Module – 3

WLAN FUNDAMENTALS AND THREAT ANALYSIS

Chapter 1:

HOW DO WLANS WORK?

This section introduces the basic working principles of Wireless Local Area Networks
(WLANs). It explains WLAN design, network topologies, and the IEEE 802.11 standards used in
wireless communication. The chapter also discusses radio frequency (RF) behavior, antennas, and
site survey considerations. Understanding these concepts helps security professionals identify and
prevent wireless network security threats.

WLAN Topologies
A Wireless Local Area Network (WLAN) allows devices to communicate using radio
frequency (RF) signals instead of cables. For communication to occur, all wireless devices must
operate on a common radio frequency channel. WLAN devices typically operate in the Industrial,
Scientific, and Medical (ISM) unlicensed spectrum, which allows wireless communication without
requiring a licensed frequency band.

802.11 Service Sets

The IEEE 802.11 standard defines four types of wireless network topologies called service
sets. These service sets determine how wireless devices communicate and connect within a WLAN.
The four service sets are:
1. Basic service set (BSS)
2. Extended service set (ESS)
3. Independent basic service set (IBSS)
4. Mesh basic service set (MBSS)

Basic Service Set

• A Basic Service Set (BSS) is the most fundamental WLAN topology.
• In a BSS, a single access point (AP) connects multiple wireless client devices.
• All wireless clients communicate with each other through the access point rather than directly.
• The access point typically connects the wireless network to a wired distribution system such as
an Ethernet LAN.
• The coverage area of the access point is known as the Basic Service Area (BSA).
• The size of the coverage area depends on transmission power, antenna gain, and environmental
conditions.
• BSS networks are commonly used in homes, small offices, and small networks.
Extended Service Set
• An Extended Service Set (ESS) is formed by connecting two or more Basic Service Sets together.
• The access points are connected using a distribution system such as an Ethernet network.
• ESS is used to expand wireless network coverage in large buildings, campuses, or organizations.
• It allows users to move between different access points while maintaining network connectivity.
• Seamless roaming occurs when coverage areas of access points overlap by about 15–20%,
allowing smooth transitions between access points.
• Nomadic roaming occurs when there is no overlap between access point coverage areas, causing
temporary disconnection when moving between areas.
• In the collocation model, two access points provide 100% overlapping coverage to support a large
number of users in crowded locations like conference rooms.

Independent Basic Service Set

• An Independent Basic Service Set (IBSS) is a wireless network that does not use an access point.
• In IBSS, wireless client devices communicate directly with each other.
• This type of network operates in ad hoc mode.
• IBSS networks are typically temporary networks created for short-term communication between
devices.
• They are commonly used for peer-to-peer connections such as file sharing between laptops or
mobile devices.

Mesh Basic Service Set

• In a Mesh Basic Service Set (MBSS), clients, access points, and gateways are interconnected in
a mesh network.
• This topology allows direct communication between client devices and also between access
points.
• Only stations that belong to the mesh network can communicate directly with each other.
• Communication with devices outside the mesh network is handled through a gateway.
• Mesh networks improve network coverage, reliability, and fault tolerance because multiple
communication paths are available.

The 802.11 Standards

• The IEEE 802.11 standards define the protocols, methods, and rules used for building and
operating Wireless Local Area Networks (WLANs).
• The original 802.11 standard was introduced in 1997 and has undergone several revisions to
improve wireless communication.
• Each revision is identified by a letter suffix such as 802.11a, 802.11b, 802.11n, and 802.11ax.
• These revisions introduce new frequencies, channels, modulation techniques, and improved data
speeds.
• Manufacturers often use these designations in Wi-Fi products to indicate compatibility and
performance levels.
Wi-Fi Alliance Naming System
• To simplify the complex naming system, the Wi-Fi Alliance introduced a new generation-based
naming scheme.
• Instead of using letter-based names, Wi-Fi standards are now identified as Wi-Fi generations.

Mapping of Wi-Fi Generations

Wi-Fi Generation IEEE Standard Year

Wi-Fi 6 802.11ax 2019
Wi-Fi 5 802.11ac 2014
Wi-Fi 4 802.11n 2009
Wi-Fi 3 802.11g 2003
Wi-Fi 2 802.11a 1999
Wi-Fi 1 802.11b 1999
This naming system makes it easier for consumers to identify the latest Wi-Fi technologies.

❖ Wi-Fi 1 (802.11b)
• 802.11b operates in the 2.4 GHz frequency band.
• It provides a maximum data rate of 11 Mbps.
• The 2.4 GHz band often suffers from interference from devices such as microwave ovens
and cordless phones.
• Despite its lower speed, 802.11b became popular because of its low cost and longer coverage
range.

❖ Wi-Fi 2 (802.11a)
• 802.11a operates in the 5 GHz frequency band.
• It provides data rates from 1.5 Mbps up to 54 Mbps.
• The higher frequency results in shorter coverage range and higher signal attenuation through
walls.
• Businesses preferred this standard because it offered higher throughput than 802.11b.

❖ Wi-Fi 3 (802.11g)
• 802.11g was introduced in 2003.
• It operates in the 2.4 GHz band but supports data rates up to 54 Mbps.
• This standard combines the speed of 802.11a with the range of 802.11b.
• It is backward compatible with 802.11b, which led to rapid adoption.

❖ Wi-Fi 4 (802.11n)
• 802.11n was ratified in 2009 and significantly improved wireless performance.
• It supports data rates up to 600 Mbps.
• It operates in both 2.4 GHz and 5 GHz bands, making it a dual-band technology.
 • It introduced Multiple Input Multiple Output (MIMO) technology.
• MIMO uses multiple antennas to transmit and receive data simultaneously, increasing speed
and range.

❖ Wi-Fi 5 (802.11ac)
• 802.11ac was introduced in 2013 as an improvement over 802.11n.
• It operates primarily in the 5 GHz band.
• It supports wider channel bandwidths (80 MHz and 160 MHz).
• It introduced Multi-User MIMO (MU-MIMO) technology.
• MU-MIMO allows multiple devices to receive data simultaneously, improving network
efficiency.
• It can achieve data rates up to about 866.7 Mbps or higher.

❖ 802.11ad Standard
• 802.11ad operates in the 60 GHz frequency band.
• It supports extremely high data rates up to 7 Gbps.
• This standard is about 10 times faster than 802.11n.
• It is mainly used for high-speed short-range wireless communication.

❖ 802.11ah Standard
• 802.11ah was introduced in 2016 for Internet of Things (IoT) devices.
• It operates in the 900 MHz frequency band.
• It is designed for low power consumption and long-range communication.
• It can support thousands of IoT devices connected to a single access point.
• It is used in smart homes, smart meters, and machine-to-machine (M2M) communication.

❖ Wi-Fi 6 (802.11ax)
• 802.11ax was introduced in 2019 as the next evolution of Wi-Fi technology.
• It supports theoretical speeds up to 10–12 Gbps.
• It is designed for high-density environments such as stadiums, airports, and shopping malls.
• It uses Orthogonal Frequency Division Multiple Access (OFDMA) to divide channels into
smaller subchannels.
• This improves spectrum efficiency and allows multiple devices to communicate
simultaneously.
• It also uses 1024 Quadrature Amplitude Modulation (1024-QAM) to increase data
transmission efficiency.

Advantages of Wi-Fi 6
• Wi-Fi 6 provides higher network capacity and improved performance in crowded
environments.
• It offers about 40% higher throughput compared to Wi-Fi 5.
• It supports bidirectional MU-MIMO communication.
• It improves battery life of connected devices through efficient power management.
❖ Wi-Fi 6E
• Wi-Fi 6E is an extension of Wi-Fi 6 that operates in the new 6 GHz frequency band.
• The Federal Communications Commission (FCC) approved the 6 GHz band in 2020.
• It provides 1200 MHz of additional wireless spectrum.
• This reduces network congestion and interference.
• Wi-Fi 6E can deliver performance close to 5G millimeter-wave speeds when used with
compatible devices.

Wireless Access Point (WAP)

A Wireless Access Point (WAP) is a networking device that connects wireless client devices
to a wired network using radio frequency (RF) signals.
• A WAP contains a radio card and antenna.
• It operates on unlicensed frequency bands such as 2.4 GHz and 5 GHz.
• It acts as a portal between wireless clients and the wired Ethernet network.
• WAPs operate in half-duplex mode, meaning they cannot transmit and receive data at the
same time.

Wireless Channels and Interference

The 2.4 GHz band is divided into multiple channels, but many of them overlap.
Only three channels are non-overlapping:
• Channel 1 – 2412 MHz
• Channel 6 – 2437 MHz
• Channel 11 – 2462 MHz
These channels are spaced apart to avoid signal interference.
Explanation of Figure 5-2
The attached Figure 5-2 illustrates wireless channel allocation in the 2.4 GHz band.
The diagram shows three sections:
1. 802.11b (DSSS) with 22 MHz channel width
o Channels overlap heavily in this standard.
2. 802.11g (OFDM) with 20 MHz channel width
o Uses subcarriers for better spectrum efficiency.
3. 802.11n (OFDM) with 40 MHz channel width
o Uses wider channels to achieve higher data speeds.

How Does a WAP Work?

The figure demonstrates that channels must be carefully selected so they do not overlap,
otherwise co-channel interference occurs, which reduces network performance.

Beacon Frames
A beacon is a broadcast signal transmitted periodically by a WAP. Beacons advertise the
presence of the wireless network and provide configuration details.
Information Contained in a Beacon
• Timestamp for synchronization
• Channel number
• Data transmission rate
 • Spread spectrum parameters
• SSID (network name)
• Quality of Service (QoS) parameters
Beacons act as the heartbeat of the wireless network.

Client Connection Process

To join a WLAN, a client device must perform the following steps:
1. Discovery of the access point through scanning
2. Authentication with the WAP
3. Association with the WAP
After association, the client sends a DHCP request to obtain:
• IP address
• DNS server address
• Network configuration information

WPA2 Four-Way Handshake

The four-way handshake is used to establish a secure encrypted connection between the
client and the access point.

The attached Figure 5-3 illustrates the four-way handshake process between the access point and
the client.
Step 1 – ANonce
• The access point sends a random number called ANonce to the client.
Step 2 – SNonce and MIC
• The client generates its own random number called SNonce.
 • It sends the SNonce along with a Message Integrity Code (MIC) back to the access
point.
Step 3 – GTK Distribution
• The access point generates the encryption keys.
• It sends the Group Temporal Key (GTK) and MIC to the client.
Step 4 – Acknowledgement
• The client sends a confirmation message to the access point.
• After this step, the association is complete and encrypted communication begins.

WAP Architecture
Types of Wireless Access Points
1. Autonomous Access Points
• Operate independently
• Have built-in switching intelligence
• Manage wireless clients directly
• Used in small or standalone networks.

2. Thin Access Points

• Depend on a central WLAN controller
• The controller manages multiple access points
• Simplifies administration of large wireless networks
• Used in enterprise environments.

Integration Service (IS)

• Integration Service enables the WAP to translate frames between wireless and wired networks.
• Example:
o Converts 802.11 wireless frames
into
o 802.3 Ethernet frames
• This allows communication between wireless clients and wired servers.

Distribution Service (DS)

• Distribution Service manages data transfer between the access point and the network backbone.
• It includes:
o Distribution Medium
The physical connection used by the WAP, typically an Ethernet LAN.
o Distribution System Service (DSS)
Software that manages:
✓ Client associations
✓ Client disassociations
✓ Packet forwarding
Wireless Antennas
❖ A wireless antenna is a device used to transmit and receive radio frequency (RF) signals in
wireless networks.
❖ The performance and coverage of a wireless network depend greatly on the type and placement
of the antenna.
❖ Wireless antennas are classified into three main categories based on their radiation pattern.
1. Omnidirectional antennas
2. Semi-directional antennas
3. Highly directional antennas

1. Omnidirectional Antennas
Omnidirectional antennas are the most common antennas used in Wireless Access Points
(WAPs).
Characteristics
• Radiate radio waves equally in all horizontal directions (360°)
• Vertical radiation range is approximately 7° to 80°
• Commonly used in point-to-multipoint networks
Gain Effect
Increasing antenna gain:
• Increases horizontal coverage
• Decreases vertical coverage
Example:
✓ If a high-gain antenna is installed on the first floor, it may provide excellent coverage on
that floor but weak coverage on upper floors.
✓ Security Consideration
✓ The signal may extend outside the building, allowing attackers in nearby areas to detect the
network.

2. Semi-Directional Antennas
Semi-directional antennas focus RF energy in a specific direction, usually around 180
degrees.
They are used when coverage is required in a particular direction rather than in all directions.
Applications
• Connecting buildings in a campus network
• Covering long corridors
• Extending wireless coverage in specific areas

Types of Semi-Directional Antennas

a) Yagi Antenna (Figure 5-4)
• Commonly used in outdoor point-to-point connections
• Can provide coverage up to 2 miles
(Refer to Figure 5-4 showing the Yagi antenna design.)
b) Planar Antenna (Figure 5-5)
• Often used in warehouses and retail stores
• Provides controlled directional coverage
(In text book refer to Figure 5-5 showing a planar antenna.)

c) Sectional Antenna
• A sectional antenna has a pie-shaped radiation pattern.
• Characteristics:
o Covers a specific slice of the coverage area
o Multiple sectional antennas can combine to provide 90°, 180°, or 360° coverage
o Commonly used on cellular towers
• Each antenna works independently with separate radios, which improves network efficiency.

2. Highly Directional Antennas

• Highly directional antennas produce a very narrow and focused RF beam.
• They are mainly used for long-distance point-to-point wireless communication.
• These antennas have:
o High gain
o Narrow beam width
o Long transmission range
• They can support wireless links of up to 35 miles under ideal conditions.

Types of Highly Directional Antennas

a) Grid Antenna (Figure 5-6)
o Uses a wire grill structure
o The spacing between wires depends on the operating frequency
(In text book refer to Figure 5-6 showing a grid antenna.)

b) Parabolic Antenna (Figure 5-7)

o Resembles a satellite dish
o Provides very high directional gain
(In text book refer to Figure 5-7 showing a parabolic antenna.)

c) MIMO Antennas
Multiple Input Multiple Output (MIMO) antennas allow multiple antennas to transmit
and receive signals simultaneously.
Advantages
o Increased data throughput
o Improved signal reliability
o Extended coverage range
MIMO is used in:
o 3G and 4G mobile networks
o Wi-Fi 802.11n and later standards
(In text book refer to Figure 5-8 showing a router with MIMO antennas.)
 d) SU-MIMO (Single User MIMO)
SU-MIMO allows multiple spatial streams to communicate with one device at a time.
Characteristics
• Entire bandwidth is dedicated to one user during a time slot
• Implemented in:
o 802.11n
o 802.11ac Wave 1
• Example configurations:
o 2×2 MIMO → two antennas, two data streams
o 4×4 MIMO → four antennas, four data streams

e) MU-MIMO (Multi-User MIMO)

MU-MIMO is an improved technology that allows multiple devices to communicate with
the access point simultaneously.
• Advantages
o Reduces network congestion
o Improves overall network efficiency
o Allows multiple users to share bandwidth
• MU-MIMO routers support:
o 2×2 streams
o 3×3 streams
o 4×4 streams
o 8×8 streams
• MU-MIMO is supported in:
o 802.11ac (Wi-Fi 5)
o 802.11ax (Wi-Fi 6)
• These technologies are useful in high-density environments such as:
o Airports
o Stadiums
o Shopping malls

Determining Antenna Coverage Area

Network designers analyze antenna radiation charts provided by manufacturers.
These charts display RF coverage from two perspectives:
1. Azimuth (Horizontal Pattern)
Shows coverage across the horizontal plane.
(In text book refer to Figure 5-9.)

2. Elevation (Vertical Pattern)

Shows coverage in the vertical direction.
(In text book refer to Figure 5-10.)
These diagrams help engineers predict RF propagation and optimize antenna placement.
Site Surveys in Wireless Networks
A site survey is the process of analyzing how radio frequency (RF) signals behave within a
specific area before installing a wireless network.
It helps determine:
• Wireless coverage area
• Interference sources
• Optimal placement of access points
• Network capacity requirements
Site surveys are important for both small networks (SOHO) and large enterprise wireless
deployments.

Objectives of a Site Survey

The main objectives of a wireless site survey are:
• Determine RF coverage requirements
• Identify interference and noise sources
• Plan access point placement
• Ensure network capacity for users
• Avoid signal leakage outside the building
In high-density areas such as conference rooms, capacity planning is important to support multiple
simultaneous users.

Spectrum and Protocol Analysis

The first step in a site survey is spectrum analysis.
➢ Spectrum Analysis
• Spectrum analysis identifies existing RF activity in the environment.
• It helps detect:
o Wireless interference
o Non-Wi-Fi RF signals
o Congested frequency bands
➢ Spectrum Analyzer
• A spectrum analyzer is a device that measures:
o Frequency of signals
o Amplitude (signal strength) of radio waves
• Modern surveys often use PC-based spectrum analysis tools to monitor the 2.4 GHz and
5 GHz bands.

Signal-to-Noise Considerations
• Wireless performance depends on the signal-to-noise ratio (SNR).
o If background noise exceeds –85 dBm, network performance may degrade.
o High noise levels can cause packet loss and retransmissions.
• Different applications tolerate different retransmission levels:
o General applications → tolerate up to 10% retransmissions
o VoIP → performance drops at 2% retransmissions
Sources of Noise and Interference
• Many devices can cause RF interference in wireless networks.
• Common sources include:
o Microwave ovens
o Cordless phones
o Fluorescent lights
o Elevator motors
o Bluetooth devices
o Other Wi-Fi networks
o Malicious transmitters (jammers)
If interference is high in 2.4 GHz, network designers may switch to the 5 GHz band.

Coverage Analysis
• Coverage analysis determines how far wireless signals will reach within the site.
• The first step is conducting coverage and capacity planning interviews.
• These interviews help determine:
o Number of users in each area
o Required network throughput
o Applications used (VoIP, video, data)
o Need for roaming between access points
• Important note:
o Increasing access point power does not always improve performance.
o Too much power can cause interference and security risks.

Access Point Placement

• The site survey determines the optimal location of wireless access points (WAPs).
• Important considerations include:
o Distance to Ethernet wiring closets
o Maximum Ethernet cable length of 100 meters (Cat5)
o Proper antenna selection
• Network designers often use a combination of antennas:
o Omnidirectional antennas → wide coverage
o Semi-directional antennas → focused coverage
• The goal is to cover only the intended area and avoid signal leakage outside the facility.

Coverage Assessment
• After placing the access points, engineers must evaluate the actual wireless coverage.
• Coverage assessment can be performed using:
1. Manual Survey
2. Predictive Survey

Manual Coverage Assessment

Manual surveys measure real RF signals in the environment.
There are two types:
1. Passive Mode Survey
• Client device measures signal strength and noise levels
• Device does not associate with the access point
• Works at Layer 1 and Layer 2
• This provides raw RF measurements.

2. Active Mode Survey

• Client device connects to access points
• Works at Layer 1, Layer 2, and Layer 3
• It measures:
o Packet loss
o Latency
o Jitter
• This gives a better understanding of actual network performance.

Predictive Coverage Assessment

• Predictive surveys use simulation software to model wireless coverage.
• Advantages:
o Faster than manual surveys
o Reduces survey costs
o Useful for large enterprise environments
• Software algorithms predict:
o RF cell sizes
o Signal propagation
o Optimal access point placement

Self-Organizing WLANs
• Modern wireless networks use controller-based access points known as self-organizing
WLANs.
• These systems can automatically adjust:
o Channel selection
o Transmission power
o Signal patterns
o Network configuration
• Thin access points continuously monitor RF conditions and send data to the WLAN
controller.
• The controller then analyzes the environment and dynamically reconfigures the network to
maintain optimal performance.