lost frameA-MPDUsBlock ACKSequence # 65 66 67 68 125 126 127 128Bitmap (64 bits)Start Sequence # 65 + 1111 1111 …. 1111 <strong>10</strong>11= 129retransmitted frameA-MPDUsBlock ACKSequence # 126 129 130 131 188 189 190 191Bitmap (64 bits)Start Sequence # 128 + 1111 1111 …. 1111 1111= 192SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Block-ACK Bitmap <strong>Analysis</strong>SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Block-ACK Bitmap <strong>Analysis</strong> (cont.)Frame #TypeSequence #Bitmap (64 bits)4579458045814582458345844585458645874588Block ACKMPDU #1MPDU #2MPDU #3MPDU #4MPDU #5MPDU #6MPDU #7MPDU #8Block ACKStart Sequence # 1381+ 64 = 1445144511446114471F144811449 lost frame 01450114511E14521Start Sequence # 1389 + 64 = 1453FF FF …. FF FFFF FF …. FF EF45894590459145924593459445954596459745984599MPDU #1MPDU #2MPDU #3MPDU #4MPDU #5MPDU #6MPDU #7MPDU #8MPDU #9MPDU #<strong>10</strong>Block ACK1449 retransmitted1453 frame14541455145614571458145914601461Start Sequence # 1398 + 64 = 1462Trace file: D05_AMPDU.pcapFF FF …. FF FFSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Block-ACK negotiation/activationThe Block-ACK options are negotiated and confirmedwith ‘Action’ frames defined in 802.11e (<strong>WLAN</strong> QoS)‚Action‘ frames are used to negotiate other options too• Category Code 0 = Spectrum management• Category Code 1 = QoS options• Category Code 2 = DLS (Direct Link Setup)• Category Code 3 = Block AckThe use of combined acknowledges can be requestedby sending a Block ACK Request (BAR)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Block-ACK negotiation/activation (cont.)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
New HT Capabilities in Beacon FrameSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Per-Packet Information Header (PPI)New PPI header replaces the radiotap header used in802.11a/b/g with additional <strong>802.11n</strong> radio informationPPI adds a pseudoheaderto each packetand provides Metadata about RF signalstrength, timing,options etc.ReferencesRadiotap manual:PPI manual:http://netbsd.gw.com/cgi-bin/man-cgi?ieee80211_radiotap+9+NetBSD-currenthttp://www.cacetech.com/documents/PPI_Header_format_1.0.1.pdfSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Per-Packet Information Header (cont.)Data-link level type (<strong>10</strong>5=IEEE 802.11 wireless)Contains data common to both pre-n and <strong>802.11n</strong>Extension field contains radio information specific to <strong>802.11n</strong>SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Per-Packet Information Header (cont.)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
AirPcap Nx and <strong>Wireshark</strong>AirPcap Nx and <strong>Wireshark</strong> is the perfect combination for:Learning about how things are functioningFinding out what <strong>802.11n</strong> options and capabilities areoffered and negotiated in the airVerifying vendor specifications (like throughput etc.)Investigating compatibility issues between vendorsTraining technical peopleand much more…SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Frame Aggregation (config. examples)Cisco‘s 802.11abgn AP1250Buffalo‘s 802.11abgn PC-CardBy disabling A-MPDU with the 'no'command, the traffic associated with thatpriority level uses A-MSDU transmissionCommand line interface:ap1250(config)#interface dot11Radio 1ap1250(config-if)#no ampdu transmit priority 0SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Analysing ‘Bad BAR’ problemSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Analysing ‘Bad BAR’ problem (cont.)Buffalo WLI-CB-AG300N isusing strange SRC MACaddress when sending BARProblem occurs only whenA-MPDU is activatedProblem seems to berelated to retransmissionsPossibly a driver issue asA-MPDU is done in softwareA-MSDU works fineSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Analysing ‘Deadlock’ problemProblem starts at frame # 22116 which is not acknowledged by receiverSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Analysing ‘Deadlock’ problem (cont.)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Analysing ‘Deadlock’ problem (cont.)Access point retransmits frame 128 times up toframe # 22246 (value of Max. Data Retries counter)As the mobile station does not acknowledge, accesspoint sends ‘Deauthentication’ in frame # 22247 andremoves station from association listAs mobile station does not acknowledge again,access point retransmits in frames # 22248 to 22250Mobile station does not acknowledge, assumes to bestill associated with access point and keeps sendingframes (# 22298, 22315 etc.) Deadlock situationSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Bandwidth MeasurementTotal rate150MbpsA-MPDUsReassembled FramesBlock AcknowledgesUDP bandwidth measurement with IPerf indicates throughput of 126MbpsSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Backwards compatibility to a/b/gPresent situationMbps12CodingBarker CodeBarker CodeDescription802.11DSSS (Clause 15)with ‚Long Preamble‘5.511CCKCCK802.11bHR/DSSS (Clause 18)with ‚Short Preamble‘69121824364854OFDMOFDMOFDMOFDMOFDMOFDMOFDMOFDM802.11gExtended Rate PHY(ERP)new Frame Format802.11aCCK = Complementary Code KeyingOFDM = Orthogonal Frequency Division MultiplexingSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Backwards compatibility to a/b/g (cont.)Present situation802.11 DSSS with‚Long Preamble‘Barker CodeBitsPreamblePLCPSFDHeader128 16 481 Mbps192µsMAC HeaderMPDU1-2 MbpsData802.11b HR/DSSS with‚Short Preamble‘Barker / CCKBitsPreamble SFDHeader56 16 481 Mbps 2 Mbps96µsMAC Header1-11 MbpsData802.11g (ERP)Extended Rate PHYnew Frame FormatOFDMBitsPreambleHeader96 246Mbps20µsMAC Header6-54 MbpsDataPLCP = Physical Layer Convergence ProtocolMPDU = MAC Layer Protocol Data Unit (decoded by <strong>Wireshark</strong>)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Backwards compatibility to a/b/g (cont.)<strong>802.11n</strong> supports three compatibility modes• Legacy mode• Mixed mode• Greenfield modeLegacy mode<strong>802.11n</strong> to b/g compatibility with Clear-to-send to selfHeaderBarkerCTS to SelfCCKHeader Data AckHT-modeBlocking out non HT stations with Network Allocation Vector (NAV)SHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Backwards compatibility to a/b/g (cont.)Mixed mode<strong>802.11n</strong> to a/g compatibility with Legacy headerHeader Header Data AckOFDMHT-modeBlocking out non HT stations with spoofed signal and lenght valuesGreenfield modeNo backwards compatibility to a/b/gHeader Data AckHT-modeSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Future of <strong>802.11n</strong>Standard has been ratified September 2009 afteryears of discussions. (IEEE <strong>802.11n</strong>-2009)Standard is based on <strong>802.11n</strong> Draft 2 specificationswith two streams, all other functions are optional.Interoperability remains a question mark for pre-NproductsNew products supporting technical features like:• Up to four spatial streams• Transmit Beamforming• Direct Link Setup … and many moreSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Thank you for your attention© SeaPics.comPlease fill in evaluation formSHARKFEST ‘<strong>10</strong> | Stanford University | June 14 –17, 20<strong>10</strong>
Change language