An Empirical Analysis of the IEEE 802.11 MAC Layer
Handoff Process
∗
Arunesh Mishra
Dept of Computer Science
University of Maryland
College Park, MD, USA
arunesh@cs.umd.edu
Minho Shin
Dept of Computer Science
University of Maryland
College Park, MD, USA
mhshin@cs.umd.edu
William Arbaugh
Dept of Computer Science
University of Maryland
College Park, MD, USA
waa@cs.umd.edu
ABSTRACT
IEEE 802.11 based wireless networks have seen rapid growth
and deployment in the recent years. Critical to the 802.11
MAC operation, is the handoff function which occurs when
a mobile no de moves its association from one access point to
another. In this paper, we present an empirical study of this
handoff process at the link layer, with a detailed breakup of
the latency into various components. In particular, we show
that a MAC layer function - probe is the primary contributor
to the overall handoff latency. In our study, we observe
that the latency is significant enough to affect the quality
of service for many applications (or network connections).
Further we find a large variation in the latency with from
one handoff to another and also among APs and STAs used
from different vendors. In this study, we account for this
variation and also draw the guidelines for future handoff
schemes.
General Terms
Measurement, Performance, Experimentation
Keywords
IEEE 802.11, Handoff, Performance, Scanning, Probe, As-
so ciation, Authentication, Latency
1. INTRODUCTION
IEEE 802.11 based wireless local area networks (WLANs)
have seen immense growth in the last few years. The pre-
dicted deployment of these networks for the next decade re-
sembles that of the Internet during the early 90s. In public
places such as campus and corporations, WLAN provides
not only convenient network connectivity but also a high
∗
Portions of this work were sponsored by a National In-
stitute of Standards Critical Infrastructure Grant, and by a
grant from Samsung Electronics AIT. CS Tech Report Num-
b er CS-TR-4395. UMIACS Tech Report Number UMIACS-
TR-2002-75.
ESS
BSS
BSS
(Wired Network)
AP AP
DS
Figure 1: The IEEE 802.11 Extended Service
Set(ESS)
speed link up to 11 Mbps (802.11b). In this paper, we are
concerned with the IEEE 802.11b network which operates
in the 2.4 GHz range.
The IEEE 802.11 network MAC specification [4] allows for
two operating modes namely, the ad hoc and the infras-
tructure mode. In the ad hoc mode, two or more wireless
stations (STAs) recognize each other and establish a peer-
to-peer communication without any existing infrastructure,
whereas in infrastructure mode there is a fixed entity called
an access point (AP) that bridges all data between the mo-
bile stations associated to it. An AP and associated mobile
stations form a Basic Service Set (BSS) communicating on
the unlicensed RF spectrum.
A collection of APs (connected through a distribution sys-
tem DS) can extend a BSS into an Extended Service Set
(ESS refer figure 1).
A Handoff occurs when a mobile station moves beyond the
radio range of one AP, and enters another BSS (at the
MAC layer). During the handoff, management frames are
exchanged between the station (STA) and the AP. Also
the APs involved may exchange certain context information
(credentials) specific to the station. Consequently, there is
latency involved in the handoff process during which the
STA is unable to send or receive traffic.
Because of the mobility-enabling nature of wireless networks,
there is opportunity for many promising multimedia and
p eer-to-peer applications (such as VoIP [3], 802.11 phones,
mobile video conferencing and chat). Also, many believe
that WLANs may become or supplement via hot spots the
next generation 4G wireless networks. Unfortunately, the
network connection as perceived by the application can suf-
fer from the jittery handoff latencies. As a matter of fact,
our measurements not only show that the latencies are very
high, but also show that they vary significantly for the same
configuration of STAs and APs.
Despite the growing popularity of WLANs, there has been
no prior measurement based analysis of the handoff pro-
cess. There is prior work on performance measurement in
ATM-based wireless networks ( [12], [8], [15] ) and cellular
wireless networks ([13]). In [2], Balachandran et. al. present
an empirical characterization of user behavior and network
p erformance in a public wireless LAN where they show the
varying number of handoffs with time. There has been work
on new handoff schemes in [14], [10],[11] and [7] focusing on
reducing WLAN handoff latency, but none of these efforts
have measured the current handoff latency.
In this study, we conduct experiments to accurately mea-
sure the handoff latency in an in-building wireless network.
The measurements are done on two co-existing wireless net-
works (utilizing APs from two popular vendors), and using
three wireless NICs from different vendors. We analyze the
handoff latencies by breaking down the whole process into
various phases to assess the contribution of each phase to
the handoff latency. Our results show that the probe phase
is the significant contributor to the handoff latency and the
variations in the probe-wait time account for the large vari-
ations in the overall handoff latency.
The rest of the paper is organized as follows. Section 2 gives
details about the handoff process as specified by the stan-
dard. Section 3 explains the methodology used for taking
the measurements. We present the analysis and results in
section 4. Section 5 concludes the study.
2. THE HANDOFF PROCESS
The handoff function or process refers to the mechanism or
sequence of messages exchanged by access points and a sta-
tion resulting in a transfer of physical layer connectivity and
state information from one AP to another with respect to the
station in consideration. Thus the handoff is a physical layer
function carried out by at least three participating entities,
namely the station, a prior-AP and a posterior-AP. The AP
to which the station had physical layer connectivity prior to
the handoff is the prior-AP, while the AP to which the sta-
tion gets connectivity after the handoff is the posterior-AP.
The state information that is transferred typically consists
of the client credentials (which allow it to gain network ac-
cess) and some accounting information. This transfer can
b e achieved by an (currently draft [5]) Inter Access Point
Protocol(IAPP), or via a proprietary protocol. For an IEEE
802.11 network that has no access control mechanism, there
would be a nominal difference between a complete associa-
tion and a handoff / reassociation. Looking at it another
way, the handoff-latency would be strictly greater than as-
sociation latency as there is an additional inter-access point
communication delay involved.
2.1 Logical steps in a handoff
The complete handoff pro cess can be divided into two dis-
tinct logical steps:(i) Discovery and (ii) Reauthentication as
described below. Later we shall see that the actual sequence
of messages exchanged perform either one of these two func-
tions.
1. Discovery: Attributing to mobility, the signal strength
and the signal-to-noise ratio of the signal from a station’s
current AP might degrade and cause it to loose connectivity
and to initiate a handoff. At this p oint, the client might not
be able to communicate with its current AP. Thus, the client
needs to find the potential APs (in range) to associate to.
This is accomplished by a MAC layer function: scan. Dur-
ing a scan, the card listens for beacon messages (sent out
perio dically by APs at a rate of 10 ms), on assigned chan-
nels. Thus the station can create a list of APs prioritized
by the received signal strength.
There are two kinds of scanning metho ds defined in the stan-
dard : active and passive. As the names suggest, in the ac-
tive mo de, apart from listening to beacon messages (which is
passive), the station sends additional probe broadcast pack-
ets on each channel and receives responses from APs. Thus
the station actively probes for the APs.
2. Reauthentication: The station attempts to reauthenti-
cate to an AP according to the priority list. The reauthenti-
cation process typically involves an authentication and a re-
association to the posterior AP. The reauthentication phase
involves the transfer of credentials and other state infor-
mation from the old-AP. As mentioned earlier, this can be
achieved through a protocol such as IAPP [5]. In the ex-
periments detailed in this paper, we do not have the draft
standard IAPP communication setup but the proprietary
inter-access point communications were allowed (between
APs of the same vendor). Thus the authentication phase
is just a null authentication in our experiments.
BACKBONE NETWORK
Access Points
Wireless station
Handoff
SNIFFER
Figure 3: The Handoff Measurement Setup
Figure 2 shows the sequence of messages typically observed
during a handoff process. The handoff process starts with
the first probe request message and ends with a reassociation
response message from an AP. We divide the entire handoff
latency into three delays which we detail below.
Station performing a handoff
Probe Response
Probe Request
(broadcast)
Probe Request
Probe Response
Authentication
Reassociation Request
All APs within range on all channels
Authentication
PROBE DELAY
AUTHENTICATION DELAY
A
D
C
B
E
F
G
New AP
DISCOVERY
PHASE
Old AP
Message Identifier
H
Reassociation Response
PHASE
REAUTHENTICATION
REASSOCIATION DELAY
TOTAL HANDOFF LATENCY
IAPP: Ack Security block
IAPP: Send security block
IAPP: Move Request
IAPP: Move Response
Figure 2: The IEEE 802.11 Handoff Procedure (followed by most cards)
1. Probe Delay: Messages A to E are the probe mes-
sages from an active scan. Consequently, we call the
latency for this process, probe delay. The actual num-
b er of messages during the probe process may vary
from 3 to 11.
2. Authentication Delay: This is the latency incurred
during the exchange of the authentication frames (mes-
sages E and F ). Authentication consists of two or
four consecutive frames depending on the authentica-
tion method used by the AP. Some wireless NICs try
to initiate reassociation prior to authentication, which
intro duces an additional delay in the handoff process
and is also a violation of the IEEE 802.11 [4] state
machine.
3. Reassociation Delay: This is the latency incurred
during the exchange of the reassociation frames (mes-
sages G and H ). Upon successful authentication pro-
cess, the station sends a reassociation request frame to
the AP and receives a reassociation response frame and
completes the handoff. Future implementations will
include additional IAPP messages during this phase
which will further increase the reassociation delay.
As a note, according to our analysis presented above, the
messages during the probe delay form the discovery phase,
while the authentication and reassociation delay form the
reauthentication phase. Apart from the latencies discussed
ab ove, there will potentially be a bridging delay caused
by the time taken for the MAC address updates (using the
IEEE 802.1d protocol) to the ethernet switches which form
the distribution system (the backbone ethernet). The results
in our experiments will not reflect this latency. In the next
section we describe the details of the experiment.
Figure 4: Handoff Latencies - Lucent STA with Lu-
cent AP
3. DESIGN OF THE EXPERIMENT
As mentioned earlier, the exp erimental setup consists of two
in-building wireless networks, a mobile wireless client, and
a mobile sniffer system. As shown in figure 3 , the basic
methodology behind the experiments, is to use the sniffer
Figure 5: Handoff Latencies - Cisco STA with Lucent
AP
Figure 6: Handoff Latencies - ZoomAir STA with
Lucent AP
(physically well within RF range of the client at all times)
to capture all packets related to the client for the analysis.
Wireless Network Environment: All the experiments
were done in the A.V. Williams Building at the University of
Maryland, College Park campus. The building hosts two co-
existing wireless networks namely cswireless and umd. The
exp eriments were done in the overlapping coverage area of
b oth networks. The cswireless network consists primarily of
Lucent APs while the umd network consists of Cisco APs.
The cswireless network density is approximately 6 APs per
flo or of the building while that of umd is approximately 8
APs per floor. The channel allocation for the networks is
done so that there is no interference between adjacent APs
i.e. the proper channels are set for the radio transmission
and reception of APs so that no adjacent APs are using the
same channel. In this experiment, channel 1, 6 and 11 are
used for the wireless communication.
Client Setup: For the mobile station, we used OpenBSD
3.1 on a HP Omnibook 500 with Pentium III 700 MHz and
384 MB RAM. The following wireless cards were used at
the mobile station during the experiment: Lucent Orinoco
Gold, Cisco Aironet 340 and ZoomAir Prism 2.
Figure 7: Handoff Latencies - Lucent STA with Cisco
AP
Figure 8: Handoff Latencies - Cisco STA with Cisco
AP
The experiments were done in the following manner. A per-
son with the mobile station walks through the building fol-
lowing a fixed path of travel (to minimize effects from the
layout of APs) during each run. The duration of the walk,
which is the duration of a single run of the experiment is ap-
proximately 30 minutes. Each experiment is characterized
by the (i) Wireless NIC used at the mobile station and (ii)
the Wireless network used. The mobile client sends negligi-
ble p eriodic ICMP messages to the network to maintain and
display connectivity. Thus as the station moves, it performs
handoffs as it leaves a BSS and enters another.
Collection of Data: During a handoff, a set of manage-
ment frames such as probe, authentication and reassociation
frames, are exchanged between the APs and the mobile sta-
tion. By collecting every management frame from the RF
medium (with timestamps) we compute the handoff delay as
the interval between the first probe request frame and reas-
sociation response frame (figure 2). Also the time spent for
each phase such as probe, authentication and reassociation
phase was obtained. This analysis is done offline.
In order to capture every management frame in the RF
medium we designed a separate IEEE 802.11 sniffing sys-
tem that is also mobile and in close proximity so that they
Figure 9: Handoff Latencies - ZoomAir STA with
Cisco AP
share the same RF medium with the client. Since neigh-
boring APs are using different channels, the sniffing system
should be able to capture frames in all three channels used,
i.e, 1, 6 and 11, simultaneously.
The wireless cards based on the Intersil Prism 2 chipset have
a monitor mode [1] which enables applications to read raw
IEEE 802.11 frames on one particular channel. Thus by
capturing traffic from three cards (on channels 1, 6, 11),
we are able to sniff all packets transmitted by participating
entities in the common RF medium. Other approaches that
use one wireless NIC and hop among channels, are bound
to miss up to an upper bound of 66% of the traffic. During
our experiments using the Cisco Aironet card to capture
packets [9], we observed a miss-rate of around 30% (from
experiments by sending parallel traffic on all three channels).
To sniff multiple channels, we set up two Linux machines,
one with one wireless card and the other with two wireless
cards which sniff three different channels independently. To
preclude the inaccuracy caused by the inconsistencies of the
system clock in the two machines, we synchronized their
times using the Network Time Protocol (NTP) through an
ethernet connection between the machines. Throughout the
experiment, we maintained a clock accuracy of 80 µs or
better between the machines (an error of less than 0.08%
for latency of 100 µs ). These linux machines we used are
IBM ThinkPad laptops with Pentium III 866 MHz and 256
MB RAM. A network sniffer program, ethereal and Prism
2 wireless cards in Hostap
1
mode are used for sniffing the
IEEE 802.11 management frames.
4. RESULTS AND ANALYSIS
Figures 4, 5 and 6 show the handoff latencies for the three
client cards (Lucent, Cisco, ZoomAir) with Lucent APs.
The X axis is the handoff number (i.e. handoffs in order of
occurrence) while the Y axis is the handoff latency breakup
among the three delays. Figures 7, 8 and 9 show the re-
sults for the Cisco APs. Each graph is a single run of the
experiment through the building. Below we itemize the con-
clusions from these results :
1
Host AP is a software implementation of AP functionality
for Prism II wireless cards.
Station performing a handoff
Probe Request
(broadcast)
New AP
All APs within range on all channels
PROBE DELAY
TOTAL HANDOFF LATENCY
Probe Response
Probe Request
Probe Response
Reassociation Request
Reassociation Response
Deauthentication
Authentication
Authentication
Reassociation Request
AUTHENTICATION DELAY
REASSOCIATION DELAY
REASSOCIATION
DELAY
REASSOCIATION
DELAY
Figure 10: The Handoff Procedure as observed using
ZoomAir wireless NICs.
1. Probe delay is the dominating component: Look-
ing at the six graphs, (figures 4,5,6,7,8,9) its clear that
the probe delay accounts for more than 90% of the
overall handoff delay, regardless of the particular STA,
AP combination. Also even in the number of mes-
sages exchanged between the STA and the APs in-
volved, the probe phase accounts for more than 80%
of these in all cases. Thus any handoff scheme that
uses techniques/heuristics that either cache or deduce
AP information without having to actually perform a
complete active scan clearly stand to benefit from the
dominating cost of the scan process.
2. The wireless hardware used (AP,STA) affects
the handoff latency: Looking at the differences in
the Y scale among the six graphs, one can readily draw
this conclusion. We can warrant this conclusion by
observing two facts. Firstly, keeping the AP fixed, we
can see that the client wireless card affects the latency.
Figure 11 compares the average values of the latency
among all six configurations. In each half of the figure
(i.e keeping the AP fixed), we can see a maximum
average difference of 335.53 ms (Lucent STA and Cisco
STA with Cisco AP). This is a huge variation by just
changing the client card being used. Secondly, keeping
the client card fixed, the AP also affects the latency
but to a much lower extent (around 50% less). This
can be inferred by looking at figure 11 and noting that
the maximum average difference (between the two APs