Question

802.11 MAC Layer Operations ((Station Connectivity))

explain Probe process by its components with draw AND Authentication process by its components with draw AND Associationprocess by its components with draw

the explaining is for understand not for assignment so please not too match words

Answer 1

WiFi connections happen in a matter of microseconds. Within that small time frame, there are many frame exchanges occurring between a station and access point. Beacon frames are transmitted at an interval to allow passive or active scanning stations to join a particular WiFi network.

For a station to successfully join a WiFi network, a series of frame exchanges must occur which make up the Authentication and Association process, the 802.11 State Machine. The frames part of this transaction are as follows:

• Probe Request
• Probe Response
• Authentication Request
• Authentication Response
• Association Request
• Association Response

The sequence of frames exchanged are displayed in the graphic below:

Probe Request Probe Response Open system Authentication Request Open system Authentication Response Association Request Association Response

Authentication:-

In a station’s WiFi network discovery process, a Probe Request will be sent from the station to the BSSID listed in a Beacon frame the station received. This is the beginning of the 802.11 State Machine.

No. Source Date Rate Time 1 21:20:00.- Apple_e0:30:c@ Destination Broadcast Protocol 802.11 Length Channel Signal Strength 156 60 44 dBm Frame Type Probe Request 6.2 Frame 1: 156 bytes on wire (1248 bits), 156 bytes captured (1248 bits) Radiotap Header vo, Length 25 802.11 radio information IEEE 802.11 Probe Request, Flags : ........ IEEE 802.11 wireless LAN Tagged parameters (103 bytes) Tag: SSID parameter set: Wildcard SSID Tag: Supported Rates 6, 9, 12, 18, 24, 36, 48, 54, [Mbit/sec) Tag: HT Capabilities (802.11n 01.10) Tag: Extended Capabilities (4 octets) Tag: Interworking Tag: VHT Capabilities Tag: Vendor Specific: Apple, Inc. Tag: Vendor Specific: Microsoft Corp.: Unknown 8 Tag: Vendor Specific: Broadcom

fig: Sample Probe Request Frame

The access point responds with a Probe Response frame. After the station receives the Probe Response frame, it acknowledges the receipt of the frame with an Acknowledgement Frame.

Next, the station transmits an Authentication Request frame; this frame is also responded with an Acknowledgement Frame from the access point.

This is not a security authentication process that you’d see with role PSK or 802.1X. This authentication frame starts the Open System authentication for joining the WiFi network. Any security methods, such as 802.1X, will occur after the 802.11 state machine.

No. Destination Time 1 21:19:58.. Source ea: 55:2d:c6:75:e le: 04:18:eb:4c:9d Protocol 802.11 Length Channel Signal Strength 419 60 -39 dBm Frame Type Probe Response Data Rate 24.0 SSID Packet6-Guest Frame 1: 419 bytes on wire (3352 bits), 419 bytes captured (3352 bits) Radiotap Header va, Length 25 802.11 radio information IEEE 802.11 Probe Response, Flags: ........C IEEE 802.11 wireless LAN Fixed parameters (12 bytes) Timestamp: @x800093fe37875000 Beacon Interval: 0.102400 (Seconds] Capabilities Information: 8x 1511 Tagged parameters (354 bytes) Tag: SSID parameter set: Packet6-Guest Tag: Supported Rates 24(B), 36, 48, 54, [Mbit/sec) Tag: DS Parameter set: Current Channel: 60 Tag: Country Information: Country Code US, Environment Any Tag: Power Constraint: 3 Tag: RSN Information Tag: QBSS Load Element 882.lle CCA Version Tag: RM Enabled Capabilities (5 octets) Tag: AP Channel Report: Operating Class 5, Channel List : 36, 44, 48, 132, 153, 157, 161, 165, Tag: Mobility Domain Tag: HT Capabilities (802.11n 01.10) Tag: HT Information (802.11n 01.10) Tag: Extended Capabilities (8 octets) Tag: VHT Capabilities Tag: VHT Operation Tag: VHT TX Power Envelope Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element Tag: Vendor Specific: Atheros Communications, Inc.: Advanced Capability Tag: Vendor Specific: Cisco Meraki Tag: Vendor Specific: Cisco Systems, Inc.: Aironet CCX version = 5 Tag: Vendor Specific: Cisco Systems, Inc.: Aironet Client MFP Disabled Tag: Vendor Specific: Cisco Systems, Inc.: Aironet Unknown (11) (11) Tag: Cisco CCX1 СKIP + Device Nane

fig:-Sample Probe Response Frame

Open System authentication is a null authentication algorithm. Any station can request Open System authentication and be authenticated if the receiver has the authentication algorithm set to true, which is usually the case.

There are only two messages that are part of the Authentication frame transaction. The access point responds with an Authentication Response frame. If the response frame is “successful” then the station has been authenticated.

Association

Upon completion of successful Authentication frame exchanges, the station moves forward with associating. The station transmits an Association Request frame containing the station’s capabilities within fields and information elements of the frame.

Frame Type Data Rate Beacon 6. Probe Request 6. Probe Response 6.@ Authentication 6.0 Ach 6. Authentication 6 . Association Reque... 6.0 No. Time Source Destination Protocol Length Channel Signal Strength 1 21:08:11.. OpenMesh_21:98:90 Broadcast 802.11 191 36 -52 dBm 2 21:08:11... Apple 1b:4f:05 Broadcast 802.11 152 36 -29 dBm 3 21:08:11. OpenMesh_21:98:90 Apple_1b:4f:05 802.11 185 36 -52 dBm 4 21:08:11... Apple_1b:41:05 OpenMesh_21:98:90 802.11 70 36 -29 dBm 5 21:08:11 Apple_1b:4f:05 (08: 802.11 39 36 -52 dBm 6 21:08:11... OpenMesh_21:98:98 Apple_16:46:05 802.11 59 36 -52 dBm 7 21:08:11... Apple_1b:49:05 OpenMesh_21:98:90 802.11 160 36 -29 dBm ▸ Frame 7: 160 bytes on wire (1280 bits), 160 bytes captured (1280 bits) Radiotap Header ve, Length 25 802.11 radio information IEEE 802.11 Association Request, Flags: ........C IEEE 802.11 wireless LAN Fixed parameters (4 bytes) Capabilities Information: 8x0011 Listen Interval: @x0014 Tagged parameters (103 bytes) Tag: SSID parameter set: D-NET Tag: Supported Rates 6(B), 9, 12(B), 18, 24(B), 36, 48, 54, [Mbit/sec] Tag: Power Capability Min: 2, Max: -32 Tag: Supported Channels Tag: RSN Information Tag: HT Capabilities (802.11n 01.10) Tag: Vendor Specific: Broadcom Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Information Element

fig:- Sample Association Request Frame

When the access point receives the Association Request frame, it responds with an Acknowledgement Frame and transmits an Association Response frame with the result of successful or unsuccessful. The station must support the required parameters defined by the WiFi network. If successful, the station will be assigned an Association ID which can be identified within the Association Response frame.

-52 dBm Other Management Frame 6.0 9 21:08:11.- OpenMesh 21:98:90 Apple_16:4f:05 802.11 1 47 36 Frame 9: 147 bytes on wire (1176 bits), 147 bytes captured (1176 bits) Radiotap Header ve, Length 25 802.11 radio information IEEE 802.11 Association Response, Flags: ........ IEEE 802.11 wireless LAN Fixed parameters (6 bytes) Capabilities Information: 6x0811 Status code: Successful (x0000) ..00 0999 2000 2001 = Association ID: 0x0001 Tagged parameters (88 bytes) Tag: Supported Rates 6(B), 9, 12(B), 18, 24(B), 36, 48, 54, [Mbit/sec) Tag: HT Capabilities (802.11n 01.10) Tag: HT Information (802.11n 01.10) Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Parameter Element

fig:- Sample Association Response Frame

The station responds to the Association Response frame with an Acknowledgement Frame which completes the 802.11 State Machine.

At this point, if there is a PSK or 802.1X configured on the WiFi network, it would begin completing that process with the necessary frame exchanges.

When troubleshooting any WiFi network, knowing how stations and access points communicate with each other can be beneficial to the process. The type of frames exchanged can assist in troubleshooting issues such as bad PSKs or failed 802.1X authentication. The frames tell the exact story happening within 802.11 wireless.

If you want to see this with your own eye, you can use wireshark packet capture and apply the following filters to your wifi network interface:

Probe Request: wlan.fc.type_subtype == 0x0004
Probe Response: wlan.fc.type_subtype == 0x0005
Authentication frame: wlan.fc.type_subtype == 0x000b
Association Request: wlan.fc.type_subtype == 0x0000
Association Response: wlan.fc.type_subtype == 0x0001

1. Probe Delay: Messages A to E are the probe messages from an active scan. Consequently, we call the latency for this process, probe delay. The actual number of messages during the probe process may vary from 3 to 11.

2. Authentication Delay: This is the latency incurred during the exchange of the authentication frames (messages E and F ). Authentication consists of two or four consecutive frames depending on the authentication method used by the AP. Some wireless NICs try to initiate re-association prior to authentication, which introduces an additional delay in the hand-off process and is also a violation of the IEEE 802.11 state machine.

SDP Controller Dyna Cemetion Access Remote Devices SDP Gateway