Further Investigations of Greenfield Mode on DFS Band September 2006 doc.: IEEE 802.11-06/1458r0 Nov 2007 Further Investigations of Greenfield Mode on DFS Band Date: 2007-11-12 D. Chan, et al. Joonsuk Kim, Broadcom Corp.

Outline Legacy Networks and DFS CIDs addressed by this submission Nov 2007 Outline Legacy Networks and DFS CIDs addressed by this submission Review of previous investigation of GF on DFS band Detrimental effects expected from GF and recommendation Proposed resolution of CIDs D. Chan, et al.

CIDs addressed by this submission Nov 2007 CIDs addressed by this submission CID Commenter Type of Comment Part of No Vote Clause Comment Proposed Change 5123 Chan, Douglas T Y 9.13.3 Transmission of GF preambles in DFS bands can cause DFS false alarms on legacy STAs. Thre is nothing in the DFS regulations that indicate radar may be ignored if preceded by MAC protection. Therefore protection is ineffective for GF preambles in DFS bands. Prohibit GF in DFS bands. 5795 Stephenson, Dave 5363 Hart, Brian D. Chan, et al.

Legacy Networks and DFS Nov 2007 Legacy Networks and DFS By the end of 2007, in the U.S, ETSI, and Japan, 5 GHz networks operating from channel 52 through channel 140 must use DFS.* This represents most of the 5 GHz band in those regulatory domains. Legacy 802.11a networks have no concept of Greenfield mode. GF transmissions look like short bursts of radar energy to them. APs with DFS must detect radars and move to another channel in order to avoid interfering with them. These radar transmissions have the following characteristics to a 5 GHz receiver The received signal is not recognizable to the 802.11a PHY Short duration Periodic Greenfield voice transmissions have the same characteristics to a 5 GHz receiver * The requirements vary slightly from country to country. D. Chan, et al.

Review of previous investigation Nov 2007 Review of previous investigation In LB 97, there were CIDs which pointed out that GF transmissions can cause legacy in the DFS band to falsely detect radars LB 94 CIDs on this: 323, 411, 1659, 1660, 2971 We performed experiments and presented a submission, 07/0329r2, in March 2007 (Orlando) to discuss the results D. Chan, et al.

Review of previous investigation (07/0329r2) Nov 2007 Review of previous investigation (07/0329r2) Transmit signal: Metalink 802.11n MATLAB simulator GF waveform Signal generator and RF upconversion to 5560 MHz Typical VoIP call traffic pattern Cisco 1510 Mesh Node falsely detected the GF transmission as radar and moved off channel A FAQ: Is this a particular problem associated with the Cisco 1510 receiver? No, we chose the Cisco 1510 because it shares a common receiver with a large fraction of 802.11a wireless LAN infrastructure devices deployed in the 5 GHz band. D. Chan, et al.

March 2007 Orlando Coex Ad Hoc Report Nov 2007 March 2007 Orlando Coex Ad Hoc Report D. Chan, et al.

March 2007 Orlando Coex Ad Hoc Report Nov 2007 March 2007 Orlando Coex Ad Hoc Report D. Chan, et al.

Further experiments Transmit Signal: Nov 2007 Further experiments Transmit Signal: Metalink 802.11n MATLAB reference transmitter MCS 4 Signal Generator and RF upconversion. RF power level varied from -20 to -80 dBm RF frequency = 5500 MHz D. Chan, et al.

Experiments Traffic Patterns Nov 2007 Experiments Traffic Patterns GF transmission sent according to a typical VoIP packet stream 50 packet sequences at each power level Randomly arrived burst of packet transmissions 40 usec (100 byte) GF packet Burst of 50 packets at a rate of 1000 pps (packets per sec) D. Chan, et al.

Nov 2007 Example results of further experiments with Vendor “X”’s 11a chipset: Traffic pattern 1: VoIP D. Chan, et al.

Nov 2007 D. Chan, et al.

Experiment observations and conclusion Nov 2007 Experiment observations and conclusion DFS detection triggered with VoIP packet stream Together with the results from the previous experiment, we can infer that: Transmission of GF preambles in DFS bands can cause DFS false alarms on legacy STAs. D. Chan, et al.

Detrimental effects expected from GF Nov 2007 Detrimental effects expected from GF Operations of legacy 802.11a networks which have no concept of Greenfield mode would be disrupted by their false detects from GF transmissions by moving to another channel each time Many mesh network architectures uses the 5 GHz band for backhaul A single voice call using GF transmissions could bring down a mesh tree while it changes channel. A small number of GF APs using efficient channel selection can totally occupy the 5 GHz band and cause a mesh network outage. This type of behavior also facilitates possibilities of simple denial of service attacks There is nothing in the DFS regulations that indicate radar may be ignored if preceded by MAC protection. Therefore protection is ineffective for GF preambles in DFS bands. Recommendation: Task Group n should prohibit GF operations in DFS bands D. Chan, et al.

CIDs addressed by this submission Nov 2007 CIDs addressed by this submission CID Commenter Type of Comment Part of No Vote Clause Comment Proposed Change Resolution 5123 Chan, Douglas T Y 9.13.3 Transmission of GF preambles in DFS bands can cause DFS false alarms on legacy STAs. Thre is nothing in the DFS regulations that indicate radar may be ignored if preceded by MAC protection. Therefore protection is ineffective for GF preambles in DFS bands. Prohibit GF in DFS bands. Accept; as in editor instructions in submission 07/xxxxrx. 5795 Stephenson, Dave 5363 Hart, Brian D. Chan, et al.

Nov 2007 Straw Poll Greenfield transmissions shall be disallowed in channels and regulatory domains where DFS is required until: 1. Acceptable methods of conveying Legacy 802.11a OBSS information to all the GF transmitting APs and their associated GF transmitting clients have been approved as IEEE draft text. 2. Acceptable methods of conveying Legacy 802.11a OBSS information to GF transmitting clients in an Ad Hoc network have been approved as IEEE draft text. D. Chan, et al.

An idea for conveying Legacy 802.11a OBSS presence to GF STAs band Nov 2007 An idea for conveying Legacy 802.11a OBSS presence to GF STAs band If an GF STA that is operating on one of the DFS channels detects the presence of legacy 802.11a OBSSs, this STA shall stop operating in GF mode for at least TBD amount of time. Use bit in HT IE that conveys detection of legacy OBSS TBD = 24 hrs D. Chan, et al.

Nov 2007 Backup slides Excerpt of two slides from 07/2693r2 displayed on slide 5 Detailed explanations of some of the effects quoted on slide 16 FAQ D. Chan, et al.

Experiment: Transmit Signal Nov 2007 Experiment: Transmit Signal Transmit Signal: Metalink 802.11n MATLAB reference transmitter MCS7 – 65 Mbps 100 byte payload Packet Duration: ~40 usec Signal Generator and RF Upconversion. Frequency: 5560 MHz D. Chan, et al.

Experiment Test Scenario Nov 2007 Experiment Test Scenario A Single Voice Call: 20 msec CODEC 100 total packets per second ACKS and call signaling were not included in the experiment. A Cisco 1510 Mesh Node was the target of the interference. The 1510 was chosen for the test because it shares the same receiver hardware with the majority of 5 GHz access points and mesh nodes deployed worldwide. D. Chan, et al.

Experiment: Results Nov 2007 The following text shows a debug log from the 1510 Receiver wlanEnableDFS: Enabling radar detection features >> Radar detected - 6 pulses, frequency 2767 Period matched for width match WARNING! WARNING! WARNING! directPulses: Found width matching radar, pulsewidth = 0 WARNING! WARNING! WARNING! Radar interference is detected. WARNING! WARNING! WARNING! directPulses: Found width matching radar, pulsewidth= 0 After a small number of radar detection events, the mesh AP moved off the channel. This experiment was repeated with varying packet lengths and pulse repetition frequencies, and the results were the same. D. Chan, et al.

A Simple Denial of Service Attack Nov 2007 A Simple Denial of Service Attack Equipment Required: A laptop computer with an 802.11n Greenfield transmitter and some degree of programmability in the MAC. Software Modifications Required: Program the 802.11n Greenfield transmitter to send out a few GF packets in one 5 GHz channel, move on to the next channel where DFS is required, and repeat. The Attack: Once the laptop is operating in this mode, walk around a 5 GHz deployment, or approach a root-AP in a mesh deployment. The Results: You bring down the legacy infrastructure or the mesh tree. D. Chan, et al.

Questions Received So Far Nov 2007 Questions Received So Far Is this a particular problem associated with the Cisco 1510 receiver? No, we chose the Cisco 1510 because it shares a common receiver with a large fraction of 802.11a wireless LAN infrastructure devices deployed in the 5 GHz band. Aren’t there other interferers in those bands that will cause the same problems? There are weather radars and military radars already deployed that will cause true radar detection events. These frequency bands are just opening up to other traffic that implements Dynamic Frequency Selection. To the best of my knowledge, 802.11a radios are the first to implement DFS and occupy those bands in large numbers. There is definitely a concern that other non-802.11 radios will implement DFS and occupy that band causing false radar detections. However we have not seen it yet. If Greenfield mode is deployed in those bands, we are consciously deploying 802.11 radios by the millions, tens of millions, or hundreds of millions, that will cause false radar detection events on the 802.11a radios deployed today. D. Chan, et al.