Mesh and WDS

  This page is monitored by the OLPC team.

What are WDS frames?

Wireless Distribution System (WDS) frames is a special type of data frame defined in the 802.11 standard that has 4 address fields (instead of 3). The standard defines the frame format but does not indicate how it should be used.

Different 802.11 Access Point (AP) vendors have manufactured equipment that uses WDS in different ways:

Static WDS

With this type of configuration, a number of WDS links (MAC addresses of other APs within range) are manually configured on each Access Point and recorded in an internal WDS link table. All traffic from the BSS (the stations that are local to a given AP) is distributed through each WDS link using WDS frames.

Dynamic WDS (aka Lazy-WDS)

In this configuration an AP automatically learns about other WDS-capable APs. This is done by recording the addresses of all the sources of WDS traffic in the vicinity. We could not find documentation on whether only broadcast WDS traffic or just any WDS traffic will trigger an AP to add a record another AP as WDS-capable.

APs that do Lazy-WDS

• Linksys WRT54G, undocumented. Cannot be turned off.
• Buffalo WHR-HP-G54. Can be turned off.
• Apple Airport Express. Can be turned off. [default: off].

Interactions with xo's

OLPC mesh frames use WDS frame format augmented with a new mesh specific header. Lazy-WDS APs will interpret mesh traffic as WDS and create a new WDS link for each xo in the vicinity. This has created numerous problems:

WDS responses to infra frames

At least in one AP (Linksys WRT54G) the WDS link will override the association table, so, even if the xo is associated with the AP, all traffic from the AP to the xo will be sent in WDS format. The xo's can differentiate normal WDS frames (sent from the AP) from OLPC mesh traffic (from other xo's), so this does not cause any user observable problem (#901).

Spurious traffic

When authentication is enabled, a Lazy-WDS AP will try to authenticate with other WDS-peers. Because xo's are wrongfully recorded as WDS nodes, we've seen spurious authentication frames sent to them from the AP. That has the effect of waking up suspended xo's for no apparent reason (#3504).

In addition to the authentication frames, we have also observed the AP sending NULL data frames to the xo's:

  No.  Time        Source                Destination           Protocol Info
  3816 9.233094    Cisco-Li_b8:6d:d3     QuantaMi_05:26:1f     IEEE 802.11 Null function (No data),SN=2735,FN=0
  4050 9.807919    Cisco-Li_b8:6d:d3     QuantaMi_05:26:1f     IEEE 802.11 Null function (No data),SN=2747,FN=0
  4316 10.428346   Cisco-Li_b8:6d:d3     QuantaMi_05:26:1f     IEEE 802.11 Null function (No data),SN=2763,FN=0
  4708 11.369663   Cisco-Li_b8:6d:d3     QuantaMi_05:26:1f     IEEE 802.11 Null function (No data),SN=2780,FN=0
  5132 12.399024   Cisco-Li_b8:6d:d3     QuantaMi_05:26:1f     IEEE 802.11 Null function (No data),SN=2795,FN=0

It's been hypothesized (Rajesh) that Lazy-WDS APs may use NULL data frames to detect if WDS peers are alive.

Denial of Service

OpenWRT is an open source version of the software that runs on the WRT54G. With that software, it is possible to turn off Lazy WDS. What is not possible, though, is to prevent the wireless firmware from internally tagging nodes in range as "WDS capable". Once a node is tagged as "WDS capable", the wireless module will drop any non-WDS traffic to that destination. So turning Lazy-WDS off will result in effectively cutting any communication with all the xo's in range, even if the xo is associated to the AP. Note that this has only been observed on an access point that was re-imaged to use the unsupported OpenWRT firmware.

WDS-link table overflow

The table of WDS-links must have a size limit. At OLPC headquarters, where there are over one hundred active xo's at any point in time, we could see APs with a large number of WDS links. At some point the AP would mistakenly send traffic destined for one xo to a different node. It is not clear yet why this happened (#4131).

Duplicate frames

Not sure why, but Lazy-WDS APs (at least the WRT54G) generate two WDS responses for each frame received from an associated station (#1863).

Cause other stations to lose association

Several people have reported this, but we don't have a traffic capture to confirm that this is related to Lazy-WDS.

(#4805, #4921)

Solutions

Ban Lazy-WDS APs across the land. If that is not possible by tomorrow morning, ask vendors to provide firmware upgrades that allow turning off WDS entirely.