CN 411

Wireless Networks

Chapter 3

Fall 2015/2016
Wireless Local Area Networks
WLANs

1
History of LAN Industry
• WANs are offered as service
• Cost of infrastructure
• Coverage area
• LANs are sold as “end products”
• You own, no service charge

Fall 2015/2016
• Emerged to enable sharing of expensive resources such as
printers.
• Early 1980s: Three standards are developed for LAN
• 802.3 (Ethernet)
• 802.4 (Token Bus)
• 802.5 (Token Ring)
2
IEEE 802 Reference Model

Fall 2015/2016
3
IEEE 802 Reference Model

Fall 2015/2016
4
 Wireless LAN
• As the name suggests, a wireless LAN is one that uses a
wireless transmission medium.
• WLANs are typically restricted in their diameter to buildings,
a campus, single rooms.. etc. And are operated by individuals,
not by large-scale network providers.
• The global goal of WLANs is to replace office cabling, to

Fall 2015/2016
enable access to the internet and, to introduce a higher
flexibility for ad-hoc communication.
• WLAN vs. WAN Cellular Networks
• Data rate (2 Mbps vs. 54 Mbps)
• Frequency band regulation (Licensing)
• Method of data delivery (Service vs. own)
5
Some advantages of WLANs are:

Flexibility: Within radio coverage, nodes can communicate

without further restriction.
Planning: As long as devices follow the same standard, they
can communicate. In the other hand any wired network

Fall 2015/2016
needs wiring plans.
Design: Allow for the design of small, independent devices
which can for example be put into a pocket. Cables not only
restrict users but also designers.
Cost : After providing wireless access to the infrastructure via
an access point for the first user, adding additional users to a
wireless network will not increase the cost. 6
Wireless LAN Applications
• LAN Extension:
• Wireless LAN linked into a wired LAN on same building.

• Cross-building Interconnect:
• Connect LANs in nearby buildings. Point-to-point wireless link

Fall 2015/2016
is used.

• Ad Hoc Networking:
• Temporary peer-to-peer network set up to meet immediate
need

7
 Wireless LAN Requirements
• Throughput: The medium access control protocol should make
a sufficient use as possible of the wireless medium to
maximize capacity.
• Number of nodes: need to support hundreds of nodes.
• Connection to backbone LAN: interconnection with stations

Fall 2015/2016
on a wired backbone LAN is required.
• Service area: A typical coverage area for a wireless LAN has a
diameter of 100 to 300 m.
• Battery power consumption: Typical wireless LAN
implementations have features to reduce power consumption
while not using the network, such as a sleep mode.
8
 Wireless LAN Requirements
• Transmission robustness and security: The design of a WLAN
must permit reliable transmission even in a noisy
environment and should provide some level of security from
eavesdropping.
• Collocated network operation: Two or more wireless LANs to
operate in the same area or in some area where interference

Fall 2015/2016
between the LANs is possible.
• License-free operation: Users would prefer to buy and
operate wireless LAN products without having to secure a
license for the frequency band used by the LAN.
• Dynamic configuration: The MAC addressing and network
management aspects of the LAN should permit dynamic and
9
automated addition, deletion, and relocation of end systems
without disruption to other users.
 IEEE 802.11 Standard

• The IEEE standard 802.11 (IEEE, 1999) specifies the most

famous family of WLANs in which many products are available.

• As the standard’s number indicates, this standard belongs to

the group of 802.x LAN standards, e.g., 802.3 Ethernet or

Fall 2015/2016
802.5 Token Ring.

• The primary goal of the standard was the specification of a

simple and robust WLAN which offers time-bounded and
asynchronous services. The MAC layer should be able to
operate with multiple physical layers
10
 IEEE 802.11
architecture
• Two network architectures are defined in the IEEE 802.11:

• In infrastructure-based WLAN: communication typically takes

place only between the wireless nodes and the access point
(AP) , but not directly between the wireless nodes. The AP and

Fall 2015/2016
all the nodes associated with it are called a basic service set
(BSS). A group of such APs and the member nodes is called an
extended service set (ESS).

11
IEEE 802.11 architecture
• Ad-hoc WLAN: do not need any infrastructure to work.
Each node can communicate directly with other nodes. It
called independent BSS or IBSS.
• In ad-hoc networks, the complexity of each node is higher
because every node has to implement medium access

Fall 2015/2016
mechanisms

12
IEEE 802.11 architecture

• 802.11 networks consist of four major physical components

• Distribution System
• Access Points
• Wireless Medium
• Stations

Fall 2015/2016
13
IEEE 802.11
architecture
• Distribution System (DS)
• Logical component of 802.11 used to forward frames to their
destination
• 802.11 does not specify any particular technology for the DS
• In the language of 802.11, the backbone Ethernet is the
distribution system medium.
• To find the rest of the DS, we need to look at the access points
(APs)
• Access Points (APs)
• Frames on a 802.11 network must be converted to another
type of frame for delivery. APs act as bridges
• They have at least one wireless network interface and at least
14
one Ethernet network interface
IEEE 802.11 architecture

• Stations
• Computing devices with wireless network interfaces
• Battery-operated mobile devices such as laptops or handheld
computers
• Stations can also be “static” devices.

• Wireless Medium
• Used to move frames from station to station
• Several different physical layers are defined to support the
802.11 MAC
• Originally, two RF PHY layers and one IR PHY layer were defined
15
Other WLAN architecture
• Point-to-multipoint bridge topology : Wireless bridges connect
LANs in one building to LANs in another building even if the
buildings are miles apart.
• These conditions receive a clear line-of-sight between
buildings.

Fall 2015/2016
• The line-of-sight range varies based on the type of wireless
bridge and antenna used as well as environmental conditions.

16
Other WLAN architecture

• Outdoor LAN bridges:

• Outdoor LAN bridges are used to connect LANs in
different buildings.
• An outdoor bridge can provide a less expensive
alternative to recurring leased line charges.
• WLAN bridge products support fairly high data rates and
ranges of several miles with the use of line-of-sight
directional antennas.
• Some APs can also be used as a bridge between buildings
of relatively close proximity

17
Protocol Architecture
The IEEE 802.11 standard only covers the Physical Layer
(PHY) and Medium Access Control Layer (MAC) like the
other 802.x LANs .

Fall 2015/2016
18
Protocol Architecture

Fall 2015/2016
19
Protocol Architecture
• The physical layer is subdivided into:
 Physical layer convergence protocol (PLCP):
Defines a method of mapping MAC layer protocol data units
(MPDUs) into a framing format suitable for sending and
receiving , and management information between two or

Fall 2015/2016
more stations using different PMD sub-layer.
 Physical medium dependent (PMD):
Defines the methods of transmitting and receiving user data
through a wireless medium ( modulation and
encoding/decoding of signals).
• PLCP layer is attached header that is designed specifically for
the PMD layer of the choice for transmission.
20
• The PLCP packet is then transmitted by the PMD layer
according to the specification of the signaling techniques
Protocol Architecture

• The data link layer within 802.11 consists of two sub layers:
Logical Link Control (LLC) and Media Access Control (MAC).
802.11 uses the same 802.2 LLC.
• The MAC layer is responsible for access mechanism and
fragmentation assembly of the packets.

Fall 2015/2016
• In addition to the MAC and PHY layers, there is a management
plane that transmits management messages over the medium
and can be used by an administrator to tune the MAC and PHY
layers.

• The PHY layer management decide on channel tuning to

21
different options for each PHY layer.
Protocol Architecture

• MAC management: supports the association and re-

association of a station to an access point and roaming
between different access points. It also controls
authentication mechanisms, encryption, synchronization of a
station with regard to an access point, and power

Fall 2015/2016
management to save battery power.

• In addition, IEE 802.11 specifies a station management sub-

layer that is responsible for coordination of the interaction
between MAC and PHY layers.

22
IEEE 802 Protocol Architecture

802.2 LLC LLC

Layer

Fall 2015/2016
802.3 802.5 MAC
802.11 MAC Layer
MAC MAC

802.11 802.11 802.11a 802.11b

FHSS DSSS OFDM HR/DSSS PHY
802.3 802.5
PHY PHY PHY PHY Layer
PHY PHY

23
Industrial, Scientific, and Medical (ISM) bands

Fall 2015/2016
24
IEEE 802.11 Physical layer

• Physical Layer (PHY) Functions:

• Encoding/decoding of signals
• PSK, QAM
• Preamble generation and removal
• For synchronization
• Bit transmission/reception
• Includes specification of the transmission medium and
topology

25
IEEE 802.11 Physical layer
WLAN Categories according to the transmission technique are:
Infrared (lR) WLANs.
Spread spectrum WLANs.
Narrow-band microwave.

Fall 2015/2016
26
 IEEE 802.11 Physical layer
• IEEE 802.11 supports three different physical layers: one layer
based on infra red (IR) and two layers based on radio frequency
(RF) transmission in the ISM bands.
• The RF PHY layers are based on spread spectrum, either direct
sequence (DS) or frequency hopping (FH).

Fall 2015/2016
1. Frequency hopping spread spectrum (FHSS) option :
• The total bandwidth is split into many channels of bandwidth 1MHz plus
guard spaces between the channels. In the USA, only 79 of these
channels are allowed.
• Transmitter and receiver stay on one of these channels for a certain time
and then hop to another channel. The dwell time in each channel is
approximately 0.4 s.
• The advantage of the FHSS system is the receivers are less complex to 27
implement.
Frequency hopping spread spectrum
(FHSS)

Fall 2015/2016
28
Frequency hopping spread spectrum (FHSS)
• Preamble, this is PHY dependent and includes:
• Synchronization (SYNC): 80 bit sequence of alternating 010101...
bit pattern, used by PHY to select the potential receiver antenna (if
diversity is used), and Synchronization with received packet timing.
• Start frame delimiter (SFD): The following 16 bits indicate the start
of the frame and provide frame synchronization. The SFD pattern is

Fall 2015/2016
0000110010111101.
• PLCP header, includes:
• PLCP_PDU length word (PLW): indicates the length of the payload in
bytes including the 32 bit CRC at the end of the payload. PLW can
range between 0 and 4,095.
• PLCP signaling field (PSF): 4 bit field indicates the data rate of the
payload, encoded in 0.5 Mbps increments from 1 Mbps to 4.5 Mbps
• Header error check (HEC): the PLCP header is protected by a 16 bit 29
checksum (CRC)
2. Direct sequence spread spectrum (DSSS) option:
• In a DSSS system, the data stream is “chipped” into several narrower
pulses (chips), thereby increasing the occupied spectrum of the
transmitted signal.
• In the case of IEEE 802.11 DSSS, spreading is achieved using the 11-
chip Barker sequence (+1, –1, +1, +1, –1, +1, +1, +1, –1, –1, –1).
• DSSS systems are more resistant to fading and multi-path effects.

Fall 2015/2016
• IEEE 802.11 DSSS PHY also uses the 2.4 GHz ISM band and offers both
1 and 2 Mbit/s data rates.
• Unlike FHSS, a signal carrying 2 Mb/s now occupies a bandwidth that
is as large as 22MHz.
• Allows for three non-interfering channels spaced 25 MHz apart in the
2.4 GHz. With this channel arrangement, a user can configure multiple
DSSS networks to operate in the same area.
• In the IEEE 802.11 standard, 11 channels are specified for the DSSS in 30
the US and 13 in Europe.
Direct sequence spread spectrum (DSSS)

Fall 2015/2016
31
Direct sequence spread spectrum (DSSS)

Fall 2015/2016
32
3. Infrared (IR) :
• The PHY layer, which is based on infra red (IR) transmission,
uses near visible light at 850–950 nm. Infra red light is not
regulated apart from safety restrictions (using lasers instead
of LEDs).
• The maximum range is about 20 m, but the transmissions
cannot penetrate physical obstacles.

Fall 2015/2016
• The modulation scheme used is Pulse position modulation
(PPM).
• The PMD layer operates based on transmission of 250 ns
pulses that are generated by switching the transmitter LEDs
on and off for the duration of the pulse

33
 Infrared (IR)
• Advantages : No government regulations controlling use
Immunity to electro-magnetic (EM) and RF interference.
• Disadvantages :
• Generally a short-range technology (30–50 ft radius under
ideal conditions)
• Signals cannot penetrate solid objects
• Signal affected by light, snow, ice, fog

Fall 2015/2016
• Dirt can interfere with infrared

34
PHY Layer Summary…
• PHY media defined by original 802.11 standard
• Direct-sequence spread spectrum
• Operating in 2.4 GHz ISM band
• Data rates of 1 and 2 Mbps
• 11 channels in the US, 13 in Europe, 1 in Japan
• Frequency-hopping spread spectrum

Fall 2015/2016
• Operating in 2.4 GHz ISM band
• Data rates of 1 and 2 Mbps
• 79 channels in the US, 23 in Japan
• Infrared
• 1 and 2 Mbps
• Wavelength between 850 and 950 nm

35
PHY Layer Summary…

Fall 2015/2016
36
IEEE 802.11 Medium Access Control (MAC)

• MAC sub-layer Covers next functional areas

• Reliable data delivery
• Medium access control

Fall 2015/2016
• Packet fragmentation and aggregation
• Security

37
MAC - Reliable Data Delivery
• 802.11 physical / MAC layers unreliable
• Noise, interference, and other propagation effects
• Result in loss of frames
• Even with error-correction codes, frames may not successfully
be received.

Fall 2015/2016
• Can be dealt with error at a higher layer, e.g. TCP

• More efficient to deal with errors at the MAC level than higher
layer, WHY??

• 802.11 includes frame exchange protocol 38

MAC - Reliable Data Delivery
• Frame exchange protocol
• Source station transmits data
• Destination responds with acknowledgment (ACK)
• If source does not receive ACK, it retransmits frame

Fall 2015/2016
• Four frame exchange
• Source issues request-to-send (RTS)
• Destination responds with clear-to-send (CTS)
• Source transmits data
• Destination responds with ACK
39
MAC – Medium Access Control

• The 802.11 working group considered two types of

proposals for a MAC algorithm
• Distributed coordination function (DCF): Stations contend for
transmission opportunities in a distributed way
• Point coordination function (PCF): AP sends poll frames to

Fall 2015/2016
trigger transmissions
• The end result is a MAC algorithm called Distributed
Foundation Wireless MAC (DFWMAC)
• The DFWMAC architecture provides a distributed access
control mechanism with an optional centralized control built
on top of that
40
MAC – Medium Access Control

Fall 2015/2016
41
MAC – Medium Access Control
• The MAC layer is responsible for controlling access to
the sharing medium with minimal collisions.
• The medium access mechanism is based on CSMA, but
there is no collision detection (DC), unlike the LAN
standard...why?

Fall 2015/2016
• Collisions are hard to detect in RF, because of the dynamic
nature of the channel (we cannot assume that all stations
hear each other)
• Difficulties in hardware implementation, it requires the
implementation of a full duplex radio capable of
transmitting and receiving at the same time
• To overcome these problems, the 802.11 uses a CA 42
mechanism together with a positive ACK
 MAC – Medium Access Control

• DCF sub-layer uses CSMA/CA (Collision Avoidance)

• if station has frame to send it listens to medium
• if medium idle, station may transmit
• else waits until current transmission complete

Fall 2015/2016
• Carrier (medium) state determined in two ways
• Physical carrier sense – actual sampling of energy in the medium
• Virtual carrier sense – using ‘duration’ field of frame
• CSMA/CA acts to prevent collisions before they happen
• CSMA/CD deals with transmissions after a collision has occurred
• DCF includes delays that act as a priority scheme
43
MAC – Medium Access Control

Fall 2015/2016
44
1. Before sending a frame, the source station senses the medium by
checking the energy level at the carrier frequency. The station uses a
persistence strategy with back-off until the channel is idle.
2. After the station found the medium idle, the station waits for a period
of time called the distributed inter-frame space (DIFS); then the
station sends a control frame called the request to send (RTS).
3. After receiving the RTS and waiting a period of time called the short
inter-frame space (IFS), the destination station sends a control frame,

Fall 2015/2016
called the clear to send (CTS), to the source station. This control
frame indicates that the destination station is ready to receive data.
4. The source sends data after waiting an amount of time equal to SIFS.
5. The destination , after waiting an amount of time equal to SIFS, sends
an acknowledgment to show that the frame has been received.
Acknowledgment is needed in this protocol because the frames may
be lost due to channel errors or collisions. A positive ACK from the
destination is necessary to ensure that the frame has been
successfully received. 45
Exponential Backoff Algorithm
• Backoff is a scheme commonly used to resolve contention
problems among different stations wishing to transmit data
at the same time.
• CW dimension: small CW may increase collisions, large CW
will likely have long backoff delays.

Fall 2015/2016
• The solution is each station maintains a contention window
that an exponentially growing CW size with initialized to
CWmin = 31.
• Randomly pick a number, say k, between [0,CW-1]
• Count down from k
• Start transmission when k = 0 if the channel is still idle
• Double CW for every unsuccessful transmission, reaches the 46
maximum value CWmax (CWmax = 1023)
The Hidden Terminal Problem
• Suppose all MSs are identical and have a transmission and
reception range of R.
• The transmission from MS-A can be heard by MS-B but not by MS-C
• If both MS-A and MS-C transmit
frames to MS-C at the same time,

Fall 2015/2016
the frames will collide.
• To reduce the possibility of
collisions due to the hidden
terminal problem, the IEEE 802.11
has an optional mechanism at
the MAC layer (RTS/CTS)
47
The Hidden Terminal Problem
• How do other stations defer sending their data if one
station acquires access?
• The key is a feature called Network Allocation Vector (NAV).
• When a station sends an RTS frame, it includes the duration of
time that it needs to occupy the channel.
• The stations that are affected by this transmission create a timer

Fall 2015/2016
called (NAV) that shows how much time must pass before these
stations are allowed to check the channel for idleness.
• Each time a station accesses the system and sends an RTS frame,
other stations start their NAV.
• In other words, each station, before sensing the physical medium
to see if it is idle, first checks its NAV to see if it has expired.
48
The Hidden Terminal Problem

Fall 2015/2016
49
 MAC - Fragmentation and Aggregation
• The wireless environment is very noisy; a lost frame has
to be retransmitted.
• The protocol, therefore, recommends fragmentation -
the division of a large frame into smaller ones WHY??
• It is more efficient to resend a small frame than a large

Fall 2015/2016
one.
• Large frame
• Reduced overhead, but less reliable
• Packet delivery ratio of an N-bit packet = (1-BER)^N
• Aggregation (Reassembly)
• Aggregate multiple small frames in order to reduce the overhead
50
 MAC – Frame Types
• There are three main types of frames:
• Data frames: which are used for data transmission.
• Control frames: which are used to control access to the
medium (e.g RTC, CTS and ACK).
• Management Frames: which are frames that are

Fall 2015/2016
transmitted the same way as data frames to exchange
management information, but are not forwarded to
upper layers.
• Each of these types is as well subdivided into different
subtypes, according to their specific function.
51
802.11 MAC Frame Format

FC = Frame control
D/I = Duration/Connection ID
SC = Sequence control
FCS = Frame check sequence

Fall 2015/2016
Address1: Source Address 52
Address2: Transmitter Address
Address3: Destination Address
Address4: Receiver Address
802.11 MAC Frame Format
• Duration/ID: How long to set the virtual carrier sensing
BUSY (medium is occupied, “NAV”)
• Sequence Control: 12 bits of SEQ No. and 4 bits of
fragment number which define the frame and the
number of fragment in the frame.

Fall 2015/2016
• Data: which is transferred transparently from a sender
to the receiver(s), (max. 2,312 byte).
• Checksum (CRC): 32 bit checksum is used to protect
the frame as it is common practice in all 802.x
networks
53
802.11 MAC Frame Format
• The frame control field contains the following:
• Protocol Version: currently 00, other options reserved for future
• Frame Type: determines the function of a frame: Data (10),
Management (00), or Control (01)
• To DS/from DS: “1” for communication between two APs

Fall 2015/2016
• More Fragmentation: “1” if another section of a fragment follows
• Retry: “1” if packet is retransmitted
• Power Management: “1” if station is into power-save mode (sleep
mode) If the field is set to 0, the station stays active.
• Wave Data: “1” more packets to the terminal in power-save mode
• Wired Equivalent Privacy: indicates that the standard security
mechanism of 802.11 is applied. “1” data bits are encrypted 54
• Order: If this bit is set to 1 the received frames must be processed
in strict order.
802.11 MAC Frame Format

• IEEE 802.11 special control packets: ACK, RTS, and

CTS

Fall 2015/2016
55
 MAC – Security
• Wireless network traffic flows in an open medium, the air
interface, and must be considered insecure.
• CIA is an often used acronym to describe the requirements of a
wireless security solution.
• C – Is the data on the network being kept as Confidential as it needs to

Fall 2015/2016
be
• I – Is the network maintaining its Integrity?
• A – Are the users on the network who they are supposed to be? Have
they been Authenticated?
• There are two basic elements of wireless security:
• Authentication verifies the content of the packets of information
travelling between two trusted wireless devices,
• Encryption ensures that only the two trusted, wireless devices can 56
read the information .
MAC – Security
• Original 802.11 standard
• Privacy
• Wired Equivalent Privacy (WEP) algorithm
• RC4 algorithm using a 40-bit key ( 104-bit key later)
• Authentication

Fall 2015/2016
• Shared-key authentication
• Security for WLANs focuses on
• Access Control (i.e., authentication)
• To prevent unauthorized users from communicating with APs
• To ensure that legitimate client units associate only with trusted APs
(not rogue or unauthorized APs)
• Privacy
• Only intended audience understands transmitted data 57
• Encryption is key
MAC – Security
• Four distinct WLAN security solutions exist
• Open Access
• Basic Security
• Enhanced Security
• Requires a Remote Authentication Dial-In User Service (RADIUS)

Fall 2015/2016
server
• Also known as an Authentication, Authorization and Accounting
(AAA) server
• Remote Access Security
• Uses a VPN to allow access to corporate network and access
business applications

58
MAC – Security
• Basic Security
• SSID - Block your Service Set Identifier
• “Sniffing” is a problem
• Open or Shared-Key
• Static WEP keys
• 40 or 128 bits

Fall 2015/2016
• Very time consuming process, especially if they change
• Stolen devices are a problem
• MAC Authentication
• Optional
• APs have access to a list
• MACs can be forged
• Basic Security II
59
• WPA or WPA2 Pre-Shared Key (PSK)
• Uses a password or identification code
802.11 Family
 IEEE 802.11a
• Offers up to 54 Mbit/s depending on SNR.
• Uses Orthogonal Frequency Division Multiplexing (OFDM)
• Also called multicarrier modulation
• Uses multiple carrier signals at different frequencies, sending some of the bits in

Fall 2015/2016
each channel
• Subcarrier modulated using BPSK, QPSK, 16-QAM or 64-QAM
• Advantage: free ISM-band (5 GHz) , available, simple system,
supports higher data rates, less interference
• Disadvantage: more difficulty penetrating walls and other
obstructions due to higher frequency.

60
802.11b
• Extension of the 802.11 DSSS scheme.
• Offer 5.5Mbps–11Mbps at 2.4 GHz.
• Lowest cost; signal range is good and not easily obstructed
• Slowest maximum speed; home appliances may interfere on
the unregulated frequency band.

Fall 2015/2016
IEEE 802.11g
• Extends 802.11b to data rates above 20 Mbps, up to 54
Mbps.
• Compatible with 802.11b devices
• Free 2.4 GHz ISM-band, OFDM PHY.
• But shared with many legacy WLANs and other systems, e.g.
61
Bluetooth and Microwave Ovens.
IEEE 802.11n
• Should support data rates of over 100 Mbps.
• It can be used in the 2.4 GHz or 5 GHz frequency bands.
• Range of enhancements to both PHY and MAC layers to
improve throughput
• Multiple antennas

Fall 2015/2016
• Smart antennas
• Changes to MAC access protocols

62
802.11 Enhancements
• 802.11p - Wireless Access in Vehicular Environments (WAVE)
• 802.11s – Mesh networking
• 802.11z – Direct Link Setup
• 802.11 aa – Robust streaming of Audio Video Transport Streams
• 802.11 ac - Very High Throughput LANs

Fall 2015/2016
…..

• All published standards, presentations, meeting information at

http://www.ieee802.org/11/

63
802.11 Family

Fall 2015/2016
64
What is Wi-Fi?
• Short for wireless fidelity.
• It is a wireless technology that uses radio frequency to
transmit data through the air.
• Wi-Fi is based on the 802.11 standard:
• 802.11a

Fall 2015/2016
• 802.11b
• 802.11g
• Wi-Fi Alliance: Non-profit standards organization
• Global organization that created the Wi-Fi brand name.
• Certifies the interoperability of 802.11 products from the
many different vendors
65