Monitoring a local area network

• US 7,702,775 B2
• Filed: 04/08/2003
• Issued: 04/20/2010
• Est. Priority Date: 04/08/2002
• Status: Expired due to Fees

• Current Assignee: NetScout Systems Incorporated
• Original Assignee: Airmagnet (NetScout Systems Incorporated)
• Inventors: Wu, Miles, Au, Dean, Kuan, Chia-Chee
• Primary Examiner(s): Nguyen; Thu Ha T
• Application Number:
  US10/410,668
• Publication Number:
  US 20030224797A1
• Time in Patent Office: 2,569 Days
• Field of Search: 709223-224, 713/201, 370/338, 370/329, 370/252, 345/456.1, 342/457, 342/465, 340/825, 714/39
• US Class Current: 709/224
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A wireless local area network (WLAN) is monitored by receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN. A database is compiled based on the received transmissions. The received transmissions are analyzed to determine the state of a station. The compiled database and the determined state of the station are used to diagnose connectivity problems of the station.

Claims

1. A method of monitoring a wireless local area network (WLAN), the method comprising:

receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN;

compiling a database including one or more individual node elements that are indexed by nodes in the WLAN, session elements, and channel elements that includes creating in the database a node element based on at least one of the received transmissions, wherein the node element in the database is identified as a node in the WLAN, wherein the node element includes a first set of statistics that tracks a number of the received transmissions that is sent into the node that is represented by the node element in the database and a second set of statistics that tracks the number of the received transmissions that is sent out of the node that is represented by the node element in the database;

analyzing the received transmissions to determine state of a station, wherein a first state of the station is associated with a first set of transmissions, and wherein determining comprises;

determining if the received transmission is one of the first set of transmissions; and

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions, wherein a second state of the station is associated with a second set of transmissions, and wherein determining comprises;

determining if the received transmission is one of the second set of transmissions; and

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions, wherein a third state of the station is associated with a third set of transmissions, and wherein determining comprises determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point; and

diagnosing connectivity problems of the station using the compiled database and the determined state of the station.

2. The method of claim 1, wherein receiving comprises:

obtaining a medium access control (MAC) address of the station;

receiving a transmission using the detector, wherein the transmission includes a source address and a destination address; and

determining if the source address or the destination address of the transmission is the MAC address of the station.

3. The method of claim 1, wherein receiving comprising:

scanning a plurality of channels used in the wireless local area network using the detector; and

rebooting the station if no transmissions are received during a scan of the plurality of channels.

4. The method of claim 3, wherein the station operates on a first channel after being rebooted, wherein the first channel is one of the plurality of channels used in the wireless local area network, and further comprising:

scanning on the first channel using the detector for a longer period of time than other channels of the plurality of channels used in the wireless local area network.

5. The method of claim 1, wherein the node is a station or the AP, and wherein compiling further comprises creating session elements in the database based on the received transmissions, wherein a session element is associated with a session established between two nodes;

and creating channel elements in the database based on the received transmissions, wherein a channel element is associated with a channel in the WLAN.

6. The method of claim 5, wherein the session element includes a first set of statistics that tracks the number of transmissions in a first direction between two nodes and a second set of statistics that tracks the number of transmissions in a second direction between two nodes;

and wherein the channel element includes a set of statistics that tracks the number of transmission in the channel.

7. The method of claim 6, wherein creating the one or more individual node elements comprises:

receiving a beacon frame from a node in the WLAN;

determining a MAC address of the node from a source and destination field of the beacon frame;

identifying the node as an AP in the database;

determining if the node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database and updating the second set of statistics of the node element; and

if the node element does exist, updating the second set of statistics of the node element.

8. The method of claim 7 further comprising:

determining a channel on which the beacon frame was received;

determining if a channel element exists in the data that corresponds to the channel;

if the channel element does not exist, adding a new channel element corresponding to the channel in the database and updating the set of statistics of the new channel element; and

if the channel element does exist, updating the set of statistics of the channel element.

9. The method of claim 6, wherein creating the one or more individual node elements comprises:

receiving a probe request from a node in the WLAN;

determining a service set identification address (SSID) of the node from the received probe request;

identifying the node as a station;

determining if the node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database and updating the second set of statistics of the node element; and

if the node element does exist, updating the second set of statistics of the node element.

10. The method of claim 9 further comprising:

determining from the received probe request a destination node;

determining a SSID of the destination node from the received probe request;

identifying the destination node as an AP;

determining if the node element exists in the database that corresponds to the destination node;

if the node element does not exist, adding a new node element corresponding to the destination node in the database and updating the first set of statistics of the node element; and

if the node element does exist, updating the first set of statistics of the node element.

11. The method of claim 6, wherein creating node elements comprises:

receiving a data frame from a node in the WLAN;

identifying the node from a header in the data frame;

determining if the node element exists in the database that corresponds to the node; and

if the node element does not exist, adding a new node element corresponding to the node in the database and updating the second set of statistics of the node element; and

if the node element does exist, updating the second set of statistics of the node element.

12. The method of claim 11, wherein identifying the node comprises:

if the node is indicated as a distribution system in the header, identifying the node as an AP; and

if the node is not indicated as a distribution system in the header, identifying the node as a station.

13. The method of claim 11 further comprising:

determining from the received data frame a destination node;

identifying the destination node from the header;

determining if the node element exists in the database that corresponds to the destination node;

if the node element does not exist, adding a new node element corresponding to the destination node in the database and updating the first set of statistics of the node element; and

if the node element does exist, updating the first set of statistics of the node element.

14. The method of claim 13, wherein identifying the destination node comprises:

if the destination node is indicated as a distribution system in the header, identifying the destination node as an AP; and

if the destination node is not indicated as a distribution system in the header, identifying the destination node as a station.

15. The method of claim 13, wherein creating session elements comprises:

identifying a session between the node and the destination node;

determining if a session element exists in the database that corresponds to the identified session;

if the session element does not exist, adding a new session element corresponding to the identified session in the database and updating the first/second set of statistics of the new session element; and

if the session element does exist, updating the first/second set of statistics of the session element.

16. The method of claim 1, wherein transmissions are received and the database is compiled during a period of time.

17. The method of claim 1, wherein analyzing comprises:

examining a received transmission; and

determining an indicative state of the station associated with the received transmission.

18. The method of claim 1, wherein the transmissions exchanged between the station and the access point comply with an extensible authentication protocol over local area networks (EAPOL) protocol.

19. The method of claim 1, wherein analyzing comprises:

displaying a list of transmissions on the detector, wherein the list includes different types of transmissions potentially exchanged between the station and the access point; and

when a received message corresponds to one of the types of transmissions in the list of transmissions, indicating on the list of transmissions that the type of transmission corresponding to the received message was received.

20. The method of claim 19, wherein the types of transmissions include transmissions exchanged between the station and the access point during an authentication process in accordance with an extensible authentication protocol over local area networks (EAPOL) protocol.

21. A method of monitoring a wireless local area network (WLAN), the method comprising:

receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN;

compiling a database based on the received transmissions that includes creating a node element in the database based on at least one of the received transmissions, wherein the node element in the database is identified as a node in the WLAN, wherein the node element includes first data identifying the node in the WLAN, second data associated with the received transmissions that are sent into the node that is represented by the node element in the database and third data associated with the received transmissions that are sent out of the node that is represented by the node element in the database;

analyzing the received transmissions to determine state of a station, wherein a first state of the station is associated with a first set of transmissions, and wherein determining comprises;

determining if the received transmission is one of the first set of transmissions; and

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions, wherein a second state of the station is associated with a second set of transmissions, and wherein determining comprises;

determining if the received transmission is one of the second set of transmissions; and

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions, wherein a third state of the station is associated with a third set of transmissions, and wherein determining comprises determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point; and

diagnosing connectivity problems of the station using the compiled database and the determined state of the station, wherein the diagnosing comprises detecting a mismatched SSID problem by matching a client station SSID against SSIDs in the compiled database;

detecting a wildcard SSID problem by matching a client station SSID against NULL SSID;

detecting a mismatched channel problem by tracking traffic sent by a station in each channel;

detecting a mismatched speed, privacy, network type, or preamble problem by matching a capability attribute of a station against that of the AP;

detecting an authentication failure problem by tracking authentication response packets;

detecting an association failure problem by tracking association response packets;

detecting an equipment failure problem when no packets are transmitted from a station;

detecting a weak AP signal problem by checking AP signal strength in the compiled database;

detecting a mismatched wired equivalent privacy (WEP) key problem when a station reaches an association state and has transmitted data packets but an associated AP does not send packets back to the station;

or a higher layer protocol problem by detecting successful data exchanges between a station and an AP.

22. A system to monitor a wireless local area network (WLAN), the system comprising:

one or more stations;

an access point (AP) that communicates with the one or more stations in the WLAN;

a detector that receives transmissions exchanged between the one or more stations and the AP in the WLAN; and

a database that includes one or more individual node elements that are indexed by nodes in the WLAN, session elements, and channel elements, wherein the database is compiled by creating a node element in the database based on at least one of the received transmissions, wherein the node element is identified as a node in the WLAN, wherein the node element includes a first set of statistics that tracks a number of the received transmissions that is sent into the node represented by the node element in the database and a second set of statistics that tracks the number of the received transmissions that is sent out of the node represented by the node element in the database;

wherein connectivity problems of a station in the WLAN is diagnosed using the compiled database and a determined state of the station, by analyzing the received transmissions to determine state of a station wherein the state of the station is determined by examining a received transmission; and

determining an indicative state of the station associated with the received transmission;

wherein a first state of the station is associated with a first set of transmissions a second state of the station is associated with a second set of transmissions and a third state of the station is associated with a third set of transmissions, and wherein determining comprises determining if the received transmission is one of the first set of transmissions;

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions;

determining if the received transmission is one of the second set of transmissions;

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point.

23. The system of claim 22, wherein the node element is associated with a station or an AP in the WLAN;

session elements, wherein a session element is associated with a session established between two nodes; and

channel elements, wherein a channel element is associated with a channel in the WLAN.

24. The system of claim 23, wherein node elements are created by:

receiving a beacon frame from a node in the WLAN;

determining a MAC address of the node from a source and destination field of the beacon frame;

identifying the node as an AP in the database;

determining if the node element exists in the database that corresponds to the node; and

if the node element does not exist, adding a new node element corresponding to the node in the database.

25. The system of claim 23, wherein node elements are created by:

receiving a probe request from a node in the WLAN;

determining a service set identification address (SSID) of the node from the received probe request;

identifying the node as a station;

determining if the node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database;

determining from the received probe request a destination node;

determining a SSID of the destination node from the received probe request;

identifying the destination node as an AP;

determining if the node element exists in the database that corresponds to the destination node; and

if the node element does not exist, adding a new node element corresponding to the destination node in the database.

26. The system of claim 23, wherein node elements are created by:

receiving a data frame from a node in the WLAN;

identifying the node from a header in the data frame;

determining if the node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database;

determining from the received data frame a destination node;

identifying the destination node from the header;

determining if the node element exists in the database that corresponds to the destination node; and

if the node element does not exist, adding a new node element corresponding to the destination node in the database.

27. The system of claim 26, wherein session elements are created by:

identifying a session between the node and the destination node;

determining if a session element exists in the database that corresponds to the identified session;

if the session element does not exist, adding a new session element corresponding to the identified session in the database.

28. A system to monitor a wireless local area network (WLAN), the system comprising:

one or more stations;

an access point (AP) that communicates with the one or more stations in the WLAN;

a detector that receives transmissions exchanged between the one or more stations and the AP in the WLAN;

analyzing the received transmissions to determine state of a station wherein the state of the station is determined by examining a received transmission; and

determining an indicative state of the station associated with the received transmission;

wherein a first state of the station is associated with a first set of transmissions a second state of the station is associated with a second set of transmissions and a third state of the station is associated with a third set of transmissions, and wherein determining comprises determining if the received transmission is one of the first set of transmissions;

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions;

determining if the received transmission is one of the second set of transmissions;

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point; and

a database compiled based on the received transmissions by creating a node element in the database based on at least one of the received transmissions, wherein the node element in the database is identified as a node in the WLAN, wherein the node element includes first data identifying the node in the WLAN, second data associated with the received transmissions that are sent into the node represented by the node element in the database and third data associated with the received transmissions that are sent out of the node represented by the node element in the database;

wherein connectivity problems of a station in the WLAN is diagnosed using the compiled database and a determined state of the station, wherein the connectivity problems of a station in the WLAN is diagnosed using the compiled database and a determined state of the station by;

detecting a mismatched SSID problem by matching a client station SSID against SSIDs in the compiled database;

detecting a wildcard SSID problem by matching a client station SSID against NULL SSID;

detecting a mismatched channel problem by tracking traffic sent by a station in each channel;

detecting a mismatched speed, privacy, network type, or preamble problem by matching a capability attribute of a station against that of the AP;

detecting an authentication failure problem by tracking authentication response packets;

detecting an association failure problem by tracking association response packets;

detecting an equipment failure problem when no packets are transmitted from a station;

detecting a weak AP signal problem by checking AP signal strength in the compiled database;

detecting a mismatched wired equivalent privacy (WEP) key problem when a station reaches an association state and has transmitted data packets but an associated AP does not send packets back to the station;

or a higher layer protocol problem by detecting successful data exchanges between a station and an AP.

29. A computer-readable storage medium containing computer executable code to monitor a wireless local area network (WLAN) by instructing a computer to operate as follows:

receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN;

compiling a database including one or more of individual node elements that are indexed by nodes in the WLAN, session elements, and channel elements that includes creating a node element in the database based on at least one of the received transmissions, wherein the node element in the database is identified as a node in the WLAN, wherein the node element includes a first set of statistics that tracks a number of the received transmissions that is sent into the node represented by the node element in the database and a second set of statistics that tracks the number of the received transmissions that is sent out of the node represented by the node element in the database;

analyzing the received transmissions to determine the state of a station, wherein analyzing comprises examining a received transmission; and

determining an indicative state of the station associated with the received transmission, wherein a first state of the station is associated with a first set of transmissions, a second state of the station is associated with a second set of transmissions and a third state of the station is associated with a third set of transmissions, and wherein determining comprises determining if the received transmission is one of the first set of transmissions;

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions;

determining if the received transmission is one of the second set of transmissions;

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point; and

diagnosing connectivity problems of the station using the compiled database and the determined state of the station.

30. The computer-readable storage medium of claim 29, wherein compiling comprises:

creating node elements in the database based on the received transmissions, wherein the node element is associate with a station or an AP in the WLAN;

creating session elements in the database based on the received transmissions, wherein a session element is associated with a session established between two nodes; and

creating channel elements in the database based on the received transmissions, wherein a channel element is associated with a channel in the WLAN.

31. The computer-readable storage medium of claim 30, wherein creating node elements comprises:

receiving a beacon frame from a node in the WLAN;

determining a MAC address of the node from a source and destination field of the beacon frame;

identifying the node as an AP in the database;

determining if the node element exists in the database that corresponds to the node; and

if the node element does not exist, adding a new node element corresponding to the node in the database.

32. The computer-readable storage medium of claim 30, wherein creating node elements comprises:

receiving a probe request from a node in the WLAN;

determining a service set identification address (SSID) of the node from the received probe request;

identifying the node as a station;

determining if the node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database;

determining from the received probe request a destination node;

determining a SSID of the destination node from the received probe request;

identifying the destination node as an AP;

determining if the node element exists in the database that corresponds to the destination node; and

if the node element does not exist, adding a new node element corresponding to the destination node in the database.

33. The computer-readable storage medium of claim 30, wherein creating node elements comprises:

receiving a data frame from a node in the WLAN;

identifying the node from a header in the data frame;

determining if the node element exists in the database that corresponds to the node;

if the node element does not exist, adding a new node element corresponding to the node in the database;

determining from the received data frame a destination node;

identifying the destination node from the header;

determining if the node element exists in the database that corresponds to the destination node; and

if the node element does not exist, adding a new node element corresponding to the destination node in the database.

34. The computer-readable storage medium of claim 33, wherein creating session elements comprises:

identifying a session between the node and the destination node;

determining if a session element exists in the database that corresponds to the identified session;

if the session element does not exist, adding a new session element corresponding to the identified session in the database.

35. A computer-readable storage medium containing computer executable code to monitor a wireless local area network (WLAN) by instructing a computer to operate as follows:

receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN;

compiling a database based on the received transmissions that includes creating a node element in the database based on at least one of the received transmissions, wherein the node element in the database is identified as a node in the WLAN, wherein the node element includes first data identifying the node in the WLAN, second data associated with the received transmissions that are sent into the node represented by the node element in the database and third data associated with the received transmissions that are sent out of the node represented by the node element in the database, wherein the database includes node elements, session elements, and channel elements;

analyzing the received transmissions to determine state of a station, wherein the state of the station is determined by examining a received transmission; and

determining an indicative state of the station associated with the received transmission;

wherein a first state of the station is associated with a first set of transmissions a second state of the station is associated with a second set of transmissions and a third state of the station is associated with a third set of transmissions, and wherein determining comprises determining if the received transmission is one of the first set of transmissions;

identifying the state of the station as being the first state when the received transmission is determined to be one of the first set of transmissions;

determining if the received transmission is one of the second set of transmissions;

identifying the state of the station as being the second state when the received transmission is determined to be one of the second set of transmissions determining if the received transmission is one of the third set of transmissions; and

identifying the state of the station as being the third state when the received transmission is determined to be one of the third set of transmissions, wherein the first state indicates the station has not been authenticated or associated with the access point, the second state indicates that the station has authenticated but not associated with the access point, and the third state indicates that the station has authenticated and associated with the access point; and

diagnosing connectivity problems of the station using the compiled database and the determined state of the station, wherein diagnosing comprises;

detecting a mismatched SSID problem by matching a client station SSID against SSIDs in the compiled database;

detecting a wildcard SSID problem by matching a client station SSID against NULL SSID;

detecting a mismatched channel problem by tracking traffic sent by a station in each channel;

detecting a mismatched speed, privacy, network type, or preamble problem by matching a capability attribute of a station against that of the AP;

detecting an authentication failure problem by tracking authentication response packets;

detecting an association failure problem by tracking association response packets;

detecting an equipment failure problem when no packets are transmitted from a station;

detecting a weak AP signal problem by checking AP signal strength in the compiled database;

detecting a mismatched wired equivalent privacy (WEP) key problem when a station reaches an association state and has transmitted data packets but an associated AP does not send packets back to the station;

or a higher layer protocol problem by detecting successful data exchanges between a station and an AP.