How a Device Connects to an AP

 How a STA Connects to a BSS

An Overview of the .11 State Machine 

A Beacon

These Beacon things keep coming up, and thats because they are probably one of the most important frames in wireless communications. If the STA is not pre-configured with a SSID it should connect to, it will use beacons to learn about the networks in the vicinity. Once that happens, we can begin moving through the connection process also know as the State Machine.

The .11 State Machine

Below is a diagram of the steps we will go through as we move through the states. Ive included pieces of a packet capture I took of my phone connecting to my home network. We will also see the 4 way handshake used by PSK authentication. Without any security in place there will be 3 states and 6 frames. With security there will be an additional state, and 4 more frames for the handshake. .1x adds even more frames but basically it adds frames for verifying the client and server identities. Also we are not including the ACK frames in the counts but they are present. 

Source:

 

Probe Request

The state machine starts with a Probe Request sent by the STA wishing to join a BSS. The request will have the name (SSID) of the BSS it wishes to join. This name can come from one of two methods. Pre-configured on the STA or by learning it through Beacons. The STA is the TA/SA and the AP is the RA/DA. If multiple APs are on the same channel they should all send probe responses. If multiple APs with the same SSID exist on different channels, the STA will send requests on each channel and select the AP with the best RSSI (generally).

 

 

Probe Responses

Moving down the machine we are greeted with Probe Responses. These are very similar to Requests in that they contain similar information to a Request but with the capabilities of the AP. Both Requests and Responses can be used to determine compatibility/conficts if a STA fails to join an BSS. Responses are different from beacons however in that they do not contain the TIM field, QoS info, Channel reports, FMS Descriptor or the HCCA TxOP count.


Side note on the last two items. The FMS descriptor stands for Flexible Multicast Service and is related to delivering video traffic to multiple clients with varying power (think battery) capabilities. I was only able to find some research papers on the subject which leads me to believe it is not widely implemented (and possibly not very effective per this paper). I also found no overview in my CWNA or CWAP books.  

 

HCCA TxOp Count or HCF CCA or Hybrid Coordination Function Controlled Channel Access Transmit Opportunity Count refers to a channel access method that is not implemented in production today. In general this a channel access method that primarily resides in the AP allowing it to give itself more opportunities to use the medium. As stated, this method is not used today and we use EDCA which implements parts of DCF and PCF which gives the ability for STAs to have Frame Bursts inside a TxOP. Thus allowing QoS to be implemented end to end. 

 

Authentication Request and Response

This is NOT like user authentication (name/password) or other security methods. This is Open System Authentication which operates at the link layer. This two frame exchange starts with the STA sending a request to the desired BSSID and then getting a response from that BSSID indicating a success or failure to authenticate. If successful it moves on down the connection process, if it fails then the STA must try again or attempt to join another BSS. OSA is similar to plugging a network cable into a switch. It is used to verify that both devices are compatible .11 radios. OSA is a null authentication because no identity information is exchanged, as stated, it merely verifys each radios ability to communicate. 

 

Association Request and Response

Similar to Probes but instead lists out ALL capabilities of the STA and AP. These are sent at the minimum support basic rate, as that was learned during the Probing phase. If the Association is successful the STA will receive an Association ID (AID) which can be used for the TIM field in DTIM beacons for Power Save functions. This is also the third state of the .11 State Machine. If no other forms of security are required, the STA may now request an IP and move up the protocol stack to begin communications. If additional security is implemented, then we will move into State 4 and begin security negotiations. 

 

 

 

4-Way Handshake and RSN Exchanges 

When using WPA2/.1x we go through one additional state which once complete will encrypt data transmissions over the medium. The 4 way handshake is not new but it is very important and also quite robust. 

 

Beginning with Message 1 which follows a STAs Association to a BSS the Authenticator (AP) will send a message to the Supplicant (STA). This contains something called an ANonce and will be used in addition with other information for the STA to create a Pairwise Transient Key (PTK). 

 

 

Message 2 is sent from the STA and contains a SNonce which will be used (again along with some other info) by the AP to create its PTK. The STA will also send a RSNE (Robust Security Network Element) and a Message Integrity Check (MIC) so the AP can verify nothing was changed

 

 

 

Message 3 is sent from the AP, containing another ANonce, RSNE, MIC and a GTK (Group Temporal Key). The GTK will be used to encrypt multi and broadcast messages to STAs joined to the BSS. 

 

 

 

Message 4 confirms the STA installed the necessary keys and completes the 4 way handshake. 

 

 

 

After completion data traffic is now encrypted. Remember data is encrypted but we must leave other frame types unencrypted so devices not joined to the BSS can decipher them.

 

If you would like to learn more about the 4-Way Handshake check out this Blog Post which goes into more detail about it and how the keys are generated.