2

I'm investigating an issue with an iPhone controllable hardware, which operates in IBSS / Ad Hoc mode. Since the hardware generation of iPhone6 & Co the iDevices can't connect to the hardware anymore, which creates the wifi network with a deprecated Microchip 802.11 b listening only to 1 / 2 Mbit / s.

I've narrowed down the problem with wireshark (see screenshots):

1.) The Microchip wifi Beacon announces the network, I assume the BSSID is randomly assigned in IBSS / Ad Hoc mode.

2.a) The iPhone5 sends a probe request to destination broadcast and receives the probe response announcing that the Microchip can only listen on 1 / 2 Mbit / s. Further conversation works just fine.

2.b) The iPhone6 sends a probe request to the randomly assigned BSSID and never receives a probe response, therefore not knowing that the Microchip can only listen on 1 / 2 Mbit / s and starts talking at 12 Mbit / s in further conversation, which obviously doesn't work.

The question now is which of the two wifi firmwares behaves not according to the 802.11-2012 standard?

Either iPhone6 Broadcom WiFi firmware, that sends the Probe Request to the BSSID of the Ad Hoc network (instead of the MAC of the Microchip WiFi chip or the Microchip firmware, that doesn't answer the Probe Request when sent to the BSSID of the Ad Hoc network it created initially?

I haven't found anything in the 802.11-2012 standard, yet, what the appropriate destination address of a probe request in an 802.11 Ad Hoc network would be (broadcast or the BSSID of the beacon). Is there an expert out there, who can give some insights and probably references to the standard where that is defined?

Thanks.

Edit:

I've attached the captured packets:

iPhone6 - not working

iPhone5 - working

The Microchip WiFi chip is 00:1e:c0:08:32:1b,

the iPhone6 is 74:1b:b2:81:7d:69,

the iPhone5 is 00:88:65:8c:33:AA

These are some relevant packets in the iPhone6 capture:

  • 186 Probe Requests from iPhone6 to unknown MAC 7a:7b:01:79:c4:b5 regarding SSID=Anova at 1Mbit (I assume randomly assigned MAC for Ad Hoc / IBSS) No Probe Response, cause there is no device with that MAC…

  • 203… Null Function from iPhone6 to Anova at 6Mbit

  • 210 first Beacon from iPhone6 with SSID=Anova at 1Mbit

  • 294 … WEP join? from iPhone6 via IPv6mcast_16/_fb/_02 at 12Mbit (as the Microchip chip understands 1 / 2Mbit only this ends in nothing

The iPhone5 addresses the Microchip WiFi chip with it's MAC address correctly, not with the randomly assigned BSSID.

Improve this question
15
  • A host sending a probe request may specify the SSID (directed probe request) to which it wants to connect. Only the IBSS host or an AP with that SSID will answer.
    – Ron Maupin ♦
    Commented Mar 31, 2016 at 16:56
  • Ok that reflects the behaviour of the iPhone6 sending the probe request to the BSSID that was randomly assigned on the IBSS host which created the Ad Hoc network initially. Would according to 802.11 the IBSS host which created the Ad Hoc network initially have to answer on this BSSID / MAC address, which obviously differs from its actual MAC address? I'm trying to figure out which of the two chips violates the 802.11 standard.
    – b00tsy
    Commented Mar 31, 2016 at 17:21
  • Questions about consumer-grade devices (e.g. iPhones) are explicitly off-topic here. You should try to ask this question on Super User.
    – Ron Maupin ♦
    Commented Apr 3, 2016 at 15:34
  • This question is directly related to the 802.11 standard, not the iPhone, which in my opinion makes it an on-topic question
    – b00tsy
    Commented Apr 4, 2016 at 15:30
  • You are asking which of the end-devices are not adhering to the standard, and that would be off-topic. I'm not sure that you have actually determined that either is not performing to the standard. Ad-Hoc networks are not really on-topic here.
    – Ron Maupin ♦
    Commented Apr 4, 2016 at 15:34

1 Answer 1

Reset to default
2
+50

1.) The Microchip wifi Beacon announces the network, I assume the BSSID is randomly assigned in IBSS / Ad Hoc mode.

To some degree, this is true. For clarity, from IEEE-802.11-2012 section 10.1.4.1:

When a STA starts a BSS, that STA shall determine the BSSID of the BSS. If the BSSType indicates an infrastructure BSS, then the STA shall start an infrastructure BSS and the BSSID shall be equal to the STA’s dot11StationID. The value of the BSSID shall remain unchanged, even if the value of dot11StationID is changed after the completion of the MLME-START.request primitive. If the BSSType indicates an IBSS, the STA shall start an IBSS, and the BSSID shall be an individual locally administered IEEE MAC address as defined in 9.2 of IEEE Std 802-2001. The remaining 46 bits of that MAC address shall be a number selected in a manner that minimizes the probability of STAs generating the same number, even when those STAs are subjected to the same initial conditions. The value SSID parameter shall be used as the SSID of the new BSS. It is important that designers recognize the need for statistical independence among the random number streams among STAs.

So, the first STA to start in the IBSS should generate the BSSID, however further STA's that join the IBSS should adopt this value.

2.b) The iPhone6 sends a probe request to the randomly assigned BSSID and never receives a probe response, therefore not knowing that the Microchip can only listen on 1 / 2 Mbit / s and starts talking at 12 Mbit / s in further conversation, which obviously doesn't work.

I will start by noting that there isn't a single probe response in this capture. This leads me to believe that there is some sort of problem with how this capture was obtained. As such, there is no way to determine if the Microchip device has responded with a probe response or not.

However, we can assume that a probe response has been sent and recevied at some point because it appears your iPhone6 has joined the IBSS. Take a look at the beacon frames at 19.85 seconds into the capture. You now see both the Microchip and the iPhone6 sending beacon frames for "Anova 1" with the same BSSID. Since they have synchronized the BSSID, this would indicate they have both become part of the same IBSS.

The question now is which of the two wifi firmwares behaves not according to the 802.11-2012 standard?

Based on the evidence at hand, and technically speaking, they both appear to be adhering to the standard. We would need a better capture to make any further determinations.

I'm investigating an issue with an iPhone controllable hardware, which operates in IBSS / Ad Hoc mode. Since the hardware generation of iPhone6 & Co the iDevices can't connect to the hardware anymore, which creates the wifi network with a deprecated Microchip 802.11 b listening only to 1 / 2 Mbit / s.

It looks like the IBSS is established. You need to start looking at why the two are not actually communicating.

Improve this answer
6
  • thanks for the detailed insights. The missing Probe Respones are strange. Unfortunately I don't have a non working device at my hands, so I can't recapture right now, but I have another capture, where the iPhone6 joins the network second time iPhone6-2. From the information, that the iPhone6 sends a Beacon of the Anova network I can assume, that the "network joining process" is complete (WEP etc....)? What would be the packet 294 in the original iPhone6 capture be, where the iPhone6 send WEP parameters with 12Mbit to IPv6mcast_16?
    – b00tsy
    Commented Apr 9, 2016 at 13:53
  • In the second capture the iPhone6 gets a response from the Microchip WiFi chip on the broadcast SSID=broadcast Probe Request, but again not in packet 426 where the iPhone6 tries to get information vi a Probe Request on SSID=Anova, which again is sent to the BSSID from the Ad Hoc Beacon (instead of the MAC of the Microchip WiFi chip). Can this considered correct behaviour (sending Probe Requests in Ad Hoc to the BSSID, which has nothing to do with the actual MAC of the first host which created the network)?
    – b00tsy
    Commented Apr 9, 2016 at 14:05
  • @b00tsy, I probably won't have time to look at the new capture in any detail until Monday at the earliest. As for the probe request, all probe requests should be broadcast (with no SSID, a specific SSID, and/or a list of SSIDs) or directed to a BSSID (AFAIK with a specific SSID and/or a list of SSIDs). A device should not be directing a probe request to another end point. But if the BSSes with multiple stations in an ad hoc are the same, you can assume they have synchronized which takes place after association.
    – YLearn
    Commented Apr 9, 2016 at 14:15
  • no prob. That means both cases, the iPhone5 sending its Probe Request to broadcast as well as the iPhone6 sending its Probe Request to the BSSID are appropriate behaviour. Then the next question I have (sorry am a 802.11 noob) is would a STA of an Ad Hoc network (either if it was the STA that created it or any other) be expected to answer a Probe Request sent to the BSSID? If yes would it be a process like the random selection of who sends the next Beacon?
    – b00tsy
    Commented Apr 9, 2016 at 14:44
  • @b00tsy, I would have to go back to the standard again to be sure, but I would assume any STA in an ad hoc should respond to a probe request to the BSSID. Due to the nature of ad hoc networks, it would be illogical for one STA to assume it can see all other STAs as there are just too many cases where it might not.
    – YLearn
    Commented Apr 9, 2016 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.