1. Further Investigations of Greenfield Mode on DFS Band
September 2006
doc.: IEEE /1458r0
Nov 2007
Further Investigations of Greenfield Mode on DFS Band
Date:
D. Chan, et al.
Joonsuk Kim, Broadcom Corp.

2. Outline Legacy Networks and DFS CIDs addressed by this submission
Nov 2007
Outline
Legacy Networks and DFS
CIDs addressed by this submission
Review of previous investigation of GF on DFS band
Detrimental effects expected from GF and recommendation
Proposed resolution of CIDs
D. Chan, et al.

3. CIDs addressed by this submission
Nov 2007
CIDs addressed by this submission
CID
Commenter
Type of Comment
Part of No Vote
Clause
Comment
Proposed Change
5123
Chan, Douglas T Y
9.13.3
Transmission of GF preambles in DFS bands can cause DFS false alarms on legacy STAs. Thre is nothing in the DFS regulations that indicate radar may be ignored if preceded by MAC protection. Therefore protection is ineffective for GF preambles in DFS bands.
Prohibit GF in DFS bands.
5795
Stephenson, Dave
5363
Hart, Brian
D. Chan, et al.

4. Legacy Networks and DFS
Nov 2007
Legacy Networks and DFS
By the end of 2007, in the U.S, ETSI, and Japan, 5 GHz networks operating from channel 52 through channel 140 must use DFS.* This represents most of the 5 GHz band in those regulatory domains.
Legacy a networks have no concept of Greenfield mode. GF transmissions look like short bursts of radar energy to them. APs with DFS must detect radars and move to another channel in order to avoid interfering with them.
These radar transmissions have the following characteristics to a 5 GHz receiver
The received signal is not recognizable to the a PHY
Short duration
Periodic
Greenfield voice transmissions have the same characteristics to a 5 GHz receiver
* The requirements vary slightly from country to country.
D. Chan, et al.

5. Review of previous investigation
Nov 2007
Review of previous investigation
In LB 97, there were CIDs which pointed out that GF transmissions can cause legacy in the DFS band to falsely detect radars
LB 94 CIDs on this: 323, 411, 1659, 1660, 2971
We performed experiments and presented a submission, 07/0329r2, in March 2007 (Orlando) to discuss the results
D. Chan, et al.

6. Review of previous investigation (07/0329r2)
Nov 2007
Review of previous investigation (07/0329r2)
Transmit signal: Metalink n MATLAB simulator GF waveform
Signal generator and RF upconversion to 5560 MHz
Typical VoIP call traffic pattern
Cisco 1510 Mesh Node falsely detected the GF transmission as radar and moved off channel
A FAQ: Is this a particular problem associated with the Cisco 1510 receiver?
No, we chose the Cisco 1510 because it shares a common receiver with a large fraction of a wireless LAN infrastructure devices deployed in the 5 GHz band.
D. Chan, et al.

7. March 2007 Orlando Coex Ad Hoc Report
Nov 2007
March 2007 Orlando Coex Ad Hoc Report
D. Chan, et al.

8. March 2007 Orlando Coex Ad Hoc Report
Nov 2007
March 2007 Orlando Coex Ad Hoc Report
D. Chan, et al.

9. Further experiments Transmit Signal:
Nov 2007
Further experiments
Transmit Signal:
Metalink n MATLAB reference transmitter
MCS 4
Signal Generator and RF upconversion.
RF power level varied from -20 to -80 dBm
RF frequency = 5500 MHz
D. Chan, et al.

10. Experiments Traffic Patterns
Nov 2007
Experiments Traffic Patterns
GF transmission sent according to a typical VoIP packet stream
50 packet sequences at each power level
Randomly arrived burst of packet transmissions
40 usec (100 byte) GF packet
Burst of 50 packets at a rate of 1000 pps (packets per sec)
D. Chan, et al.

11. Nov 2007
Example results of further experiments with Vendor “X”’s 11a chipset: Traffic pattern 1: VoIP
D. Chan, et al.

12. Nov 2007
D. Chan, et al.

13. Experiment observations and conclusion
Nov 2007
Experiment observations and conclusion
DFS detection triggered with VoIP packet stream
Together with the results from the previous experiment, we can infer that:
Transmission of GF preambles in DFS bands can cause DFS false alarms on legacy STAs.
D. Chan, et al.

14. Detrimental effects expected from GF
Nov 2007
Detrimental effects expected from GF
Operations of legacy a networks which have no concept of Greenfield mode would be disrupted by their false detects from GF transmissions by moving to another channel each time
Many mesh network architectures uses the 5 GHz band for backhaul
A single voice call using GF transmissions could bring down a mesh tree while it changes channel.
A small number of GF APs using efficient channel selection can totally occupy the 5 GHz band and cause a mesh network outage.
This type of behavior also facilitates possibilities of simple denial of service attacks
There is nothing in the DFS regulations that indicate radar may be ignored if preceded by MAC protection. Therefore protection is ineffective for GF preambles in DFS bands.
Recommendation:
Task Group n should prohibit GF operations in DFS bands
D. Chan, et al.

15. CIDs addressed by this submission
Nov 2007
CIDs addressed by this submission
CID
Commenter
Type of Comment
Part of No Vote
Clause
Comment
Proposed Change
Resolution
5123
Chan, Douglas T Y
9.13.3
Transmission of GF preambles in DFS bands can cause DFS false alarms on legacy STAs. Thre is nothing in the DFS regulations that indicate radar may be ignored if preceded by MAC protection. Therefore protection is ineffective for GF preambles in DFS bands.
Prohibit GF in DFS bands.
Accept; as in editor instructions in submission 07/xxxxrx.
5795
Stephenson, Dave
5363
Hart, Brian
D. Chan, et al.

16. Nov 2007
Straw Poll
Greenfield transmissions shall be disallowed in channels and regulatory domains where DFS is required until:
1. Acceptable methods of conveying Legacy a OBSS information to all the GF transmitting APs and their associated GF transmitting clients have been approved as IEEE draft text.
2. Acceptable methods of conveying Legacy a OBSS information to GF transmitting clients in an Ad Hoc network have been approved as IEEE draft text.
D. Chan, et al.

17. An idea for conveying Legacy 802.11a OBSS presence to GF STAs band
Nov 2007
An idea for conveying Legacy a OBSS presence to GF STAs band
If an GF STA that is operating on one of the DFS channels detects the presence of legacy a OBSSs, this STA shall stop operating in GF mode for at least TBD amount of time.
Use bit in HT IE that conveys detection of legacy OBSS
TBD = 24 hrs
D. Chan, et al.

18. Nov 2007
Backup slides
Excerpt of two slides from 07/2693r2 displayed on slide 5
Detailed explanations of some of the effects quoted on slide 16
FAQ
D. Chan, et al.

19. Experiment: Transmit Signal
Nov 2007
Experiment: Transmit Signal
Transmit Signal:
Metalink n MATLAB reference transmitter
MCS7 – 65 Mbps
100 byte payload
Packet Duration: ~40 usec
Signal Generator and RF Upconversion.
Frequency: 5560 MHz
D. Chan, et al.

20. Experiment Test Scenario
Nov 2007
Experiment Test Scenario
A Single Voice Call:
20 msec CODEC
100 total packets per second
ACKS and call signaling were not included in the experiment.
A Cisco 1510 Mesh Node was the target of the interference.
The 1510 was chosen for the test because it shares the same receiver hardware with the majority of 5 GHz access points and mesh nodes deployed worldwide.
D. Chan, et al.

21. Experiment: Results
Nov 2007
The following text shows a debug log from the 1510 Receiver
wlanEnableDFS: Enabling radar detection features
>> Radar detected - 6 pulses, frequency 2767 Period matched for width match
WARNING! WARNING! WARNING! directPulses: Found width matching radar, pulsewidth = 0
WARNING! WARNING! WARNING! Radar interference is detected.
WARNING! WARNING! WARNING! directPulses: Found width matching radar, pulsewidth= 0
After a small number of radar detection events, the mesh AP moved off the channel.
This experiment was repeated with varying packet lengths and pulse repetition frequencies, and the results were the same.
D. Chan, et al.

22. A Simple Denial of Service Attack
Nov 2007
A Simple Denial of Service Attack
Equipment Required:
A laptop computer with an n Greenfield transmitter and some degree of programmability in the MAC.
Software Modifications Required:
Program the n Greenfield transmitter to send out a few GF packets in one 5 GHz channel, move on to the next channel where DFS is required, and repeat.
The Attack:
Once the laptop is operating in this mode, walk around a 5 GHz deployment, or approach a root-AP in a mesh deployment.
The Results:
You bring down the legacy infrastructure or the mesh tree.
D. Chan, et al.

23. Questions Received So Far
Nov 2007
Questions Received So Far
Is this a particular problem associated with the Cisco 1510 receiver?
No, we chose the Cisco 1510 because it shares a common receiver with a large fraction of a wireless LAN infrastructure devices deployed in the 5 GHz band.
Aren’t there other interferers in those bands that will cause the same problems?
There are weather radars and military radars already deployed that will cause true radar detection events.
These frequency bands are just opening up to other traffic that implements Dynamic Frequency Selection. To the best of my knowledge, a radios are the first to implement DFS and occupy those bands in large numbers.
There is definitely a concern that other non radios will implement DFS and occupy that band causing false radar detections. However we have not seen it yet.
If Greenfield mode is deployed in those bands, we are consciously deploying radios by the millions, tens of millions, or hundreds of millions, that will cause false radar detection events on the a radios deployed today.
D. Chan, et al.