1. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 1 Measurement of 802.11 Roaming Intervals Darwin Engwer Nortel Networks 4655 Great America Pkwy Santa Clara, CA 95054 Phone: 408-495-7099 Fax: 408-495-5615 e-Mail: dengwer@nortelnetworks.com

2. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 2 Introduction This presentation uses animation. The reader is encouraged to view the presentation in a way that makes the animation visible (Slide Show mode).

3. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 3 Goals of this presentation define the components of an 802.11 system define roaming in an 802.11 system identify an initial set of roaming conditions for consideration/ analysis identify the start and end points of the roaming interval present test setups for effective roaming interval measurements stimulate thought and discussion on handover topics...

4. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 4 Scope of this presentation Considers existing 802.11 standards: –1999 base, 802.11a, 802.11b, 802.11d, 802.11F, 802.11g and 802.11h Does not specifically address pending standards: –802.11e, 802.11i, 802.11j and 802.11n aspects of roaming not addressed: –criteria for triggering the roaming event

5. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 5 Components of an 802.11 System Std 802.11- 1999 defines a station (STA) Std 802.11- 1999 further defines a subset of STAs called Access Points (APs) –“STA acting as an AP” for clarity as to the type of stations referenced herein, I further define a “STA that is NOT acting as an AP” as a Mobile Unit (MU).

6. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 6 802.11 System Layout MU Uplink to Infrastructure Network AP#1 SSID= “ACME” AP#2 SSID= “ACME”

7. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 7 Premises MU can only be associated with one AP at any given point in time (per clause number 5.4.2.2)

8. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 8 Roaming Definition Roaming occurs when an MU changes it’s association from one AP to another within the same ESS: –i.e. the SSIDs of the two APs are identical –this is called a “BSS-transition” per clause 5.4.2.1.b –uses the reassociation service per clause 5.4.2.3 Changing to an AP with a different SSID represents a change to a different network. This is a meta-case and is not discussed in this presentation. (“ESS-transition” per 5.4.2.1.c)

9. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 9 Roaming in an Ideal Network MU Uplink to Infrastructure Network AP#1 SSID= “ACME” AP#2 SSID= “ACME” MU

10. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 10 Core Roaming Sequence 1. MU is communicating with AP#1 2. MU moves to AP#2 coverage area 3. MU stops communicating with AP#1 4. MU starts communicating with AP#2 goal = measure time between events 3 and 4

11. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 11 But, it’s more complicated than that … networks are made of real components that can affect the outcome

12. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 12 Roaming in a HUB Network HUB Uplink to Infrastructure Network AP#1 SSID= “ACME” AP#2 SSID= “ACME” MU

13. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 13 How does roaming work … consider the Message Sequence Chart (MSC) for roaming in a simple, hub-based network …

14. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 14 MSC: Establish Association with AP#1 MUAP1AP2Uplink SCAN PHASE JOIN PHASE Auth Request Ack Auth Reponse Ack Association Request Ack Association Reponse Ack DATA Ack DATA

15. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 15 MSC: Roam to AP#2 MUAP2Uplink Ack DATA SCAN PHASE Re-Association Request Ack Re-Association Reponse Ack 802.11F MOVE-Notify 802.11F MOVE-Response Ack DATA AP1 JOIN PHASE Auth Request Ack Auth Reponse Ack Roaming event t1

16. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 16 Important parts of the core roaming sequence: discovery of candidate APs roaming event triggered reassociate request to AP#2 handover from AP#1 to AP#2 [IAPP] –was proprietary; now 802.11F defines an interoperable mechanism –ends the MU’s association with AP#1 - avoids “dangling association” –this helps AP#1differentiate between an MU that has wandered out of range - AP#1 still tries to communicate with the MU - and an MU that has roamed to another AP - AP#1 does NOT try to communicate with the MU). AP#2 sends reassociate response

17. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 17 Reassociate Frame recap contains: –Capability Field –Listen Interval –Current [old] AP [MAC] address –SSID –Supported Rates

18. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 18 there are some alternatives these are “technically” allowed by the standard, but not recommended … instead of reassociating with AP#2, the MU could perform a fresh association with AP#2 –in some cases this may be needed - such as when the MU has been completely out of range of the entire ESS for an extended period of time –strongly discouraged since fresh association does not properly support mobility (per clause 5.4.2)

19. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 19 … alternatives prior to re-associating with AP#2 the MU could send a disassociate request to AP#1 –allowed by the standard; intended to be used when changing ESS –physical aspects can make this approach troublesome when used within an ESS MU is trying to communicate over a known to be poor link (to AP#1) MU and/or AP#1 can get stuck retrying part of the disassociate frame exchange sequence –OK for SSID changes (changing ESS) –OK if the MU really is leaving the network, e.g. powering down –unreliable and error-prone in real networks within an ESS: disassociates the MU from the network (ESS) at the exact time when the MU is trying to stay associated with the network (ESS) hence use of disassociate in this way prevents subsequent use of reassociate –hence, not to be used within an ESS

20. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 20 … alternatives there are other techniques that are likely legal per the standard but, for fast roaming I recommend that focus be placed on the normal, preferred case: MU reassociates with AP#2

21. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 21 Recap - Roaming in a simple HUB Network HUB Uplink to Infrastructure Network AP#1 SSID= “ACME” AP#2 SSID= “ACME” MU

22. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 22 But, it’s more complicated than that … a hub network doesn’t account for interceding delays or switching in a real network

23. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 23 Roaming in a Switched Network SWITCH Uplink to Infrastructure Network AP#1 SSID= “ACME” AP#2 SSID= “ACME” P1 P2 P3 MU Data path

24. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 24 Roaming in a Switched Network need to consider switching delays and, learning of MU MAC address-to-port mapping –must be addressed in the absence of uplink traffic from the MU –even when there is uplink traffic, there may be delays (e.g until the next uplink packet is sent) –solution: handled by the 802.11F Layer 2 Update (XID) packet this packet is addressed at layer 2 as if it originated from the MU sent just after an 802.11F ADD-Notify packet and after receipt of an 802.11F MOVE-response packet.

25. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 25 MSC: Associating with AP#1 MUAP2UplinkAP1 Auth Request Ack Auth Reponse Ack JOIN PHASE SCAN PHASE Switch Association Request Ack Association Reponse Ack 802.11F ADD-Notify DATA Ack DATA 802.11F L2 Update Ack DATA

26. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 26 MSC: Roaming in a Switched Network MUAP2Uplink DATA Ack DATA SCAN PHASE Re-Association Request Ack Re-Association Response Ack 802.11F MOVE-Notify 802.11F L2 Update 802.11F MOVE-Resp DATA Ack DATA Roaming event SwitchAP1 JOIN PHASE Auth Request Ack Auth Reponse Ack

27. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 27 Beginning of the Roaming Interval Defined: The last point in time when all network components know and agree upon the link path [to the MU]. The relevant components are: –the MU –the AP (AP#1) –the infrastructure network (e.g. layer 2 switch)...

28. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 28 Beginning of the Roaming Interval Is it: –the start of the Scan process? (i.e. MU sends probe request) No, MU could have scanned in advance No, MU could be doing passive scanning –the start of the Join process? No, does not include any lost service due to possible scanning –the reassociation request? No, again may not include any lost service due to possible scanning From the MU’s perspective the last data frame received from AP#1 marks a definitive point in time when service via AP#1 was known to be good.

29. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 29 End of the Roaming Interval Defined: The point in time when all network components know and agree upon the new link path [to the MU]. The relevant components are: –the MU –the old AP (AP#1) –the new AP (AP#2) –the infrastructure network (e.g. layer 2 switch) From the MU’s perspective the first data frame received from AP#2 marks a definitive point in time when service via AP#2 is known to be good.

30. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 30 Roaming Interval Defined: the end of service from AP#1 and the start of service from AP#2 Beginning: last data frame successfully received from AP#1 End: first data frame successfully received from AP#2

31. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 31 Determining the Roaming Interval MUAP2Uplink DATA Ack DATA SCAN PHASE Re-Association Request Ack Re-Association Response Ack 802.11F MOVE-Notify 802.11F L2 Update 802.11F MOVE-Resp DATA Ack DATA Roaming event SwitchAP1 JOIN PHASE Auth Request Ack Auth Reponse Ack Roaming Interval

32. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 32 Determining the Roaming Interval the specifics of what happens during the roaming interval will vary from implementation to implementation under some conditions additional packet exchanges may be required (e.g. 802.11F) but, it is enough to just say that roaming happens, and the path of the data service changes from AP#1 to AP#2 and the time required to do all that is the Roaming Interval value in which we are interested...

33. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 33 Determining the Roaming Interval MUAP2Uplink DATA Ack DATA SCAN PHASE Re-Association Request Ack Re-Association Response Ack 802.11F MOVE-Notify 802.11F L2 Update 802.11F MOVE-Resp DATA Ack DATA SwitchAP1 JOIN PHASE Auth Request Ack Auth Reponse Ack ROAMING Roaming Interval

34. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 34 Measuring the Roaming Interval Now that the extent of the roaming interval is known, how can a test setup be configured in order to measure it?

35. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 35 Measurement by Powering Down AP#1 P1P2P3 AP#1 SSID= “ACME” AP#2 SSID= “ACME” MUSniffer Switch

36. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 36 Powering Down AP#1 - Test Sequence power up sniffer power up AP#1 power up the MU wait until the MU establishes association with AP#1 power up AP#2 wait until the MU detects AP#2 (client site survey software?) start sniffer capture power down AP#1 wait until MU reassociates with AP#2 and receives data from AP#2 stop sniffer capture save sniffer trace

37. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 37 Issues with Powering Down AP#1 not representative of the real world: –not representative of real world RF conditions at roaming event NOT the more usual roaming AP-to-AP with some amount of coverage overlap –effects (and capabilities) of the interceding network are not considered no interceding delays or switching effects in the network –deals with AP failure (or completely out of range) case rather than real seamless AP-to-AP roaming scenario MU is not comparing 2 candidate APs and choosing one it is just choosing the only AP available –power down of AP#1 means the MU state machine is dealing with the case of a poor connection due to a complete end to the stream of beacons from AP#1 –APs cannot communicate with each other during roaming event

38. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 38 Analysis of Power Down AP#1 Measurement Setup roaming time measurement: power down setup is inadequate bcus: –1. not representative of real world RF conditions at roaming event –2. not representative of infrastructure conditions at roaming event Desired setup is for the signal from AP#1 to fade rather than stop, so that at the roaming event AP#1 is still powered up and connected to the infrastructure network. Also, need to ensure reassociate vs. fresh association

39. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 39 Measurement Using a “Cone of Silence” P1 P2P3 AP#1 SSID= “ACME” AP#2 SSID= “ACME” MUSniffer Switch

40. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 40 “Cone of Silence” - Test Sequence power up sniffer power up AP#1 power up the MU wait until the MU establishes association with AP#1 power up AP#2 wait until the MU detects AP#2 (client site survey software?) start sniffer capture place “Cone of Silence” over AP#1 wait until MU reassociates with AP#2 and receives data from AP#2 stop sniffer capture save sniffer trace

41. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 41 “Cone of Silence” Issues Better than the powering down AP#1 case but not as definitive as we would like. Murphy’s Law: When we need APs to be poor they are amazingly good (at getting a signal around or through the cone of silence), this can interfere with the integrity and repeatability of the measurement. Note that the cone of silence approach can be made to work, as long as the cone is a high quality mechanical enclosure with very tight "RF seals".

42. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 42 Measurement Using an RF Attenuator on AP#1 P1 P2P3 MU AP#1 SSID= “ACME” CH= 1 0-30 db AP#2 SSID= “ACME” CH= 11 3 db Sniffer Switch Note: APs are on different channels to ensure worst case roaming interval.

43. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 43 RF Attenuator - Test Sequence power up sniffer power up AP#1; set attenuator to minimum attenuation power up the MU wait until the MU establishes association with AP#1 power up AP#2 wait until the MU detects AP#2 (client site survey software?) start sniffer capture increase attenuation on AP#1 radio/ antenna(s) wait until MU reassociates with AP#2 and receives data from AP#2 stop sniffer capture save sniffer trace

44. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 44 Attenuator Test Setup Notes Attenuator test setup provides a convenient, reproducible, definitive way of creating real world conditions that force a roaming event can be done using external antennas on the AP with an adjustable RF signal attenuator inline between the two –ensure that the attenuator is of a continuously variable type, NOT a discrete step type –note that the rate at which the attenuator is adjusted can affect the measurement result (therefore, must define and record the adjustment rate) could also be done using Tx power adjustment on AP#1 –ensure that the RF output level can be adjusted low enough to force the roaming event –may require a fixed attenuator combined with the Tx power adjustment

45. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 45 Recap - limits of the Roaming Interval MUAP2Uplink DATA Ack DATA SCAN PHASE Re-Association Request Ack Re-Association Response Ack 802.11F MOVE-Notify 802.11F L2 Update 802.11F MOVE-Resp DATA Ack DATA SwitchAP1 JOIN PHASE Auth Request Ack Auth Reponse Ack ROAMING Roaming Interval

46. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 46 MU leaves channel to authenticate with AP#2 MU leaves channel to reassociate with AP#2 First packet from AP#2 ACK to the last data frame exchanged with AP#1 30 ms Example Measurement Sniffer Trace Note: In this example the two APs are on the same channel, which is not the worst case scenario. Sniffer did not capture the ACKs from the MU, but ACKs were sent.

47. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 47 Measuring the Handover Interval Now know when to start and end measuring Now know the test setup How do we actually make the measurement? Need a method to detect and determine the end of service from AP#1 and the start of service from AP#2...

48. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 48 Measuring the Handover Interval connect a packet generator (e.g. Chariot) to the switch set the packet generator to send out [short] packets on a continuous basis Packet type = directed L2 packets with a destination address equal to the MU’s MAC address set a fixed interval between packets include a sequence number in every packet downlink packet generator ensures worst case scenario for roaming interval –i.e. showcases the worst case effects through the switch

49. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 49 Measurement Using a Packet Generator P1 P2 P3 MU Traffic Generator AP#1 SSID= “ACME” CH= 1 0-30 db AP#2 SSID= “ACME” CH= 11 3 db Sniffer Switch Note: APs are on different channels to ensure worst case roaming interval. Data path

50. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 50 Measuring the Handover Interval Assume generator sends packets every ‘n’ msec, then by measuring the Roaming Interval (as defined earlier), –time from last packet thru AP#1 to first packet thru AP#2 we can determine the Roaming Interval with an accuracy of +/- ‘n’ msec. Or, restated, an absolute accuracy of 2x ‘n’ msec. –(per Nyquist’s theory) The sequence numbers in the packets will also indicate if any packets (and how many) were lost during the roaming interval. Both the roaming interval and the number of packets lost are critical pieces of information needed to evaluate the effect of certain applications (e.g. VOIP).

51. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 51 Summary defined the components of an 802.11 system defined core roaming in an 802.11 system identified an initial set of roaming conditions for consideration/ analysis identified the start and end points of the roaming interval –end of AP#1 data service, beginning of AP#2 data service presented test setups for effective roaming interval measurements –Best = 1 MU, 2 APs, switch, packet generator, RF attenuator and sniffer

52. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 52 Other Topics to Be Explored other cases to possibly consider: –inter-subnet layer 3 handover measurement - [need to describe setup too] –handover from one PHY type to another - within the same AP, e.g. 11b->11a, 11a->11b must consider single MAC and multi MAC cases MU client software considerations (e.g. higher level authentications, and so on)

53. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 53 Credits Haixiang He - artistic design and animation Bob O’Hara - technical review and sample sniffer trace

54. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 54 References Std 802.11-1999 Std 802.11F-2003 11-03-0563-00-000i-tgi-4-way-handshake-timings.ppt - July 2003, Nick Petroni Netwave Roaming Specification - 1995, Engwer, et. al.

55. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 55 The End

56. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 56 Backup Slides

57. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 57 Roaming in Multi-PHY APs DS 11a PHY MAC 11b PHY MAC 11g PHY MAC 5 GHz Radio 2.4 GHz Radio 0x … 1234 0x … 12350x … 1236

58. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 58 Roaming in Multi-PHY APs DS MAC 11a PHY11b PHY11g PHY 5 GHz 2.4 GHz Radio 0x … 1234

59. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 59 Definitions AP* MU 802.11 STA * STA operating as an AP. MU = Mobile Unit (Mobile STA)

60. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 60 Definitions MU 802.11 STA AP

61. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 61 Definitions MMU 802.11 STA AP UMU (adhoc/ IBSS) MMU = Managed MU UMU = Unmanaged MU (adhoc)

62. doc.: IEEE 802.11-04/0086r3 Submission January 2004 Darwin Engwer, Nortel NetworksSlide 62 The End - Really