Linux无线网络系统分析

1、Linux无线网络系统分析孟宁电话腾讯微博：mengning997 新浪微博：孟宁V5E-mail：主页：http:/ 一是硬件上，有哪些东西，他们是如何放置的。 硬件：网络 + 有线网络 无线网络 80211无线网络 二是软件上，通信协议上，是如何实现通信的。 软件：Linux网络架构 Linux下的80211 无线网络架构802.11和OSI模型80211 Wireless LAN BSS stands for Basic Service Set. The coverage of an access point is called a BSS. STA ind

2、icates a wireless device acting in BSS as a regular STAtion. IBSS stands for Independent Basic Service Set. Its basically Ad-Hoc mode. SSID stands for Service Set IDentifier. The SSID is a code attached to all packets on a wireless network to identify each packet as part of that network. The code co

3、nsists of a string of 1-32 octets (usually represented as case sensitive alphanumeric characters).无线信号传输方式窄带无线电通信(Narrow-Band Radio) 这种技术类似于无线电台的广播，必须把发送器和接收器都调拨到同一频带。 无线电信号可以穿越墙物，在一个很广的域内传播，所以不必把它调聚成束。 然而，窄带射频发送有无线电波反射的问题，并受联邦通信委员会管制，它们必须准确地进行调谐，以防其它频率的干扰。扩展频谱通信（Spread Spectrum Communication） 简称扩频通

4、信，是一种信息传输方式，其信号所占有的频带宽度远大于所传信息必需的最小带宽。 频带的扩展是通过一个独立的码序列（一般是伪随机码）来完成，用编码及调制的方法来实现的，与所传信息数据无关 在接收端则用同样的码进行相关同步接收、解扩及恢复所传信息数据。 这种技术是在一个很宽的频率范围内广播信号，避免在窄带无线电通信中遇到的问题。 用一种编码来传播信号，接收站用同一编码来恢复信号。用这种方法，扩频无 线电信号能工作在其它信号所占据的频率范围内。 扩频无线电信号不会干涉常规的无线电广播，这是因为它的能量十分微弱。80211 Frame Type Management Frames Authenticat

5、ion frame, Deauthentication frame Association request frame, Association response frame, Disassociation frame Reassociation request frame, Reassociation response frame Beacon Frame:Authentication frame, Deauthentication frame Probe request frame, Probe response frame Control Frames Request to Send (

6、RTS) frame Clear to Send (CTS) frame(Use RTS/CTS to avoid hidden station problem) Acknowledgement (ACK) frame Data FramesCSMA/CA CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) A station wishing to transmit senses the air, and, if no activity is detected, the station waits an additi

7、onal, randomly selected period of time and then transmits if the medium is still free. If the packet is received intact, the receiving station issues an ACK frame that, once successfully received by the sender, completes the process. If the ACK frame is not detected by the sending station, either be

8、cause the original data packet was not received intact or the ACK was not received intact, a collision is assumed to have occurred and the data packet is transmitted again after waiting another random amount of time.MLME MLME Stands for Media Access Control (MAC) Sublayer Management Entity. MLME is

9、the management entity where the Physical layer (PHY) MAC state machines reside.Linux无线网络架构wext/WE是Wireless Extensions的缩写Linux网络设备工作原理FullMAC and SoftMAC FullMAC is a term used to describe a type of wireless card where the MLME is managed in hardware. You would not use mac80211 to write a FullMAC wir

10、eless driver. SoftMAC is a term used to describe a type of wireless card where the MLME is expected to be managed in software. mac80211 is a driver API for SoftMAC wireless cards, for example.Radiotap Radiotap 是一个标准，用于802.11的 帧接收(frame reception)和帧注入(frame injection) 所谓的帧接收，就是硬件（网卡）用中断通知CPU，一个数据帧到了，

11、要CPU去接收。一般是在将无线网卡设置为混杂模式的时候，底层接受到数据帧之后，不处理，而是直接传送给上层处理，一般用于分析无线网络数据传输的时候，分析网络问题到底出现在哪。Code structure Most important for driver authors: include/net/mac80211.h This file defines the API to mac80211 from below.Code structure All files except the header file are in net/mac80211/. Kconfig, Makefile buil

12、d system ieee80211 i.h most internal data structures main.c main module entry points main entry points for driver calls (reg/dereg) iface.c virtual interface handling key.c, key.h key management sta info.c, sta info.h Station (peer) management pm.c power management (suspend/hibernate) rate.c, rate.h

13、 internal rate control functions rc80211* rate control algorithms rx.c frame receive path tx.c frame transmit path scan.c software scanning codeCode structure ht.c, agg-rx.c, agg-tx.c HT/aggregation code mesh, hwmp, plink, pathtbl.c,h 802.11s mesh mlme.c Station/managed mode MLME ibss.c IBSS MLME cf

14、g.c, cfg.h, wext.c configuration entry points event.c events to userspace spectmgmt.c spectrum management code aes*, tkip.*, wep.*, michael.*, wpa.* WPA/RSN/WEP code wme.c, wme.h some QoS code util.c utility functions led.c, led.h LED handling debugfs* debugfs codeData structures ieee80211_local/iee

15、e80211_hw sta_info/ieee80211_sta ieee80211_conf ieee80211_bss_conf ieee80211_key/ieee80211_key_conf ieee80211_tx_info ieee80211_rx_status ieee80211_sub_if_data/ieee80211_vifieee80211_local/ieee80211_hw each instance of these (hw is embedded into local) represents a wireless device ieee80211_hw is th

16、e part of iieee80211_local that is visible to drivers contains all operating information about a wireless devicesta_info/ieee80211_sta represents any station (peer) could be mesh peer, IBSS peer, AP, WDS peer would also be used for DLS peer ieee80211_sta is driver-visible part ieee80211_find_sta for

17、 drivers lifetime managed mostly with RCUieee80211_conf hardware configuration most importantly - current channel intention: hardware specific parametersieee80211_bss_conf BSS configuration for all kinds of BSSes (IBSS/AP/managed) contains e.g. basic rate bitmap intention: per BSS parameters in case

18、 hardware supports creating/associating with multiple BSSesieee80211_key/ieee80211_key_conf represents an encryption/decryption key ieee80211_key_conf given to driver for hardware acceleration ieee80211_key contains internal book-keeping and software encryption stateieee80211_tx_info most complicate

19、d data structure lives inside skbs control buffer (cb) goes through three stages (substructure for each) initialisation by mac80211 (control) use by driver (driver_data/rate_driver_data) use for TX status reporting (status)ieee80211_rx_status contains status about a received frame passed by driver t

20、o mac80211 with a received frameieee80211_sub_if_data/ieee80211_vif contains information about each virtual interface ieee80211_vif is passed to driver for those virtual interfaces the driver knows about (not monitor, VLAN) contains sub-structures depending on mode ieee80211_if_ap ieee80211_if_wds i

21、eee80211_if_vlan ieee80211_if_managed ieee80211_if_ibss ieee80211_if_meshMain flows configuration receive path transmit path management/MLMEMain flows configuration all initiated from userspace (wext or nl80211) for managed and IBSS modes: triggers statemachine (on workqueue) some operations passed

22、through to driver more or less directly (e.g. channel setting)Main flows receive path packet received by driver passed to mac80211s rx function (ieee80211_rx) with rx_status info for each interface that the packet might belong to RX handlers are invoked data: converted to 802.3, delivered to network

23、ing stack management: delivered to MLMEMain flows transmit path packet handed to virtual interfaces ieee80211_subif_start_xmit converted to 802.11 format sent to master interface packet handed to ieee80211_master_start_xmit transmit handlers run, control information created packet given to drivertransmit handlers ieee80211_tx_h_check_assoc ieee80211_tx_h_ps_buf ieee80211_tx_h_select_key ieee80211_tx_h_michael_mic_add ieee8021