IEEE 802.11 Notes

IEEE 802.11: Background

Introduction to IEEE 802.11

IEEE 802.11 standards encompass wireless local area networks (WLANs), with "Wi-Fi" (Wireless Fidelity) as a widely used term.
It provides a wireless method for interconnecting devices and enables connections to the Internet and other heterogeneous networks.

Wireless Access Technology

Wireless technologies extend or replace wired networks, allowing mobile users to transmit and receive data wirelessly.
Cisco Visual Networking Index (VNI) reported a sevenfold growth in public Wi-Fi hotspots from 2015 to 2020, increasing from 64.2 million to 432.5 million.
Cisco's "Zettabyte Era" study projected that over 63% of total IP traffic would originate from wireless and mobile devices by 2021.
Statista data from February 2023 estimated approximately 549 million public Wi-Fi hotspots worldwide in 2022.
Smartphone shipments in 2023 exceeded one billion units, with nearly 70% of the global population using smartphones.
The number of smartphone subscriptions was estimated at seven billion in 2023 and is projected to reach almost eight billion by 2028.

Basic Building Blocks of IEEE 802.11 Networks

Station (STA): Devices like laptops, tablets, and smartphones that exchange information over the wireless network.
Access Point (AP): Provides STAs access to the Distribution System (DS) via the wireless medium. It includes a STA and a DS Access Function (DSAF).
Wireless Medium (WM): Various physical layers employing different radio frequencies for frame transmission between stations.
Distribution System (DS): Connects two or more Basic Service Sets (BSSs) and Local Area Networks (LANs) to create an Extended Service Set (ESS).

Service Set and Identifiers

Distribution System Service (DSS): Services provided by the DS to transport MAC service units (data frames) between STAs that are not within direct communication range.
Service Set: A group of 802.11-enabled devices associated with a particular 802.11 WLAN, distinguished by its Service Set Identifier (SSID).
- The SSID is a 32-octet field that acts as the network name, often referred to as the Extended Service Set Identifier (ESSID).
Basic Service Set (BSS): The fundamental building block of an 802.11 network, consisting of a group of STAs that communicate with each other.

Types of BSS

Infrastructure BSS

Structure: AP + Associated STAs = BSS.
Can have multiple BSSs in an ESS.
BSSID: AP's MAC address (48 bits).

Independent BSS (Ad-hoc)

Structure: STAs communicate directly (no AP).
Single BSS = the network.
Variable number of STAs.

Basic Service Area (BSA)

The AP's coverage area within a BSS.

Extended Service Set (ESS)

Multiple interconnected BSSs sharing the same SSID.
BSSs can use the same or different channels.

BSS Organizational Forms

Infrastructure BSS: STAs connect to APs, and communication between BSSs occurs via the DS.
Independent BSS (IBSS): Direct STA-to-STA communication without an AP, DS, or wired connection. It is self-configuring and uses ad-hoc networking. The BSSID is a 48-bit MAC address generated by the network, and all STAs are responsible for beacon frame transmission.
Personal BSS (PBSS): Operates at high frequencies (>45 GHz) with high throughput (~7 Gbps) and short range (1-10 m). STAs communicate directly, but one STA acts as the PBSS Control Point (PCP), providing timing through directional multi-gigabit (DMG) beacon and announce frames. An AP or PCP can enforce a uniform security policy across all STAs.
Mesh BSS (MBSS): Defined by IEEE 802.11s-2011, integrating features of infrastructure and independent BSSs. It typically accesses the DS through mesh points acting as mesh gateways. Mesh Portals (MPPs) connect the MBSS to the wired infrastructure, with mesh points forming wireless backhaul links. A Mesh Access Point (MAP) provides access point functionality for STAs.

802.11 Evolution

802.11b (Wi-Fi 1): Operates in the 2.4 GHz band using DSSS, with a maximum data rate of 11 Mbps.
802.11a (Wi-Fi 2): Uses the 5 GHz band and OFDM modulation, providing data rates up to 54 Mbps.
802.11e: Provides mechanisms for Quality of Service (QoS).
802.11f: Addresses station mobility within an IP network (intra-network handover) using the Inter-Access Point Protocol (IAPP) for seamless transitions.
802.11g (Wi-Fi 3): Extends 802.11b, achieving data rates up to 54 Mbps.
802.11i: Focuses on security in Wireless Local Area Networks.
802.11h: Offers improved collision control in 802.11a.
802.11n (Wi-Fi 4): Aims to increase the speed of 802.11a/b/g to 600 Mbps.
802.11u: Enables interoperability with non-802.11 networks (e.g., 3GPP).
802.11s: Supports Mesh Networking and Extended Service Set (ESS).
- Simultaneous Authentication of Equals (SAE) is used in WPA3 as defined in IEEE 802.11-2016 (11ae, 11aa, 11ad, 11ac, 11af).
802.11w: Protected Management Frames.
802.11T: Recommended practices for evaluating 802.11 wireless performance.
802.11ac (Wi-Fi 5): High-throughput (>500 Mbits/s) WLAN on the 5 GHz band, finalized in January 2014.
802.11ad (WiGig): Provides very high data rates (~7 Gbps) for short-range communication (~1-10 meters) at the 60 GHz unlicensed band, also known as Directional Multi-Gigabit (DMG).
802.11 ah (2017), aj (2017)
802.11ax: Wi-Fi 6 (2019) and Wi-Fi 6E (2020), which expands on Wi-Fi 6 by allowing access to the 6 GHz band.
Current Full Standard: IEEE 802.11-2020, a revision based on IEEE 802.11-2016.
802.11be (Wi-Fi 7) - 2024: Significantly increased speeds through wider channels and 4096-QAM, reduced latency with Multi-Link Operation (MLO) allowing simultaneous use of multiple frequency bands.
802.11bh: Randomized and Changing MAC Addresses - 2024
802.11bi: Enhanced Data Privacy - 2025

Functional Model of IEEE 802.11

Network Discovery

When a Station (STA) powers on, it searches for available wireless networks.
Access Points (APs) broadcast their presence using beacon frames, which contain information like SSID and other network parameters.
Beacons are transmitted at regular intervals defined by the Target Beacon Transmission Time (TBTT), measured in Time Units (TUs), where 1 TU = 1024 microseconds. A common beacon interval is 100 TUs (102.4 milliseconds).
Passive scanning: STAs listen for beacon frames to discover available APs.
Modern APs support multi-SSID, creating multiple Virtual APs (VAPs) on a single physical AP. Each VAP has a unique SSID, customized security, and its own BSSID (MAC address).

Scanning Process

The STA scans all available frequencies, typically dwelling for ~0.1 seconds on each frequency to detect a beacon.
This process is time-consuming, especially when transitioning between APs.
- When the signal weakens, the STA must quickly connect to another AP within the same network to maintain the connection.

Active Scanning

The STA sends a probe request message to detect APs.
APs respond with a probe response, announcing their presence to the STA.
Probe requests are typically broadcast (destination address ff:ff:ff:ff:ff:ff).
After sending a probe request, the STA starts a timer and waits for probe responses. If none are received within the timeout period, the STA moves to the next channel.
Directed Probe Request: A STA can send a directed probe request by specifying the SSID it's searching for. Only APs with a matching SSID will respond.

SSID Cloaking

Hiding the SSID offers minimal security because probe responses always include the SSID.
STAs often include the desired SSID in probe requests, exposing it to potential attackers who might impersonate the network.

Network Selection and Connection

The STA selects an SSID to connect to.
The STA authenticates with the AP. The STA is now authenticated but not yet associated
The STA sends an association request to the AP and receives a response. The STA is now both authenticated and associated with the network through the AP

Authentication and Association

The STA sends an authentication request to the AP.
If no authentication is required, the AP sends an authentication response.
The STA sends an association request to the AP, and the AP responds with an association response, confirming a successful association and connection to the network.

Open System Authentication

In the simplest case (Open System Authentication), the authentication exchange is minimal. The STA sends an authentication request, and the AP responds with an authentication response, essentially granting access. If the network is open (no security), the STA can then proceed directly to association and network access. However, most modern networks use stronger security. For networks requiring pre-shared key (PSK) or pairwise master key (PMK) authentication, the AP initiates a 4-way handshake after the initial authentication request/response. This handshake uses the PSK or PMK to authenticate the STA and derive the temporal key (TK). Opportunistic Wireless Encryption (OWE, defined in RFC 8110) requires a Diffie-Hellman key exchange during the association phase. The resulting pairwise secret is then used in the subsequent 4-way handshake. WPA3-Personal networks use Simultaneous Authentication of Equals (SAE, a variant of the Dragonfly key exchange defined in RFC 7664) instead of open system authentication. SAE, defined in 802.11-2016 onward, involves a commit phase and a confirm phase before network association

Association ID (AID)

Upon successful association, the AP assigns the STA an Association ID (AID). The AID, a 2-byte value ranging from 1 to 2007, identifies the STA, particularly for delivering buffered frames when power-saving mode is enabled.
Association is specific to infrastructure-based networks and does not occur in IBSS.

Roaming

When multiple APs are present, and a user roams, the STA can attempt to associate with a new AP offering a stronger signal.

Roaming Process

Sending a disassociation message to the current AP.
Sending a (re)association message to the new AP.

Detailed Authentication and Association Process

The STA initiates authentication by sending an authentication management frame to the AP. The AP responds with an ACK frame
Upon successful authentication, the AP sends an authentication frame to the STA with an authentication sequence number indicating success (typically a status code of 0)
- Following successful authentication, the STA sends an association request to the AP. The AP acknowledges this request and then responds with an association.response frame. A successful association is indicated in the response frame by a status code of 0 (or a similar success indicator)

IEEE 802.11 Frame Categories

Control Frames: Manage access to the wireless medium and provide frame acknowledgments. Examples include Request to Send (RTS), Clear to Send (CTS), Acknowledgment (ACK), Block Ack Request, Block Ack, and Power Save Poll (PS-Poll).
Management Frames: Used for BSS management and exchanged between STAs and APs. Examples include Authentication, Deauthentication, Association Request, Association Response, Reassociation Request, Reassociation Response, Disassociation, Beacon, Probe Request, Probe Response, ADDBA, and DELBA.
Data Frames (including QoS data frames): Carry user data after STA association. They contain payloads with information from the network layer and above.

MAC Sublayer

The MAC header in 802.11 frames has a minimum size of 30 bytes and a maximum size of 36 bytes. The difference in size is due to optional fields. The QoS Control field (introduced in 802.11e - traffic classes, priorities, etc.) and the HT Control field (introduced in 802.11n) are optional and contribute to the variable header size.
The Frame Control, Duration/ID, Address 1, and Frame Check Sequence (FCS) fields are always present in all 802.11 frame types and subtypes. All other fields are optional, depending on the frame type and subtype
Each frame type has a header with fields used by the MAC sublayer of the 802.11 data link layer.

RTS/CTS Mechanism

RTS/CTS frames are used to reduce frame collisions, especially those caused by the