802.11 User Fingerprinting

Ramki Gummadi (MIT), David Wetherall (UW)Ben Greenstein (IRS), Srinivasan Seshan (CMU)

Presented by Lei Yang in CS595H, W081Understanding and Mitigating the Impact of RF Interference on 802.11 Networks1The impact of interference?2Shannon Channel CapacityCapacity = Bandwidth*log(1+Signal/Noise)

Very useful in communication theoryGive the upper boundGive directions for approaching the upper boundE.g. Telephone line moderm

Very difficult to extend to wireless networksToo many factors and optimization goals

senderreceiversignalnoiseExtend to wireless networks?3Current status of network information theorySuccesfully extend to broadcast and multi access channelBut the simplest cases are still unknownThe simplest relay channelThe simplest interference channelReal networks are much more sophisticated

Factors are difficult to modelReal interference are not stationary, white and additiveMAC schedulingDelayUser cooperation/relay/multi-hopDynamic trafficHardware implementation factors

Interference channelWhat can we do?4Information theoretical viewCT: bit-meters/second Scaling law results O(n), O(n)Estimate performance in real networksModeling based on simplificationsMarkov process for MAC behaviorPoisson arrival of trafficCapture hardware impactsSimulations ExperimentsDesign better schemes to improve performancePhysical layer: modulation, codingMAC/Network layer: scheduling, routingJoint optimization: network coding, distributed source codingAnother interference paperLast weeks paperTheoretical approachThis paperExperimental approachIn wireless networks, Blog(1+S/N) doesnt consider CSMA MAC and traffic demandDevelop a model to estimate pairwise throughput and packet loss ratioPropose a new scheduling method?Even for a single 802.11 link, show interference generates worse impacts by experimentsExtend existing SINR model to capture the impactsShow that simple solutions dont work, propose a channel-hopping method to reduce the impacts5Motivations6Growing interference in unlicensed bands Anecdotal evidence of problems, but how severe?Characterize how 802.11 operates under interference in practice

Other 802.11

6What do we expect?7Throughput to decrease linearly with interferenceThere to be lots of options for 802.11 devices to tolerate interferenceBit-rate adaptationPower controlFECPacket size variationSpread-spectrum processingTX/RX diversity

Interferer power(log-scale)Throughput (linear)Theory7What we see8Effects of interference more severe in practice

Caused by hardware limitations of commodity cards, which theory doesnt modelPracticeInterferer power(log-scale)Throughput (linear)Theory8Overview of this paper9Characterize the impact of interference

Extend the SINR model

Simple interference mitigation methods dont help much

Apply channel hopping to tolerating interference

Experimental setup10

802.11ClientAccessPointUDP flow

802.11 Interferer

10802.11 receiver path11MACPHYTimingRecoveryPreamble Detector/Header CRC-16 CheckerAGCBarker CorrelatorDescramblerADC6-bit samplesTo RF AmplifiersRF SignalReceiverData(includes beacons)

DemodulatorPHYMACAnalog signalAmplifier controlSYNCSFDCRCPayloadExtend SINR model (in paper) to capture these vulnerabilitiesPHY headerInterested in worst-case natural or adversarial interference11Timing recovery interference12Interferer sends continuous SYNC patternInterferes with packet acquisition (PHY reception errors)

Weak interfererModerate interfererLog-scale12Dynamic range selection13Interferer sends on-off random patterns (5ms/1ms)AGC selects a low-gain amplifier that has high processing noise (packet CRC errors)

13Header processing interference14Interferer sends continuous 16-bit Start Frame DelimitersAffects PHY header processing (header CRC errors)

Unsynchronized interferer14Extending the SINR Model15Original Model

Extended ModelAccounting for processing gainAccounting for AGC behaviorAcouting for non-linearity in receiver sensitivity

Not very useful

Interference mitigation options16Lower the bit rateDecrease the packet sizeChoose a different modulation schemeLeverage multipath (802.11n)Move to a clear channel

Impact of 802.11 parameters17Rate adaptation, packet sizes, FEC, and varying CCA parameters do not help

With and without FECRate adaptationChanging CCA modeChanging packet size17Impact of 802.11g/n18No significant performance improvement

High throughputs without interferenceSignificant drops with weak interfererImpact of frequency separation19But, even small frequency separation (i.e., adjacent 802.11 channel) helpsChannel hopping to mitigate interference?

19Rapid channel hopping20Use existing hardwareDesign dictated by radio PHY and MAC properties (synchronization, scanning, and switching latencies)Design must accommodate adversarial and natural interference channel hoppingTest with an oracle-based adversaryDesign overviewPacket loss during switching + adversarys search speed 10ms dwell periodNext hop is determined using a secure hash chainTriggered only when heavy packet loss is detected

20Evaluation of channel hopping21Good TCP & UDP performance, low loss rate

Weak interference, 17% degradationModerate interference, 1Mbps throughputEvaluation of channel hopping22

Acceptable throughput even with multiple interferers

InterferersThree orthogonal 802.11 interferersLinear scale

Conclusions23Lot of previous work on RF interferenceWe show 802.11 NICs have additional PHY and MAC fragilities

Interference causes substantial degradation in commodity NICsEven weak and narrow-band interferers are surprisingly effective

Changing 802.11 parameters does not mitigate interference, but rapid channel hopping can

Pros & Cons24ProsClear structureUseful resultsClearly separation of hardware limitations

ConsExtended model is not usefulChannel Hopping solution is not novel