This post is directly related to the following previous article: "Wireshark: How to check it a Wi-Fi Network Supports 802.11v".
In the previous article, we talked about how to check if a specific Wi-Fi network is supporting IEEE 802.11v, from the access point perspective. Like anything in Wi-Fi, we need support from both the access point and the STAs in order for it to work.
So in this article, we are going to explain how we can validate is a specific client device supports 802.11v.
I would like to address special thanks to Phil Morgan for providing useful information and giving me the idea to write this follow up post.
If you want to check if a client device supports 802.11k, feel free to check this other article: https://www.semfionetworks.com/blog/wireshark-how-to-check-if-a-wi-fi-network-supports-80211k
In the previous article, we talked about how to check if a specific Wi-Fi network is supporting IEEE 802.11v, from the access point perspective. Like anything in Wi-Fi, we need support from both the access point and the STAs in order for it to work.
So in this article, we are going to explain how we can validate is a specific client device supports 802.11v.
I would like to address special thanks to Phil Morgan for providing useful information and giving me the idea to write this follow up post.
If you want to check if a client device supports 802.11k, feel free to check this other article: https://www.semfionetworks.com/blog/wireshark-how-to-check-if-a-wi-fi-network-supports-80211k
Association Request
We were checking the Beacon frame broadcasted by the AP in order to validate if a specific SSID was supporting 802.11v. In order to check if a specific client supports it, we need to take a look at the Association Request frame sent by the client device when it connects to the Wi-Fi network. (cf. diagram below)
Note: before we start looking deeper into the association request frame, something important needs to be noted regarding 802.11v client support. Since the support of 802.11v is advertised by the AP in the beacon frames the station will be aware of 802.11v support within the BSS and will only advertise its support for 802.11v in its association request if it is advertised by the AP in the beacon frame.
So if you are performing your own packet captures, make sure you enable 802.11v support on the access point first.
Once again, looking at the association request frame in order to find 802.11v support, we need to focus on the Extended Capabilities Information Element number 127 and look at the 4th bit of the 3rd octet. This bit is most commonly named the "BSS Transition bit". If the bit is set to "1", the client device support 802.11v.
The following screenshot shows the BSS Transition bit of an association request sent by a Samsung Galaxy S7 Edge. This is taken from the .pcap files available on Mike Albano's website.
So if you are performing your own packet captures, make sure you enable 802.11v support on the access point first.
Once again, looking at the association request frame in order to find 802.11v support, we need to focus on the Extended Capabilities Information Element number 127 and look at the 4th bit of the 3rd octet. This bit is most commonly named the "BSS Transition bit". If the bit is set to "1", the client device support 802.11v.
The following screenshot shows the BSS Transition bit of an association request sent by a Samsung Galaxy S7 Edge. This is taken from the .pcap files available on Mike Albano's website.
Clients.mikealbano.com
Mike Albano did a really good job studying the most common Wi-Fi client devices. He documented his work on his website called clients.mikealbano.com. I'm talking about his website because there is an option to filter only the devices supporting 802.11v.
Make sure to read the note at the bottom of the page related to IEEE 802.11v support.
So if you are not sure if a specific client supports 802.11v, you can head over to his website and perform a quick research. You can even download a .pcap file for every device containing an association request.
So if you are not sure if a specific client supports 802.11v, you can head over to his website and perform a quick research. You can even download a .pcap file for every device containing an association request.
Validate client 802.11v support on a Cisco WLC
On a Cisco Wireless LAN Controller, there is a way to check if an associated client supports IEEE 802.11v. Obviously, as explained earlier, this client device has to be associated to an SSID already advertising the BSS transition capability.
So once the client is associated to the Wi-Fi, head over to the "Monitor" page, on the left menu, select "Clients". This will open up a new page displaying all the client devices connected to your different Wi-Fi networks supported by the controller.
Click on the mac address of the client that you want to study. This will open up a new page providing more detailed information related to this specific client.
On this page, you will be able to see if it support IEEE 802.11v, as shown below, under the "802.11v BSS Transition" sub-section:
So once the client is associated to the Wi-Fi, head over to the "Monitor" page, on the left menu, select "Clients". This will open up a new page displaying all the client devices connected to your different Wi-Fi networks supported by the controller.
Click on the mac address of the client that you want to study. This will open up a new page providing more detailed information related to this specific client.
On this page, you will be able to see if it support IEEE 802.11v, as shown below, under the "802.11v BSS Transition" sub-section:
If the client device supports it, you will see "Supported", if it doesn't, you will see "Not Supported".
Update (2019): Using the WLAN Pi and Profiler
Thanks to our amazing Wi-Fi community, we now have tools to validate the general capabilities of Wi-Fi client devices in an easier and more scalable way.
All you need is a WLAN Pi. On the latest version of the WLAN Pi image (1.7+), you will be able to use the program called profiler developed by @Watkinschoffer and @wifinigel!
This program broadcast a special beacon frame that tricks the client device in thinking that the Wi-Fi network supports pretty much everything and is using the maximum capabilities defined in the 802.11 specifications.
You can start the program from your WLAN Pi using the following command:
All you need is a WLAN Pi. On the latest version of the WLAN Pi image (1.7+), you will be able to use the program called profiler developed by @Watkinschoffer and @wifinigel!
This program broadcast a special beacon frame that tricks the client device in thinking that the Wi-Fi network supports pretty much everything and is using the maximum capabilities defined in the 802.11 specifications.
You can start the program from your WLAN Pi using the following command:
Then, you can simply use your device and connect to that specific SSID. The client will not hold back and provide, in return, its maximum capabilities (including 802.11v).
(Image from the github documentation page)
(Image from the github documentation page)
You can also use the GUI of the WLAN Pi to retrieve the results in a text or csv file.
The profiler tool would require an entire dedicated blog article and does way more than just validate 802.11v. I invite you to check it out and try it out yourself.
For more information, please head over to the gitub page: https://github.com/WLAN-Pi/profiler
The profiler tool would require an entire dedicated blog article and does way more than just validate 802.11v. I invite you to check it out and try it out yourself.
For more information, please head over to the gitub page: https://github.com/WLAN-Pi/profiler
Thank you for reading!
Cheers'
written by François Vergès
RSS Feed
