Table 2. Number of PRFs and their confidence percentage (All WNICs - 100 trials)
WNIC 1 2 3 4 5 6 7 8 9 10 11
~n % ~n % ~n % ~n % ~n % ~n % ~n % ~n % ~n % ~n % ~n %
591 94 641 64 641 71 739 96 739 91 986 73 838 83 739 85 591 96 443 88 345 80
Airlink
542 3 591 35 690 28 789 2 690 8 937 27 789 17 740 15 642 4 493 12 394 20
168 84 168 86 168 86 168 85 168 87 168 85 168 97 168 100 168 100 168 100 168 100
Dlink
111 14 111 13 111 13 111 13 111 13 111 15 169 3
1844 63 2233 72 2816 80 2963 62 2720 62 3350 64 3156 46 2817 55 2622 42 2329 53 1554 52
Intel
1796 34 2282 19 2767 13 2914 24 2769 21 3302 32 3205 33 2865 30 2671 42 2282 19 1505 47
168 99 168 99 168 99 168 99 168 99 168 99 168 100 168 100 168 100 168 100 168 100
Link-P
191 1 189 1 189 1 183 1 169 1 111 1
1223 88 1116 79 957 53 1063 95 1063 67 1276 95 1435 77 1329 71 1010 89 744 70 584 74
Link-H
1276 9 1063 16 904 47 1010 4 1010 32 1223 4 1382 22 1276 28 957 5 691 29 638 25
548 80 822 74 766 51 876 84 876 62 1041 82 932 76 1041 71 766 99 657 94 548 52
Cisco
492 19 766 26 825 49 821 14 932 37 986 14 876 23 986 28 658 1 712 4 493 48
111 99 111 71 111 100 111 99 111 99 168 41 168 100 111 99 111 100 55 67 55 100
Lucent
149 1 55 28 145 1 169 1 111 59 168 1 112 33
The number of PRFs sent on each channel is another parameter which can help profile
the scanning behavior of WNICs. Table - 2 shows the number of PRFs and their confidence
percentage when put through 100 trials. Each PRF (~n) may include a range of ±2 PRFs. To
further explain the table, if we examine the channel 1 for Airlink WNIC, we can deduce that 591
±2 PRFs were sent in 94 trials. And another 542 ±2 PRFs were sent in 3 trials on this channel.
The table highlights the accuracy of results using the number of PRFs as a parameter for
profiling the active scanning algorithm.
Figure 4(a). Median - Number of PRFs (All channels - 100 trials - log scale)
Figure 4(b). Percentage Standard Deviation of number of PRFs (log scale)
Figure 4(a) displays the median number of PRFs on each channel. Figure 4(b) plots the
percentage of standard deviation in the number of PRFs for all trials. The standard deviation plot
reveals that the number of PRFs sent across different trials is stable. All WNICs (except Lucent
and D-Link) had less than 3% standard deviation across all trials for all channels. For channels
where D-Link and Lucent exceeded 3% standard deviation, the number of PRFs fluctuated
between two distinct values. For example, on channels 1 through 6, D-Link fluctuated between
111 or 168 PRFs per trial, yet 75-84% of the trials sent 168 PRFs on these channels.
For all the WNICs profiled, we observed that channel 6 received the maximum or close
to the maximum number of PRFs, asserting the inclination of finding an AP on channel 6, though
it received very less number of 1
st
PRFs.
While most of the WNICs sent a different number of probes per channel, 2 WNICs
probed all channels equally (D-Link and Link-P). Lucent probed channels 1-6, 8 and 9 equally,
sending 111 PRFs. Channel 7 received 168 frames and channels 10 and 11 each received 55
PRFs. The scanning algorithm of the Intel WNIC was much more aggressive than the other
WNICs, sending 2.5 times more PRFs than the next highest WNIC, Link-P. Compared to the
WNIC sending the least number of PRFs (Lucent) on channel 6, Intel sent nearly 25 times more
PRFs. When the Linksys WNIC is used with the Host AP driver (Link-H), the WNIC behaves
more aggressively sending 2 to 6 times more PRFs per channel. When the Linksys WNIC is used
with the Prism driver (Link-P), the WNIC sends an equal number of PRFs across all
channels. From this scenario we can infer that the scanning algorithm is highly influenced by the
driver software. The reason for this assumption is that the Host AP driver can be configured to
make the WNIC behave as an AP. It provides configuration to make it behave in managed (host
mode) as well as master mode (AP mode). Such configuration may directly result in tweaking
the active scanning behavior, as previously observed.
When comparing Airlink and D-Link, which are two WNICs with chipsets from the same
manufacturer (Atheros) that used the same driver (MadWifi), we also noted distinctive behavior.
The Airlink WNIC sent 4 to 8 times more PRFs per channel, while the D-Link WNIC sent a
constant number of PRFs across all channels. The differences could be attributed to the fact that
the chipset of each WNIC are different versions or the WNIC vendor imposed there own
limitations on the scanning process.
We also noticed an unexpected observation between two WNICs. The D-Link and Link-P
WNICs behave almost identically sending a constant number of PRFs across all channels,
despite the fact that the WNICs are based on two different chipsets and used different drivers.
This unique observation warrants further investigation as part of our future work to explain this
behavior.
The statistics regarding the number of PRFs varied greatly across the set of WNICs we
analyzed. Some WNICs were more aggressive in the number of PRFs sent. Some WNICs
exhibited a steady scanning algorithm probing different channels equally, while other scanning
algorithms favored certain channels. The analysis also illustrates the impact that the hardware
and driver software combination has on the number of PRFs.
6.3 - Burstiness of Probe Request Frames
Burstiness can be defined as a peculiar nature of the active scanning algorithm, when it
probes the channel more than once, without probing any other channel in between.
Burstiness can be subcategorized as follows:
1) Burstiness when scanning starts, which is, if more than one PRF is sent on the first channel it
dwells on, without probing any other channel in between.
2) Burstiness after scanning starts, sending more than one PRF on a given channel, during the
complete trial.
It was interesting to observe that the Intel WNIC behaved very distinctly from the other
WNICs. All the other WNICs exhibited no burstiness (sent one PRF on a channel) or at times
sent two or more PRFs on a particular channel. Whereas, the Intel WNIC displayed a higher
degree of burstiness for the above two sub categories. Intel was the only WNIC which in 70% of
the trials sent burst of PRFs ranging from 2 -19 when it sent the 1
st
PRF. Unlike the other WNIC
it continued sending more than one PRF when dwelling on any channel, which was quite
commonly observed for this WNIC.
