doc.: ieee 802.11-04/0086r3 submission january 2004 darwin engwer, nortel networksslide 1...

January 2004

Darwin Engwer, Nortel Networks

Slide 1

doc.: IEEE 802.11-04/0086r3

Submission

Measurement of802.11 Roaming Intervals

Darwin EngwerNortel Networks

4655 Great America PkwySanta Clara, CA 95054Phone: 408-495-7099

Fax: 408-495-5615e-Mail: [email protected]

January 2004


Slide 2

doc.: IEEE 802.11-04/0086r3

Submission

Introduction

• This presentation uses animation. The reader is encouraged to view the presentation in a way that makes the animation visible (Slide Show mode).

January 2004


Slide 3

doc.: IEEE 802.11-04/0086r3

Submission

Goals of this presentation

• define the components of an 802.11 system• define roaming in an 802.11 system• identify an initial set of roaming conditions for

consideration/ analysis• identify the start and end points of the roaming

interval• present test setups for effective roaming interval

measurements

• stimulate thought and discussion on handover topics ...

January 2004


Slide 4

doc.: IEEE 802.11-04/0086r3

Submission

Scope of this presentation

• Considers existing 802.11 standards:– 1999 base, 802.11a, 802.11b, 802.11d, 802.11F, 802.11g and 802.11h

• Does not specifically address pending standards:– 802.11e, 802.11i, 802.11j and 802.11n

• aspects of roaming not addressed:– criteria for triggering the roaming event

January 2004


Slide 5

doc.: IEEE 802.11-04/0086r3

Submission

Components of an 802.11 System

• Std 802.11- 1999 defines a station (STA)• Std 802.11- 1999 further defines a subset of STAs called

Access Points (APs)– “STA acting as an AP”

• for clarity as to the type of stations referenced herein, I further define a “STA that is NOT acting as an AP” as a Mobile Unit (MU).

January 2004


Slide 6

doc.: IEEE 802.11-04/0086r3

Submission

802.11 System Layout

MU

Uplink to InfrastructureNetwork

AP#1SSID= “ACME”


January 2004


Slide 7

doc.: IEEE 802.11-04/0086r3

Submission

Premises

• MU can only be associated with one AP at any given point in time (per clause number 5.4.2.2)

January 2004


Slide 8

doc.: IEEE 802.11-04/0086r3

Submission

Roaming Definition

• Roaming occurs when an MU changes it’s association from one AP to another within the same ESS:– i.e. the SSIDs of the two APs are identical– this is called a “BSS-transition” per clause 5.4.2.1.b– uses the reassociation service per clause 5.4.2.3

• Changing to an AP with a different SSID represents a change to a different network. This is a meta-case and is not discussed in this presentation. (“ESS-transition” per 5.4.2.1.c)

January 2004


Slide 9

doc.: IEEE 802.11-04/0086r3

Submission

Roaming in an Ideal Network

MU MU




MU

January 2004


Slide 10

doc.: IEEE 802.11-04/0086r3

Submission

Core Roaming Sequence

• 1. MU is communicating with AP#1• 2. MU moves to AP#2 coverage area• 3. MU stops communicating with AP#1• 4. MU starts communicating with AP#2

• goal = measure time between events 3 and 4

January 2004


Slide 11

doc.: IEEE 802.11-04/0086r3

Submission

But, it’s more complicated than that …

• networks are made of real components that can affect the outcome

January 2004


Slide 12

doc.: IEEE 802.11-04/0086r3

Submission

Roaming in a HUB Network

HUB




MU MUMU

January 2004


Slide 13

doc.: IEEE 802.11-04/0086r3

Submission

How does roaming work …

• consider the Message Sequence Chart (MSC) for roaming in a simple, hub-based network …

January 2004


Slide 14

doc.: IEEE 802.11-04/0086r3

Submission

MSC: Establish Association with AP#1

MU AP1 AP2 Uplink

SCAN PHASE

JOIN PHASE

Auth Request

Ack

Auth Reponse

Ack

Association Request

Ack

Association Reponse

AckDATA

Ack

DATA

January 2004


Slide 15

doc.: IEEE 802.11-04/0086r3

Submission

MSC: Roam to AP#2

MU AP2 Uplink

Ack

DATADATA

SCAN PHASE

Re-Association Request

Ack

Re-Association Reponse

Ack

802.11F MOVE-Notify

802.11F MOVE-Response

Ack

DATADATA

AP1

JOIN PHASE

Auth RequestAck

Auth Reponse

Ack

Roaming event

t1

January 2004


Slide 16

doc.: IEEE 802.11-04/0086r3

Submission

Important parts of the core roaming sequence:

• discovery of candidate APs• roaming event triggered• reassociate request to AP#2• handover from AP#1 to AP#2 [IAPP]

– was proprietary; now 802.11F defines an interoperable mechanism– ends the MU’s association with AP#1 - avoids “dangling association”– this helps AP#1differentiate between an MU that has wandered out of

range - AP#1 still tries to communicate with the MU - and an MU that has roamed to another AP - AP#1 does NOT try to communicate with the MU).

• AP#2 sends reassociate response

January 2004


Slide 17

doc.: IEEE 802.11-04/0086r3

Submission

Reassociate Frame recap

• contains:– Capability Field– Listen Interval– Current [old] AP [MAC] address– SSID– Supported Rates

January 2004


Slide 18

doc.: IEEE 802.11-04/0086r3

Submission

there are some alternatives

• these are “technically” allowed by the standard, but not recommended …

• instead of reassociating with AP#2, the MU could perform a fresh association with AP#2– in some cases this may be needed - such as when the MU has been

completely out of range of the entire ESS for an extended period of time– strongly discouraged since fresh association does not properly support

mobility (per clause 5.4.2)

January 2004


Slide 19

doc.: IEEE 802.11-04/0086r3

Submission

… alternatives

• prior to re-associating with AP#2 the MU could send a disassociate request to AP#1– allowed by the standard; intended to be used when changing ESS– physical aspects can make this approach troublesome when used within an

ESS• MU is trying to communicate over a known to be poor link (to AP#1)• MU and/or AP#1 can get stuck retrying part of the disassociate frame exchange

sequence– OK for SSID changes (changing ESS)– OK if the MU really is leaving the network, e.g. powering down– unreliable and error-prone in real networks within an ESS:

• disassociates the MU from the network (ESS) at the exact time when the MU is trying to stay associated with the network (ESS)

• hence use of disassociate in this way prevents subsequent use of reassociate– hence, not to be used within an ESS

January 2004


Slide 20

doc.: IEEE 802.11-04/0086r3

Submission

… alternatives

• there are other techniques that are likely legal per the standard

• but, for fast roaming I recommend that focus be placed on the normal, preferred case:

MU reassociates with AP#2

January 2004


Slide 21

doc.: IEEE 802.11-04/0086r3

Submission

Recap - Roaming in a simple HUB Network

HUB




MU MUMU

January 2004


Slide 22

doc.: IEEE 802.11-04/0086r3

Submission

But, it’s more complicated than that …

• a hub network doesn’t account for interceding delays or switching in a real network

January 2004


Slide 23

doc.: IEEE 802.11-04/0086r3

Submission

Roaming in a Switched Network

SWITCH




P1 P2P3

MU MUMU

Data pathData path

January 2004


Slide 24

doc.: IEEE 802.11-04/0086r3

Submission

Roaming in a Switched Network

• need to consider switching delays• and, learning of MU MAC address-to-port mapping

– must be addressed in the absence of uplink traffic from the MU– even when there is uplink traffic, there may be delays (e.g until the next

uplink packet is sent)

– solution: handled by the 802.11F Layer 2 Update (XID) packet• this packet is addressed at layer 2 as if it originated from the MU• sent just after an 802.11F ADD-Notify packet and after receipt of an

802.11F MOVE-response packet.

January 2004


Slide 25

doc.: IEEE 802.11-04/0086r3

Submission

MSC: Associating with AP#1

MU AP2 UplinkAP1

Auth Request

Ack

Auth Reponse

Ack

JOIN PHASE

SCAN PHASE

Switch

Association Request

Ack

Association Reponse

Ack802.11F ADD-Notify

DATA

Ack

DATA

802.11F L2 Update

Ack

DATA

January 2004


Slide 26

doc.: IEEE 802.11-04/0086r3

Submission

MSC: Roaming in a Switched Network

MU AP2 Uplink

DATA

Ack

DATA

SCAN PHASE


Ack

Re-Association Response

Ack

802.11F MOVE-Notify802.11F MOVE-Notify

802.11F L2 Update

802.11F MOVE-Resp802.11F MOVE-Resp

DATA

Ack

DATARoaming event

SwitchAP1

JOIN PHASE

Auth RequestAck

Auth ReponseAck

January 2004


Slide 27

doc.: IEEE 802.11-04/0086r3

Submission

Beginning of the Roaming Interval

• Defined: The last point in time when all network components know and agree upon the link path [to the MU].

• The relevant components are:– the MU– the AP (AP#1)– the infrastructure network (e.g. layer 2 switch)

• ...

January 2004


Slide 28

doc.: IEEE 802.11-04/0086r3

Submission

Beginning of the Roaming Interval

• Is it:– the start of the Scan process? (i.e. MU sends probe request)

• No, MU could have scanned in advance• No, MU could be doing passive scanning

– the start of the Join process?• No, does not include any lost service due to possible scanning

– the reassociation request?• No, again may not include any lost service due to possible scanning

• From the MU’s perspective the last data frame received from AP#1 marks a definitive point in time when service via AP#1 was known to be good.

January 2004


Slide 29

doc.: IEEE 802.11-04/0086r3

Submission

End of the Roaming Interval

• Defined: The point in time when all network components know and agree upon the new link path [to the MU].

• The relevant components are:– the MU– the old AP (AP#1)– the new AP (AP#2)– the infrastructure network (e.g. layer 2 switch)

• From the MU’s perspective the first data frame received from AP#2 marks a definitive point in time when service via AP#2 is known to be good.

January 2004


Slide 30

doc.: IEEE 802.11-04/0086r3

Submission

Roaming Interval

• Defined: the end of service from AP#1 and the start of service from AP#2

• Beginning: last data frame successfully received from AP#1

• End: first data frame successfully received from AP#2

January 2004


Slide 31

doc.: IEEE 802.11-04/0086r3

Submission

Determining the Roaming Interval

MU AP2 Uplink

DATA

Ack

DATA

SCAN PHASE


Ack


Ack


802.11F L2 Update


DATA

Ack

DATARoaming

event

SwitchAP1

JOIN PHASE

Auth RequestAck

Auth ReponseAckRoaming

Interval

January 2004


Slide 32

doc.: IEEE 802.11-04/0086r3

Submission


• the specifics of what happens during the roaming interval will vary from implementation to implementation

• under some conditions additional packet exchanges may be required (e.g. 802.11F)

• but, it is enough to just say that roaming happens, and the path of the data service changes from AP#1 to AP#2 and the time required to do all that is the Roaming Interval value in which we are interested ...

January 2004


Slide 33

doc.: IEEE 802.11-04/0086r3

Submission


MU AP2 Uplink

DATA

Ack

DATA

SCAN PHASE


Ack


Ack


802.11F L2 Update802.11F MOVE-Resp

802.11F MOVE-Resp

DATA

Ack

DATA

SwitchAP1

JOIN PHASE

Auth RequestAck

Auth ReponseAck

ROAMINGRoamingInterval

January 2004


Slide 34

doc.: IEEE 802.11-04/0086r3

Submission

Measuring the Roaming Interval

• Now that the extent of the roaming interval is known, how can a test setup be configured in order to measure it?

January 2004


Slide 35

doc.: IEEE 802.11-04/0086r3

Submission

Measurement by Powering Down AP#1

P1 P2 P3



MU Sniffer

Switch

January 2004


Slide 36

doc.: IEEE 802.11-04/0086r3

Submission

Powering Down AP#1 - Test Sequence

• power up sniffer• power up AP#1• power up the MU• wait until the MU establishes association with AP#1• power up AP#2• wait until the MU detects AP#2 (client site survey

software?)• start sniffer capture• power down AP#1• wait until MU reassociates with AP#2 and receives data

from AP#2• stop sniffer capture• save sniffer trace

January 2004


Slide 37

doc.: IEEE 802.11-04/0086r3

Submission

Issues with Powering Down AP#1

• not representative of the real world:– not representative of real world RF conditions at roaming event

• NOT the more usual roaming AP-to-AP with some amount of coverage overlap– effects (and capabilities) of the interceding network are not considered

• no interceding delays or switching effects in the network– deals with AP failure (or completely out of range) case rather than real

seamless AP-to-AP roaming scenario• MU is not comparing 2 candidate APs and choosing one• it is just choosing the only AP available

– power down of AP#1 means the MU state machine is dealing with the case of a poor connection due to a complete end to the stream of beacons from AP#1

– APs cannot communicate with each other during roaming event

January 2004


Slide 38

doc.: IEEE 802.11-04/0086r3

Submission

Analysis ofPower Down AP#1 Measurement Setup

• roaming time measurement: power down setup is inadequate bcus:– 1. not representative of real world RF conditions at roaming event– 2. not representative of infrastructure conditions at roaming event

• Desired setup is for the signal from AP#1 to fade rather than stop, so that at the roaming event AP#1 is still powered up and connected to the infrastructure network.

• Also, need to ensure reassociate vs. fresh association

January 2004


Slide 39

doc.: IEEE 802.11-04/0086r3

Submission

Measurement Using a “Cone of Silence”

P1 P2 P3



MU Sniffer

Switch

January 2004


Slide 40

doc.: IEEE 802.11-04/0086r3

Submission

“Cone of Silence” - Test Sequence

• power up sniffer• power up AP#1• power up the MU• wait until the MU establishes association with AP#1• power up AP#2• wait until the MU detects AP#2 (client site survey

software?)• start sniffer capture• place “Cone of Silence” over AP#1• wait until MU reassociates with AP#2 and receives data


January 2004


Slide 41

doc.: IEEE 802.11-04/0086r3

Submission

“Cone of Silence” Issues

• Better than the powering down AP#1 case but not as definitive as we would like.

• Murphy’s Law: When we need APs to be poor they are amazingly good (at getting a signal around or through the cone of silence), this can interfere with the integrity and repeatability of the measurement.

• Note that the cone of silence approach can be made to work, as long as the cone is a high quality mechanical enclosure with very tight "RF seals".

January 2004


Slide 42

doc.: IEEE 802.11-04/0086r3

Submission

Measurement Using an RF Attenuator on AP#1

P1 P2 P3

MU

AP#1SSID= “ACME”CH= 1

0-30 db


3 db

Sniffer

Switch

Note: APs are on different channels to ensure worst case roaming interval.

January 2004


Slide 43

doc.: IEEE 802.11-04/0086r3

Submission

RF Attenuator - Test Sequence

• power up sniffer• power up AP#1; set attenuator to minimum attenuation• power up the MU• wait until the MU establishes association with AP#1• power up AP#2• wait until the MU detects AP#2 (client site survey

software?)• start sniffer capture• increase attenuation on AP#1 radio/ antenna(s)• wait until MU reassociates with AP#2 and receives data


January 2004


Slide 44

doc.: IEEE 802.11-04/0086r3

Submission

Attenuator Test Setup Notes

• Attenuator test setup provides a convenient, reproducible, definitive way of creating real world conditions that force a roaming event

• can be done using external antennas on the AP with an adjustable RF signal attenuator inline between the two– ensure that the attenuator is of a continuously variable type, NOT a

discrete step type– note that the rate at which the attenuator is adjusted can affect the

measurement result (therefore, must define and record the adjustment rate)

• could also be done using Tx power adjustment on AP#1– ensure that the RF output level can be adjusted low enough to force the

roaming event– may require a fixed attenuator combined with the Tx power adjustment

January 2004


Slide 45

doc.: IEEE 802.11-04/0086r3

Submission

Recap - limits of the Roaming Interval

MU AP2 Uplink

DATA

Ack

DATA

SCAN PHASE


Ack


Ack


802.11F L2 Update


DATA

Ack

DATA

SwitchAP1

JOIN PHASE

Auth RequestAck

Auth ReponseAck

ROAMINGRoamingInterval

January 2004


Slide 46

doc.: IEEE 802.11-04/0086r3

Submission

MU leaves channel to

authenticate with AP#2

MU leaves channel to

reassociate with AP#2

First packet from AP#2

ACK to the last data

frame exchanged with AP#1

30 ms

Example Measurement Sniffer Trace

Note: In this example the two APs are on the same channel, which is not the worst case scenario.

Sniffer did not capture the ACKs from the MU, but

ACKs were sent.

January 2004


Slide 47

doc.: IEEE 802.11-04/0086r3

Submission

Measuring the Handover Interval

• Now know when to start and end measuring• Now know the test setup• How do we actually make the measurement?

• Need a method to detect and determine the end of service from AP#1 and the start of service from AP#2

• ...

January 2004


Slide 48

doc.: IEEE 802.11-04/0086r3

Submission


• connect a packet generator (e.g. Chariot) to the switch• set the packet generator to send out [short] packets on

a continuous basis• Packet type = directed L2 packets with a destination

address equal to the MU’s MAC address• set a fixed interval between packets• include a sequence number in every packet

• downlink packet generator ensures worst case scenario for roaming interval– i.e. showcases the worst case effects through the switch

January 2004


Slide 49

doc.: IEEE 802.11-04/0086r3

Submission

Measurement Using a Packet Generator

P1 P2

P3

MU

Traffic Generator


0-30 db


3 db

Sniffer

Switch

Note: APs are on different channels to ensure worst case roaming interval.

Data pathData path

January 2004


Slide 50

doc.: IEEE 802.11-04/0086r3

Submission


• Assume generator sends packets every ‘n’ msec, then• by measuring the Roaming Interval (as defined earlier),

– time from last packet thru AP#1 to first packet thru AP#2

• we can determine the Roaming Interval with an accuracy of +/- ‘n’ msec.

• Or, restated, an absolute accuracy of 2x ‘n’ msec.– (per Nyquist’s theory)

• The sequence numbers in the packets will also indicate if any packets (and how many) were lost during the roaming interval.

• Both the roaming interval and the number of packets lost are critical pieces of information needed to evaluate the effect of certain applications (e.g. VOIP).

January 2004


Slide 51

doc.: IEEE 802.11-04/0086r3

Submission

Summary

• defined the components of an 802.11 system• defined core roaming in an 802.11 system• identified an initial set of roaming conditions for

consideration/ analysis• identified the start and end points of the roaming

interval– end of AP#1 data service, beginning of AP#2 data service

• presented test setups for effective roaming interval measurements– Best = 1 MU, 2 APs, switch, packet generator, RF attenuator and sniffer

January 2004


Slide 52

doc.: IEEE 802.11-04/0086r3

Submission

Other Topics to Be Explored

• other cases to possibly consider:– inter-subnet layer 3 handover measurement - [need to describe setup too]– handover from one PHY type to another - within the same AP,

e.g. 11b->11a, 11a->11b• must consider single MAC and multi MAC cases

• MU client software considerations (e.g. higher level authentications, and so on)

January 2004


Slide 53

doc.: IEEE 802.11-04/0086r3

Submission

Credits

• Haixiang He - artistic design and animation• Bob O’Hara - technical review and sample sniffer trace

January 2004


Slide 54

doc.: IEEE 802.11-04/0086r3

Submission

References

• Std 802.11-1999• Std 802.11F-2003• 11-03-0563-00-000i-tgi-4-way-handshake-timings.ppt -

July 2003, Nick Petroni• Netwave Roaming Specification - 1995, Engwer, et. al.

January 2004


Slide 55

doc.: IEEE 802.11-04/0086r3

Submission

The End

January 2004


Slide 56

doc.: IEEE 802.11-04/0086r3

Submission

Backup Slides

January 2004


Slide 57

doc.: IEEE 802.11-04/0086r3

Submission

Roaming in Multi-PHY APs

DS

11a PHY

MAC

11b PHY

MAC

11g PHY

MAC

5 GHzRadio

2.4 GHzRadio

0x…1234 0x…1235 0x…1236

January 2004


Slide 58

doc.: IEEE 802.11-04/0086r3

Submission

Roaming in Multi-PHY APs

DS

MAC

11a PHY 11b PHY 11g PHY

5 GHz 2.4 GHz Radio

0x…1234

January 2004


Slide 59

doc.: IEEE 802.11-04/0086r3

Submission

Definitions

AP*

MUMU

802.11 STA

* STA operating as an AP.

MU = Mobile Unit(Mobile STA)

January 2004


Slide 60

doc.: IEEE 802.11-04/0086r3

Submission

Definitions

MU

802.11 STA

AP

January 2004


Slide 61

doc.: IEEE 802.11-04/0086r3

Submission

Definitions

MMU

802.11 STA

APUMU(adhoc/ IBSS)

MMU = Managed MUUMU = Unmanaged MU (adhoc)

January 2004


Slide 62

doc.: IEEE 802.11-04/0086r3

Submission

The End - Really

doc.: ieee 802.11-04/0086r3 submission january 2004 darwin engwer, nortel networksslide 1...

Documents