Implementing Wireless LAN using IEEE 802.11b Standard 1 FREQUENCY BAND 802.11 operates in the 2.4 GHz ISM band. This band is license exempt so other equipments use the same frequency band, e.g. microwaves and Bluetooth devices. Therefore, WLAN systems have to be tolerant to disturbance from other sources than WLAN equipment. The specific channels available vary by country and the regulation agencies, which controls the spectrum allocation. IEEE 802.11b WLAN operates at the ISM frequency band, which is 2.4 GHz - 2.4835 GHz in USA and Europe and 2.471 - 2.497 GHz in Japan. The frequency band is divided into 14 partially overlapping channels each 22 MHz wide. In Europe, 13 of these are available, 11 in USA and only one in Japan. 2 TYPES OF NETWORK Two or more communicating stations are called a basic service set (BSS).There are two types of BSS, independent and infrastructure. An Independent BSS (IBSS) is stations that communicate directly. An IBSS has no centralized entity and the connections come and go under short periods. Hence, they are also referred to as Ad hoc networks. A more common configuration is when the BSS contains an AP that handles all traffic in the BSS. In such an infrastructure, all communication goes through the AP. An extended service set (ESS) is several infrastructure BSS connected by a distribution system (DS). The DS is usually a wired Ethernet but the standard does not specify any particular technology for the backbone network. All devices within the same BSS (basic service set) use the same channel. 3 IEEE 802.11B STANDARD The data link layer in the Internet protocol stack can be split into two sublayers, Logic Link Control (LLC) layer and Medium Access Control (MAC) layer, as can the physical layer, Physical Layer Convergence Procedure (PLCP) and Physical Medium Dependent (PMD).

Figure 1: IEEE 802 Standards in the Internet Protocol Stack 4 PHYSICAL LAYER 4.1 Physical Layer Packet Format PLCP Protocol Data Unit (PPDU) is generated at the PLCP sublayer, then transmitted to the PMD sublayer, which provides a means and method of transmitting and receiving data through wireless medium. The IEEE 802.11b standard defines two different packet structures that are used in the DSSS standard. There is a short and a long packet format. The short PLCP preamble and header may be used to minimize overhead and thus maximize the network data throughput. The short packet format is intended to reduce the overhead of transmissions while the long packet format is to maintain compatibility with IEEE 802.11 networks. The PHY preamble is used to allow the receiver to perform necessary synchronization operations to the transmitter. The PHY header is the overhead containing the information regarding the PSDU. The PHY header is the overhead needed by the PHY layer. The remainder of the packet, i.e., PSDU, contains the data passed to the PHY layer by the MAC layer

Figure 2: Long PLCP PPDU Format

Figure 3: PLCP Preamble and Header Different pieces of the packet are transmitted at variable transmission rates. The long preamble and PLCP header are always transmitted in 1 Mbps DBPSK and duration is fixed to be 192 microsec. Each packet may be sent using two different rates; the PLCP header is sent at the basic rate while the rest of the packet might be sent at a higher rate. The basic rate is 1 Mbps (with DBPSK modulation and CRC 16 bits) for 802.11b. The higher rate used to transmit the physical-layer payload (which includes the MAC header) is indicated in the PCLP header.

Figure 4: Transmission Rates 4.2 Frame Fields Sync: This field helps the receiver to synchronize its operation at the frame boundaries. Start Frame Delimeter(SFD): This field indicates the start of the PMD parameters within PLCP. Following this field is the header that contains parameters.

The header consists of • An 8-bit SIGNAL field that indicates the transmission rate (modulation) that is used

for carrying the data units. The SIGNAL and SERVICE fields of the PLCP header will determine the data rate and modulation of the PSDU.

• An 8-bit SERVICE field that is mostly reserved for future use. • A 16-bit LENGTH field that indicates the length of the PSDU. • A 16-bit CRC check that is calculated for the SIGNAL,SERVICE and LENGTH

fields. It is used for error detection. The PSDU field carries the MAC frames. 4.3 Physical Layer Functions The physical layer in 802.11 consists of the two sub layers; physical layer convergence procedure (PLCP) and physical medium dependent (PMD). These two sub layers provides for three basic functions. First, PLCP manages the exchange of data frames between the MAC-layer and the PHY-layer. Physical layer convergence protocol defines a method of mapping the MAC layer data units into frames suitable for transmitting and receiving across the air interface. Secondly, signal preparation for RF transmission, e.g. signal modulation and applying proper spreading sequence, is done by PMD. Thirdly the PMD layer must check the activity on the medium and provide carrier-sensing information back to the MAC-layer. 4.3.1 PMD-sublayer The PMD is the lowest layer before transmission through a channel. At this layer there are functions implemented for sensing the channel, thereby determine if it is idle or not. This is performed with energy detection (ED), carrier sensing (CS) or a combination. When ED is used, a transmitter checks the channel and if there is a signal energy exceeding a certain level the transmitter will back off according to the rules set up by the upper MAC-layer. The CS mechanism will do the same if it detects a signal that contains interpretable information, otherwise the signal is considered to be noise. 4.4.1 FHSS vs DSSS The two PHY access techniques, FHSS and DSSS, operate in channels spread between 2.4 and 2.497 GHz. However, the FHSS technique has also been substantially less popular than the DSSS technique. This is mainly due to the higher bandwidth available to the DSSS implementation and the fact that the DSSS function lends itself better to interoperability between different implementations. For this reason, this thesis focuses on the more popular technique of DSSS used under the IEEE 802.11b standard. 4.4.2 Basic spreading technique (spreading using Barker sequence) Direct Sequence Spread Spectrum uses a PN spreading code to spread transmitted data

over a wide bandwidth. This can be thought of as XORing a stream of data bits with a specific PN sequence. In the 802.11 standard, a single PN code is used by every user in the network. This PN code is the 11 bit barker sequence: +1 -1 +1 +1 -1 +1 +1 +1 -1 -1 – 1. The technique of XORing data with the Barker sequence is shown in Figure 6. The figure shows how a "one" or a "zero" is transmitted as 11 bits of data represented by the original Barker sequence or the inverse of the Barker sequence. By combining data with a bandwidth at baseband of 1 MHz, spreading it and up-converting it to the desired 2.4 GHz channel results in an RF channel bandwidth of 22 MHz. The chip rate over the radio interface is 11 MHz. In DSSS, the transmitted signal is spread in bandwidth using a spreading code. Each symbol is multiplied by the spreading code. Since the chip rate after spreading is faster than the symbol rate, the bandwidth is increased (by a factor that equals the length of the spreading code). At the receiver, the signal is despread by a filter that is matched to the spreading code. This reduces interference and introduces processing gain to the desired signal. The amount of processing gain is calculated as- G =Chip rate/Symbol rate Thus, DSSS tolerates interference well which is especially important when operating at the ISM band. The used spreading code is an 11-chip Barker sequence, i.e., +1,-1,+1,+1,-1,+1,+1,+1,-1,-1,-1. Barker sequence has very good autocorrelation properties and is thus ideal for environments with interference. The processing gain for a code of length 11 is 10.4 dB. In 1 Mbps PHY, differential BPSK is used as modulation method after spreading. In 2 Mbps PHY, differential QPSK is used (the same code is used in both I- and Q-branches). The original 802.11 protocol supports data rates of 1 and 2 Mbps. The information bits are spread with eleven chip long sequence called Barker code and the resulting bit sequence is modulated using either differential binary phase shift keying (DBPSK) for data rate of 1 Mbps and differential quaternary PSK (DQPSK) when a 2 Mbps rate is needed.

Figure 5: Spreading in IEEE 802.11 1 Mbps WLAN using Barker code (length 11)

Figure 6: Illustration of the processing spreading data using a Barker Sequence 4.4.3 DSSS Advantages The DSSS technique has two major advantages. It provides a spreading gain against narrowband interference signals and it spreads the transmitted signal across a wide range so the transmission resembles noise to a narrowband receiver. These two characteristics are why DSSS was originally used by the military because it is difficult to jam and

difficult to detect by narrowband radios. These two characteristics also make the DSSS technique ideal for coexisting with other narrowband users. 4.4.4 DPSK In phase shift keying (PSK) the signals are mapped to a certain phase adjustment of the carrier frequency. In differential PSK (DPSK) the phase shift of the signal carrier depends on the current bit in the information sequence. In DBPSK the phase changes if the information bit is 0, but remains unchanged if the bit equals 1. 4.4.5 Complementary code keying (CCK) The extension 802.11b support higher multiple data rates, 5.5 and 11 Mbps. In order to achieve these rates CCK modulation is applied. Increasing the data rate from 2 Mbps requires more bits to be sent per symbol. For PSK modulation this means that a transceiver would need to process even smaller phase shifts than for DQPSK. This however will set higher requirements on the hardware, which is not to be considered as an economical option. Therefore complementary code keying (CCK) was chosen as modulation when higher data rates were introduced. CCK is related to M-ary orthogonal keying (MOK). For CCK modulation the spreading code is chosen from a set of M almost orthogonal code sequences. These sequences consist of 8 complex chips; each chip can assume one of four phases (QPSK). Meaning that 48 = 65536 different sequences can be attained. However only 64 of 65536 sequences are orthogonal and therefore are these used for spreading. To maintain a channel bandwidth of approximately 22 MHz the symbol rate is increased to 1.375 Msps resulting in total chip rate of 11Mcps. For CCK the information bit stream is virtually arranged into groups of 4-bits and 8-bits for 5.5 Mbps and 11 Mbps respectively. The groups of bits are divided once again, where 2 bits (5.5 Mbps) as well as 6 bits (11 Mbps) are used for choosing a specific spreading sequence out of 4 or 64 sequences. As a result the actual spreading sequence, by itself carries either 2 (5.5 Mbps) or 6 information bits (11 Mbps). The remaining 2 information bits are modulated through DQPSK and the resulting phase is used to shift every complex chip of the 8 chip long sequence. Now let’s see how the IEEE Standard 802.11 code set is used to modulate a digital waveform. Since the direct sequence spread spectrum (DSSS) technique is used for the high rate modulation scheme, the complementary codes defined in the draft standard are referred to as spreading codes because they are used to spread the occupied bandwidth of the DSSS waveform. Bandwidth spreading and dispreading is the basis for obtaining processing gain in DSSS systems. The IEEE 802.11 complementary spreading codes have a code length 8 and a chipping rate of 11 Mchip/s. The 8 complex chips comprise a single symbol. By making the symbol rate 1.375 MS/s the 11Mbps waveform ends up occupying the same approximate bandwidth as that for the 2Mbps 802.11 QPSK waveform thereby allowing for 3

nonoverlapping channels in the ISM band. This is important for maximizing aggregate system throughput in a wireless LAN network and was one reason for choosing CCK as the modulation technique. The 8-bit CCK code words are derived from the following formula:

(1) where, C is the code word with LSB first to MSB last. This strange looking formula is used to generate the code sets for both 11 and 5.5Mbps data rates. Thus a subset of the 11Mbps code set is used at the 5.5Mbps data rate. The parameters � 1 - � 4 determine the phase values of the complex code set and are defined in the 802.11 high rate standard. For the 11Mbps data rate each symbol represents 8 bits of information. At 5.5Mbps 4 bits per symbol are transmitted. For the purpose of this discussion the 11Mbps mode will be described. The data bit stream is partitioned into bytes as (d7, d6, d5, …, d0) where d0 is the LSB and is first in time. The 8 bits are used to encode the phase parameters � 1 - � 4 according to scheme shown in Table1. The encoding is based on differential QPSK modulation as specified in Table 2.

Table 1: Phase Parameter Encoding Scheme

Table 2: DQPSK Modulation of Phase Parameters

Let’s use an example to see how a typical code word is generated. Assume the 11Mbps mode and a data bit stream given as d7, d6, d5,…,d0 = 1 0 1 1 0 1 0 1. Thus from Table 2

In High Rate/DSSS, complementary code keying is used as a modulation method. CCK is an M-ary orthogonal keying modulation method where one of the M unique (almost orthogonal) signal code words are chosen for transmission. The length of a code word is 8 => the duration of one symbol is 8 complex chips. The chip rate is still 11 MHz, so the radio parts of the transmitter stay the same as in 802.11. Only six bits need to be fed to the code generation block, since the first two bits (-1) affect all chips:

Figure 7: Modulator Circuit At the receiver, the transmitted bits are detected by finding the correct codeword using a bank of 64 correlators. Also, phase detection for the code that gave the largest correlator output is needed. Now let’s see how the HFA3861A baseband processor uses the code word to modulate a carrier and spread the bandwidth of the waveform. Referring to Equation 1, we see that phase parameter � 1 is contained in all 8 chips of the code word so it essentially rotates the whole vector. This is important in the circuit implementation of the CCK modulation as we shall see. Figure 8 shows the block diagram of the CCK modulator circuit. The output of the HFA3861A data scrambler is partitioned into bytes and fed to a serial in parallel out mux circuit that gets clocked at the symbol rate of 1.375MHz. Six bits of the mux output are used to select one of 64 complex codes which are fed to a differential modulator circuit. The other 2 bits of the mux output are used to QPSK modulate, i.e., rotate, the 8 chip complex code word. The outputs of the differential modulator are the I and Q outputs in accordance with Equation 1 for generating complex codes. And that is essentially CCK modulation in a nutshell.

Figure 8: Block Diagram of HFA3861A Modulator Circuit

In the receiver the CCK modulated waveform is converted from analog to digital form after downconversion. Figure 9 shows the demodulator circuit of the HFA3861A. Demodulation of the CCK modulated signal is done coherently in the HFA3861A baseband processor by a RAKE receiver implementation which features a channel matched filter and Fast Walsh Transform block. A bank of 64 correlators followed by a biggest picker circuit determines which code was transmitted giving 6 bits of the data word (in the 11Mbps mode). The other 2 bits of the 8-bit data word are determined from the QPSK phase of the symbol.

Figure 9: HFA3861A Rake receiver

5 MAC LAYER 5.1 MAC Layer Packet Format The MAC Protocol Data Unit (MPDU) is encapsulated by adding a 30 byte MAC header and a 4 byte Frame Check Sequence (FCS) field to the Frame Body.

Figure 10: Basic structure of the IEEE 802.11b packet as it's transmitted on the physical

Figure 11: The structure of packet created at the MAC Layer(MPDU Frame Format)

Figure 12: MPDU Frame Format 5.2 Frame Fields In the MAC header, the frame control field controls e.g. frame type, fragmentation, power management and WEP (wired equivalent privacy). The actual use of addresses depends on the combination of two bits( To DS/ From DS) in the frame control field. Duration field contained in frame explicitly indicates the length of time that the frame will be transmitting on the channel( or how long the channel will be busy). If two wireless LAN users are sending packets to one another but each is using a different access point, the 802.11 MAC address of both access points and both clients will be present in the four address fields. Up to four addresses are needed because it is sometimes necessary to identify the address of the access point used by the transmitter or receiver. There are four address fields, not all of which are necessarily present. They are used for transmitter address, receiver address, source address and destination address. Sequence control provides a mechanism to identify each PDU and fragment with a sequence no. (4 bit fragment no. and 12 bit sequence no.). • The sequence control field is used for frame and fragment numbering. The Frame Body is a variable length field containing a MAC Service Data Unit (MSDU) passed down from the LLC, or one of its fragments. For large MSDUs exceeding a Fragmentation Threshold, one MSDU is broken into multiple fragments. The FCS is used to detect transmission errors that might occur over the fields of the MAC header and the Frame Body.

5.3 MAC Layer Functions Medium access control (MAC) layer controls the access of the stations to the medium (radio interface). The main task of MAC is to provide a reliable data delivery service and control access to the shared wireless medium. The 802.11 MAC layer provides functionality to allow reliable data delivery for the upper layers over the wireless physical medium. MAC layer also handles ARQ, addressing and authentication, among others. 5.4 Medium Access Modes IEEE 802.11 defines two MAC access modes: the Distributed Coordination Function (DCF), and the Point Coordination Function (PCF). The fundamental access mode of the IEEE 802.11 MAC is a DCF known as carrier sense multiple access with collision avoidance (CSMA/CA). The DCF shall be implemented in all STAs, for use within both IBSS and infrastructure network configurations. As shown in figure 13 when a station attempts to transmit, it shall sense the channel to determine whether there are other stations transmitting. If the station is deferred due to a busy medium condition, it shall select a random backoff time following the current transmission. If the channel is sensed idle more than Distributed Interframe Space (DIFS) interval, the station will then initiate its transmission. After each successful reception of data packet, the destination station shall issue an immediate positive acknowledgement (ACK frame) following a time interval equal to Short Inter-Frame Space (SIFS). The originating station will schedule a retransmission if no ACK is received during a limit time ACK-out. The aim of this protocol is to reduce the collision probability between multiple STAs accessing a medium, at the point where collisions would most likely occur. This is because multiple STAs could have been waiting for the medium to become available again. This is the situation that necessitates a random backoff procedure to resolve medium contention conflicts. Details of CSMA/CA are as well described in following subsection. DCF also defines an optional access mechanism to further minimize collisions the transmitting and receiving STA exchange short control frames (RTS and CTS frames) after determining that the medium is idle or any backoffs, prior to data transmission.

Figure 13: Basic Access in MAC protocol

5.4.1 CSMA/CA - Backoff Procedure For a station to transmit, it senses the medium, and, if the channel is idle for a defined time DIFS, the transmission proceeds. If the medium is determined to be busy, the station is deferred until the end of the current transmission, as Station B and Station C illustrated in figure 14. After deferral, the station shall perform the backoff algorithms. A backoff timer is set and decrements during each idle slot. In IEEE 802.11 definition, the timer shall be frozen if there are other stations transmitting, until the medium is detected as idle again – when the timer decrements again. The station is allowed to transmit whereupon the backoff timer reaches zero. Finally, the backoff algorithms must be conducted when a station issues two consecutive transmissions, as shown for station B. CW is the width (in slots) of the contention window with initial value CWmin. Each station in the network determines its backoff timer by selecting a random integer from the range [0, CW] with uniform distribution. The value of CW doubles after each consecutive unsuccessful transmission, until it reaches the maximum value CWmax. After each successful transmission or when the retry limit is reached, the CW is reset to the default minimum value CWmin.

Figure 14: Backoff Procedure in 802.11 DCF (with SIFS and ACK omitted)

5.4.2 Retry Counters Every station maintains two different counters, station short retry count (SSRC) as well as long retry count (SLRC), both of which are used to indicate the number of retransmission attempts of packet. Only SSRC is covered in this thesis since SSRC is used when RTS/CTS is not implemented and SLRC is used when RTS/CTS is implemented. The SSRC is set with an initial value zero and incremented each time a data packet is retransmitted. The retry attempts will be ceased and the packet will be discarded when the SSRC reaches the retry limit dot11ShortRetryLimit. The counter SSRC shall be reset to zero either when it reaches dot11ShortRetryLimit or when an ACK frame is received in response to the data packet. 5.4.3 Another Explanation of CSMA/ CA • In IEEE 802.11(b), the access to the medium is controlled through coordination functions: − Distributed coordination function (DCF): All stations participate in the medium access control using CSMA/CA access scheme. − Point coordination function (PCF): An access point controls the medium access by polling the stations periodically. This is an optional feature that is not very widely implemented. DCF provides contention-based access whereas PCF can be used to provide contention-free services. The basic multiple access scheme used in IEEE 802.11(b) is a DCF called carrier sense multiple access with collision avoidance (CSMA/CA). • Before a station starts to transmit, it senses the medium to determine if another station is transmitting:

− If the medium is idle for a duration >= distributed interframe spacing (DIFS), the station starts transmitting. − If the medium is busy, the station shall do the following: 1. Wait until the end of current transmission. 2. After the medium has been idle for a duration of DIFS, the station selects a random backoff interval counter and starts decrementing it while the medium is idle. 3. After the counter reaches zero, the station starts transmitting. 4. If the medium becomes busy while decrementing the counter, the counter is stopped until the medium becomes idle again.

Figure 15: CSMA/ CA Obviously, as the number of transmitting stations increases, the throughput of a single station decreases rapidly. 5.4.4 Hidden node problem • The hidden node problem occurs when there are two stations A and B that cannot

hear each other both trying to send to the same access point AP (or any other station). • Both A and B sense that the medium is idle and start transmitting. They cannot hear

each other, but AP hears both of them, so collision will occur at AP

Figure 16: Hidden node 5.4.5 RTS/CTS To get around the hidden node problem, a refinement to the distributed coordination function has been specified. • The problem is solved using a RTS (request to send) / CTS (clear to send) protocol

prior to packet transmission. • The station A that wants to transmit first sends an RTS packet to the receiving station

AP. The receiving station AP then responds with a CTS packet if the medium is idle. • Other station B that cannot hear the RTS packet, can hear the CTS packet coming

from AP and will thus defer the transmission. • RTS and CTS packets are very short, so it is less probable that they will collide with

RTS packets of other stations. 6 BIT-RATE SELECTION MECHANISM Some 802.11 PHYs have multiple data transfer rate capabilities that allow implementations to perform dynamic rate switching with the objective of improving performance. The 802.11b protocol supports four data rates: 11Mbps, 5.5Mbps, 2Mbps and 1Mbps. Ordinary, an 802.11b device will select the highest possible data rate for transmission. However, when the device, e.g. a wireless card, moves away from the access point, or is connected to high density network, or experience poor connectivity due to some other reasons, the highest data rate probably can not provide reliable transmissions. Therefore, the 802.11b device will use a more interference tolerant modulation scheme and as a result drop down to a lower rate. The IEEE 802.11b standard does not specify the criteria of data rate switching, but it does put all decisions on the sender. 7 REFERENCES [1] Henty, B. E., (2001), “A Brief Tutorial on the PHY and MAC layers of the IEEE 802.11b Standard.”

[2] Liu, J., (2005), WLAN Radio Analysis and Measurement, MS Project, Stockholm, Sweden. [3] Zhao, D., (2004), Improved Multi-Point Communication for Data and Voice Over IEEE802.11b, MS thesis, University of Saskatchewan, Saskatoon, Saskatchewan. [4] Manshaei, M. H., G. R. Cantieni, C. Barakat, and T. Turletti, (2005), “Performance Analysis of the IEEE 802.11 MAC and Physical Layer Protocol,” Proc. of the 6th IEEE Int. Sym. on a World of Wireless Mobile and Multimedia Networks. [5] Ahmad, A., (2005), Wireless and Mobile Data Networks, John Wiley and Sons, Hoboken, New Jersey. [6] Koivisto, T., (2006), “Overview of IEEE 802.11b Wireless LAN,” S-72.4210 Postgraduate course in Radio Communications. [7] Pearson, B., (2000), “Complementary Code Keying Made Simple.”