Unit – 4

Wireless Communications and

Networks

Dr Karthik Rajendra
Professor & Deputy Director (Sponsored Research)
REVA University
Agenda
This unit is organized into three major chapters, each corresponding to a critical domain in wireless networking. The progression moves from access
technologies that bring wireless connectivity to homes and offices, through mobility-enabling Internet protocols, and finally to the dominant wireless
LAN standard family.

01 02 03

Cordless Systems & Wireless Local Mobile IP & Wireless Access IEEE 802.11 Wi-Fi Standard
Loop Protocol
Cordless telephony evolution, WLL Mobile IP operation, agent discovery, The IEEE 802 protocol architecture, 802.11 MAC
architectures, and the WiMAX / IEEE 802.16 registration, tunneling, and the Wireless layer mechanisms (DCF & PCF), and the
broadband wireless access standards. Application Protocol (WAP) stack for mobile physical layer specifications (FHSS, DSSS,
Internet access. OFDM, HR-DSSS).
 PART I

Cordless Systems &

Wireless Local Loop
This chapter examines two complementary technologies that extend wireless
connectivity into the residence and office environment: cordless telephone systems
and wireless local loop (WLL). Both represent strategies for replacing or
supplementing copper-based last-mile infrastructure with radio-based alternatives,
offering cost savings, rapid deployment, and enhanced flexibility. The chapter
culminates with the IEEE 802.16 broadband wireless access standard and its
commercial embodiment, WiMAX.
CHAPTER 11

Cordless Systems — Overview & Evolution

Cordless telephony has evolved dramatically from its earliest single-user, single-handset analog implementations to sophisticated multi-user digital systems capable of serving
entire office buildings and campuses. Understanding this evolution is essential for appreciating how wireless access technologies scale from personal to enterprise environments.

First-Generation Analog DECT — Digital Enhanced

Simple cordless phones operating over short ranges (typically The Digital Enhanced Cordless Telecommunications (DECT)
<100 m) with a single base station serving a single handset. standard, developed by ETSI, is a mature multi-cell, multi-user
Analog FM modulation was used, providing limited voice quality system operating at 1880–1900 MHz. DECT uses
and no security. Examples include early CT0 systems prevalent in FDMA/TDMA/TDD and supports seamless handover, making it
the 1980s. suitable for office PBX replacements and residential multi-
handset environments.

1 2 3 4

CT2 — Second Generation PACS & PHS

The Cordless Telephone Second Generation (CT2) standard The Personal Access Communications System (PACS) in North
introduced digital voice encoding and FDMA/TDD access. CT2 America and the Personal Handyphone System (PHS) in Japan
supported public telepoint services—outdoor base stations where extended cordless concepts to support limited mobility with
users could make (but not receive) calls. It operated in the 864– micro-cellular architectures, bridging cordless and cellular
868 MHz band with 32 kbps ADPCM voice coding. paradigms.
CHAPTER 11

Key Cordless System Characteristics

Cordless systems share a common architectural philosophy: a base station connected to the fixed telephone network provides wireless access to one or more
handsets within a limited range. However, the specific technical parameters vary significantly across standards, influencing their suitability for different
deployment scenarios.

Parameter CT2 DECT PHS PACS

Frequency Band 864–868 MHz 1880–1900 MHz 1895–1918 MHz 1850–1990 MHz

Multiple Access FDMA/TDD FDMA/TDMA/TDD FDMA/TDMA/TDD FDMA/TDMA/FDD

Channels per Carrier 1 12 4 8

Speech Coding 32 kbps ADPCM 32 kbps ADPCM 32 kbps ADPCM 32 kbps ADPCM

Handover No Yes (seamless) Yes Yes

Max Range ~200 m ~300 m (indoor) ~300 m ~300 m

All four standards employ 32 kbps ADPCM (Adaptive Differential Pulse Code Modulation) for voice encoding, a technique that exploits the correlation between
successive speech samples to achieve toll-quality voice at half the data rate of standard PCM (64 kbps). This is particularly important in cordless systems where
spectrum efficiency is paramount due to the limited frequency allocations.
CHAPTER 11

DECT Architecture — A Closer Look

DECT (Digital Enhanced Cordless Telecommunications) represents the most sophisticated and widely deployed cordless standard globally. Its
architecture and protocol stack merit detailed examination because they illustrate many principles that recur in more complex wireless systems.

Multi-Cell Architecture FDMA/TDMA/TDD Access Security & Data Services

DECT supports a multi-cell deployment where DECT allocates 10 carrier frequencies, each DECT provides authentication and encryption
multiple base stations (Fixed Parts, or FPs) are divided into 24 time slots (12 uplink, 12 capabilities, addressing the security
connected to a common controller. Portable downlink in TDD mode). This yields 120 shortcomings of earlier analog cordless
Parts (PPs) — the handsets — can roam simultaneous full-duplex channels per cell. phones. Additionally, DECT supports data
between cells with seamless handover, similar Dynamic Channel Allocation (DCA) allows the services at rates up to 552 kbps, enabling
to cellular networks but at a much smaller system to automatically select the best applications beyond voice, such as wireless
scale. This allows DECT to cover entire office available channel, minimizing interference ISDN access and cordless Internet connectivity.
floors or campuses. without centralized frequency planning.
CHAPTER 11

Wireless Local Loop — Motivation & Concept

The wireless local loop (WLL), also known as radio in the loop (RITL) or fixed wireless access (FWA), is a system that connects subscribers to the public switched telephone
network (PSTN) using radio signals as a substitute for copper wire for all or part of the connection between the subscriber and the local exchange (end office).

Why WLL? Key Distinction

The traditional local loop — the copper twisted-pair cable running from the telephone exchange Unlike cellular systems designed for mobile users, WLL systems serve fixed
to the subscriber premises — represents the most expensive and time-consuming component subscriber locations. This simplification relaxes many of the mobility
of telephone network deployment. In developing countries and in rural areas of developed management requirements (handover, location updating) that complicate
nations, the economics of laying copper are often prohibitive. WLL offers several compelling cellular design, allowing WLL systems to be optimized for capacity, range,
advantages: and voice quality at lower cost.

• Rapid deployment: Base stations can be erected in weeks rather than the months or years However, some WLL systems do support limited mobility — a concept
required for cable installation, enabling operators to generate revenue quickly. sometimes called fixed wireless access with nomadic capability — where
• Lower infrastructure cost: Eliminates the need for trenching, conduit, and cable, which can the subscriber terminal can be relocated but is not used while in motion.
account for 50–80% of local loop costs in difficult terrain.
• Scalability: Capacity can be incrementally added by installing additional base stations or
sectors as demand grows.
• Terrain independence: Radio signals can reach subscribers in mountainous, marshy, or
densely forested areas where cable installation is impractical.
CHAPTER 11

WLL System Architecture

A typical WLL system architecture consists of several key components that together provide the radio-based last-mile connection between subscribers and the telephone network.
Understanding this architecture is fundamental to grasping how WLL replaces or supplements the traditional copper local loop.

Subscriber Terminal Radio Link

Customer premises radio Wireless last-mile
equipment connection

Base Station Backhaul & Central

Aggregates subscriber Office
traffic
Transport to PSTN switch

The subscriber terminal (also called the Network Interface Unit or NIU) is installed at the customer premises and typically includes a
radio transceiver, antenna, and standard telephone interface (RJ-11 jack). The base station serves multiple subscribers within its
coverage area, converting radio signals to wireline format. The backhaul connection links the base station to the central office, often
using microwave, fiber, or leased lines. At the central office, the WLL traffic is switched onto the PSTN just like any other subscriber
traffic. From the PSTN's perspective, a WLL subscriber is indistinguishable from a copper-line subscriber.
CHAPTER 11

WLL Design Considerations

Designing a WLL system requires careful consideration of several interrelated factors that determine system capacity, coverage, voice quality, and economic viability. These factors
are more constrained than in mobile cellular systems because WLL must deliver wireline-equivalent quality to justify its role as a local loop replacement.

1 2

Frequency Band Selection Voice Quality Requirements

WLL systems operate across a wide range of frequencies, from 800 MHz to 26 GHz Because WLL replaces the copper local loop, subscribers expect wireline-equivalent
and beyond. Lower frequencies (800 MHz–2 GHz) provide better propagation voice quality. This means that the radio link must introduce minimal additional delay,
characteristics and non-line-of-sight (NLOS) coverage but offer less bandwidth. jitter, and distortion. Speech coding algorithms must balance compression
Higher frequencies (above 10 GHz) provide abundant bandwidth but require line-of- efficiency with perceptual quality. Many WLL systems use 32 kbps ADPCM or
sight (LOS) paths and are susceptible to rain fade. The choice of frequency band higher-rate codecs to ensure toll quality, unlike cellular systems that often use lower-
profoundly affects range, capacity, antenna size, and equipment cost. rate vocoders (8–13 kbps).

3 4

Capacity Planning Reliability & Availability

WLL operators must dimension the system to handle the expected subscriber Telephone service is expected to be available 99.99% of the time or better. WLL
density and traffic load (measured in Erlangs per subscriber). Sectorized antennas systems must be engineered to meet this "five nines" reliability target, accounting
at the base station can increase capacity by dividing the coverage area into sectors, for equipment failures, power outages (battery backup is essential), and propagation
each served by a dedicated set of radio channels. Frequency reuse patterns, similar impairments. Redundant base station equipment and diverse backhaul paths are
to cellular planning, are employed when multiple base stations cover a service area. common design features.
CHAPTER 11

WLL Technology Approaches

Multiple access technologies have been adapted for WLL deployment, each with distinct advantages. The choice among them depends on the target market,
regulatory environment, available spectrum, and the balance between voice and data services.

FDMA-Based WLL TDMA-Based WLL

Traditional frequency division schemes allocate a dedicated pair of Time division approaches (including DECT-based WLL and GSM-based
frequencies to each active call. Simple to implement but spectrally fixed wireless) share a carrier among multiple subscribers via time slots.
inefficient. Suitable for low-density rural deployments where spectrum is Offers better spectral efficiency than FDMA and supports dynamic
plentiful relative to demand. channel allocation. GSM-based WLL leverages mature, low-cost
equipment from the cellular market.

CDMA-Based WLL OFDM-Based WLL

Code division multiple access provides inherent interference resistance Orthogonal frequency division multiplexing is increasingly used for
and soft capacity limits. CDMA-based WLL systems (e.g., based on IS-95) broadband WLL, particularly in the IEEE 802.16 standard. OFDM's
can serve more subscribers per unit of spectrum than TDMA alternatives, resilience to multipath fading and its ability to support high data rates
particularly in high-density environments. The technology also facilitates a make it ideal for delivering both voice and broadband data services over
smooth migration path to 3G data services. the wireless local loop.
 CHAPTER 11 WIMAX

WiMAX & IEEE 802.16

The evolution of wireless local loop technology culminated in the development of the
IEEE 802.16 broadband wireless access standard and its commercial certification
framework, WiMAX (Worldwide Interoperability for Microwave Access). These
represent the most ambitious effort to define an interoperable, standards-based
broadband wireless access system capable of serving as a true alternative to wired
broadband technologies such as DSL, cable, and T1/E1 lines.
CHAPTER 11 — WIMAX

IEEE 802.16 — Standard Development & Scope

The IEEE 802.16 working group was formed to develop standards for broadband wireless access (BWA) systems operating in the metropolitan area network (MAN) frequency
range. The standard has evolved through several versions, each expanding the scope and capabilities of the system.

802.16 (2001) 802.16d / 802.16-2004

The original standard addressed line-of-sight (LOS) fixed A consolidation of 802.16 and 802.16a into a single fixed
wireless access in the 10–66 GHz band. At these frequencies, wireless access standard, also known as "Fixed WiMAX."
single-carrier (SC) modulation was specified, and LOS Refined the MAC and PHY specifications and formed the basis
propagation was assumed. Data rates up to 134 Mbps per for the first wave of WiMAX Forum certifications.
sector were achievable with 28 MHz channels.

802.16a (2003) 802.16e (2005)

Extended the standard to the 2–11 GHz band, enabling non- Added support for mobile subscribers, enabling handover
line-of-sight (NLOS) operation. This amendment introduced between base stations at vehicular speeds. Known as "Mobile
OFDM and OFDMA physical layers to combat multipath effects WiMAX," this amendment positioned 802.16 as a competitor to
prevalent at lower frequencies. This was the pivotal 3G cellular systems for mobile broadband data services.
amendment that made 802.16 commercially viable for broad
deployment.
CHAPTER 11 — WIMAX

IEEE 802.16 Protocol Architecture

The IEEE 802.16 standard defines a layered protocol architecture consisting of a Physical (PHY) layer and a Medium Access Control (MAC) layer. The
MAC layer is further divided into three sublayers, each addressing a specific set of functions. This modular design allows the standard to support multiple
physical layer options while maintaining a common MAC framework.

Service-Specific Convergence Sublayer (CS)

The topmost MAC sublayer interfaces with higher-layer protocols such as ATM, Ethernet, and IP. The CS maps external network
data into MAC service data units (SDUs), performing functions like header suppression and payload header compression. Separate
CS specifications exist for ATM and packet-based (IP/Ethernet) traffic.

MAC Common Part Sublayer (CPS)

The core of the MAC layer, responsible for system access, bandwidth allocation, connection establishment and
maintenance, and Quality of Service (QoS) management. The CPS defines the framing structure, scheduling
mechanisms, and the request/grant protocol by which subscriber stations obtain bandwidth from the base
station.

Security Sublayer
Provides authentication, key exchange, and encryption/decryption of data. The security
sublayer uses the Privacy Key Management (PKM) protocol for key exchange and supports
DES-CBC and AES encryption algorithms to protect data confidentiality over the air
interface.

Physical (PHY) Layer

Handles modulation, coding, and transmission over the radio channel.
Multiple PHY specifications are defined: WirelessMAN-SC (single carrier
for LOS), WirelessMAN-OFDM (256-point FFT for NLOS), and
WirelessMAN-OFDMA (2048-point FFT for NLOS with multiple access).
Supports adaptive modulation and coding to optimize throughput based
on channel conditions.
CHAPTER 11 — WIMAX

802.16 MAC Layer — Connection-Oriented Design

A defining feature of the IEEE 802.16 MAC layer is its connection-oriented architecture. Unlike the contention-based MAC of Wi-Fi (802.11), the 802.16 MAC assigns
dedicated connections to each subscriber service flow, enabling deterministic QoS guarantees. This design philosophy reflects the standard's origin as a broadband access
technology intended to deliver carrier-grade services.

Connection Concepts QoS Service Classes

All data communication in 802.16 occurs over connections, each identified by a The 802.16 MAC defines four QoS scheduling services, each tailored to a specific
unique 16-bit Connection Identifier (CID). When a subscriber station (SS) enters the traffic type:
network, it is assigned three management connections per direction (basic, primary,
• Unsolicited Grant Service (UGS): For constant bit rate (CBR) traffic like T1/E1
and secondary) for control signaling. Additional transport connections are
emulation. The BS provides fixed-size grants at periodic intervals.
established on demand for user data, with each connection associated with a
• Real-Time Polling Service (rtPS): For real-time variable bit rate (VBR) traffic
specific QoS parameter set.
like MPEG video. The BS polls the SS at regular intervals to determine
This approach allows the base station to precisely control bandwidth allocation, bandwidth needs.
scheduling priority, and traffic policing on a per-connection basis. It is • Non-Real-Time Polling Service (nrtPS): For delay-tolerant VBR traffic like FTP.
fundamentally different from the shared, contention-based access of 802.11 and The BS polls the SS at longer intervals, with contention-based requests as a
more closely resembles the virtual circuit concept of ATM. backup.
• Best Effort (BE): For traffic with no specific QoS requirements, such as web
browsing. Bandwidth is allocated after all other service classes are satisfied.
CHAPTER 11 — WIMAX

802.16 Physical Layer Options

The IEEE 802.16 standard defines multiple physical layer specifications to address different deployment scenarios, frequency bands, and propagation conditions. The choice of PHY
directly impacts system range, throughput, and resilience to multipath fading. Below is a comparison of the key PHY options defined in 802.16 and 802.16a.

Characteristic WirelessMAN-SC WirelessMAN-OFDM WirelessMAN-OFDMA

Frequency Range 10–66 GHz 2–11 GHz 2–11 GHz

Propagation Line-of-Sight (LOS) Non-Line-of-Sight (NLOS) Non-Line-of-Sight (NLOS)

Modulation Single Carrier (QPSK, 16-QAM, 64-QAM) 256-point FFT OFDM (BPSK to 64-QAM) 2048-point FFT OFDMA (BPSK to 64-QAM)

Multiple Access TDMA TDMA OFDMA (subcarrier allocation)

Channel BW 20, 25, 28 MHz 1.75 to 20 MHz (flexible) 1.75 to 20 MHz (flexible)

Duplexing TDD or FDD TDD or FDD TDD or FDD

Adaptive Modulation Yes Yes Yes (per subcarrier group)

Peak Data Rate ~134 Mbps (28 MHz) ~75 Mbps (20 MHz) ~75 Mbps (20 MHz)

Adaptive modulation and coding (AMC) is a critical feature across all PHY options. The base station continuously monitors channel quality for each subscriber and dynamically
adjusts the modulation scheme and forward error correction (FEC) code rate. Subscribers close to the base station with strong signals use high-order modulation (64-QAM) for
maximum throughput, while distant subscribers or those experiencing fading fall back to robust schemes (QPSK) that sacrifice throughput for reliability. This mechanism maximizes
aggregate system throughput while maintaining connectivity at the cell edge.
CHAPTER 11 — WIMAX

OFDM & OFDMA in 802.16

Orthogonal Frequency Division Multiplexing (OFDM) is the cornerstone technology that enabled IEEE 802.16 to operate effectively in the sub-11 GHz bands where non-
line-of-sight (NLOS) propagation and severe multipath fading are the norm. Understanding OFDM is essential for grasping how 802.16 achieves high data rates in
challenging wireless environments.

OFDM Principles OFDMA Extension

OFDM divides the available channel bandwidth into a large number of narrow, OFDMA (Orthogonal Frequency Division Multiple Access) extends OFDM by
orthogonal subcarriers. Each subcarrier carries a low-rate data stream using partitioning the subcarriers into subsets called subchannels, each of which can
conventional modulation (BPSK, QPSK, 16-QAM, or 64-QAM). The key advantage be allocated to a different subscriber. This provides a flexible multiple access
is that the symbol duration on each subcarrier is much longer than in a single- scheme that operates in the frequency domain rather than (or in addition to) the
carrier system, making the signal inherently resistant to intersymbol interference time domain.
(ISI) caused by multipath delay spread.
The 2048-point FFT OFDMA PHY in 802.16 uses this approach, enabling the
A cyclic prefix (CP) is prepended to each OFDM symbol — a copy of the end of base station to allocate bandwidth with fine granularity. Different subscribers
the symbol appended to the beginning. As long as the multipath delay spread is can receive different numbers of subchannels based on their data rate
shorter than the CP duration, ISI is completely eliminated. The 256-point FFT requirements and QoS agreements. Furthermore, because subchannels assigned
OFDM PHY in 802.16 uses 192 data subcarriers, 8 pilot subcarriers, and 56 null to a single subscriber can be distributed across the entire band (diversity
subcarriers (including guard bands), yielding a robust and spectrally efficient subchannelization) or concentrated in a contiguous block (band AMC), the
signal. system can be optimized for either diversity gain or multi-user diversity gain
depending on the deployment scenario.
CHAPTER 11 — WIMAX

The WiMAX Forum & Commercial Impact

While IEEE 802.16 defines the technical standard, the WiMAX Forum is an industry consortium that certifies equipment for interoperability, promotes
the technology, and defines system profiles. The relationship between IEEE 802.16 and WiMAX is analogous to the relationship between IEEE 802.11
and the Wi-Fi Alliance.

Interoperability Certification Coverage & Range Complementary to Wi-Fi

The WiMAX Forum defines specific WiMAX systems can provide coverage WiMAX was designed to complement,
system profiles — subsets of the full over a range of 40–50 km for fixed not compete with, Wi-Fi. A common
802.16 standard — and tests equipment (LOS) installations and 5–15 km for deployment model envisions WiMAX
against these profiles to ensure multi- NLOS urban deployments. This range is providing the broadband backhaul
vendor interoperability. This is critical orders of magnitude greater than Wi-Fi, connection from the Internet backbone
for market acceptance, as operators positioning WiMAX as a true MAN to Wi-Fi hot spots, which then serve end
need confidence that base stations technology capable of serving as a users over short ranges. WiMAX
from one vendor will work with wireless alternative to DSL, cable, and provides the "last mile" to the building or
subscriber terminals from another. T1/E1 for last-mile broadband access. hot spot; Wi-Fi provides the "last 100
meters" to the user's device.
CHAPTER 11

Chapter 11 — Key Takeaways

Cordless Evolution WLL Rationale 802.16 / WiMAX

Cordless systems have evolved from Wireless Local Loop replaces the copper IEEE 802.16 with WiMAX certification
single-user analog devices to multi-cell, last mile with radio, offering rapid provides a standards-based, interoperable
multi-user digital systems (DECT) capable deployment, lower cost, and terrain broadband wireless access solution with
of replacing office PBX systems with independence — especially valuable in QoS support, adaptive modulation, and
wireless connectivity. developing regions and rural areas. ranges up to 50 km — a true DSL/cable
alternative.
 PART II CHAPTER 12

Mobile IP & Wireless

Access Protocols
This chapter examines the protocol-level mechanisms required to enable Internet
access for mobile and wireless devices. Mobile IP extends the Internet Protocol to
support transparent host mobility, while the Wireless Application Protocol (WAP)
provides a complete protocol stack optimized for the constraints of mobile wireless
devices. Together, they form the foundational framework for mobile Internet
connectivity.
CHAPTER 12

Mobile IP — The Mobility Problem

The Internet Protocol (IP) was designed with the implicit assumption that a host's point of attachment to the network remains fixed. An IP address serves a dual purpose: it identifies
the host and specifies the host's location in the network topology (its network prefix determines the routing path). When a host moves to a different network, its IP address no longer
reflects its actual location, and packets destined for that host will be routed to the wrong network.

The Problem in Detail Mobile IP Solution Philosophy

Consider a laptop with IP address [Link] on its home corporate LAN. When the Mobile IP, standardized by the IETF in RFC 3344, provides an elegant solution that
user travels and connects to a Wi-Fi network at a hotel, the laptop is now on a maintains a mobile host's original IP address regardless of its current location, without
completely different network (e.g., 10.0.5.x). Packets sent to [Link] by a requiring changes to the global Internet routing infrastructure. The key principles are:
correspondent host will still be routed to the home corporate LAN, where the laptop no
longer resides. There are two naive solutions, both inadequate:
• The mobile host retains its home address permanently; all correspondent hosts
• Change the IP address: The mobile host obtains a new address on each visited continue to use this address.
network (via DHCP). But existing TCP connections are bound to the old address • A home agent on the home network intercepts packets destined for the mobile
and will break. Furthermore, correspondent hosts have no way to discover the new host when it is away and forwards them to its current location.
address. • The mobile host acquires a temporary care-of address on each visited network,
• Update routing tables: Propagate a host-specific route for every mobile host and this address is registered with the home agent.
across the global Internet. This is completely infeasible — it would explode the size • Tunneling (IP-in-IP encapsulation) is used to forward packets from the home agent
of routing tables and generate unmanageable update traffic. to the mobile host's care-of address, transparently to correspondent hosts.
CHAPTER 12

Mobile IP — Key Entities & Terminology

The Mobile IP architecture introduces three principal entities and several critical address concepts. Mastering this terminology is a prerequisite for
understanding the protocol's operation.

Mobile Host (MH) Home Agent (HA) Foreign Agent (FA)

The mobile device (laptop, PDA, smartphone) A router on the mobile host's home network A router on the visited (foreign) network that
that moves between networks while that maintains a mobility binding — a mapping assists the mobile host. The FA provides a
maintaining active communication sessions. between the MH's home address and its care-of address to the MH (the FA's own
The MH possesses a permanent home current care-of address. When the MH is away address serves as the CoA), de-encapsulates
address — an IP address assigned within its from home, the HA intercepts packets tunneled packets received from the HA, and
home network that remains unchanged destined for the MH's home address (using delivers them to the MH on the local network.
regardless of the MH's physical location. The proxy ARP on the home network) and tunnels Using the FA's address as the CoA avoids the
MH also acquires a temporary care-of address them to the MH's care-of address. The HA is need for the MH to obtain a unique address on
(CoA) each time it attaches to a foreign the linchpin of Mobile IP's transparency every visited network (though a co-located
network. mechanism. CoA directly assigned to the MH is also
supported).
CHAPTER 12

Mobile IP Operation — Three Phases

Mobile IP operates through three well-defined phases that collectively enable transparent host mobility. Each phase involves specific protocol messages and mechanisms
that must interoperate correctly for the system to function.

Phase 1: Agent Discovery Phase 2: Registration Phase 3: Tunneling

The mobile host must determine whether it is on its Once the MH detects it is on a foreign network, it After registration, packets from correspondent hosts
home network or a foreign network, and if on a must register its care-of address with its home are routed normally to the MH's home network. The
foreign network, it must learn the identity and care-of agent. The MH sends a Registration Request to the HA intercepts them and encapsulates each packet in
address offered by the local foreign agent. This is HA (relayed through the FA). The HA authenticates a new IP header with the care-of address as the
accomplished through Agent Advertisement the request, creates a mobility binding (home destination — this is IP-in-IP tunneling. The
messages — extensions to ICMP Router address care-of address), and returns a encapsulated packets traverse the Internet to the FA,
Advertisement messages — that are periodically Registration Reply. The registration has a finite which strips the outer header and delivers the
broadcast by home agents and foreign agents. The lifetime and must be periodically renewed. original packet to the MH. Reverse traffic from the
MH can also actively solicit advertisements using Authentication uses a shared secret and MD5-based MH is sent directly to the correspondent host via the
Agent Solicitation messages. By comparing the keyed hash (HMAC-MD5) to prevent spoofing. foreign network's default router, without traversing
network prefix in the advertisement with its own the home agent (asymmetric routing).
home address, the MH determines whether it has
moved.
CHAPTER 12

Mobile IP — Agent Discovery in Detail

Agent Discovery is the mechanism by which a mobile host detects its movement between networks and identifies available mobility agents. It extends the standard ICMP Router
Discovery protocol (RFC 1256) with mobility-specific information.

Agent Advertisement Messages Movement Detection

Home agents and foreign agents periodically broadcast Agent Advertisement messages on their The mobile host compares the network prefix advertised by the agent with its
local links. These messages are ICMP Router Advertisements with a Mobility Agent own home address prefix. If they match, the MH is on its home network and
Advertisement Extension appended. The extension contains: operates normally. If they differ, the MH has moved to a foreign network and
must initiate registration.
• Sequence number: Allows the MH to detect missed advertisements and agent reboots.
• Registration lifetime: The maximum allowed registration lifetime, in seconds. Two algorithms are defined for movement detection:
• Flags: Indicate whether the agent is a home agent (H bit), a foreign agent (F bit), supports
• Lifetime-based: If the MH has not received an advertisement from its
registration required (R bit), and other capabilities.
current agent before the advertisement lifetime expires, it assumes it
• Care-of addresses: One or more care-of addresses offered by a foreign agent. Multiple CoAs
has moved.
allow the FA to serve multiple mobile hosts or offer different service types.
• Prefix-based: The MH compares network prefixes in successive
advertisements. A change in prefix indicates movement.
Advertisements are typically sent every 1–3 seconds on fast links and less frequently on slow
links. Additionally, the MH may send an Agent Solicitation (ICMP Router
Solicitation) to actively request advertisements when it powers on or
suspects it has moved.
CHAPTER 12

Mobile IP — Registration Process

Registration is the process by which the mobile host informs its home agent of its current care-of address. This phase must be secure, as a malicious entity could redirect traffic by
forging a registration request. The protocol uses cryptographic authentication to prevent such attacks.

1 Registration Request 2 FA Relay

The MH constructs a Registration Request message containing its home address, If a foreign agent is involved, it validates the request format, stamps it with its own
the HA's address, the requested care-of address, a requested registration lifetime, information (including the FA-HA authentication extension if the FA and HA share a
and a 64-bit identification field (for replay protection). Critically, the message security association), and relays it to the HA. The FA also records the pending
includes a Mobile-Home Authentication Extension — a keyed HMAC-MD5 hash registration in its visitor list.
computed over the message using a 128-bit shared secret between the MH and
HA. This authenticates the MH to the HA and ensures message integrity. The
request is sent to the FA (or directly to the HA if using a co-located CoA).

3 HA Processing 4 Registration Reply

The home agent authenticates the request by computing the HMAC-MD5 hash with The MH receives the reply and checks its authentication extension. If the
its shared secret and comparing it to the received value. It verifies the identification registration is accepted, the MH updates its mobility state and begins forwarding
field against its replay protection window. If valid, the HA creates or updates the traffic through the foreign network. If denied, the reply includes a code indicating
mobility binding, starts a binding lifetime timer, and sends a Registration Reply the reason (e.g., authentication failure, administratively prohibited, insufficient
back to the MH (via the FA) with a status code indicating success or failure. The resources). The MH may attempt re-registration with corrected parameters.
HA may also issue gratuitous ARP on the home network to redirect traffic for the
MH's home address to itself.
CHAPTER 12

Mobile IP — Tunneling Mechanisms

Once registration is complete, the home agent must forward intercepted packets to the mobile host at its current care-of address. This is accomplished via
tunneling — encapsulating the original IP datagram inside a new IP datagram. Mobile IP supports three encapsulation methods, each with different trade-offs.

IP-in-IP Encapsulation (RFC 2003) Minimal Encapsulation (RFC GRE Encapsulation (RFC 2784)
The default and mandatory tunneling
2004) Generic Routing Encapsulation provides a
mechanism. The HA prepends a new IP Reduces overhead by combining fields from general-purpose tunneling framework that can
header to the original packet, with the care-of the original and outer headers. A minimal encapsulate any network-layer protocol inside
address as the destination and the HA's forwarding header (8 or 12 bytes) replaces the IP. The GRE header (4 bytes minimum, with
address as the source. The protocol field of full outer IP header. The original IP header is optional extensions) is inserted between the
the outer header is set to 4 (indicating the modified in place — the destination is changed outer IP header and the original packet. GRE is
payload is itself an IP datagram). This method to the CoA, and the original destination is more flexible than IP-in-IP because it supports
preserves the entire original packet, including saved in the forwarding header. This reduces additional features like key fields for tunnel
its header, allowing the MH to recover the per-packet overhead but cannot be used when identification and sequence numbers for in-
original source address and all header fields. the original packet is already fragmented (the order delivery. However, its overhead is
The overhead is 20 bytes per packet. Don't Fragment bit is effectively forced). comparable to IP-in-IP.
 CHAPTER 12
Mobile IP — Triangle Routing & Route Optimization
A well-known inefficiency of basic Mobile IP is the triangle routing problem, also called the "dog-leg" routing
problem. Understanding this issue is important because it motivates the route optimization extensions defined in
later protocol developments.
The Triangle Routing Problem

In standard Mobile IP, packets from a Correspondent

Host (CH) to the Mobile Host (MH) always travel
through the Home Agent (HA), even when the MH and
CH are on the same network or geographically close.
The path is: CH → HA → FA → MH. The return path
from MH to CH is direct: MH → CH. This asymmetric,
triangular routing is inefficient because:

• Increased latency: Every packet takes a detour

through the home network, adding potentially
significant delay, especially if the home network is
geographically distant from both the CH and MH.
• Wasted bandwidth: The HA-to-FA tunnel leg
carries traffic that could otherwise take a shorter
path, consuming bandwidth on the home
network's link and intermediate networks.
• HA bottleneck: The home agent must process and
tunnel every packet for every mobile host
registered with it, creating a potential performance
bottleneck and single point of failure.

Route Optimization Route optimization extensions (RFC 4449 for IPv4,

built-in for IPv6 Mobile IP) address triangle routing by
allowing the correspondent host to learn the mobile
host's care-of address and tunnel packets directly to it.
The HA sends a Binding Update to the CH, informing it
of the MH's CoA. The CH then caches this binding and
sends subsequent packets directly to the CoA,
This optimization introduces additional complexity — bypassing the HA entirely.
the CH must maintain a binding cache, handle binding
updates securely, and handle situations where the MH
moves again before the cache is updated.
Nevertheless, route optimization is essential for
scalable Mobile IP deployment, particularly for real-
time applications sensitive to delay.
 CHAPTER 12 WAP

Wireless Application
Protocol
The Wireless Application Protocol (WAP) is a comprehensive protocol suite
developed by the WAP Forum (now part of the Open Mobile Alliance) to provide mobile
users of wireless phones, pagers, and personal digital assistants (PDAs) with access
to telephony and information services, including the Internet and the World Wide Web.
WAP addresses the unique constraints of mobile wireless devices — limited
processing power, small displays, constrained input mechanisms, and low-bandwidth,
high-latency wireless links — by defining an optimized protocol stack that mediates
between the wireless device and the wired Internet infrastructure.
CHAPTER 12 — WAP

WAP — Motivation & Design Constraints

The WAP specification emerged from the recognition that the standard Internet protocols (HTTP, TCP, HTML) were designed for powerful desktop computers
connected via high-bandwidth, low-latency wired networks. These protocols are ill-suited to the mobile wireless environment for several fundamental reasons that
drove the WAP design.

Device Constraints Network Constraints Power Constraints

Mobile wireless devices of the era had Wireless networks of the second-generation Battery life was (and remains) a critical
extremely limited resources: processors with era provided data rates of only 9.6–14.4 kbps, concern for mobile devices. Excessive radio
clock speeds of 10–50 MHz, RAM measured with round-trip latencies of 1–10 seconds and transmission drains batteries rapidly. WAP's
in kilobytes, small monochrome or low- frequent disconnections. HTTP's verbose text- protocol optimizations — smaller messages,
resolution color displays (often 100×100 based headers and TCP's three-way fewer round trips, and binary encoding —
pixels or less), and constrained input handshake and retransmission mechanisms directly reduce radio usage and extend battery
mechanisms (numeric keypads with no imposed unacceptable overhead on these life. The protocol was designed to minimize
keyboard). Standard HTML pages designed slow, high-latency links. WAP addressed this the number of bytes exchanged for a given
for desktop browsers were utterly unusable on with a compressed binary protocol stack transaction.
these devices. WAP introduced the Wireless optimized for wireless channel
Markup Language (WML), an XML-based characteristics.
markup language designed specifically for
small screens and limited input capabilities.
CHAPTER 12 — WAP

WAP Protocol Architecture

The WAP protocol stack is a layered architecture that mirrors the structure of the Internet protocol stack but replaces each layer with a wireless-optimized equivalent. A central
component of the architecture is the WAP Gateway (proxy), which serves as an intermediary between the wireless domain and the wired Internet, performing protocol translation and
content transcoding.
CHAPTER 12 — WAP
WAP Protocol Layers — Detailed Examination
Each layer of the WAP stack is designed to address the specific challenges of mobile wireless communication while maintaining
functional equivalence with corresponding Internet protocols. Below, we examine each layer from bottom to top.
Wireless Datagram Protocol (WDP)
WDP provides a consistent datagram transport interface to the upper layers, abstracting the diversity of underlying wireless bearer
services (GSM SMS, GSM CSD, CDMA packet data, GPRS, CDPD, etc.). WDP is functionally equivalent to UDP in the Internet world.
When the bearer is IP-capable, WDP maps directly to UDP. For non-IP bearers like SMS, WDP provides an adaptation layer. This
insulates the rest of the WAP stack from bearer-specific details, enabling WAP to run over virtually any wireless network.
Wireless Transport Layer Security (WTLS)
WTLS provides authentication, data integrity, and privacy services, equivalent to TLS/SSL in the Internet stack. It is optimized for
wireless use with compressed certificate formats, session caching to avoid repeated handshakes, and support for datagram
transport (unlike TLS, which requires TCP). WTLS supports multiple cipher suites and can be selectively invoked — not all WAP
sessions require encryption. A critical architectural note: the WAP Gateway decrypts WTLS traffic and re-encrypts it as TLS for
the onward connection to the origin server, creating a brief "gap" in end-to-end security at the gateway.
Wireless Transaction Protocol (WTP)
WTP provides transaction-level reliability, equivalent to a lightweight subset of TCP. It supports three transaction classes:
unreliable push (Class 0), reliable push (Class 1, with acknowledgment), and reliable request-response (Class 2, the most
common). WTP eliminates much of TCP's overhead — there is no explicit connection setup or teardown, and the
acknowledgment mechanism is simpler. WTP also supports asynchronous transactions and message concatenation to
reduce the number of messages exchanged.
Wireless Session Protocol (WSP)
WSP provides session management capabilities, equivalent to HTTP at the application layer but with significant
enhancements for wireless use. WSP supports both connection-mode (over WTP) and connectionless (over WDP)
operation. Key features include binary encoding of HTTP headers (reducing message size by up to 50%), session
suspend/resume capabilities (allowing a session to survive temporary loss of connectivity), and push functionality
(enabling servers to send unsolicited content to the device). WSP also supports content negotiation, allowing the client and
server to agree on data formats.
Wireless Application Environment (WAE)
WAE is the application-level framework, providing the user-facing functionality. It includes the WML micro-browser (rendering
WML pages), WMLScript (a lightweight scripting language similar to JavaScript), and Wireless Telephony Application
Interface (WTAI) (enabling WML pages to initiate phone calls and access phone book entries). WAE specifications ensure
that content can be efficiently delivered to and displayed on devices with the constraints described earlier.
 CHAPTER 12 — WAP

The WAP Gateway — Protocol Translation Engine

The WAP Gateway (also called the WAP proxy) is the architectural keystone that bridges the wireless and wired worlds. It sits between the mobile device and the Internet,
performing real-time protocol translation so that the mobile device communicates using lightweight WAP protocols while the Internet server communicates using standard
HTTP/TCP/IP.

Gateway Functions

• Protocol translation: Converts WSP requests into HTTP requests

and vice versa. Binary-encoded WSP headers are expanded into
text-based HTTP headers for the origin server, and responses are
compressed back into binary for the wireless device.
• Content encoding: Compiles WML source from the origin server
into compact binary WML (WBXML) for efficient transmission over
the wireless link. This binary encoding can reduce content size by
40–60%.
Security Considerations
• WMLScript compilation: Compiles WMLScript from the server into
bytecode that can be interpreted by the device's WMLScript virtual The WAP Gateway introduces a well-known security concern: the "WAP gap." Because
machine. WTLS terminates at the gateway and a separate TLS/SSL session is established from

• Image transcoding: Converts standard Web images (JPEG, GIF, the gateway to the origin server, there is a brief moment when data exists in plaintext
within the gateway's memory. This means that the gateway operator (typically the
PNG) into the Wireless Bitmap (WBMP) format suitable for the
mobile network operator) theoretically has access to the unencrypted data. For highly
device's display capabilities.
sensitive transactions (e.g., banking), this necessitates trust in the gateway operator or
• Caching: Caches frequently requested content to reduce latency
end-to-end application-layer encryption that bypasses the WAP security model entirely.
and wireless network load. WAP 2.0 addressed this by moving to a direct TCP/TLS model that eliminates the gateway-based
security translation, enabling true end-to-end encryption between the device and the origin server.
CHAPTER 12 — WAP

WML — Wireless Markup Language

The Wireless Markup Language is an XML-based content markup language designed for specifying content and user interface for mobile wireless devices. WML
introduced the concept of decks and cards, a metaphor that organizes content into small, screen-sized units optimized for limited display areas.

Deck and Card Model Key WML Features

A WML document is called a deck, which is the unit of content transferred in a • Text and image display: WML supports formatted text (bold, italic, line
single HTTP/WSP transaction. A deck contains one or more cards, each breaks, paragraphs) and WBMP images. No support for the rich formatting
representing a single screen of information or user interaction. Navigation of HTML — by design.
between cards within a deck is instantaneous (no network round trip required) • User input: Input elements (text fields, select lists, option groups) are
because the entire deck is resident on the device. Navigation to a different deck optimized for keypad input, including soft-key bindings that map to physical
requires a new network request. device buttons.
• Variables: WML supports variables that can be set and referenced across
This model is a direct response to the high latency of wireless networks: by
cards, enabling simple state management within a deck.
bundling multiple screens into a single download, the perceived responsiveness
• Event handling: Cards can respond to events such as timer expiration, card
of the application is dramatically improved. A well-designed WML application
entry, and card exit, triggering navigation or variable assignments.
pre-loads likely next screens into the initial deck, minimizing the number of over-
• Tasks: WML defines four tasks: go (navigate to a URL), prev (return to
the-air transactions.
previous card), refresh (re-display the current card with updated variables),
and noop (do nothing).
CHAPTER 12

Chapter 12 — Key Takeaways

Mobile IP WAP Stack WAP Gateway

Mobile IP solves the host mobility problem WAP provides a complete, wireless- The WAP Gateway bridges wireless and
by introducing home agents, foreign optimized protocol stack (WDP, WTLS, Internet domains by performing protocol
agents, and care-of addresses, using IP-in- WTP, WSP, WAE) that addresses the translation, content transcoding, and
IP tunneling to transparently redirect constraints of mobile devices and wireless caching, though it introduces the "WAP
packets to a mobile host's current location networks through binary encoding, reduced gap" security concern addressed in WAP
without changing its permanent IP address. round trips, and session management. 2.0.
 PART III CHAPTER 14

IEEE 802.11 — Wi-Fi

Standard
The IEEE 802.11 family of standards defines the most widely deployed wireless LAN
technology in the world. This chapter examines the IEEE 802 protocol architecture
that underpins all IEEE LAN standards, the 802.11 Medium Access Control (MAC)
layer with its distributed and point coordination functions, and the 802.11 Physical
(PHY) layer specifications including FHSS, DSSS, OFDM, and HR-DSSS. Together,
these constitute the technical foundation of Wi-Fi networking.
CHAPTER 14

IEEE 802 Protocol Architecture

All IEEE 802 LAN and MAN standards share a common protocol architecture that maps to the lower two layers of the OSI reference model. This architecture provides a uniform
framework for wired Ethernet (802.3), Token Ring (802.5), wireless LANs (802.11), and other IEEE 802 standards, enabling them to interoperate through bridges and switches.

LLC
1 Logical Link Control

MAC
2
Medium Access Control

PHY
3
Physical Layer

The IEEE 802 architecture divides the OSI Data Link Layer into two sublayers: the Logical Link Control (LLC) sublayer (defined in IEEE 802.2) and the Medium Access Control (MAC)
sublayer. The LLC is common across all IEEE 802 standards and provides a uniform interface to higher-layer protocols (IP, IPX, etc.) regardless of the underlying LAN technology.
The MAC sublayer is specific to each LAN type and handles the rules governing how stations gain access to the shared medium. The Physical (PHY) layer handles the actual
transmission of bits over the medium — encoding, modulation, and signal timing.

This separation has a profound practical benefit: network-layer protocols like IP need not be modified when the underlying LAN technology changes. A station can move from an
Ethernet LAN to a Wi-Fi LAN, and as long as the LLC interface remains consistent, IP and its associated protocols continue to operate without modification.
CHAPTER 14

IEEE 802 — LLC, MAC, and PHY Functions

Understanding the precise responsibilities of each sublayer in the IEEE 802 architecture is essential for appreciating how wireless LAN standards like 802.11 fit into the broader
networking landscape. Each sublayer has clearly defined functions that, together, provide reliable data link service over a shared medium.

Logical Link Control (802.2) Medium Access Control Physical Layer

The LLC sublayer provides the interface between the The MAC sublayer governs access to the shared The PHY layer handles signal encoding/decoding, bit
network layer and the MAC sublayer. It offers three transmission medium and provides addressing and timing and synchronization, and interaction with the
types of service: Type 1 (unacknowledged error detection. Each station has a globally unique 48- transmission medium (in 802.11's case, radio waves
connectionless — the most commonly used for IP bit MAC address. The MAC sublayer assembles data or infrared). The PHY is divided into two sublayers:
traffic), Type 2 (connection-oriented with flow and into frames with address and error-detection fields the Physical Layer Convergence Procedure (PLCP),
error control), and Type 3 (acknowledged (FCS — Frame Check Sequence using CRC-32), and which maps MAC frames into a frame format suitable
connectionless). LLC uses Service Access Points disassembles received frames, performing address for transmission, and the Physical Medium
(SAPs) to identify the higher-layer protocol being recognition and error detection. Critically, the MAC Dependent (PMD) sublayer, which handles the actual
served — functionally equivalent to the protocol field defines the access control protocol — the algorithm modulation and transmission/reception of signals.
in an Ethernet II frame. The LLC header contains by which stations decide when they may transmit. For Multiple PHY specifications can coexist under the
Destination SAP (DSAP), Source SAP (SSAP), and a 802.11, this is the Distributed Coordination Function same MAC — a key design feature exploited by
control field that specifies the PDU type. (DCF) and the Point Coordination Function (PCF). 802.11's numerous PHY options (a, b, g, etc.).
CHAPTER 14

IEEE 802.11 — Architecture & Topologies

Before examining the MAC and PHY layers in detail, it is important to understand the network topologies and architectural components defined by the 802.11 standard.
The standard defines two fundamental modes of operation and several key architectural elements.

Infrastructure Mode (BSS) Ad Hoc Mode (IBSS)

In infrastructure mode, wireless stations communicate through an Access Point In ad hoc mode (Independent BSS or IBSS), stations communicate directly with
(AP). The AP and its associated stations form a Basic Service Set (BSS). All each other without an access point. Any station within range of another can
traffic within the BSS passes through the AP — even traffic between two stations communicate directly. The IBSS is self-contained — there is no connection to a
in the same BSS is relayed by the AP. Multiple BSSs can be connected through a wired network. Ad hoc mode is useful for spontaneous, temporary networks (e.g.,
Distribution System (DS) — typically a wired Ethernet backbone — forming an a group of laptops in a conference room sharing files). However, ad hoc mode
Extended Service Set (ESS). The ESS appears as a single logical LAN to higher- lacks the management and infrastructure capabilities of BSS mode and is less
layer protocols. Stations can roam between BSSs within an ESS with transparent commonly deployed in production environments.
handover.
CHAPTER 14

802.11 Services
The IEEE 802.11 standard defines nine services that collectively provide the functionality needed for a wireless LAN to operate within the IEEE 802 framework. These services are
divided into two categories: station services (provided by every station) and distribution system services (provided by the distribution system, typically through the AP).

Station Services Distribution System Services

• Authentication: Establishes the identity of stations to each other. 802.11 defines • Association: Establishes the relationship between a station and an AP, enabling
Open System authentication (essentially null) and Shared Key authentication (using the DS to route frames to the station. A station must associate with exactly one AP
WEP). WPA and WPA2 (802.11i) later replaced these with robust IEEE 802.1X- at a time.
based authentication. • Disassociation: Terminates an association. A station should disassociate before
• Deauthentication: Terminates an existing authentication relationship, typically leaving a BSS, though the AP must also handle abrupt departures.
preceding disassociation. • Reassociation: Transfers an existing association from one AP to another — the
• Privacy: Prevents eavesdropping on data traffic. Originally provided by WEP (Wired mechanism that enables roaming within an ESS. The new AP communicates with
Equivalent Privacy), later superseded by TKIP (WPA) and CCMP/AES the old AP (via the DS) to transfer the station's context.
(WPA2/802.11i). • Distribution: The primary DS service — determines how to deliver a frame within
• MAC Service Data Unit (MSDU) delivery: The fundamental data transfer service — the DS. If the destination is in the same BSS, the AP delivers it locally; if in a
delivering a MAC service data unit (the payload) from one station to one or more different BSS, the DS routes it to the appropriate AP.
destination stations. • Integration: Enables delivery of frames between the 802.11 network and a non-
802.11 LAN (e.g., Ethernet) connected via the DS. Performs any necessary address
and frame format translation.
CHAPTER 14

802.11 MAC Layer — Overview

The 802.11 MAC layer is the heart of the Wi-Fi standard, governing how stations share the wireless medium. Unlike wired Ethernet (802.3), which
uses CSMA/CD (Carrier Sense Multiple Access with Collision Detection), wireless networks cannot directly detect collisions because a station's own
transmission drowns out any simultaneous incoming signal. This fundamental constraint led to the development of a collision avoidance mechanism
rather than collision detection.

The 802.11 MAC defines two coordination functions:

Distributed Coordination Function (DCF) Point Coordination Function (PCF)

The mandatory, default access method. DCF is a contention-based An optional, contention-free access method available only in
protocol using CSMA/CA (Carrier Sense Multiple Access with infrastructure mode. PCF uses a centralized polling mechanism
Collision Avoidance). All stations compete for access to the medium controlled by the AP (acting as the Point Coordinator). The AP grants
using the same distributed algorithm — no central controller is individual stations permission to transmit during a contention-free
required. DCF is the only MAC mechanism that operates in both period (CFP), enabling deterministic medium access suitable for time-
infrastructure and ad hoc modes. sensitive traffic. PCF operates on top of DCF and alternates with
contention periods.
CHAPTER 14 — MAC

DCF — CSMA/CA Mechanism

The Distributed Coordination Function implements a listen-before-talk protocol that attempts to avoid collisions rather than detect them. The algorithm is elegant in its simplicity but
includes several critical mechanisms to ensure fair and reliable medium access in the challenging wireless environment.

1 Carrier Sensing 2 Interframe Spacing (IFS)

Before transmitting, a station must sense whether the medium is idle. 802.11 After the medium becomes idle, a station must wait for a specified interframe space
employs two complementary carrier sensing mechanisms: physical carrier sensing before attempting to transmit. Different IFS values create a priority hierarchy: SIFS
(the PHY layer detects energy on the medium) and virtual carrier sensing (the MAC (Short IFS, ~10 μs) for highest-priority frames like ACKs and CTS; DIFS (DCF IFS, ~50
layer reads the Duration field in received frame headers to determine how long the μs) for regular data frames; and EIFS (Extended IFS) after an erroneous frame is
medium will be busy). The virtual carrier sense mechanism maintains a Network received. Because SIFS < DIFS, acknowledgment frames always win access over new
Allocation Vector (NAV) — a timer that counts down to zero. When the NAV is non- data frames, ensuring the reliability mechanism functions correctly.
zero, the medium is considered busy regardless of what the physical layer senses.
This dual mechanism provides robust medium occupancy detection.

3 Random Backoff 4 Positive Acknowledgment

If the medium is busy when a station wishes to transmit, or after the IFS wait, the Every unicast data frame must be acknowledged with an ACK frame sent by the
station enters a random backoff procedure. It selects a random integer from the receiver after a SIFS interval. If the sender does not receive an ACK within a timeout
range [0, CW] (where CW is the Contention Window) and counts down by one for period, it assumes the frame was lost (due to collision or channel error) and
each idle slot time. When the counter reaches zero, the station transmits. If a retransmits. This positive acknowledgment mechanism is essential because, unlike
collision occurs (detected by the absence of an ACK), CW is doubled (binary wired CSMA/CD, the sender cannot detect collisions during transmission and has no
exponential backoff), up to a maximum value, and the process repeats. This other way to determine whether the frame was successfully received.
randomization distributes transmissions in time, reducing the probability of repeated
collisions.
CHAPTER 14 — MAC

The Hidden Station Problem & RTS/CTS

One of the most significant challenges unique to wireless LANs is the hidden station problem, which arises because wireless stations have limited transmission range and cannot
always hear each other. The RTS/CTS mechanism is the 802.11 solution to this problem.

The Problem RTS/CTS Solution

Consider three stations: A, B, and C. Station B is within range of both A and C, but A and The 802.11 standard defines an optional Request-to-Send / Clear-to-Send (RTS/CTS)
C are out of range of each other. If A is transmitting to B, station C cannot hear A's exchange that mitigates the hidden station problem:
transmission (the medium appears idle to C). If C then begins transmitting to B, a
1. The source station sends a short RTS frame to the destination, indicating the
collision occurs at B — but neither A nor C is aware of it.
intended duration of the data exchange.
This is called the "hidden station" problem because A is hidden from C (and vice versa). 2. The destination responds with a CTS frame, also containing the duration
Standard carrier sensing fails because it relies on the ability to hear other information.
transmissions, which is not always possible in a wireless environment with limited 3. All stations that hear either the RTS or the CTS set their NAV to the indicated
range. duration, deferring their own transmissions.
4. The source then transmits the data frame, and the destination replies with an ACK.

Because the CTS is sent by the destination (which is within range of the hidden station),
the hidden station hears the CTS and defers. The overhead of RTS/CTS makes it most
efficient for long data frames; a configurable RTS Threshold allows stations to use
RTS/CTS only for frames exceeding a specified length.
CHAPTER 14 — MAC

DCF Timing — Frame Exchange Sequences

The precise timing relationships between frames, interframe spaces, and backoff periods are fundamental to the correct operation of the DCF. The 802.11 standard
defines several frame exchange sequences with increasing levels of protection.

1 2 3

Basic Access RTS/CTS Access Fragmentation

Sequence: DATA → SIFS → ACK Sequence: RTS → SIFS → CTS → SIFS → DATA Sequence: RTS → CTS → Frag1 → ACK → Frag2
The simplest exchange. The source waits for → SIFS → ACK → ACK → ...
DIFS + backoff, transmits the data frame, and The four-frame exchange that mitigates the When a data frame exceeds the fragmentation
the receiver acknowledges after SIFS. If no ACK hidden station problem. The RTS and CTS threshold, it is broken into fragments. Each
is received within the ACK timeout, the source frames reserve the medium for the entire fragment is individually acknowledged. The
retransmits with an increased contention exchange duration. All stations hearing either entire fragment burst is protected by the initial
window. This sequence is vulnerable to the the RTS or CTS defer by setting their NAV. The RTS/CTS exchange (the NAV covers the full
hidden station problem. overhead of the two extra frames (RTS + CTS) is burst duration). This is beneficial when the
justified when the data frame is long, because a wireless channel has a high bit error rate,
collision during data transmission wastes more because shorter fragments are less likely to
time than a collision during the short RTS frame. contain errors, reducing the amount of data that
must be retransmitted.
CHAPTER 14 — MAC

Point Coordination Function (PCF)

The Point Coordination Function is an optional, centrally controlled access mechanism that provides contention-free service. PCF is designed to support time-bounded
delivery for applications such as voice and video that require predictable access to the medium. PCF is only available in infrastructure mode and is built on top of DCF.

How PCF Works PCF Priority Mechanism

The AP acts as the Point Coordinator (PC) and alternates between contention-free periods PCF achieves priority over DCF through the interframe space hierarchy.
(CFP) and contention periods (CP). This alternation is governed by a superframe structure The PC uses PIFS (PCF IFS), which is shorter than DIFS but longer than
defined by the CFP repetition interval. SIFS:

1. The PC initiates a CFP by transmitting a Beacon frame containing the maximum CFP SIFS < PIFS < DIFS
duration. All stations set their NAV to this duration, preventing contention-based access
Because the PC waits only PIFS after the medium becomes idle, it can
during the CFP.
seize the medium before any DCF station (which must wait DIFS +
2. During the CFP, the PC polls individual stations using CF-Poll frames. A polled station
backoff). This ensures that the CFP always begins on time, even in a busy
may transmit one frame in response. The PC can combine polling with data delivery
network.
using Data+CF-Poll frames.
3. If a polled station has no data to send, it responds with a Null frame. If no response is Practical Note: Despite its theoretical advantages, PCF is rarely
received within a PIFS interval, the PC moves to the next station on its polling list. implemented in commercial 802.11 products. The more recent 802.11e
4. The PC terminates the CFP by transmitting a CF-End frame, which resets all stations' amendment (Wi-Fi Multimedia / WMM) introduced the Enhanced
NAVs to zero, initiating the contention period. Distributed Channel Access (EDCA) and HCF Controlled Channel Access
(HCCA) mechanisms that provide more effective QoS without the
limitations of PCF.
CHAPTER 14 — MAC

802.11 MAC Frame Format

The 802.11 MAC frame format is more complex than the Ethernet (802.3) frame format because it must accommodate the additional requirements of wireless communication, including
multiple addressing modes, fragmentation, power management, and frame sequencing. Understanding the frame format is essential for protocol analysis and debugging.

Field Size (bytes) Description

Frame Control 2 Protocol version, frame type/subtype (management, control, data), To DS, From DS, More Fragments,
Retry, Power Management, More Data, Protected Frame, Order.

Duration/ID 2 Duration value used to set NAV timers at receiving stations, or Association ID in PS-Poll frames.

Address 1 6 Receiver address — the MAC address of the intended immediate recipient of the frame on the wireless
medium.

Address 2 6 Transmitter address — the MAC address of the station that transmitted the frame onto the wireless
medium.

Address 3 6 Additional address — meaning depends on To DS and From DS bits. Can be the source, destination, or
BSSID.

Sequence Control 2 Contains 12-bit sequence number (for duplicate detection) and 4-bit fragment number (for fragment
reassembly).

Address 4 6 Used only in wireless distribution system (WDS) frames, where both To DS and From DS bits are set.

Frame Body 0–2312 The payload — contains the MSDU (MAC Service Data Unit) or a portion thereof if fragmented.

FCS 4 Frame Check Sequence — 32-bit CRC over all header fields and the frame body for error detection.

Four-address mechanism: The use of up to four MAC addresses in a single frame is necessitated by the BSS architecture. In infrastructure mode, frames traveling from a wireless
station to the AP and then to another wireless station require distinct source, destination, transmitter, and receiver addresses. The To DS and From DS bits in the Frame Control field
determine the interpretation of the four address fields, accommodating all possible routing scenarios within and between BSSs.
CHAPTER 14 — MAC

802.11 Frame Types

The IEEE 802.11 standard defines three major categories of frames, each serving a distinct purpose in the operation of the wireless LAN. The frame
type is encoded in the Type and Subtype fields of the Frame Control header.

Management Frames Control Frames Data Frames

Used for establishing and maintaining Support the delivery of data frames through Carry the actual user payload (MSDU)
communication. Management frames are the MAC access protocol mechanisms. across the wireless link. Data frames are
never relayed by the AP to the DS — they Control frames are always short (no frame the only frame type that can be forwarded
are consumed locally. Key subtypes body) to minimize medium occupancy. Key beyond the BSS through the distribution
include: Beacon (periodic broadcast by AP subtypes include: RTS (Request to Send), system. Several subtypes exist for
advertising the BSS), Probe CTS (Clear to Send), ACK combining data delivery with control
Request/Response (active scanning), (Acknowledgment), CF-End (end of functions: Data (simple data), Data+CF-Ack
Authentication/Deauthentication, contention-free period), and PS-Poll (Power (data with piggybacked acknowledgment),
Association/Disassociation/Reassociation Save Poll — sent by a station waking from Data+CF-Poll (data with poll for PCF), Null
Request/Response. Management frames power-save mode to request buffered (no data — used for power management
carry the SSID, supported data rates, and frames from the AP). signaling and poll responses).
capability information needed for a station
to discover and join a BSS.
 CHAPTER 14 PHYSICAL LAYER

802.11 Physical Layer

The IEEE 802.11 standard defines multiple physical layer specifications to
accommodate different frequency bands, data rates, and deployment environments.
The MAC layer is designed to operate identically regardless of which PHY is in use,
thanks to the PLCP convergence sublayer. This section examines the original and
extended PHY options: FHSS, DSSS, OFDM (802.11a), and HR-DSSS (802.11b), as well
as the 802.11g extension that combined OFDM with backward compatibility.
CHAPTER 14 — PHY

802.11 PHY Layer Architecture

Every 802.11 PHY specification follows a common two-sublayer architecture that cleanly separates medium-independent functions from medium-
dependent functions. This architectural consistency enables the MAC layer to remain agnostic to the underlying transmission technology.

Physical Layer Convergence Procedure (PLCP) Physical Medium Dependent (PMD)

The PLCP sublayer provides the interface between the MAC and the The PMD sublayer handles the actual transmission and reception of
PMD. Its primary function is to map MAC Protocol Data Units (MPDUs) signals over the wireless medium. It defines the modulation scheme,
into a frame format suitable for transmission by the PMD sublayer. The operating frequency, signal characteristics, and the interface to the
PLCP prepends a PLCP preamble and PLCP header to each MPDU. The antenna. For wireless PHYs, this includes the spread spectrum or OFDM
preamble provides synchronization (allows the receiver to lock onto the modulation parameters, transmit power levels, receiver sensitivity
incoming signal, establishing bit timing and frequency reference). The thresholds, and channel specifications. The PMD sublayer also defines
header carries information needed by the receiver to decode the frame, the Clear Channel Assessment (CCA) mechanism — the physical carrier
including the data rate, frame length, and a header error check (HEC). sensing function that the MAC uses to determine whether the medium is
Each PHY specification defines its own unique PLCP preamble and idle. CCA can use energy detection (measuring total power on the
header format, optimized for the modulation scheme in use. channel), carrier detection (detecting the presence of a valid 802.11
signal), or a combination of both.
CHAPTER 14 — PHY

Frequency Hopping Spread Spectrum (FHSS) PHY

The original IEEE 802.11 standard (1997) defined an FHSS physical layer operating in the 2.4 GHz ISM band. While FHSS has been largely superseded by DSSS
and OFDM in modern Wi-Fi, understanding its operation provides valuable insight into spread spectrum principles applied to networking.

Technical Specifications Operation Principles

• Frequency band: 2.4000–2.4835 GHz (ISM band) In FHSS, the transmitter and receiver synchronize to a common
• Number of channels: 79 channels, 1 MHz apart (in North America and most of hopping pattern — a pseudorandom sequence that determines the
Europe) carrier frequency for each time interval (hop). All stations in a BSS
• Hopping rate: ≥ 2.5 hops/second (minimum dwell time of 390 ms per channel) use the same hopping sequence, synchronized via the Beacon
• Modulation: 2-level GFSK (Gaussian Frequency Shift Keying) at 1 Mbps; 4-level frame's timestamp and hopping parameters.
GFSK at 2 Mbps
The key advantage of FHSS is its inherent resistance to narrowband
• Data rates: 1 Mbps (mandatory), 2 Mbps (optional)
interference and its ability to coexist with other systems in the ISM
• Hop sequences: 78 hopping sequences defined, divided into 3 sets of 26. BSSs
band. If a particular frequency is experiencing interference, the
using sequences from different sets minimize mutual interference.
system hops away from it within a fraction of a second. However, the
low data rate (max 2 Mbps) and the overhead of synchronizing hop
patterns limited FHSS's commercial success, and it was eventually
eclipsed by DSSS-based implementations.
CHAPTER 14 — PHY

Direct Sequence Spread Spectrum (DSSS) PHY

The original 802.11 standard also defined a DSSS physical layer, which became the dominant implementation for first-generation Wi-Fi products. DSSS
operates in the same 2.4 GHz ISM band as FHSS but uses a fundamentally different spreading technique.

Technical Specifications Spreading with Barker Code

• Frequency band: 2.4000–2.4835 GHz (ISM band) In DSSS, each data bit is multiplied by a high-rate spreading code (the 11-
• Channels: 14 channels, each 22 MHz wide, with center frequencies chip Barker sequence: +1, −1, +1, +1, −1, +1, +1, +1, −1, −1, −1) before
spaced 5 MHz apart. Only 3 non-overlapping channels (1, 6, 11 in modulation. This spreads the narrowband data signal across the full 22
North America) are available. MHz channel bandwidth, creating a wideband signal with low spectral
• Spreading code: 11-chip Barker sequence applied to each data bit, power density. At the receiver, the same Barker code is applied to
spreading the signal bandwidth by a factor of 11 despread the signal, concentrating the energy back into the original data
• Modulation: DBPSK (Differential Binary Phase Shift Keying) at 1 Mbps; bandwidth while spreading any narrowband interference across the full 22
DQPSK (Differential Quadrature PSK) at 2 Mbps MHz, effectively reducing its power by a factor of 11 (10.4 dB processing
• Chip rate: 11 Mchips/s gain).
• Data rates: 1 Mbps (mandatory), 2 Mbps (optional)
The Barker sequence was chosen for its excellent autocorrelation
properties — the correlation peak is sharp and the sidelobes are small,
minimizing intersymbol interference and enabling accurate timing recovery
at the receiver.
CHAPTER 14 — PHY

High Rate DSSS (HR-DSSS) — IEEE 802.11b

The IEEE 802.11b amendment (1999) extended the original DSSS PHY to support data rates of 5.5 and 11 Mbps while maintaining backward compatibility with the 1 and 2 Mbps
DSSS rates. 802.11b was the standard that launched the commercial Wi-Fi revolution, making wireless LANs practical for mainstream enterprise and consumer deployment.

Complementary Code Keying (CCK) Multirate Support & Dynamic Rate PLCP Preamble Options
The key innovation in 802.11b is the use of Switching 802.11b defines two PLCP preamble options: a long
Complementary Code Keying (CCK) instead of the 802.11b stations automatically negotiate the highest preamble (144 bits at 1 Mbps, compatible with
Barker code for spreading at the higher data rates. mutually supported data rate and dynamically adjust original 802.11 DSSS) and a short preamble (72 bits
CCK uses complex complementary codes of length the rate based on channel conditions — a at 1 Mbps) that reduces overhead and improves
8 chips as the spreading sequence. The specific mechanism called dynamic rate shifting. When throughput. The short preamble was introduced
code used for each symbol is determined by the signal quality degrades (e.g., as a station moves because the long preamble's 144-μs duration
data bits being transmitted, encoding multiple bits farther from the AP), the station falls back to a lower constituted a significant overhead penalty at the
per symbol. At 5.5 Mbps, 4 data bits select one of 16 rate (11 → 5.5 → 2 → 1 Mbps) to maintain higher 11 Mbps data rate. Stations must support the
complex code words (with an additional 4 chips of connectivity. This graceful degradation ensures that long preamble for backward compatibility; short
spreading). At 11 Mbps, 8 data bits select one of coverage area is maximized at the cost of reduced preamble support is optional.
256 code words. The chip rate remains 11 Mchips/s, throughput at the cell edge, analogous to the
maintaining the same 22 MHz channel bandwidth adaptive modulation concept in 802.16.
and ensuring coexistence with original DSSS
equipment.
CHAPTER 14 — PHY

OFDM PHY — IEEE 802.11a

The IEEE 802.11a amendment (1999) defined a high-speed PHY operating in the 5 GHz Unlicensed National Information Infrastructure (UNII) band using Orthogonal Frequency
Division Multiplexing (OFDM). 802.11a was a significant leap forward, offering data rates up to 54 Mbps — a five-fold increase over 802.11b.

Technical Specifications OFDM Advantages at 5 GHz

• Frequency band: 5.15–5.35 GHz and 5.725–5.825 GHz (UNII bands) The 5 GHz band offers several advantages over 2.4 GHz: significantly more available
• Channel bandwidth: 20 MHz spectrum (up to 300 MHz vs. 83.5 MHz), less interference from consumer devices
• Number of subcarriers: 52 (48 data + 4 pilot) (microwave ovens, Bluetooth, cordless phones all operate at 2.4 GHz), and more non-
• Subcarrier spacing: 312.5 kHz (20 MHz / 64 FFT points) overlapping channels (up to 12 or more vs. 3). The use of OFDM provides excellent
• OFDM symbol duration: 4 μs (3.2 μs useful + 0.8 μs guard interval/CP) multipath resilience through the cyclic prefix mechanism, enabling robust operation in
• Modulation per subcarrier: BPSK, QPSK, 16-QAM, or 64-QAM indoor environments with significant multipath delay spread.
• FEC coding: Convolutional coding at rates 1/2, 2/3, or 3/4
The combination of multiple modulation levels and FEC code rates yields eight
• Data rates: 6, 9, 12, 18, 24, 36, 48, 54 Mbps
possible data rate configurations, from a robust 6 Mbps (BPSK, rate 1/2) to a high-
throughput 54 Mbps (64-QAM, rate 3/4). As with 802.11b, stations dynamically select
the highest sustainable rate based on current channel conditions.

The primary disadvantage of 802.11a is reduced range compared to 802.11b at the

same transmit power, because higher-frequency signals experience greater path loss
and are more heavily attenuated by walls and obstacles.
CHAPTER 14 — PHY

802.11a — OFDM Data Rate Configurations

The flexibility of the OFDM PHY in IEEE 802.11a is achieved through adaptive modulation and coding. By varying the modulation order and FEC code rate, the system supports
eight distinct data rate configurations. Understanding these configurations is essential for link budget analysis and network capacity planning.

Rate (Mbps) Modulation Code Rate Coded Bits/Subcarrier Data Bits/OFDM Symbol

6 BPSK 1/2 1 24

9 BPSK 3/4 1 36

12 QPSK 1/2 2 48

18 QPSK 3/4 2 72

24 16-QAM 1/2 4 96

36 16-QAM 3/4 4 144

48 64-QAM 2/3 6 192

54 64-QAM 3/4 6 216

Each OFDM symbol carries data on 48 subcarriers simultaneously. At the highest rate (54 Mbps), each subcarrier uses 64-QAM (6 bits per symbol) with a rate-3/4 convolutional
code, yielding 216 data bits per 4-μs OFDM symbol (216 bits / 4 μs = 54 Mbps). At the most robust rate (6 Mbps), each subcarrier uses BPSK (1 bit per symbol) with a rate-1/2
code, yielding only 24 data bits per symbol but with maximum error protection for challenging channel conditions. The 6 and 12 Mbps rates are mandatory; all others are optional.
CHAPTER 14 — PHY

IEEE 802.11g — Bridging 2.4 GHz and OFDM

The IEEE 802.11g amendment (2003) brought the high-speed OFDM modulation of 802.11a into the 2.4 GHz band, combining the throughput advantages of OFDM with
the superior range and wall-penetration characteristics of the 2.4 GHz frequency, while maintaining full backward compatibility with the massive installed base of
802.11b equipment.

Data Rates: Up to 54 Mbps Backward Compatibility Additional Optional Modes

802.11g supports all eight OFDM data rates (6– Full backward compatibility with 802.11b is 802.11g also defines optional modulation
54 Mbps) from 802.11a, plus the four achieved by supporting the original modes: PBCC (Packet Binary Convolutional
CCK/DSSS rates (1–11 Mbps) from 802.11b. DSSS/CCK modulation alongside OFDM. Coding) at 22 and 33 Mbps, and DSSS-OFDM (a
Mandatory rates include 1, 2, 5.5, 6, 11, 12, and However, this comes at a cost: when an hybrid mode using DSSS preamble with OFDM
24 Mbps. This dual-mode capability allows 802.11b station is associated with an payload). However, these optional modes were
802.11g APs to simultaneously serve both 802.11g AP, the AP must use protection rarely implemented by commercial products,
legacy 802.11b clients and new 802.11g clients. mechanisms (RTS/CTS with DSSS/CCK, or and the market standardized on the mandatory
CTS-to-self) before OFDM transmissions, to OFDM/CCK dual-mode operation.
ensure that legacy stations can update their
NAV. This overhead reduces the effective
throughput for all stations in a mixed
802.11b/g network.
CHAPTER 14 — PHY

Comparison of 802.11 PHY Specifications

The following table provides a comprehensive comparison of the major 802.11 physical layer specifications covered in the textbook. This summary is invaluable for understanding the
trade-offs between different Wi-Fi implementations and their suitability for various deployment scenarios.

Parameter 802.11 FHSS 802.11 DSSS / 802.11b 802.11a 802.11g

Frequency 2.4 GHz ISM 2.4 GHz ISM 5 GHz UNII 2.4 GHz ISM

Max Data Rate 2 Mbps 11 Mbps 54 Mbps 54 Mbps

Modulation GFSK DBPSK/DQPSK/CCK OFDM (BPSK to 64-QAM) OFDM + CCK/DSSS

Spreading Frequency hopping Barker (1,2) / CCK (5.5,11) None (OFDM) None (OFDM) / CCK

Channel BW 1 MHz hop 22 MHz 20 MHz 20 MHz

Non-Overlapping Ch. ~15 sets 3 12+ (varies by country) 3

Multipath Resilience Good (hopping) Moderate (Barker/CCK) Excellent (OFDM CP) Excellent (OFDM mode)

Typical Indoor Range ~20 m ~35 m (11 Mbps) ~25 m (54 Mbps) ~30 m (54 Mbps)

Backward Compatible N/A 802.11 DSSS N/A (different band) 802.11b

The evolution from FHSS at 2 Mbps to OFDM at 54 Mbps in less than six years demonstrates the rapid advancement of wireless PHY technology driven by market demand for higher
throughput. Each generation maintained the same MAC architecture, validating the IEEE 802 design principle of MAC-PHY independence.
CHAPTER 14

Other IEEE 802.11 Standards — Security & QoS

Beyond the core MAC and PHY specifications, several important 802.11 amendments address critical shortcomings in the original standard. Two of the
most significant are IEEE 802.11i (security) and the Wi-Fi Protected Access (WPA/WPA2) certifications that preceded and accompanied it.

WEP and Its Weaknesses WPA and WPA2 (802.11i)

The original 802.11 security mechanism, Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA) was an interim solution introduced by the
was intended to provide confidentiality equivalent to a wired network. WEP Wi-Fi Alliance in 2003, implementing a subset of the then-draft 802.11i
used the RC4 stream cipher with 40-bit or 104-bit keys. However, WEP standard. WPA replaced WEP's flawed key mixing with TKIP (Temporal
contained fundamental cryptographic flaws: the initialization vector (IV) Key Integrity Protocol), which uses a per-packet key mixing function, a 48-
was only 24 bits (leading to IV reuse), key management was nonexistent bit IV (eliminating reuse), and a cryptographic message integrity check
(all stations shared a single static key), and the integrity check (CRC-32) (Michael MIC).
was not cryptographically secure. By 2001, publicly available tools could
WPA2 implements the full IEEE 802.11i standard and replaces TKIP with
crack a WEP key in minutes by passively collecting traffic.
CCMP (Counter Mode with CBC-MAC Protocol), based on the AES block
cipher. CCMP provides both confidentiality and integrity using a single,
well-analyzed cryptographic algorithm. Authentication is handled by IEEE
802.1X (using EAP and a RADIUS server for enterprise environments) or a
Pre-Shared Key (PSK) for personal/home environments.
CHAPTER 14

Data Scrambling in 802.11

Data scrambling is a technique applied at the physical layer in several 802.11 PHY specifications (particularly 802.11b and 802.11a/g) to improve signal
quality and simplify receiver design. It is distinct from encryption — scrambling does not provide security.

Purpose of Scrambling Scrambling Mechanism

Digital data often contain long runs of identical bits (e.g., a sequence of all zeros). Scrambling is implemented using a Linear Feedback Shift
When such data are modulated and transmitted, they produce a signal with strong Register (LFSR) that generates a pseudorandom bit sequence.
spectral lines (energy concentrated at specific frequencies), which can cause The data bits are XORed with this sequence before modulation. At
several problems: the receiver, the same LFSR generates the identical
pseudorandom sequence and XORs it with the received data to
• DC bias: Long runs of a single value can cause a DC offset in the signal,
recover the original bits (since XOR is self-inverse: A ⊕ B ⊕ B =
potentially saturating receiver amplifiers.
A).
• Clock recovery difficulty: Receivers derive bit timing from transitions in the
signal. Long runs without transitions make it difficult to maintain The scrambler polynomial used in 802.11b is: S(z) = z⁷ + z⁴ + 1.
synchronization. For 802.11a/g (OFDM), the same polynomial is used. The
• Spectral characteristics: Unscrambled data may produce a signal with poor scrambler is initialized with a random seed for each frame to
spectral properties that violate regulatory emission limits or interfere with ensure that identical data frames produce different scrambled
other systems. sequences, improving the statistical properties of the transmitted
signal.
CHAPTER 14

Chapter 14 — Key Takeaways

IEEE 802 Architecture DCF: CSMA/CA PHY Evolution

The IEEE 802 framework separates LLC The mandatory 802.11 MAC uses 802.11 PHY has evolved from 2 Mbps
(common to all LANs) from MAC and PHY CSMA/CA with random backoff, positive FHSS/DSSS to 54 Mbps OFDM, with each
(specific to each LAN type), enabling ACK, virtual carrier sensing (NAV), and generation maintaining MAC compatibility.
protocol independence and smooth optional RTS/CTS to manage shared 802.11g unified 2.4 GHz OFDM with
interoperation between wired and wireless access in an environment where collision 802.11b backward compatibility, driving
LANs. detection is impossible. mass-market adoption.
 SYNTHESIS

Cross-Chapter Comparison
The three chapters covered in this presentation — Cordless/WLL, Mobile IP/WAP, and IEEE 802.11 — address different facets of wireless networking, yet they share common themes
and complementary functions. Understanding these relationships provides a holistic view of wireless systems architecture.
REFERENCE

Summary of Key Standards & Protocols

The following table consolidates the principal standards and protocols discussed across all three chapters, providing a quick-reference guide for further study and examination
preparation.

Standard/Protocol Organization Primary Function Key Feature

DECT ETSI Multi-cell digital cordless telephony FDMA/TDMA/TDD, seamless handover, 32 kbps
ADPCM

IEEE 802.16 IEEE Broadband wireless MAN access OFDM/OFDMA, adaptive modulation, QoS
scheduling

WiMAX WiMAX Forum Interoperability certification for 802.16 System profiles, multi-vendor interop, up to 50 km
range

Mobile IP (RFC 3344) IETF Transparent host mobility on the Internet Home/foreign agents, care-of address, IP-in-IP
tunneling

WAP WAP Forum / OMA Mobile Internet access protocol suite Binary encoding, WML micro-browser, WAP
gateway proxy

IEEE 802.11b IEEE 2.4 GHz WLAN at 11 Mbps CCK modulation, Barker code, dynamic rate
shifting

IEEE 802.11a IEEE 5 GHz WLAN at 54 Mbps OFDM with 52 subcarriers, 8 data rate options

IEEE 802.11g IEEE 2.4 GHz WLAN at 54 Mbps OFDM + CCK backward compatibility with
802.11b

WPA2 / 802.11i Wi-Fi Alliance / IEEE WLAN security AES-CCMP encryption, 802.1X authentication
 CONCLUSION

Conclusion & Further Study

This presentation has traversed three foundational chapters of wireless communications and networking, progressing from last-mile access technologies through
mobility-enabling protocols to the dominant wireless LAN standard. The key insights can be summarized as follows:

Wireless Last Mile Mobility & Internet Access Wireless LANs

Cordless systems and WLL technologies, Mobile IP and WAP address the protocol-level The IEEE 802.11 family — with its elegant
culminating in IEEE 802.16/WiMAX, challenges of mobility and device constraints, separation of MAC and PHY, the robust
demonstrate how standards-based respectively. Mobile IP's agent/tunneling CSMA/CA mechanism, and the progression
broadband wireless access can replace or architecture maintains transport-layer from DSSS to OFDM — has become the
supplement copper infrastructure, particularly connectivity during host movement, while ubiquitous technology for local wireless
where economic or geographic factors favor WAP's binary-optimized stack bridged the gap connectivity. Understanding its MAC timing,
radio over cable. The connection-oriented between resource-constrained wireless frame structures, and PHY modulation
MAC with QoS scheduling distinguishes devices and the wired Internet. options remains essential for any wireless
802.16 from the contention-based approach networking professional.
of 802.11.

Reference: William Stallings, Wireless Communications and Networks, Second Edition, Pearson Prentice Hall, 2005. ISBN: 0-13-191835-4. For further study,
consult the book's companion Web site at [Link]/Wireless/[Link] and the recommended readings at the end of each chapter.