March 2008 doc IEEE 802 11 080278 r

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Avoiding Interactions with Lazy-WDS Equipment Date: 2008 -03 -15 Submission Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Abstract Mesh multicast traffic will trigger unwanted responses on Access Points that implement Lazy. WDS. A frame format change is proposed that will avoid these interactions and make a more efficient use of the 802. 11 header address fields. Submission 2 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Background The origin of this problem is summarized in IEEE Std 802. 11 TM-2007: 3. 170 wireless distribution system (WDS): (. . . ) This standard describes such a frame format, but does not describe how such a mechanism or frame format would be used. The Wi-Fi Alliance is also silent about the use of the WDS frame format. Submission 3 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Background So vendors had to get creative. There are two ways APs use WDS frames: • Static WDS configuration – Network managers manually enter a list of WDS-peers • Dynamic WDS configuration (most commonly known as Lazy-WDS) – Access Points automatically "discover" WDS peers. Submission 4 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 What triggers automatic peer discovery? • We've empirically established that Lazy-WDS Access Points will assign WDS-peer status to any STA that transmits a multicast WDS frame (i. e if bit 8, 1 st octet of the Receiver Address is set). • Ah, and this is regardless of the value of the protected bit in the frame control header. Submission 5 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 The birth of a WDS-peer link Submission 6 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 How does that affect 802. 11 s? • Resolution 11 -07/799 r 6 established that mesh will use WDS frame format. This means that each MP in the vicinity of a Lazy-WDS AP will be treated as a WDS-peer. • There is a large deployed population of Lazy-WDS Access Points. . . being in the vicinity of one is not hard. Submission 7 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 So? Mesh Points in range of Lazy-WDS APs will cause two serious problems: spurious traffic and DDo. S attack on the AP. Submission 8 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Spurious Traffic • Lazy-APs will retransmit all multicast traffic in the BSS to each and every MP in range. • The AP does not consider the Mesh Sequence number to limit broadcast flooding. • N MPs in range -> Each multicast frame is retransmitted N times by the AP. Submission 9 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Spurious Traffic Submission 10 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Spurious Traffic Submission 11 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Distributed Denial of Service Attack • Apparently Lazy-WDS APs were designed to support only a small number of WDS peer links. • A large number of MPs near a Lazy-WDS AP will carry out a DDo. S attack on the Access Point. • Service to the BSS will be disrupted. Submission 12 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Distributed Denial of Service Attack Submission 13 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Because of these problems we propose. . . Submission 14 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Broadcast and Multicast Packet Transmission According to Draft 1. 09 • Broadcast mesh packets are transmitted using 4 address frame formats with Address 1 as either unicast or broadcast/multicast. • If Address 1 is unicast there is no issue. • However if Address 1 is broadcast then… Submission 15 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Broadcast and Multicast Packet Transmission According to Draft 1. 09 11 A. 5. 5. 3. 1 At Source MPs For non Proxied entries Address 1 = Broadcast or Multicast Address 2 = Source MP MAC address Address 3 = Broadcast or Multicast Address 4 = Source MP MAC Address 11 A. 5. 5. 3. 2 At Intermediate and destination MPs For non Proxied entries Address 1 = Broadcast or Multicast Address 2 = Intermediate MP MAC address Address 3 = Broadcast or Multicast Address 4 = Source MP MAC Address From Proxied entities Address 1 = Broadcast or Multicast Address 2 = Source MP MAC address Address 3 = Broadcast or Multicast Address 4 = Source MP MAC Address 5 = Broadcast or Multicast Address 6 = Address of Proxied entity From Proxied entities Address 1 = Broadcast or Multicast Address 2 = Intermediate MP MAC address Address 3 = Broadcast or Multicast Address 4 = Source MP MAC Address 5 = Broadcast or Multicast Address 6 = Address of Proxied entity Observations • A lot of redundant fields • Broadcast/multicast address repeated 2 times in non-proxied case • Broadcast/multicast address repeated 3 times in proxied case Submission 16 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Broadcast and Multicast Packet Transmission According to Draft 1. 09 Address 1 = Broadcast or Multicast Address 2 = MP 1 MAC Address 3 = Broadcast or Multicast Address 4 = MPs MAC Address SQ 1 Address 1 = Broadcast or Multicast Address 2 = MPs MAC Address 3 = Broadcast or Multicast Address 4 = MPs MAC Address SQ 1 Determines duplicate Packet based on <MPs, SQ 1> MP 1 MPs Address 1 = Broadcast or Multicast Address 2 = MPs MAC Address 3 = Broadcast or Multicast Address 4 = MPs MAC Address SQ 1 MP 3 MP 2 Submission 17 Address 1 = Broadcast or Multicast Address 2 = MP 2 MAC Address 3 = Broadcast or Multicast Address 4 = MPs MAC Address SQ 1 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Broadcast and Multicast Packet Transmission According to Draft 1. 09 Address 1 = Broadcast or Multicast Address 2 = MPi 1 MAC Address 3 = Broadcast or Multicast Address 4 = MPs 1 MAC Address 5 =Broadcast or Multicast Address 6=S Can’t determine duplicate SQ 1 packet, forwards packets Address 1 = Broadcast or Multicast Address 2 = MPs 1 MAC Address 3 = Broadcast or Multicast Address 4 = MPs 1 MAC Address 5 =Broadcast or Multicast Address 6=S SQ 1 MPi 1 MPs 1 Address 1 = Broadcast or Multicast Address 2 = MPs 2 MAC Address 3 = Broadcast or Multicast Address 4 = MPs 2 MAC Address 5 =Broadcast or Multicast Address 6=S SQ 2 S MP 3 MPi 2 MPs 2 Submission 18 Address 1 = Broadcast or Multicast Address 2 = MPi 2 MAC Address 3 = Broadcast or Multicast Address 4 = MPs 2 MAC Address 5 =Broadcast or Multicast Address 6=S SQ 2 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Broadcast and Multicast Packet Transmission Proposed Solution • Use 3 address formats for all non-proxied broadcast/multicast data frames • Use AE=01 to carry proxied entity in proxied broadcast/multicast frame • Addr 1, Addr 2, Addr 3 are TA, RA and SA respectively • From DS = 1, To DS = 0 • Addr 4 is proxied entity when AE=01 11 A. 5. 5. 3. 1 At Source MPs For non Proxied entries Address 1 = Broadcast or Multicast Address 2 = Source MP MAC address Address 3 = Source MP MAC Address 11 A. 5. 5. 3. 2 At Intermediate MPs For non Proxied entries Address 1 = Broadcast or Multicast Address 2 = Intermediate MP MAC address Address 3 = Source MP MAC Address From Proxied entities Address 1 = Broadcast or Multicast Address 2 = Source MP MAC address Address 3 = Source MP MAC address Address 4 = Address of Proxied entity From Proxied entities Address 1 = Broadcast or Multicast Address 2 = Intermediate MP MAC address Address 3 = Source MP MAC Address 4 = Address of Proxied entity Submission 19 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Broadcast and Multicast Packet Transmission Proposed Solution Address 1 = Broadcast or Multicast Address 2 = MP 1 MAC Address 3 = MPs MAC Address SQ 1 Address 1 = Broadcast or Multicast Address 2 = MPs MAC Address 3 = MPs MAC Address SQ 1 Determines duplicate Packet based on <MPs, SQ 1> MP 1 MPs Address 1 = Broadcast or Multicast Address 2 = MPs MAC Address 3 = MPs MAC Address SQ 1 MP 3 MP 2 Submission 20 Address 1 = Broadcast or Multicast Address 2 = MP 2 MAC Address 3 = MPs MAC Address SQ 1 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Broadcast and Multicast Packet Transmission According to Draft 1. 09 Addr 4 is proxied entity when AE=01 Address 1 = Broadcast or Multicast Address 2 = MPs 1 MAC Address 3 = MPs 1 MAC Address 4 = S SQ 1 Addr 4 is proxied entity when AE=01 Address 1 = Broadcast or Multicast Address 2 = MPi 1 MAC Address 3 = MPs 1 MAC Address 4 = S SQ 1 MPi 1 MPs 1 Use <S, SQ 1> to determine duplicate packets from the MPs Can’t determine duplicate packet from different MP MP 3 Addr 4 is proxied entity when AE=01 Address 1 = Broadcast or Multicast Address 2 = MPs 2 MAC Address 3 = MPs 2 MAC Address 4 = S MPi 2 SQ 2 S Addr 4 is proxied entity when AE=01 Address 1 = Broadcast or Multicast Address 2 = MPi 2 MAC Address 3 = MPs 2 MAC Address 4 = S SQ 2 MPs 2 Submission 21 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Changes Required 1. Modify 11. A. 5. 5. 3. 1 and 11. A. 5. 5. 3. 2 to describe transmission of 3 address broadcast and multicast data frames 2. Modify Table s 2 to allow AE=01 for broadcast/multicast data frames as well Submission 22 Javier Cardona et al.

March 2008 doc. : IEEE 802. 11 -08/0278 r 1 Straw Poll Would you support the proposed modifications to mesh broadcast frames as presented in this submission? 1) Yes Submission 2) No 23 3) DK/DC Javier Cardona et al.