A Look Into 802.11v

News

• The spread of COVID-19 is getting serious. We talked about its effects on Wi-Fi and on our jobs
• 2020 WLPC videos are available
• There will be a WLPC 2020 in Mexico in Spanish
• Wireless Update #2 is out on The Wi-Fi YouTube Channel
• Aruba announced a new technology called Aruba Air Pass designed to ease roaming between Wi-Fi and cellular connections

802.11v

From the standards:

Defines mechanisms and services for Wireless Network Management of STAs that include BSS transition management, channel usage and coexistence, collocated interference reporting, diagnostic, multicast diagnostic and event reporting, flexible multicast, efficient beacon mechanisms, proxy ARP advertisement, location, timing measurement, directed multicast, extended sleep modes, traffic filtering, and management notification. 

IEEE 802.11v or BSS Transition is an amendment that was published in 2011 and added to the IEEE 802.11-2012 standards. The objective of this amendment was to develop extensions to the 802.11 MAC/PHY to provide network management for STAs including:

• L2 management of attached stations
• Monitoring the attached stations
• Configuring the attached stations
• Updating the attached stations

Most of the time in the enterprise place, we use it to enhance roaming (BSS Transition).

While the IEEE 802.11k amendment defined messages to retrieve information from the station, the ability to configure the station was not in its scope. So the 802.11v amendment is complementary to the 802.11k amendment.

For example, with 802.11v, the AP can request a client to roam to a specific AP.

You can read it in full within the 802.11-2016 standard in section 11.24. The Action frame details are in section 9.6.14.1.

Procedures within 802.11v

• Event request and report
  • Enables the network to perform real-time diagnostics. 
  • Event field will be set to 1
  • Can keep track of transition events
  • RSNA events
  • Peer-to-peer link events
  • WNM log events
• Diagnostic request and report
  • Provides diagnostic and debugging of network issues
  • Diagnostics field set to 1
  • The report can contain an overall result of the transaction
  • Can include manufacturer information specific about an associated station
  • Can include association diagnostics, tests can be completed to a specific AP
  • Can include 802.1X authentication diagnostics to determine if station is able to complete 802.1X authentication with a designated BSS
• Location tracking 
  • Method to allow tracking of other station’s location using Location Indication Channels, Location Indication Interval and Location Indication Broadcast Data Rate sub-elements
  • Motion detection and Time of Departure reporting is optional
• Timing measurement
• Fine timing measurement
  • Allowing a station to determine its distance from another station.
• BSS Transition management for load balancing
  • Most common
  • Goal is for improved throughput, effective data rate and QoS for aggregate of stations in a network by transitioning individual station traffic loads to more appropriate access points within the ESS
  • It’s optional for station support
• FMS multicast rate processing
• QoS traffic capability
• AC Station Count
• TFS
• BSS max idle period
• Proxy ARP
• Channel usage
• Group addressed transmission service
• Wireless Network Management notification

BSS Transition Frames

Beacon

Within the beacon frame, you can identify 802.11v support from the BSSID. The Beacon Frame will contain an Extended Capabilities element

BSS Transition Management Query

A station supporting BSS transition may request a BSS Transition Candidate list by sending a BSS Transition Management Query to its associated AP.

There are a number of query reasons

A BSS Transition Candidate List Entries field will contain zero or more Neighbor Report elements. 

Contained in the Neighbor Report is a Candidate Preference list with a value of 1 and 255 to indicate the preferred BSS, with 255 indicating the most preferred candidate.

BSS Transition Management Request and Response

AP may send a BSS Transition Management Request frame to a station at any time, if the station supports it. 

The AP includes the BSS Transition Candidate List Entries within the BSS Transition Management Request frame in response to the BSS Transition Management Query frame. 

A BSS Transition Candidate List Entries field will contain zero or more Neighbor Report elements. 

Contained in the Neighbor Report is a Candidate Preference list with a value of 1 and 255 to indicate the preferred BSS, with 255 indicating the most preferred candidate.

A station can ignore the candidate list altogether. 

If the AP transmits a BSS Transition Management Request frame with the Disassociation Imminent field set to 1, the Disassociation Timer field in that Request frame will be set to 0 or set to the number of TBTTs that will occur prior to the AP disassociating the station. 

Depending on what the station receives from the AP within the BSS Termination field, it will send a BSS Transition Management Response frame with a status code.

The status code can be any of the following, but Status Code 0 is an Accept:

Wireshark Filters

• Find out if my SSID supports 802.11v: wlan.extcap.b19 == 1
• Find all Wireless Network Management frames: wlan.fixed.category_code == 10
• Find BSS Transition Management Query: wlan.fixed.action_code == 6
• Find BSS Transition Management Request: wlan.fixed.action_code == 7
• Find BSS Transition Management Response: wlan.fixed.action_code == 8

Cisco WLC Configuration for Testing

(Cisco Controller) >show advanced client-steering
Client Steering Configuration Information
  Macro to micro transition threshold............ -55 dBm
  micro to Macro transition threshold............ -65 dBm
  micro-Macro transition minimum client count.... 1
  micro-Macro transition client balancing win.... 1
  Probe suppression mode......................... probe-only
  Probe suppression validity window.............. 100 s
  Probe suppression aggregate window............. 200 ms
  Probe suppression transition aggressiveness.... 3
  Probe suppression hysteresis................... -3 dB
WLAN Configuration Information
  WLAN ID  WLAN Profile Name / SSID               11k Neighbor Report  11v BSS Transition
  -------  -------------------------------------  -------------------  ------------------
  3        Frame Thrower / Frame Thrower          Enabled              Enabled

Links & Ressources

• How to check if a Wi-Fi network supports 802.11v: https://www.semfionetworks.com/blog/wireshark-how-to-check-if-a-wi-fi-network-supports-80211v
• How to check if a client device supports 802.11v: https://www.semfionetworks.com/blog/how-to-check-if-a-client-device-supports-80211v
• BSS Transition Management from Mark Williams: http://giantsnerdwifi.blogspot.com/2016/11/cisco-11v-bss-transition-management_7.html
• CTS 206 on 802.11k: https://www.cleartosend.net/cts-206-a-look-into-802-11k/
• CTS 198 on 802.11r: https://www.cleartosend.net/fast-bss-transition-802-11r/
• Andrew McHale WLPC 2019: https://www.youtube.com/watch?v=4Ua2lI6HBhE
• 802.11v PCAP