Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017....

53
Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC Acknowledgment Frames Wei Wang , Qiang Wang, Wai Kay Leong, Ben Leong, and Yi Li School of Computing, National University of Singapore

Transcript of Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017....

Page 1: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC Acknowledgment Frames

Wei Wang, Qiang Wang, Wai Kay Leong, Ben Leong, and Yi Li

School of Computing, National University of Singapore

Page 2: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

RISING DEMAND FOR WIFI

Page 3: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

RISING DEMAND FOR WIFI

WiFi hotspot market:

Annual growth at 84%

WiFi

By the year of 2017

WiFi will make up 56% of total Internet traffic

Global WiFi Hotspot Market 2012-2016, by Research and Markets Cisco Visual Networking Index forecast, 2012-2017

Page 4: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

DENSE DEPLOYMENT OF ACCESS POINT

Page 5: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

AP DENSITY MEASUREMENT

War-walking

Page 6: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

Each 1-sec duration is considered as a “sample”

WAR-WALKING

Low speed: 1 m/sIdentify an AP based on BSSID in BeaconWiFi sniffer

Page 7: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

WAR-WALKING

Commercial area

University campus

Residential area

Page 8: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

AP DENSITY RESULTS

ScenariosMedian number of APs

Channel 1 Channel 6 Channel 11 OthersCommercial 6 6 9 < 1University 8 6 5 < 1Residential 9 15 10 < 4

Page 9: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

INTERFERENCE MITIGATION

Current approaches:

• Regulate the tx power of the MAC Data frames from AP

Our key observation:

• MAC Acknowledgment frames from clients could also cause serious interference to neighbor cells

Page 10: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

MAC ACK INTERFERENCE

MAC ACK frames effectively extend the interference range of a hotspot

AP1

C1

AP2C2

Page 11: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

MEASURE THE IMPACT OF ACK INTERFERENCE

AP1 AP2C1

C2

• Campus WLAN- Cisco AP (1140 series)

• Clients with Atheros adapters- 802.11a and 802.11n

Experiment Setup

Page 12: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPACT OF MAC ACK INTERFERENCE

11n vs. 11n, UDPAP1 AP2C1

C2

Page 13: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPACT OF MAC ACK INTERFERENCE

11n vs. 11n, UDPAP1 AP2C1

C2

Page 14: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPACT OF MAC ACK INTERFERENCE

11n vs. 11n, UDPAP1 AP2C1

C2

Page 15: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPACT OF MAC ACK INTERFERENCE

11n vs. 11n, UDPAP1 AP2C1

C2

Page 16: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPACT OF MAC ACK INTERFERENCE

11n vs. 11n, TCPAP1 C1

C2

Page 17: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPACT OF MAC ACK INTERFERENCE

11a vs. 11n, UDP

11a11n

AP1 AP2C1

C2

Page 18: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPACT OF MAC ACK INTERFERENCE

11a vs. 11n, UDP

11n11a

AP1 C1

C2

AP2

Page 19: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF ACK

DATA Sender

ACK Sender

Default ACK power

ACK power reduced too much!

Sender has to retx!

Page 20: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF ACK

Key ideaGradually reduce the power of ACK, until the point just before the success rate of ACK starts decreasing.

Called Minimum Power for ACK (MinPACK)

ChallengeHow can the ACK sender accurately estimate the success rate of ACK?

Page 21: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

ESTIMATION OF ACK SUCCESS RATE

DATA Sender

ACK Sender

Feedback-based method

1 ACK tx1 ACK rx

2 ACK tx

3 ACK tx2 ACK rx

Inform ACK sender 2/3 = 67%

Accurate, but need to modify DATA sender!

Page 22: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

ESTIMATION OF ACK SUCCESS RATE

DATA Sender

ACK Sender

Passive estimation method

1

2

1 ACK tx

2 ACK tx

23 ACK tx

2/3 = 67%

Not perfect due to retx limit, but good enough in practice

3

Prev ACK success

Prev ACK fail

Prev ACK success

Page 23: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

PASSIVE ESTIMATION FOR BLOCK ACK

Problem: DATA sender could send any frame that has not been acknowledged

Solution: ACK sender maintains a history of frames received

More details in the paper

Page 24: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

MINPACK PROTOCOL

200 ms

Time

ACK tx power

Initially at max power

Get the max ACK success rate Φmax

maxReduce if Φ > Φmax- δ

Periodically set to max power to get new Φmax

Revert to previous level otherwise

Repeat power adjustment

Page 25: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

EVALUATION OF MINPACK

Outline• Gain of MinPACK

- 11a vs. 11a in 20-node testbed- 11n vs. 11n in campus WLAN- 11a vs. 11n in campus WLAN

• Interaction with DATA power control

• Adaptation to client mobility

Page 26: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

GAIN OF MINPACK

• 20-node outdoor 802.11a testbed

• Arbitrarily select 38 pairs of competing links, with UDP traffic

Page 27: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

THROUGHPUT GAIN

Equal20% gain50% gain

Page 28: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

THROUGHPUT GAIN

• MinPACK does no harm

• Median gain is 31%

Page 29: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

THROUGHPUT GAIN

• MinPACK does no harm

• Median gain is 31%

• Passive method achieves

similar performance to

Feedback method

Page 30: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPROVEMENT OF FAIRNESS

Default ACK power

MinPACK

MinPACK achieves better fairness for this link pair

Page 31: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPROVEMENT OF FAIRNESS

MinPACK achieves better efficiency for this link pair

Page 32: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

IMPROVEMENT OF FAIRNESS

• Fairness is improved for most link pairs.

• Some link pairs have fairness and efficiency both improved.

Page 33: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Page 34: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power

Page 35: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power

Page 36: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power

Page 37: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power

Page 38: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power

Page 39: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power

Page 40: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power vs. MinPACK

Page 41: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power vs. MinPACK

Page 42: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power vs. MinPACK

Page 43: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power vs. MinPACK

Page 44: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power vs. MinPACK

Page 45: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

POWER CONTROL OF DATA FRAMES IS NOT SUFFICIENT

AP1 AP2C1

C2

Default ACK power vs. MinPACK

Page 46: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

MOBILITY

AP1C1 AP2

C2Default ACK power

High throughput for both C1 and C2

Low throughput for C2Low throughput for C1

60 m40 m

Page 47: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

MOBILITY

AP1C1 AP2

C2MinPACK

High throughput for both C1 and C2 Better fairness, slightly

higher total throughput

60 m

Default ACK power

40 m

Page 48: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

CONCLUSION

• MAC ACK interference is common and serious

• MinPACK

- Improve total throughput and/or fairness- Complementary to tx power control of DATA frames- Adaptive to mobility- Applicable to commercial hardware adapters

Page 49: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

THANK YOU!

Page 50: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

BACK-UP SLIDES

Page 51: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

DISTRIBUTION OF ACK POWER REDUCTION

ACK is small, sent at low rate, and protected by EIFS

Median 14 dB reduction

Max 28 dB reduction

Page 52: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

Number of ap for each channel or what? (make it clearer) How about other channels(ie. 2-5)?

Impact of mac ack interference: no need animation, add to next page at the corner, put 11/a and 11/n at the legend label, adjust color of the histogram, ‘how does ‘ to ‘how can’

Estimation of ack success rate: break up the animation, highlight the data sender is AP(hard to modify, put a pic here)

Passive estimation for block ack: ‘the extra’ to ‘solution’

Evaluation of minpack: make the point direct to audience

Throughput gain: make lines darker, add animation to make it clearer

Distribution of ack power reduction: font problem to be fixed, power reduction important? Consider removing this slide

Power control of data frames is not enough: make it more natural to audience, use more solid pattern(hart to see), no need to say words at every step

Mobility: prepare for the doubt of c1 performance decrease, draw the location of c2 in the graph, draw the total throughput(prev vs. now)

Page 53: Uncovering a Hidden Wireless Menace: Interference from 802.11x …bleong/slides/secon14... · 2017. 10. 22. · Uncovering a Hidden Wireless Menace: Interference from 802.11x MAC

AP1 AP2C1

C2