Introduction --

WLANs are typically restricted in their diameter to buildings, a campus, single

rooms etc. and are operated by individuals, not by large-scale network
providers. The global goal of WLANs is to replace office cabling, to enable
tetherless access to the internet and, to introduce a higher flexibility for ad-hoc
communication in, e.g., group meetings.
Characteristics of wireless LANs

Advantages --
- very flexible within the transmission area
- ad-hoc networks without previous planning possible
- (almost) no wiring difficulties (e.g. historic buildings, firewalls)
- more robust against disasters like, e.g., earthquakes, fires
- or users pulling a plug...

Disadvantages--
- typically lower user data rates/higher delays and delay jitter compared
to wired networks due to shared medium, lots of interference (it depends
on your neighbors!)
- different/proprietary solutions, especially for higher bit-rates or low-
power, standards take their time, devices have to fall back to
older/standard solutions
- products have to follow many national restrictions if working wireless,
it takes longer time to establish global solutions
- Safety and security: Using radio waves for data transmission might
interfere with other high-tech equipment in, e.g., hospitals.
Design goals for wireless LANs

• global, seamless operation

• low power for battery use
• no special permissions or licenses needed to use the
LAN
• robust transmission technology
• easy to use for everyone, simple management
• protection of investment in wired networks
• security (no one should be able to read my data),
privacy (no one should be able to collect user profiles),
safety (low radiation)
• transparency concerning applications and higher layer
protocols, but also location awareness if necessary
The IEEE standard 802.11 (IEEE, 1999) specifies the most
famous family of WLANs in which many products are available. As
the standard‟s number indicates, this standard belongs to the
group of 802.x LAN standards, e.g., 802.3 Ethernet or 802.5
Token Ring. This means that the standard specifies the
physical and medium access layer adapted to the special
requirements of wireless LANs, but offers the same interface as
the others to higher layers to maintain interoperability.
802.11 – Classical system architecture of an infrastructure network

Station (STA)
- terminal with access mechanisms
to the wireless medium and radio
contact to the access point
Basic Service Set (BSS) - group of
stations using the same radio
frequency
Access Point - station integrated
into the wireless LAN and the
distribution system
Portal - bridge to other (wired)
networks
Distribution System -
interconnection network to form one
logical network
(EES: Extended Service Set)
based on several BSS
Figure shows the components of an infrastructure and a wireless part as
specified for IEEE 802.11. Several nodes, called stations (STAi), are
connected to access points (AP). Stations are terminals with access
mechanisms to the wireless medium and radio contact to the AP. The stations
and the AP which are within the same radio coverage form a basic service set
(BSSi). The example shows two BSSs – BSS1 and BSS2 – which are
connected via a distribution system.
A distribution system connects several BSSs via the AP to form a
single network and thereby extends the wireless coverage area. This
network is now called an extended service set (ESS) and has its
own identifier, the ESSID. The ESSID is the „name‟ of a network and
is used to separate different networks. Without knowing the ESSID
(and assuming no hacking) it should not be possible to participate in
the WLAN. The distribution system connects the wireless networks
via the APs with a portal, which forms the interworking unit to other
LANs.
802.11 - Architecture of an ad-hoc network

Direct communication within a

limited range

- Station (STA):
terminal with access
mechanisms to the wireless
medium
- Independent Basic Service Set
(IBSS):
group of stations using the same
radio frequency
In addition to infrastructure-based networks, IEEE 802.11 allows the
building of ad-hoc networks between stations, thus forming one or
more independent BSSs (IBSS) as shown in Figure . In this case, an
IBSS comprises a group of stations using the same radio frequency.
Stations STA1, STA2, and STA3 are in IBSS1, STA4 and STA5 in
IBSS2. This means for example that STA3 can communicate directly
with STA2 but not with STA5. Several IBSSs can either be formed via
the distance between the IBSSs or by using different carrier
frequencies (then the IBSSs could overlap physically). IEEE 802.11
does not specify any special nodes that support routing, forwarding of
data or exchange of topology information as, e.g., HIPERLAN 1 or
Bluetooth.
IEEE standard 802.11 Protocol architecture

As indicated by the standard number, IEEE 802.11 fits seamlessly into the other
802.x standards for wired LANs. Figure shows the most common scenario: an
IEEE 802.11 wireless LAN connected to a switched IEEE 802.3 Ethernet via a
bridge. Applications should not notice any difference apart from the lower
bandwidth and perhaps higher access time from the wireless LAN. The WLAN
behaves like a slow wired LAN. Consequently, the higher layers (application, TCP,
IP) look the same for wireless nodes as for wired nodes. The upper part of the data
link control layer, the logical link control (LLC), covers the differences of the medium
access control layers needed for the different media.
802.11 - Layers and functions

MAC PHY

- access mechanisms, - clear channel

fragmentation, encryption assessment (carrier
MAC Management sense)
- synchronization, roaming, - modulation, coding
MIB, power management PHY Management
- channel selection, MIB
Station Management
- coordination of all
management functions
802.11 - Physical layer

3 versions: 2 radio (typ. 2.4 GHz), 1 IR

- data rates 1 or 2 Mbit/s
FHSS (Frequency Hopping Spread Spectrum) – obsolete
- spreading, despreading, signal strength, typ. 1 Mbit/s
- min. 2.5 frequency hops/s (USA), two-level GFSK modulation
DSSS (Direct Sequence Spread Spectrum)
- – many products
- - DBPSK modulation for 1 Mbit/s (Differential Binary Phase Shift
Keying), DQPSK for 2 Mbit/s (Differential Quadrature PSK)
- - preamble and header of a frame is always transmitted with 1
Mbit/s, rest of transmission 1 or 2 Mbit/s
- - chipping sequence: +1, -1, +1, +1, -1, +1, +1, +1, -1, -1, -1 (Barker
code)
- - max. radiated power 1 W (USA), 100 mW (EU), min. 1mW
Infrared - obsolete - 850-950 nm, diffuse light, typ. 10 m range
- - carrier detection, energy detection, synchronization
Frequency hopping spread spectrum-
Frequency hopping spread spectrum (FHSS) is a spread
spectrum technique which allows for the coexistence of multiple
networks in the same area by separating different networks using
different hopping sequences. The original standard defines 79
hopping channels for North America and Europe, and 23 hopping
channels for Japan (each with a bandwidth of 1 MHz in the 2.4
GHz ISM band). The selection of a particular channel is achieved
by using a pseudo-random hopping pattern. National restrictions
also determine further parameters, e.g., maximum transmit power
is 1 W in the US, 100 mW EIRP (equivalent isotropic radiated
power) in Europe and 10 mW/MHz in Japan. The standard
specifies Gaussian shaped FSK (frequency shift keying), GFSK,
as modulation for the FHSS PHY. For 1 Mbit/s a 2 level GFSK is
used (i.e., 1 bit is mapped to one frequency,), a 4 level GFSK for 2
Mbit/s (i.e., 2 bits are mapped to one frequency). While sending
and receiving at 1 Mbit/s is mandatory for all devices, operation at
2 Mbit/s is optional..
Figure shows a frame of the physical layer used with FHSS. The
frame consists of two basic parts, the PLCP part (preamble and
header) and the payload part. While the PLCP part is always
transmitted at 1 Mbit/s, payload, i.e MAC data, can use 1 or 2
Mbit/s.

● Synchronization: The PLCP preamble starts with 80 bit

synchronization, which is a 010101... bit pattern. This pattern is
used for synchronization of potential receivers and signal
detection by the CCA ( Clear channel assessment ).
● Start frame delimiter (SFD): The following 16 bits indicate the
start of the frame and provide frame synchronization. The SFD
pattern is 0000110010111101.
● PLCP_PDU length word (PLW): This first field of the PLCP
header indicates the length of the payload in bytes including the
32 bit CRC at the end of the payload. PLW can range between 0
and 4,095.
● PLCP signalling field (PSF): This 4 bit field indicates the data
rate of the payload following. All bits set to zero (0000) indicates
the lowest data rate of 1 Mbit/s. The granularity is 500 kbit/s, thus
2 Mbit/s is indicated by 0010 and the maximum is 8.5 Mbit/s
(1111). This system obviously does not accommodate today‟s
higher data rates.
● Header error check (HEC): Finally, the PLCP header is
protected by a 16 bit checksum with the standard ITU-T generator
polynomial G(x) = x16 + x12 + x5 + 1.
Direct sequence spread spectrum-

Direct sequence spread spectrum (DSSS) is the alternative

spread spectrum method separating by code and not by
frequency.
In the case of IEEE 802.11 DSSS, spreading is achieved
using the 11-chip Barker sequence (+1, –1, +1, +1, –1, +1, +1,
+1, –1, –1, –1). The key characteristics of this method are its
robustness against interference and its insensitivity to
multipath propagation (time delay spread). However, the
implementation is more complex compared to FHSS.
IEEE 802.11 DSSS PHY also uses the 2.4 GHz ISM band and
offers both 1 and 2 Mbit/s data rates.
The system uses differential binary phase shift keying (DBPSK)
for 1 Mbit/s transmission and differential quadrature phase shift
keying (DQPSK) for 2 Mbit/s as modulation schemes. Again, the
maximum transmit power is 1 W in the US, 100 mW EIRP in
Europe and 10 mW/MHz in Japan. The symbol rate is
1 MHz, resulting in a chipping rate of 11 MHz. All bits transmitted
by the DSSS PHY are scrambled with the polynomial s(z) = z7 +
z4 + 1 for DC blocking and whitening of the spectrum. Many of
today‟s products offering 11 Mbit/s according to 802.11b are still
backward compatible to these lower data rates.
Figure shows a frame of the physical layer using DSSS. The
frame consists of two basic parts, the PLCP part (preamble and
header) and the payload part. While the PLCP part is always
transmitted at 1 Mbit/s, payload, i.e., MAC data, can use 1 or 2
Mbit/s.

● Synchronization: The first 128 bits are not only used for
synchronization, but also gain setting, energy detection and
frequency offset compensation.
● Start frame delimiter (SFD): This 16 bit field is used for
synchronization at the beginning of a frame and consists of the
pattern 1111001110100000.
● Signal: Originally, only two values have been defined for this
field to indicate the data rate of the payload. The value 0x0A
indicates 1 Mbit/s (and thus DBPSK), 0x14 indicates 2 Mbit/s
(and thus DQPSK). Other values have been reserved for future
use, i.e., higher bit rates.
● Service: This field is reserved for future use; however, 0x00
indicates an IEEE 802.11 compliant frame.
● Length: 16 bits are used in this case for length indication of the
payload in microseconds.
● Header error check (HEC): Signal, service, and length fields
are protected by this checksum using the ITU-T CRC-16 standard
polynomial.
Infra red
The PHY layer, which is based on infra red (IR) transmission, uses
near visible light at 850–950 nm. Infra red light is not regulated
apart from safety restrictions (using lasers instead of LEDs). The
standard does not require a line-of-sight between sender and
receiver, but should also work with diffuse light. This allows for
point-to-multipoint communication. The maximum range is about
10 m if no sunlight or heat sources interfere with the transmission.
Typically, such a network will only work in buildings, e.g.,
classrooms, meeting rooms etc.
Frequency reuse is very simple – a wall is more than enough to
shield one IR based IEEE 802.11 network from another.
Today, no products are available that offer infra red
communication based on 802.11. Proprietary products offer, e.g.,
up to 4 Mbit/s using diffuse infra red light
 Medium access control layer
The MAC layer has to fulfill several tasks. First of all, it has to
control medium access, but it can also offer support for
roaming, authentication, and power conservation. The
basic services provided by the MAC layer are the mandatory
asynchronous data service and an optional time-bounded
service. While 802.11 only offers the asynchronous service
in ad-hoc network mode, both service types can be offered
using an infrastructure-based network together with the
access point coordinating medium access.

The asynchronous service supports broadcast and multi-cast

packets, and packet exchange is based on a „best effort‟
model, i.e., no delay bounds can be given for transmission.
Medium access control layer architecture -
Distributed Coordination Function (DCF)

Fundamental access method in 802.11, mandatory

Also known as CSMA/CA (Carrier Sense Multiple Access with
Collision Avoidance) Random backoff, certain fairness, refinement
with RTS/CTS possible.
Point Coordination Function (not really used, will be kicked out of
the standard in the future)
Contention free access, reservation of the medium

Hybrid Coordination Function (HCF)

QoS support by combining DCF and PCF

Contention-based channel access (Enhanced Distributed Channel
Access, EDCA) and controlled channel access (HCF Controlled
Channel Access, HCCA)
Support of different priorities for, e.g., background, best effort,
video, voice traffic (WiFiWMM Designations)
802.11 -MAC Inter Frame Space
Priorities of packets defined through different inter frame spaces
(not always guaranteed)
RIFS (Reduced IFS)shortest IFS, reduced overhead, only if no
SIFS expected, for higher throughput
SIFS(Short IFS)for ACK, CTS, polling response
PIFS (PCF IFS)used to gain priority access.
DIFS(DCF IFS)for “normal” asynchronous data service
AIFS (Arbitration IFS)variable depending on QoS
EIFS (Extended IFS)IFS e.g. after an incorrect FCS.
802.11 -CSMA/CA access method I
station ready to send starts sensing the medium (Carrier Sense
based on CCA, Clear Channel Assessment)
if the medium is free for the duration of an Inter-Frame Space
(IFS), the station can start sending (IFS depends on service type)
if the medium is busy, the station has to wait for a free IFS, then
the station must additionally wait a random back-off time (collision
avoidance, multiple of slot-time)
if another station occupies the medium during the back-off time of
the station, the back-off timer stops (fairness)
The mandatory access mechanism of IEEE 802.11 is based on
carrier sense multiple access with collision avoidance
(CSMA/CA), which is a random access scheme with carrier sense
and collision avoidance through random backoff. The basic
CSMA/CA mechanism is shown in Figure. If the medium is idle for
at least the duration of DIFS (with the help of the CCA signal of
the physical layer), a node can access the medium at once. This
allows for short access delay under light load. But as more and
more nodes try to access the medium, additional mechanisms are
needed.
If the medium is busy, nodes have to wait for the duration of DIFS,
entering a contention phase afterwards. Each node now chooses a
random backoff time within a contention window and delays
medium access for this random amount of time. The node continues
to sense the medium. As soon as a node senses the channel is
busy, it has lost this cycle and has to wait for the next chance, i.e.,
until the medium is idle again for at least DIFS. But if the randomized
additional waiting time for a node is over and the medium is still idle,
the node can access the medium immediately. The additional
waiting time is measured in multiples of the above-mentioned slots.
This additional randomly distributed delay helps to avoid collisions –
otherwise all stations would try to transmit data after waiting for the
medium becoming idle again plus DIFS.
802.11 -Competing stations -simple version

Figure explains the basic access mechanism of IEEE 802.11 for five
stations trying to send a packet at the marked points in time. Station3
has the first request from a higher layer to send a packet (packet arrival
at the MAC SAP). The station senses the medium, waits for DIFS and
accesses the medium, i.e., sends the packet. Station1, station2, and
station5 have to wait at least until the medium is idle for DIFS again
after station3 has stopped sending. Now all three stations choose a
backoff time within the contention window and start counting
down their backoff timers.
802.11 -Competing stations -simple version

Figure shows the random backoff time of station1 as sum of boe (the
elapsed backoff time) and bor (the residual backoff time). The same is
shown for station5. Station2 has a total backoff time of only boe and
gets access to the medium first. No residual backoff time for station2 is
shown. The backoff timers of station1 and station5 stop, and the
stations store their residual backoff times. While a new station has to
choose its backoff time from the whole contention window, the two old
stations have statistically smaller backoff values. The older values are
on average lower than the new ones.
802.11 -Competing stations -simple version

Now station4 wants to send a packet as well, so after DIFS waiting time,
three stations try to get access. It can now happen, as shown in the
figure, that two stations accidentally have the same backoff time, no
matter whether remaining or newly chosen. This results in a collision on
the medium as shown, i.e., the transmitted frames are destroyed.
Station1 stores its residual backoff time again. In the last cycle shown
station1 finally gets access to the medium, while station4 and station5
have to wait. A collision triggers a retransmission with a new random
selection of the backoff time. Retransmissions are not privileged.
The contention window starts with a size of, e.g., CWmin = 7.
Each time a collision occurs, indicating a higher load on the
medium, the contention window doubles up to a maximum of, e.g.,
CWmax = 255 (the window can take on the values 7, 15, 31, 63,
127, and 255). The larger the contention window is, the greater is
the resolution power of the randomized scheme. It is less likely to
choose the same random backoff time using a large CW.
However, under a light load, a small CW ensures shorter access
delays. This algorithm is also called exponential backoff and is
already familiar from IEEE 802.3 CSMA/CD in a similar version.
802.11 -CSMA/CA access method II
Sending unicast packets
station has to wait for DIFS before sending data
receivers acknowledge at once (after waiting for SIFS) if the
packet was received correctly (FCS)
automatic retransmission of data packets in case of transmission
errors, but exponential increase of contention window
802.11 –DCF with RTS/CTS
Sending unicast packets -
station can send RTS with reservation parameter after waiting for
DIFS (reservation determines amount of time the data packet
needs the medium) acknowledgement via CTS after SIFS by
receiver (if ready to receive) sender can now send data at once,
acknowledgement via ACK other stations store medium
reservations distributed via RTS and CTS using NAV (Network
allocation vector.)
Fragmentation
MAC Frame format
Types
control frames, management frames, data frames
Sequence numbers
important against duplicated frames due to lost ACKs
Addresses
receiver, transmitter (physical), BSS identifier, sender (logical
Miscellaneous
sending time, checksum, frame control, data
802.11 –MAC Frame format

● Frame control: The first 2 bytes serve several purposes. They

contain several sub-fields as explained after the MAC frame.
● Duration/ID: If the field value is less than 32,768, the duration
field contains the value indicating the period of time in which the
medium is occupied (in μs). This field is used for setting the NAV
for the virtual reservation mechanism using RTS/CTS and during
fragmentation.
● Address 1 to 4: The four address fields contain standard IEEE
802 MAC addresses (48 bit each), as they are known from other
802.x LANs. The meaning of each address depends on the DS
bits in the frame control field and is explained in more detail in a
separate paragraph.
● Sequence control: Due to the acknowledgement mechanism
frames may be duplicated. Therefore a sequence number is
used to filter duplicates.
● Data: The MAC frame may contain arbitrary data (max. 2,312
byte), which is transferred transparently from a sender to the
receiver(s).
● Checksum (CRC): Finally, a 32 bit checksum is used to
protect the frame as it is common practice in all 802.x networks.
The frame control field shown in Figure contains the following fields:
● Protocol version: This 2 bit field indicates the current protocol
version and is fixed to 0 by now. If major revisions to the standard
make it incompatible with the current version, this value will be
increased.
● Type: The type field determines the function of a frame:
management (=00), control (=01), or data (=10). The value 11 is
reserved. Each type has several subtypes as indicated in the
following field.
● Subtype: Example subtypes for management frames are: 0000 for
association request, 1000 for beacon. RTS is a control frame with
subtype 1011, CTS is coded as 1100. User data is transmitted as
data frame with subtype 0000.
● To DS/From DS: Explained in the following in more detail.
● More fragments: This field is set to 1 in all data or
management frames that have another fragment of the current
MSDU to follow.
● Retry: If the current frame is a retransmission of an earlier
frame, this bit is set to 1. With the help of this bit it may be simpler
for receivers to eliminate duplicate frames.
● Power management: This field indicates the mode of a station
after successful transmission of a frame. Set to 1 the field
indicates that the station goes into power-save mode. If the field
is set to 0, the station stays active.
● More data: In general, this field is used to indicate a receiver that a
sender has more data to send than the current frame. This can be
used by an access point to indicate to a station in power-save mode
that more packets are buffered. Or it can be used by a station to
indicate to an access point after being polled that more polling is
necessary as the station has more data ready to transmit.
● Wired equivalent privacy (WEP): This field indicates that the
standard security mechanism of 802.11 is applied. However, due to
many weaknesses found in the WEP algorithm higher layer security
should be used to secure an 802.11 network.
● Order: If this bit is set to 1 the received frames must be processed
in strict order.
MAC address format (examples)
Special Frames: ACK, RTS, CTS

Acknowledgement

Request To Send

Clear To Send
MAC management
MAC management plays a central role in an IEEE 802.11 station as it
more or less controls all functions related to system integration, i.e.,
integration of a wireless station into a BSS, formation of an ESS,
synchronization of stations etc. The following functional groups have
been identified and will be discussed in more detail in the following
sections:
● Synchronization: Functions to support finding a wireless LAN,
synchronization of internal clocks, generation of beacon signals.
● Power management: Functions to control transmitter activity for
power conservation, e.g., periodic sleep,without missing a frame.
● Roaming: Functions for joining a network (association), changing
access points, scanning for access points.
● Management information base (MIB): All parameters
representing the current state of a wireless station and an access
point are stored within a MIB for internal and external access. A MIB
can be accessed via standardized protocols such as the simple
network management protocol (SNMP).
Synchronization-
Each node of an 802.11 network maintains an internal clock. To
synchronize the clocks of all nodes, IEEE 802.11 specifies a
timing synchronization function (TSF). As we will see in the
following section, synchronized clocks are needed for power
management, but also for coordination of the PCF and for
synchronization of the hopping sequence in an FHSS system.
Using PCF, the local timer of a node can predict the start of a
super frame, i.e., the contention free and contention period. FHSS
physical layers need the same hopping sequences so that all
nodes can communicate within a BSS.
Within a BSS, timing is conveyed by the periodic transmissions of
a beacon frame. A beacon contains a timestamp and other
management information used for power management and
roaming (e.g., identification of the BSS). The timestamp is used by
a node to adjust its local clock. The node is not required to hear
every beacon to stay synchronized; however, from time to time
internal clocks should be adjusted. The transmission of a beacon
frame is not always periodic because the beacon frame is also
deferred if the medium is busy.
Beacon transmission in a busy 802.11 infrastructure network

Within infrastructure-based networks, the access point performs

synchronization by transmitting the periodic beacon signal, whereas
all other wireless nodes adjust their local timer to the time stamp.
This represents the simple case shown in Figure. The access point is
not always able to send its beacon B periodically if the medium is
busy. However, the access point always tries to schedule
transmissions according to the expected beacon interval (target
beacon transmission time), i.e., beacon intervals are not shifted if
one beacon is delayed. The timestamp of a beacon always reflects
the real transmit time, not the scheduled time.
Beacon transmission in a busy 802.11 ad-hoc network

For ad-hoc networks, the situation is slightly more complicated as they

do not have an access point for beacon transmission. In this case, each
node maintains its own synchronization timer and starts the transmission
of a beacon frame after the beacon interval. Figure shows an example
where multiple stations try to send their beacon. However, the standard
random backoff algorithm is also applied to the beacon frames so only
one beacon wins. All other stations now adjust their internal clocks
according to the received beacon and suppress their beacons for this
cycle. If collision occurs, the beacon is lost. In this scenario, the beacon
intervals can be shifted slightly because all clocks may vary as may the
start of a beacon interval from a node‟s point of view. However, after
successful synchronization all nodes again have the same consistent
view.
Power management
Idea: switch the transceiver off if not needed
States of a station: sleep and awake
Timing Synchronization Function (TSF)
stations wake up at the same time
Infrastructure
-Traffic Indication Map (TIM)
-list of unicast receivers transmitted by AP
-Delivery Traffic Indication Map (DTIM)
- list of broadcast/multicast receivers --transmitted by AP
Ad-hoc
-Ad-hoc Traffic Indication Map (ATIM)announcement of receivers
by
-stations buffering frames
-more complicated -no central AP
-collision of ATIMs possible.
APSD (Automatic Power Save Delivery)
more efficient method in 802.11e replacing above schemes offering
scheduled (S-APSD) and unscheduled service periods (U-APSD)
Wireless devices are battery powered (unless a solar panel is
used). Therefore, power-saving mechanisms are crucial for the
commercial success of such devices. Standard LAN protocols
assume that stations are always ready to receive data, although
receivers are idle most of the time in lightly loaded networks.
However, this permanent readiness of the receiving module is
critical for battery life as the receiver current may be up to 100 mA
.
The basic idea of IEEE 802.11 power management is to switch off
the transceiver whenever it is not needed. For the sending device
this is simple to achieve as the transfer is triggered by the device
itself. However, since the power management of a receiver cannot
know in advance when the transceiver has to be active for a
specific packet, it has to „wake up‟ the transceiver periodically.
Switching off the transceiver should be transparent to existing
protocols and should be flexible enough to support different
applications. However, throughput can be traded-off for battery
life.
Longer off-periods save battery life but reduce average throughput
and vice versa. The basic idea of power saving includes two
states for a station: sleep and awake, and buffering of data in
senders. If a sender intends to communicate with a power-saving
station it has to buffer data if the station is asleep. The sleeping
station on the other hand has to wake up periodically and stay
awake for a certain time. During this time, all senders can
announce the destinations of their buffered data frames. If a
station detects that it is a destination of a buffered packet it has to
stay awake until the transmission takes place. Waking up at the
right moment requires the timing synchronization function
(TSF) . All stations have to wake up or be awake at the same time
Power management in infrastructure-based networks is much
simpler compared to ad-hoc networks. The access point buffers
all frames destined for stations operating in power-save mode.
With every beacon sent by the access point, a traffic indication
map (TIM) is transmitted. The TIM contains a list of stations for
which unicast data frames are buffered in the access point. The
TSF assures that the sleeping stations will wake up periodically
and listen to the beacon and TIM. If the TIM indicates a unicast
frame buffered for the station, the station stays awake for
transmission. For multi-cast/broadcast transmission, stations will
always stay awake. Another reason for waking up is a frame
which has to be transmitted from the station to the access point. A
sleeping station still has the TSF timer running.
Power saving with wake-up patterns (infrastructure)

Figure shows an example with an access point and one station.

The state of the medium is indicated. Again, the access point
transmits a beacon frame each beacon interval. This interval is
now the same as the TIM interval. Additionally, the access point
maintains a delivery traffic indication map (DTIM) interval for
sending broadcast/multicast frames. The DTIM interval is
always a multiple of the TIM interval.
Power saving with wake-up patterns (infrastructure)

All stations (in the example, only one is shown) wake up prior to
an expected TIM or DTIM. In the first case, the access point has to
transmit a broadcast frame and the station stays awake to receive
it. After receiving the broadcast frame, the station returns to
sleeping mode. The station wakes up again just before the next
TIM transmission. This time the TIM is delayed due to a busy
medium so, the station stays awake. The access point has nothing
to send and the station goes back to sleep.
Power saving with wake-up patterns (infrastructure)

At the next TIM interval, the access point indicates that the station
is the destination for a buffered frame. The station answers with a
PS (power saving) poll and stays awake to receive data. The
access point then transmits the data for the station, the station
acknowledges the receipt and may also send some data (as
shown in the example). This is acknowledged by the access point
(acknowledgments are not shown in the figure). Afterwards, the
station switches to sleep mode again.
Power saving with wake-up patterns (infrastructure)

Finally, the access point has more broadcast data to send at the
next DTIM interval, which is again deferred by a busy medium.
Depending on internal thresholds, a station may stay awake if the
sleeping period would be too short. This mechanism clearly shows
the trade-off between short delays in station access and saving
battery power. The shorter the TIM interval, the shorter the
delay, but the lower the power-saving effect.
U-APSD –WMM Power Save
Procedure for unicast data delivered to a STA in PS mode
STA triggers release of buffered data from AP
WMM Power Save based on legacy procedures plus optional U-
APSD
Advantages:
No more polling needed
Downlink data frames sent together in a fast sequence
Trigger frame may already contain data –ideal e.g. for VoIP
Applications specify PS behavior, i.e. sleep period
Power management in IEEE 802.11 ad-hoc networks

In ad-hoc networks, power management is much more complicated

than in infrastructure networks. In this case, there is no access point
to buffer data in one location but each station needs the ability to
buffer data if it wants to communicate with a power-saving station. All
stations now announce a list of buffered frames during a period when
they are all awake. Destinations are announced using ad-hoc traffic
indication map (ATIMs) – the announcement period is called the
ATIM window. Figure shows a simple ad-hoc network with two
stations. Again, the beacon interval is determined by a distributed
function (different stations may send the beacon).
Power management in IEEE 802.11 ad-hoc networks

However, due to this synchronization, all stations within the

ad-hoc network wake up at the same time. All stations stay awake for
the ATIM interval as shown in the first two steps and go to sleep
again if no frame is buffered for them. In the third step, station1 has
data buffered for station2. This is indicated in an ATIM transmitted by
station1. Station2 acknowledges this ATIM and stays awake for the
transmission. After the ATIM window, station1 can transmit the data
frame, and station2 acknowledges its receipt. In this case,
the stations stay awake for the next beacon.
Roaming
Typically, wireless networks within buildings require more than just
one access point to cover all rooms. Depending on the solidity
and material of the walls, one access point has a transmission
range of 10–20 m if transmission is to be of decent quality. Each
storey of a building needs its own access point(s) as quite often
walls are thinner than floors. If a user walks around with a wireless
station, the station has to move from one access point to another
to provide uninterrupted service. Moving between access points is
called roaming. The term “handover” or “handoff” as used in
context of mobile or cellular phone systems would be more
appropriate as it is simply a change of the active cell. However, for
WLANs roaming is more common.
802.11 -Roaming
No or bad connection? Then perform:
Scanning
scan the environment, i.e., listen into the medium for beacon
signals or send probes into the medium and wait for an answer

Reassociation Request
station sends a request to one or several AP(s)

Reassociation Response
success: AP has answered, station can now participate
failure: continue scanning

AP accepts ReassociationRequest
signal the new station to the distribution system
the distribution system updates its data base (i.e., location
information) typically, the distribution system now informs the old
AP so it can release resources.
The steps for roaming between access points are:
● A station decides that the current link quality to its access point
AP1 is too poor. The station then starts scanning for another
access point.
● Scanning involves the active search for another BSS and can
also be used for setting up a new BSS in case of ad-hoc
networks. IEEE 802.11 specifies scanning on single or multiple
channels (if available at the physical layer) and
differentiates between passive scanning and active scanning.
Passive scanning simply means listening into the medium to find
other networks, i.e., receiving the beacon of another network
issued by the synchronization function within an access point.
Active scanning comprises sending a probe on each channel
and waiting for a response. Beacon and probe responses contain
the information necessary to join the new BSS.
● The station then selects the best access point for roaming
based on, e.g., signal strength, and sends an association
request to the selected access point AP2.
● The new access point AP2 answers with an association
response. If the response is successful, the station has roamed
to the new access point AP2. Otherwise, the station has to
continue scanning for new access points.
● The access point accepting an association request indicates the
new station in its BSS to the distribution system (DS). The DS
then updates its database, which contains the current location of
the wireless stations. This database is needed for forwarding
frames between different BSSs, i.e. between the different
access points controlling the BSSs, which combine to form an
ESS . Additionally, the DS can inform the old access point AP1
that the station is no longer within its BSS.