Identifying a Malfunctioning Access Point | Wyebot

Identifying a Malfunctioning Access Point

Wireless networks are complex, dynamic ecosystems.  Isolating a single component in order to solve problems can be incredibly difficult, especially when you consider the massive amount of traffic now being exchanged on a typical wireless network.  Parsing through this volume of data to manually identify problems is impractical. This is why it can be so helpful to have an automated, proactive tool that can perform the computational analysis for you, isolating and identifying problems in seconds, rather than days.

In a public school district in Massachusetts, this is exactly the role that Wyebot’s Wireless Intelligence Platform ™ (WIP) played.  The district had a network issue and could not identify the cause. One of WIP’s captured PCAP files – files that contain the wireless packet data captured by the sensor and used to analyze network behavior – revealed an issue with an AP caused by a beta version of firmware.  

In a nutshell, the update added support for the Multiple BSSID Information Element but did not take into consideration the length of the TIM element.  This was the cause of the district’s network issues.

What does all that mean?  Let’s break it down:

  1. Within a WLAN there are multiple APs.  Packets are identified as transmitted to/from a specific AP through the use of the basic service set identifier, or BSSID.

  2. The Multiple BSSID Information Element describes a field that exists in the beacon frame.  Beacons are sent out by the AP at regular intervals to allow devices to discover and connect to it.

  3. TIM stands for Traffic Indication Map, which is also part of the beacon frame.

  4. The presence of the Multiple BSSID element changes the way TIM is sent in a beacon frame, but the update did not consider the length of TIM when adding support for Multiple BSSID within the beacon frame.

  5. This caused the network’s issues, including a buffering issue and an issue with the Partial Virtual Bitmap extending beyond its usual length.

In addition, WIP found that one of the SSIDs on the network was only being broadcast by one radio of a specific AP.  The SSID is the name of the network that users see when they try to connect to a network. For example, a network might have three SSIDs: Student, Faculty, and Guest.

With WIP’s assistance, the school district knew what was causing the network issues and could proceed with a resolution.  “As far as I can see, the product seems to sell itself,” the district’s network administrator commented.