Monitoring a local area network

• US 20030224797A1
• Filed: 04/08/2003
• Published: 12/04/2003
• Est. Priority Date: 04/08/2002
• Status: Active Grant

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: Airmagnet (NetScout Systems Incorporated)
• Inventors: Kuan, Chia-Chee, Wu, Miles, Au, Dean
• Granted Patent: US 7,702,775 B2
• Time in Patent Office: Days
• US Class Current: 455/446
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A wireless local area network (WLAN) is monitored by receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN. A database is compiled based on the received transmissions. The received transmissions are analyzed to determine the state of a station. The compiled database and the determined state of the station are used to diagnose connectivity problems of the station.

Claims

1. A method of monitoring a wireless local area network (WLAN), the method comprising:

receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN;

compiling a database based on the received transmissions;

analyzing the received transmissions to determine the state of a station; and

diagnosing connectivity problems of the station using the compiled database and the determined state of the station.

2. The method of claim 1, wherein receiving comprises:

obtaining a medium access control (MAC) address of the station;

receiving a transmission using the detector, wherein the transmission includes a source address and a destination address; and

determining if the source address or the destination address of the transmission is the MAC address of the station.

3. The method of claim 1, wherein receiving comprising:

scanning a plurality of channels used in the wireless local area network using the detector; and

rebooting the station if no transmissions are received during a scan of the plurality of channels.

4. The method of claim 3, wherein the station operates on a first channel after being rebooted, wherein the first channel is one of the plurality of channels used in the wireless local area network, and further comprising:

scanning on the first channel using the detector for a longer period of time than other channels of the plurality of channels used in the wireless local area network.

5. The method of claim 1, wherein compiling comprises:

creating node elements in the database based on the received transmissions, wherein a node element is associate with a station or an AP in the WLAN;

creating session elements in the database based on the received transmissions, wherein a session element is associated with a session established between two node elements; and

creating channel elements in the database based on the received transmissions, wherein a channel element is associated with a channel in the WLAN.

6. The method of claim 5,

wherein a node element includes a first set of statistics that tracks the number of transmissions into the node element and a second set of statistics that tracks the number of transmissions out of the node element;

wherein a session element includes a first set of statistics that tracks the number of transmissions in a first direction between two node elements and a second set of statistics that tracks the number of transmissions in a second direction between two node elements; and

wherein a channel element includes a set of statistics that tracks the number of transmission in the channel.

7. The method of claim 6, wherein creating node elements comprises:

receiving a beacon frame from a node in the WLAN;

determining a MAC address of the node from a source and destination field of the beacon frame;

identifying the node as an AP in the database;

determining if a node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database and updating the second set of statistics of the node element; and

if the node element does exist, updating the second set of statistics of the node element.

8. The method of claim 7 further comprising:

determining a channel on which the beacon frame was received;

determining if a channel element exists in the data that corresponds to the channel;

if the channel element does not exist, adding a new channel element corresponding to the channel in the database and updating the set of statistics of the new channel element; and

if the channel element does exist, updating the set of statistics of the channel element.

9. The method of claim 6, wherein creating node elements comprises:

receiving a probe request from a node in the WLAN;

determining a service set identification address (SSID) of the node from the received probe request;

identifying the node as a station;

determining if a node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database and updating the second set of statistics of the node element; and

if the node element does exist, updating the second set of statistics of the node element.

10. The method of claim 9 further comprising:

determining from the received probe request a destination node;

determining a SSID of the destination node from the received probe request;

identifying the destination node as an AP;

determining if a node element exists in the database that corresponds to the destination node;

if the node element does not exist, adding a new node element corresponding to the destination node in the database and updating the first set of statistics of the node element; and

if the node element does exist, updating the first set of statistics of the node element.

11. The method of claim 6, wherein creating node elements comprises:

receiving a data frame from a node in the WLAN;

identifying the node from a header in the data frame;

determining if a node element exists in the database that corresponds to the node; and

if the node element does not exist, adding a new node element corresponding to the node in the database and updating the second set of statistics of the node element; and

if the node element does exist, updating the second set of statistics of the node element.

12. The method of claim 11, wherein identifying the node comprises:

if the node is indicated as a distribution system in the header, identifying the node as an AP; and

if the node is not indicated as a distribution system in the header, identifying the node as a station.

13. The method of claim 11 further comprising:

determining from the received data frame a destination node;

identifying the destination node from the header;

determining if a node element exists in the database that corresponds to the destination node;

if the node element does not exist, adding a new node element corresponding to the destination node in the database and updating the first set of statistics of the node element; and

if the node element does exist, updating the first set of statistics of the node element.

14. The method of claim 13, wherein identifying the destination node comprises:

if the destination node is indicated as a distribution system in the header, identifying the destination node as an AP; and

if the destination node is not indicated as a distribution system in the header, identifying the destination node as a station.

15. The method of claim 13, wherein creating session elements comprises:

identifying a session between the node and the destination node;

determining if a session element exists in the database that corresponds to the identified session;

if the session element does not exist, adding a new session element corresponding to the identified session in the database and updating the first/second set of statistics of the new session element; and

if the session element does exist, updating the first/second set of statistics of the session element.

16. The method of claim 1, wherein transmissions are received and the database is compiled during a period of time.

17. The method of claim 1, wherein analyzing comprises:

examining a received transmission; and

determining an indicative state of the station associated with the received transmission.

18. The method of claim 17, wherein a first state of the station is associated with a first set of transmissions, and wherein determining comprises:

determining if the received transmission is one of the first set of transmissions; and

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions.

19. The method of claim 18, wherein a second state of the station is associated with a second set of transmissions, and wherein determining comprises:

determining if the received transmission is one of the second set of transmissions; and

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions.

20. The method of claim 19, wherein a third state of the station is associated with a third set of transmissions, and wherein determining comprises:

determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions.

21. The method of claim 20, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point.

22. The method of claim 1, wherein the transmissions exchanged between the station and the access point comply with an extensible authentication protocol over local area networks (EAPOL) protocol.

23. The method of claim 1, wherein analyzing comprises:

displaying a list of transmissions on the detector, wherein the list includes different types of transmissions potentially exchanged between the station and the access point; and

when a received message corresponds to one of the types of transmissions in the list of transmissions, indicating on the list of transmissions that the type of transmission corresponding to the received message was received.

24. The method of claim 23, wherein the types of transmissions include transmissions exchanged between the station and the access point during an authentication process in accordance with an extensible authentication protocol over local area networks (EAPOL) protocol.

25. The method of claim 1, wherein diagnosing comprises:

detecting a mismatched SSID problem by matching a client station SSID against SSIDs in the compiled database;

detecting a wildcard SSID problem by matching a client station SSID against NULL SSID;

detecting a mismatched channel problem by tracking traffic sent by a station in each channel;

detecting a mismatched speed, privacy, network type, or preamble problem by matching a capability attribute of a station against that of the AP;

detecting an authentication failure problem by tracking authentication response packets;

detecting an association failure problem by tracking association response packets;

detecting an equipment failure problem when no packets are transmitted from a station;

detecting a weak AP signal problem by checking AP signal strength in the compiled database;

detecting a mismatched wired equivalent privacy (WEP) key problem when a station reaches an association state and has transmitted data packets but an associated AP does not send packets back to the station;

or

a higher layer protocol problem by detecting successful data exchanges between a station and an AP.

26. A system to monitor a wireless local area network (WLAN), the system comprising:

one or more stations;

an access point (AP) that communicates with the one or more stations in the WLAN;

a detector that receives transmissions exchanged between the one or more stations and the AP in the WLAN; and

a database compiled based on the received transmissions;

wherein connectivity problems of a station in the WLAN is diagnosed using the compiled database and a determined state of the station.

27. The system of claim 26, wherein the database comprises:

node elements, wherein a node element is associate with a station or an AP in the WLAN;

session elements, wherein a session element is associated with a session established between two node elements; and

channel elements, wherein a channel element is associated with a channel in the WLAN.

28. The system of claim 27, wherein node elements are created by:

receiving a beacon frame from a node in the WLAN;

determining a MAC address of the node from a source and destination field of the beacon frame;

identifying the node as an AP in the database;

determining if a node element exists in the database that corresponds to the node; and

if the node element does not exist, adding a new node element corresponding to the node in the database.

29. The system of claim 27, wherein node elements are created by:

receiving a probe request from a node in the WLAN;

determining a service set identification address (SSID) of the node from the received probe request;

identifying the node as a station;

determining if a node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database;

determining from the received probe request a destination node;

determining a SSID of the destination node from the received probe request;

identifying the destination node as an AP;

determining if a node element exists in the database that corresponds to the destination node; and

if the node element does not exist, adding a new node element corresponding to the destination node in the database.

30. The system of claim 27, wherein node elements are created by:

receiving a data frame from a node in the WLAN;

identifying the node from a header in the data frame;

determining if a node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database;

determining from the received data frame a destination node;

identifying the destination node from the header;

determining if a node element exists in the database that corresponds to the destination node; and

if the node element does not exist, adding a new node element corresponding to the destination node in the database.

31. The system of claim 30, wherein session elements are created by:

identifying a session between the node and the destination node;

determining if a session element exists in the database that corresponds to the identified session;

if the session element does not exist, adding a new session element corresponding to the identified session in the database.

32. The system of claim 26, wherein the state of the station is determined by:

examining a received transmission; and

determining an indicative state of the station associated with the received transmission.

33. The system of claim 32, wherein a first state of the station is associated with a first set of transmissions a second state of the station is associated with a second set of transmissions and a third state of the station is associated with a third set of transmissions, and wherein determining comprises:

determining if the received transmission is one of the first set of transmissions;

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions;

determining if the received transmission is one of the second set of transmissions;

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions

determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions.

34. The system of claim 33, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point.

35. The system of claim 26, wherein connectivity problems of a station in the WLAN is diagnosed using the compiled database and a determined state of the station by:

detecting a mismatched SSID problem by matching a client station SSID against SSIDs in the compiled database;

detecting a wildcard SSID problem by matching a client station SSID against NULL SSID;

detecting a mismatched channel problem by tracking traffic sent by a station in each channel;

detecting a mismatched speed, privacy, network type, or preamble problem by matching a capability attribute of a station against that of the AP;

detecting an authentication failure problem by tracking authentication response packets;

detecting an association failure problem by tracking association response packets;

detecting an equipment failure problem when no packets are transmitted from a station;

detecting a weak AP signal problem by checking AP signal strength in the compiled database;

detecting a mismatched wired equivalent privacy (WEP) key problem when a station reaches an association state and has transmitted data packets but an associated AP does not send packets back to the station;

or

a higher layer protocol problem by detecting successful data exchanges between a station and an AP.

36. A computer-readable storage medium containing computer executable code to monitor a wireless local area network (WLAN) by instructing a computer to operate as follows:

receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN;

compiling a database based on the received transmissions;

analyzing the received transmissions to determine the state of a station; and

diagnosing connectivity problems of the station using the compiled database and the determined state of the station.

37. The computer-readable storage medium of claim 36, wherein compiling comprises:

creating node elements in the database based on the received transmissions, wherein a node element is associate with a station or an AP in the WLAN;

creating session elements in the database based on the received transmissions, wherein a session element is associated with a session established between two node elements; and

creating channel elements in the database based on the received transmissions, wherein a channel element is associated with a channel in the WLAN.

38. The computer-readable storage medium of claim 37, wherein creating node elements comprises:

receiving a beacon frame from a node in the WLAN;

determining a MAC address of the node from a source and destination field of the beacon frame;

identifying the node as an AP in the database;

determining if a node element exists in the database that corresponds to the node; and

if the node element does not exist, adding a new node element corresponding to the node in the database.

39. The computer-readable storage medium of claim 37, wherein creating node elements comprises:

receiving a probe request from a node in the WLAN;

determining a service set identification address (SSID) of the node from the received probe request;

identifying the node as a station;

determining if a node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database;

determining from the received probe request a destination node;

determining a SSID of the destination node from the received probe request;

identifying the destination node as an AP;

determining if a node element exists in the database that corresponds to the destination node; and

if the node element does not exist, adding a new node element corresponding to the destination node in the database.

40. The computer-readable storage medium of claim 37, wherein creating node elements comprises:

receiving a data frame from a node in the WLAN;

identifying the node from a header in the data frame;

determining if a node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database;

determining from the received data frame a destination node;

identifying the destination node from the header;

determining if a node element exists in the database that corresponds to the destination node; and

if the node element does not exist, adding a new node element corresponding to the destination node in the database.

41. The computer-readable storage medium of claim 40, wherein creating session elements comprises:

identifying a session between the node and the destination node;

determining if a session element exists in the database that corresponds to the identified session;

if the session element does not exist, adding a new session element corresponding to the identified session in the database.

42. The computer-readable storage medium of claim 36, wherein analyzing comprises:

examining a received transmission; and

determining an indicative state of the station associated with the received transmission.

43. The computer-readable storage medium of claim 42, wherein a first state of the station is associated with a first set of transmissions a second state of the station is associated with a second set of transmissions and a third state of the station is associated with a third set of transmissions, and wherein determining comprises:

determining if the received transmission is one of the first set of transmissions;

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions;

determining if the received transmission is one of the second set of transmissions;

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions

determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions.

44. The computer-readable storage medium of claim 43, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point.

45. The computer-readable storage medium of claim 36, wherein diagnosing comprises:

detecting a mismatched SSID problem by matching a client station SSID against SSIDs in the compiled database;

detecting a wildcard SSID problem by matching a client station SSID against NULL SSID;

detecting a mismatched channel problem by tracking traffic sent by a station in each channel;

detecting a mismatched speed, privacy, network type, or preamble problem by matching a capability attribute of a station against that of the AP;

detecting an authentication failure problem by tracking authentication response packets;

detecting an association failure problem by tracking association response packets;

detecting an equipment failure problem when no packets are transmitted from a station;

detecting a weak AP signal problem by checking AP signal strength in the compiled database;

detecting a mismatched wired equivalent privacy (WEP) key problem when a station reaches an association state and has transmitted data packets but an associated AP does not send packets back to the station;

or

a higher layer protocol problem by detecting successful data exchanges between a station and an AP.