802.11d -- Why you should care.

Like many, I recently updated OSX to the latest version. After doing so, I could no longer connect to my 5GHz SSID. Immediately, I'm blaming the upgrade. Turns out, it was much more arcane than that, and actually due to a new neighbor, or more specifically, that new neighbors country-code settings on their Access Point. Read on for more detail...

I noticed that changing channels on my AP seemed to fix the issue, so I took a look at my supported channels. On OSX you do this by navigating to:

Spotlight-->System Information -- Utilities--> select Wi-Fi

From there, you will see something resembling the following. Notice, the lack of support for the UNII-1 band (and the first channel of UNII-2):

For a list of what channels (frequencies) are supported in which country (called "Regulatory Domains") you can refer to the following link: Regulatory Domain Reference

Again, I'm thinking "upgrade broke my wifi". Seemed strange that my client would not support UNII-1, yet would support the 802.11h channels. So I open my favorite WiFi scanner (WiFi Explorer) and notice the following:

Wait...Country Code Taiwan? Now I start looking closer at logs and doing packet captures. First, I notice the following, which really gives it away: /var/log/system.log


Mar  2 09:50:15 mikes-MacBook-Air-4 kernel[0]: en0: 802.11d country code set to 'TW'.
Mar  2 09:50:15 mikes-MacBook-Air-4 kernel[0]: en0: Supported channels 1 2 3 4 5 6 7 8 9 10 11 56 60 64 100 104 108 112 116 120 124 128 132 136 140 149 153 157 161 165

I then do a packet capture on that channel (1), to be sure:



No.     Time        Source                Destination           Protocol Length Info

  

     31 0.172504    Cisco-Li_f1:46:a7     Broadcast             802.11   336    Beacon frame, SN=342, FN=0, Flags=........C, BI=100, SSID=qunitis

Frame 31: 336 bytes on wire (2688 bits), 336 bytes captured (2688 bits)

Radiotap Header v0, Length 25

IEEE 802.11 Beacon frame, Flags: ........C

IEEE 802.11 wireless LAN management frame

    Fixed parameters (12 bytes)

    Tagged parameters (271 bytes)

        Tag: SSID parameter set: qunitis

            Tag Number: SSID parameter set (0)

            Tag length: 7

            SSID: qunitis

       Tag: Country Information: Country Code TW, Environment Any

            Tag Number: Country Information (7)

            Tag length: 6

            Code: TW

            Environment: Any (0x20)

            Country Info: First Channel Number: 1, Number of Channels: 11, Maximum Transmit Power Level: 16 dBm

...and there it is. 802.11d causing my adapter to modify it's supported channel list. In short: 802.11d allows manufacturers to support multiple Regulatory Domains in the chipset, allowing the infrastructure (AP's) to dictate what channels & Tx Power are allowed. What made this worse is my neighbor being close to the 'edge', so this issue would present itself when in my living room (back of my house) but not when in the front of my house.

After wandering around my neighborhood on a Sunday morning scanning WiFi networks, I determined this to be the proximity of the offending AP (new neighbor):

So until I explain 802.11d to my new neighbors and have them update their 'Country Code; it's Channel 161(-1) for me.

Considerations for the Enterprise.

Battling Rogue AP's is a constant issue in my Enterprise WLAN. I currently work for a Higher-ed, with a sizable network, including all Residence Halls. A major part of a successful WLAN, when medium/high density of AP's are in use, is the ability to utilize the 5GHz spectrum. If you remove 802.11h (DFS) channels from your plan, your now down to 8 (9 at most) 20MHz channels.(Assuming you do not have 40MHz-wide channels in use for your HD areas).

Now what happens when someone brings in a "mis-configured" Rogue, such as my new neighbor? Potentially half (4) of your channels are no longer able to be used by clients in the area of that AP. Keeping in mind that Beacon frames (where the Regulatory Domain is advertised) are sent out at lowest Basic data-rate...which btw is likely 1Mb on a SOHO device (D-Link, Linksys etc.), those frames can be demodulated from far away! This is catastrophic in an area that relies on the 5GHz spectrum to achieve a higher density of AP's.