802.11ac Frames - What's Changed?

good afternoon everyone it is time for us to begin our webinar today on 802 dot 11ac frames what's changed and this is going to be a brief overview of the changes in 802 dot 11ac frames without going into extensive depth into every detail of all the bits and bytes the goal here is to get an understanding of some of the things that have been introduced with 802 dot 11ac and how they're going to impact our thinking about frames and frame analysis when it comes to troubleshooting wireless networks now there are two ways to think about frames for either wired or wireless networks we can think about frames from the perspective of the designer of drivers and chipsets that need to worry about transmitting frames and we can think of them from the perspective of network implementers Troubleshooters and optimizers who need to look at frames in order to see what's going on on the network how the network is behaving what they can do to make it perform better and so forth well that's primarily our focus at CW NP so our focus at CW NP is not on training programmers who are going to develop chipsets and drivers our focus is on training and certifying those who actually do have the ability to implement wireless networks and troubleshoot them so today we're looking at the 802 dot 11 AC frames and we're going to talk a little bit about what's new in them now the first thing though is to let you know a little bit about what CW NP offers for those of you that might be with us today who are not familiar with CW NP in detail and just in case you have any difficulty seeing what's on the screen this is a slide based presentation so you should see these slides and be able to hear the audio as well now the CW NP certifications include CW na which is our flagship certification we have more people certified as CW a than level and then we have professional level certifications like CWS pcw DP and CWAP and CWAP in particular is very heavily focused on understanding 802 1011 frames and how to analyze them from a troubleshooting and performance perspective CW SP is about security and CW DP is about design and these are our three professional level certifications now an individual who gains the four certifications I've just mentioned CW na CW s p CW DP and CWAP can then apply to become a CW any there are specific qualifications for that and you'll certainly want to check out the CW NP comm website to read about the CWD requirements because it's not just about taking a test for CWD you have to have the four certifications previously mentioned and experience and other qualifying factors so you'll want to make sure that you check on the specific requirements at the CW and P comm website so the agenda today then is to talk first of all just briefly about 802 dot 11 frames the standard frame format and then to go into a little more detail about the changes at the Mac layer and the Phi layer so when we deal with framing with any kind of networking we are dealing with mac layer frames this is all about the bits that format the thing that should be sent on the physical media whether that's a wire or RF waves it's still needing to be formatted before it's passed on to the physical layer which is going to then also add some extra bits for the transmission at the physical layer some of those bits are simply for the purpose of training the receiver when it comes to wireless so that the receiver knows that a frame is coming in and it can start listening appropriately for it and some of the bits actually say something about the payload like the size of the payload so that the receivers can understand how long it's going to take for that transmission to take place so we'll talk about these as we go along now the presentation today is going to be somewhere around 20 to 25 minutes it's going to be a shorter presentation not an extremely long because again we're not going into great detail just getting you started in thinking about the new things in 802 that 11ac frames so before we get into any of the content let me recommend a couple things first of all if you want more information on frame analysis for 802 11 a really great source is the different protocol analyzer vendors so for example you can look at tamo softs website err magnet Wi-Fi analyzer pro omni peak is another good Wireless analyzer program all of these are applications that are specifically designed for analysis with 802 10 11 and their websites but also the help within these applications is very useful and you can download trial versions of the applications to see that information so that's a good source another is we are in the process of editing right now a brief series of blog posts that'll give you an overview of some of the information I mentioned here today but also more information as well and this will be authored by a guest blogger and you'll get to see those coming up at the C WP blog pretty soon so that would be another source as well and of course the ultimate source for all things 802 dot 11 analysis is the CW AP certification and so if you really really want to go into depth to all of this information about frames then the study guides for the certification the practice exams and of course gaining that knowledge to pass the certification itself now let's talk a little bit about then this process of encapsulation because when we talk about frames what we're talking about is the container that holds useful data when we're dealing with useful data we're dealing with layer 3 and above technically we're dealing with layer 4 and above but we can call it useful data at layer 3 and above because it's going to some destination outside of our local area network in many cases it has an IP header it may be going to the internet it may be going somewhere on our wide area network it may just be going on the local area network but the point is at that level layer 3 it has an IP header and from that point up we're dealing with something that we can transfer through our network or even out of our network so lower layers the data link layer in the physical layer are really what defined the different kinds of networks that we use whether that's Wi-Fi or Ethernet or some other layer one and layer two technology with 802 that 11 of course we're dealing with the MAC header and Mac footer or frame check sequence to be able to do integrity checks against the data so all we do is at layer 2 particularly at the sub layer of layer 2 called the data link layer we actually or the Mac sub-layer of the data link layer we actually encapsulate the upper layer information so the IP header the TCP UDP header the data we take all of that we wrap it inside of the 802 dot 11 mac frame format so the actual upper layer information becomes the payload of the mac frame this payload is stored in the section of the mac frame that actually has a very specific name and that name is simply going to be the frame body so the frame body is the data it's the thing the frame is delivering okay now think about like this if you have a window in your house and there's a frame around that window you didn't put it there for the frame you put it there for the window the window is what you want you need the frame to hold the window but you actually want the window not the frame okay well maybe you have a fancy frame so you like the frame too but you get the point the point is that we have the frame to hold the window we have a picture frame to hold a picture the point is then we have a frame to hold the upper layer useful data it's just used to hold it until it gets to the next point where it doesn't have to hold it anymore and then if there are many hops there might be many devices that create frames to hold that upper layer data along the way until it gets to its destination now we'll talk a little bit more about what's in this frame in just a moment but in addition to the mac layer it is important to know that there is encapsulation at the phi layer now technically speaking encapsulation you would think is having a header and a footer well the file errors sorta has a footer in that there are some extra bits sent after the data in order to communicate to a convolution coder that the frame is done but the point is that we mostly focus on the Phi header the information that is at the front of the payload before the mac frame and so we'll talk a little bit about what's changed in that area as well in 802 11 AC now first of all I want to back up for just a moment and point out a big change that came in 802 dot 11 in in 802 dot 11 n we were introduced to frame aggregation now to understand frame Agra's eight aggregation there are a couple of terms you need to understand these terms are MSD you and MPD you and MSD you is a max service protocol data unit a max service data unit to keep it nice and short the point is that it is the chunk of information the bits the ones and zeros that the mac layer needs to process its received from the upper layers or it could be that it's transmitted back to the upper layers when a frame is received when a frame is being transmitted the data comes down through the upper layers the mac layer receives the IP header tcp UDP header the data it then treats that information the stuff that came from above as the MSD u it needs to take the mstu and put a header and a footer on it after it has appended a header and footer it is now called an MPD you a Mac protocol data unit and is ready to be sent down to the physical layer okay so an MSD UMX service data unit received from the upper layers after the mac header and footer are added it becomes an MPD you and it's sent down to the lower layers well what 802 dot 11 in added was the ability to actually aggregate multiple MSD use so that we can send multiple MSD use in a single MPD you and notice the way the graphic represents it here we have three IP headers three TCP or UDP headers and three data payloads they are embedded within one Mac header and Mac footer or frame check sequence so the point is that we're dealing here with multiple MS to use this was an added feature in 11n to get more data through more quickly during a transmitter tunity the MPD you remember is what comes out of the Mac layer well 11 n also introduced the aggregated MPD you in this case what we're doing is we're taking entire mac frames multiple mac frames and sending them in a burst at the physical layer so notice that we have not just a three IP headers but we have three mac headers and we have three mac frame check sequence --is and so the point is that we're actually transmitting all of that extra information together at the physical layer so from now I just want to point out that this was introduced at 11:00 in the ability to aggregate at the MSD you or MPD you level and this gave us the ability to send more data more quickly with higher data rate clients 802 dot 11 M clients specifically then and now we have support for aggregation of frames with 802 da 11ac as well but something really important has changed with 802 dot 11ac all frames are sent as aggregated MPD use that is to say even if we're only sending one frame we have one Mac header one mac frame check sequence one mac frame we're still sending it using the v format for an a MPD you okay so that was a decision that was made for efficiency purposes and it's simply because there are very very high data rates that we have an 8:02 dot 11ac and to keep the discussion simple today just know that by doing it this way by always sending aggregated MPD use instead of only doing it when we need to we end up getting more efficiency in our overall communications across the board now don't be alarmed that doesn't mean an 802 double Evan AC device cannot communicate with an 802 11 a device it and it's simply going to communicate in such a way that it's a standard MPD you are a standard five communication with OFDM right so it's backward compatible it knows it's talking to that device it'll talk to it in a way that it can hear it and understand it but when an 802 of an AC device is talking to an 802 11 AC device it's always going to be an aggregated MPD you in the transmission now let's talk then a little bit about the standard 802 11 frame a totodile 11 AC does redefine the general frame format the general frame format is just what it sounds like it's the frame that's generally used it's the frame that's most commonly used there are variants to the format there are different frames that include things that are not listed here and there are frames that do not include something so there are different frames but the common frame format particularly used for all data transmission is the one we see here now one thing you would notice immediately if you had looked at the frame format for 11 n and 11a which is all we care about with 11 AC by the way remember 11 AC works in 5 gigahertz and that's all it doesn't work in 2.40 yards so we're not really worried about what a frame might look like down there are we we're focused on frames that an 11 AC device would send and that other devices that are not 11 AC might be able to see for example 11 a and 11 M so the early frame bits are effectively backward compatible because we still have a frame control field we still have a duration ID field and so forth but there are frame bits later on like the HT control field can be of the VHT variant and it will mean that it has some stuff in it that older client stations would not understand now an important thing to note is the frame body size was changed with the release of 11 AC 2 instead of being 0 to some maximum simply stated to be variable and the reason it's stated to be variable is there are several different factors that can impact the actual frame body size but the maximum for the MSD u frame body size is 11450 4 so it's bigger than it was or 11m maxed out at 79 55 with aggregated MSD use 11a was the old 2,304 bytes these are by the way bytes or octet SIF you prefer to be more specific an octet is an 8-bit byte okay so a byte could be something other than eight bits and that's why for better accuracy it's good to say octet but many people always think a byte is eight bits well if you think that you're right in this case so the frame control field is two octets or two bytes which means it's 16 bits right the for example HT control field is four octets or four bytes which means it's 32 bits okay and so what does that mean well each one of those ones and zeros can mean something right so if you've got sixteen bits in the frame control field you could potentially represent 16 different things that can be either on or off yes or no up or down in or out in other words it's a binary toggle right or you could use two of the bits to represent something three of the bits to represent something and so forth well in the 802 dot 11 standard all of these individual fields are defined some of them it is just one bit that represents something it's a yes or no type thing and some of them it's multiple bits that represent something but you can look through the standard which is freely available for download at the I Triple E web site if you do a search for get 802 you'll find the project where you can download these standards and when you download them you can scroll through do a search for general frame format and you'll find the beginning of the frame discussions there and then you can go through and see what each bit represents many people are overwhelmed sometimes when they start looking at frames and they look at individual bits and they think how could I really be expected to understand all of these ones and zeros well you're not really expected to be able to look at say 16 ones and zeros in a row like the frame control field and just immediately in a glance look at it say okay I know everything about the frame control field you would instead as a human being look at a reference and see what the first bit represents and what the second bit represents what the third bit represents what it means if it's a one or a zero and so forth okay so you would actually look at them bit by bit to process it because we don't normally as humans speak the binary bit based language do we we're not computers a computer on the other hand can process them extremely rapidly and figure out what they mean what they represent and then do the appropriate thing so it's not hard to understand frames it's just time consuming okay because it's simple to know ok these bits mean one of these several things now it can get challenging when for example you might find out that a particular bit is telling you that something is being used like space-time block coding okay so it's saying yes we are using space time block coding and you think oh I don't even know what that is and then you've got to dig around in the standard or otherwise to find out what it means because sometimes the 802 dot 11 standard uses the technology and it simply points out that it's using that technology it doesn't always define the details of how it works it's assumed you would be able to find that elsewhere or it may reference another standard where you could find it and so the point is that it may seem like it's hard but it's actually just time consuming because you've got to dig up the information to get what you need that's why when we can we want to use a protocol analyzer that's 802 dot 11 intelligent it understands what these bits mean and then it represents them to us in a meaningful and useful way so we don't have to look at a bunch of ones and zeros and try to figure things out now one of the things that's obviously going to be added if you're familiar with frame analysis in 802 11 n is VHT capabilities information so the VHD capabilities info or just element it's called both things it's called the VHT capabilities information element and it's also called the VHT capabilities element within the standard mostly within graphics you'll see the word info or information and then within text you'll see capabilities element the concept is that this chunk of bits which as you can see here is 14 octet s'long 1 for the element ID 1 for the length 4 for the VHD capabilities info and then 8 for supported mcs data rate so the point is them that but this is going to tell us this chunk of information is important things like the maximum MPD you size the supported channel widths is it 20 40 80 160 are using a short guard interval there's a typo in the slide there it should be GI not GI you are using a short guard interval when you're dealing with 81 60 or 80 plus 80 channels or are you using the long guard interval in such case what about the single user beaming forming capabilities so this will communicate whether or not the station is capable of sending or receiving single user beamforming and multi-user beamforming all that's included in this and then the v h TTX op power save support whether that is going to be support or not it's a new Power Save feature in 802 the 11 AC that has been added this is part of what is included in the v HT capabilities information element now this is going to be in beacon frames and probe request and probe response frames for example so this is not necessarily something you're looking for in a data frame this is something you're looking for in frames that communicate to devices what the network is capable of so they can decide whether or not to participate in that network now in addition to the mac layer framing it's important to know as I said there is Phi layer framing and I'm not going to go into tremendous of detail about five framing today because it can get really complicated but let me give you the high-level overview of what's going on here first of all on the far right you see the data well the data as you can see is simply stated as being data and it says the data field carries the PSD you well the PSD U is the Phi service data unit now you've heard something similar to that already today you heard about the Mac service data unit right well the Phi service data unit is the MPD u that is received from the Mac layer for processing by the physical layer what processing does the physical layer do it adds the LS TF l LT f l cig vh TC gave h TS t FV h TL TF v HT sig b it adds those things that are prepended before the data in the graphic here and this graphic by the way comes right out of the 802 dot 11 AC standard you'll notice that this represents instead of octets it represents microseconds okay so it's telling you there's a short training field for eight microseconds a long training field for eight then there's a non HT signal field for four microseconds those first three fields are backward compatible all the way to eight oh two dot 11a which is all that matters in five gigahertz remember we don't care about 802 11 prime in five gigahertz the old frequency hopping spread spectrum and direct sequence spread spectrum they don't matter to us in five gigahertz because five gigahertz was first introduced with OFDM with a toe 2.11 a and then we had HT with 802 11 N and now v HT with 802 11 AC and eventually with 802 to 11 ax will have more so the point is that what we have to deal with for now is backward compatibility we need something to tell everybody listening on the medium there's a frame about to be transmitted and that's what the nan HT short and long training field and signal fields do they get that information out there the v HT signal a field is giving some specific information about this particular Phi communication it is something that only a v HT station would be able to fully understand properly the v HT short training field is a training field that again only v HT would understand as well as the long training field getting ready a leading up to the signal B field which is the one that's going to have some information about the length of the actual data to be delivered and then finally we get our data field now the data field does have prepended to it some some communications that are used in order to synchronize for convolution coding and things like that generally speaking it's just the PSD you it's the upper layer information that came from the mac layer and is now being sent by the filer so here's the thing with 802 11 n we had a legacy 5 framing format and then we had an HT fry it framing format with 11ac we just do away with that this is the 1:5 framing format that we use so that we're able to communicate backwardly as well as with the newer standards now again this is talking about when we're implementing this communicating with an intended frame for another 11ac device the question was what are the VHT training fields the same as the HT training fields and the answer is that they are not identical they are now specific for VHT you can get more information about the details on that in matthew ghasts book if you have a copy of that 802 dot 11ac a survival guide he does good in that if you don't want to go to the standard and have to read it there directly but there is information in the standard on that as well okay so now let's wrap up the webinar today to talk about well how do we get these frames because we really don't want to just look at a bunch of ones and zeros right well you can capture 802 11ac in a few ways come view for Wi-Fi Omni peak and Wi-Fi analyzer Pro can all capture 802 11 AC com view for Wi-Fi can do it with a USB adapter right now there are two by two 11 AC adapters that you can use and capture with Compu for Wi-Fi it works great and if you're just wanting to do it in the lab in order to see it and capture the frames and understand them then 2 by 2 is all you need the problem is in the real world we have those MacBook Pros out there we have other 3x3 devices like access points and so we need to be able to capture those well you can do that with AP capture which will work with comm view for Wi-Fi it also works with Omni Peak and Wi-Fi analyzer Pro so you can do ap capture for those now Wi-Fi analyzer Pro from air magnet does also offer a custom adapter that you can get it's actually an Express card adapter and so you would need a laptop with an Express card slot you know like an Allah No laptop or one of those because not too many of them have them anymore but you would need one with an Express card slot and then you can use that custom adapter which is a three by three by three 11 AC adapter so you'll be able to capture everything from three by three eleven AC all the way back to 11a so those are some ways you can use a MacBook Pro to do your captures and that'll allow you to capture three by three by three and of course you can just use ApS in other words you can capture on the AP and then you can just open your capture file for analysis and I've mentioned this ap in several webinars over the past year or so and it's the cisco w AP 371 it's inexpensive you can get it for under $300 u.s. if you search around a new egg in places like that usually i'm saying you can I haven't looked today to verify that it's still out there and available at that price but the cisco w AP 371 is an inexpensive mate for small business AP but it has built into it the ability to do protocol capture so you can capture the frames three by three by three and then analyze them now of course we're right on the cusp of seeing four by four aps in the enterprise with eleven AC and then we'll have to figure that out again but for now this is what we're looking at and then when it comes to analyzing it obviously we can use calm view for Wi-Fi omni peak Wi-Fi analyzer pro and you can also use Wireshark Wireshark does have decodes for 802 11 AC it's just hard to capture directly in Wireshark 411 AC there really haven't been any major updates to capturing within Wireshark itself since early 11 N and even with that we can do it in Linux so we can use Linux we can capture with 11n adapters we can look at it in Wireshark but even then there are some real challenges with some adapters to being able to capture 40 megahertz 11 n channels much less 11ac capture capability which were really not stee to seeing yet on the linux platform so that's gonna be something to watch for as it comes along but for now the momentum really is moving into the APS and doing the protocol capture there and when you need to capture from the client side you want to see what frames look at what like where the client is again you have the option of only having to buy to capture with calm view for Wi-Fi and a USB adapter getting an ExpressCard laptop so you can use Wi-Fi analyzer Pro with their Express card adapter or you can take your cisco whap 371 with you and your p OE switch you get a little mini POS which you can carry with you and go to the location plug it in and do your capture it's not pretty but it does get the job done and it will work to do capturing at the client location rather easily actually okay well that's what we wanted to cover today to give you an overview of the new features and capabilities and 11ac frames we'll begin to explore these more and more as we look at later webinars we're in the process of updating our CWAP curriculum right now and getting ready for a launch of a new version of that exam next year so you'll see more webinars coming giving it in more detail on these topics as we move along also a quick note before we open up for any questions you might have the Wi-Fi Trek conference is literally next week so it's coming up right around the corner now and we're going to be excited to be in San Francisco so if you haven't heard about it looked into it make sure you check out the website the URL listed here is CW MP comm slash 2015 national conference and it is not too late to attend you can even register at the conference and walk in and attend that is a possibility that you can do if you have questions contact customer care at CW n p comm if you have questions about the webinar today do feel free to type those in you can either just type them into chat and send it to all participants or you can type it into QA and I'll try to get to them there as well okay will the presentation be posted online yes we will be putting this on our youtube channel at CW NP TV so do a search for CW NP t viii on the YouTube channel and/or on YouTube and you will be able to find it there okay any other questions you might have feel free to go ahead and send those in I'll get them to you quickly as I can beacon frames have both HT info element and v HT info on 5 gigahertz question that is correct and so they do have both of those in the beacon frame to communicate HT capabilities because all 802 11 HC devices are automatically by default a toke still have an end capable as well so they will communicate the HT capabilities as well within the beacon frames that is correct okay give you a moment here if there are any other questions if you don't have questions and you need to run that feel free to go ahead and go now but while hang out for just another minute or two to see if there any other questions to come in and let me say thank you for attending for those of you that have been with us today okay I'm not seeing more questions coming in so at this point I'm going to go ahead and wrap up the webinar thank you very much for attending and again if you do ever have questions in the future you want to talk to somebody our forums are a great place to get involved you go to see w MP comm go to the forums there there are people that will help get your questions answered it's a great community to get support when you're trying to understand 802 dot eleven so make sure you take advantage of that and for those of you that will be at the conference I look forward to seeing you next week have a great day

Channel: CWNPTV

Views: 24,639

Rating: 4.9288888 out of 5

Keywords: cwnp, wifi, 802.11, wireless, wlan, frames, CWAP

Id: aeuf8wD1Wqs

Length: 32min 29sec (1949 seconds)

Published: Thu Sep 17 2015