doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Avoiding Interactions with Lazy-WDS Equipment Date:

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 2 Abstract Mesh multicast traffic will trigger unwanted responses on Access Points that implement Lazy- WDS. A frame format change is proposed that will avoid these interactions and make a more efficient use of the header address fields.

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 3 Background The origin of this problem is summarized in IEEE Std TM-2007: wireless distribution system (WDS): (...) This standard describes such a frame format, but does not describe how such a mechanism or frame format would be used. The Wi-Fi Alliance is also silent about the use of the WDS frame format.

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 4 Background So vendors had to get creative. There are two ways APs use WDS frames: Static WDS configuration –Network managers manually enter a list of WDS-peers Dynamic WDS configuration (most commonly known as Lazy-WDS)‏ –Access Points automatically "discover" WDS peers.

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 5 What triggers automatic peer discovery? We've empirically established that some Lazy-WDS Access Points will assign WDS-peer status to any STA that transmits a multicast WDS frame (i.e if bit8, 1st octet of the Receiver Address is set). Ah, and this is regardless of the value of the protected bit in the frame control header.

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 6 The birth of a WDS-peer link

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 7 How does that affect s? Resolution 11-07/799r6 established that mesh will use WDS frame format. This means that each MP that forwards a broadcast/multicast frame in the vicinity of a Lazy-WDS AP will be treated as a WDS-peer. There is a large deployed population of Lazy-WDS Access Points... being in the vicinity of one is not hard.

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 8 So? Mesh Points in range of Lazy-WDS APs will cause two serious problems: spurious traffic and DDoS attack on the AP.

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 9 Spurious Traffic Lazy-APs will retransmit all multicast traffic in the BSS to each and every MP in range. The AP does not consider the Mesh Sequence number to limit broadcast flooding. N MPs in range -> Each multicast frame is retransmitted N times by the AP.

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 10 Spurious Traffic

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 11 Spurious Traffic

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 12 Distributed Denial of Service Attack Apparently Lazy-WDS APs were designed to support only a small number of WDS peer links. A large number of MPs near a Lazy-WDS AP will carry out a DDoS attack on the Access Point. Service to the BSS will be disrupted.

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 13 Distributed Denial of Service Attack

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 14 Because of these problems we propose...

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 15 Broadcast and Multicast Packet Transmission According to Draft 1.09 Broadcast mesh packets are transmitted using 4 address frame formats with Address 1 as either unicast or broadcast/multicast. If Address 1 is unicast there is no issue. However if Address 1 is broadcast then…

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 16 Broadcast and Multicast Packet Transmission According to Draft A At Source MPs For non Proxied entries Address 1 = Broadcast or Multicast Address 2 = Source MP MAC address Address 3 = Broadcast or Multicast Address 4 = Source MP MAC Address From Proxied entities Address 1 = Broadcast or Multicast Address 2 = Source MP MAC address Address 3 = Broadcast or Multicast Address 4 = Source MP MAC Address AE: Add 5 = Broadcast or Multicast AE:Addr 6 = Address of Proxied entity 11A At Intermediate and destination MPs For non Proxied entries Address 1 = Broadcast or Multicast Address 2 = Intermediate MP MAC address Address 3 = Broadcast or Multicast Address 4 = Source MP MAC Address From Proxied entities Address 1 = Broadcast or Multicast Address 2 = Intermediate MP MAC address Address 3 = Broadcast or Multicast Address 4 = Source MP MAC Address AE:Addr 5 = Broadcast or Multicast AE:Addr 6 = Address of Proxied entity Observations A lot of redundant fields Broadcast/multicast address repeated 2 times in non-proxied case Broadcast/multicast address repeated 3 times in proxied case

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 17 Broadcast and Multicast Packet Transmission According to Draft 1.09 MPs MP1 MP2 MP3 Address 1 = Broadcast or Multicast Address 2 = MPs MAC Addr Address 3 = Broadcast or Multicast Address 4 = MPs MAC Address SQ1 Address 1 = Broadcast or Multicast Address 2 = MPs MAC Addr Address 3 = Broadcast or Multicast Address 4 = MPs MAC Address SQ1 Address 1 = Broadcast or Multicast Address 2 = MP1 MAC Addr Address 3 = Broadcast or Multicast Address 4 = MPs MAC Address SQ1 Address 1 = Broadcast or Multicast Address 2 = MP2 MAC Addr Address 3 = Broadcast or Multicast Address 4 = MPs MAC Address SQ1 Determines duplicate Packet based on

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 18 Broadcast and Multicast Packet Transmission According to Draft 1.09 MPs1 MPi1 MPi2 MP3 Address 1 = Broadcast or Multicast Address 2 = MPs1 MAC Addr Address 3 = Broadcast or Multicast Address 4 = MPs1 MAC Address AE:Addr 5 =Broadcast or Multicast AE:Addr 6= S SQ1 Address 1 = Broadcast or Multicast Address 2 = MPi1 MAC Addr Address 3 = Broadcast or Multicast Address 4 = MPs1 MAC Address AE:Addr 5 =Broadcast or Multicast AE:Addr 6 = S SQ1 Address 1 = Broadcast or Multicast Address 2 = MPi2 MAC Addr Address 3 = Broadcast or Multicast Address 4 = MPs2 MAC Address AE:Addr 5 =Broadcast or Multicast AE:Addr 6 = S SQ1 S

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 19 Broadcast and Multicast Packet Transmission Proposed Solution 11A At Source MPs For non Proxied entries Address 1 = Broadcast or Multicast Address 2 = Source MP MAC address Address 3 = Source MP MAC Address From Proxied entities Address 1 = Broadcast or Multicast Address 2 = Source MP MAC address Address 3 = Source MP MAC address AE:Addr 4 = Address of Proxied entity 11A At Intermediate MPs For non Proxied entries Address 1 = Broadcast or Multicast Address 2 = Intermediate MP MAC address Address 3 = Source MP MAC Address From Proxied entities Address 1 = Broadcast or Multicast Address 2 = Intermediate MP MAC address Address 3 = Source MP MAC Address AE:Add 4 = Address of Proxied entity Use 3 address formats for all non-proxied broadcast/multicast data frames Use AE=01 to carry proxied entity in proxied broadcast/multicast frame Addr1, Addr2, Addr3 are TA, RA and SA respectively From DS = 1, To DS = 0 Addr4 is proxied entity when AE=01

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 20 Broadcast and Multicast Packet Transmission Proposed Solution MPs MP1 MP2 MP3 Address 1 = Broadcast or Multicast Address 2 = MPs MAC Addr Address 3 = MPs MAC Address SQ1 Address 1 = Broadcast or Multicast Address 2 = MPs MAC Addr Address 3 = MPs MAC Address SQ1 Address 1 = Broadcast or Multicast Address 2 = MP1 MAC Addr Address 3 = MPs MAC Address SQ1 Address 1 = Broadcast or Multicast Address 2 = MP2 MAC Addr Address 3 = MPs MAC Address SQ1 Determines duplicate Packet based on

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 21 Broadcast and Multicast Packet Transmission Proposed Solution MPs1 MPi1 MPi2 MP3 Addr4 is proxied entity when AE=01 Address 1 = Broadcast or Multicast Address 2 = MPs1 MAC Addr Address 3 = MPs1 MAC Addr AE:Addr 4 = S SQ1 Addr4 is proxied entity when AE=01 Address 1 = Broadcast or Multicast Address 2 = MPi1 MAC Addr Address 3 = MPs1 MAC Address AE:Addr 4 = S SQ1 Addr4 is proxied entity when AE=01 Address 1 = Broadcast or Multicast Address 2 = MPi2 MAC Addr Address 3 = MPs2 MAC Address AE:Addr 4 = S SQ1 Use to determine duplicate packets. MPs2 S

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 22 Changes Required 1.Modify 11.A and 11.A to describe transmission of 3 address broadcast and multicast data frames 2.Modify Table s2 to allow AE=01 for broadcast/multicast data frames as well

doc.: IEEE /0278r5 Submission March 2008 Javier Cardona et al. Slide 23 Straw Poll Would you support the proposed modifications to mesh broadcast frames as presented in this submission? 1) Yes2) No 3) DK/DC