ofdm wi-凯发k8网页登录
this example shows how to retrieve information about wi-fi® networks using a software-defined radio (sdr) and preamble detection. the example scans over the 5 ghz channels and uses an sdr preamble detector to detect and capture orthogonal frequency-division multiplexing (ofdm) packets from the air. the example then decodes the ofdm packets to determine which packets are access point (ap) beacons. the ap beacon information includes the service set identifier (ssid), media access control (mac) address (also known as the basic ssid, or bssid), ap channel bandwidth, and 802.11 standard used by the ap.
introduction
this example scans through a set of wi-fi channels to detect ap beacons that are transmitted on 20 mhz subchannels. the scanning procedure uses a preamble detector on an ni™ usrp™ radio.
the scanning procedure comprises of these steps.
configure the object with a preamble that is generated from the legacy long training field (l-ltf).
set the frequency band and channels for the preamble detector to scan.
scan each specified channel and with each successful detection of an ofdm packet, capture a waveform for a set duration.
process the waveform in matlab® by searching for beacon frames in the captured waveform and extracting relevant information from each successfully decoded beacon frame.
display key information about the detected aps.
set up radio
call the radioconfigurations
function. the function returns all available radio setup configurations that you saved using the radio setup wizard. for more information, see .
savedradioconfigurations = radioconfigurations;
to update the dropdown menu with your saved radio setup configuration names, click update. then select the radio to use with this example.
savedradioconfigurationnames = [string({savedradioconfigurations.name})];
radio = savedradioconfigurationnames(1);
configure preamble detector
create a preamble detector object with the specified radio. because the object requires exclusive access to radio hardware resources, before running this example for the first time, clear any other object associated with the specified radio. in subsequent runs, to speed up the execution time of the example, reuse your new workspace object.
if ~exist("pd","var") pd = preambledetector(radio); end
to update the dropdown menu with the antennas available for capture on your radio, call the hcaptureantennas
helper function. then select the antenna to use with this example.
captureantennaselection = hcaptureantennas(radio);
pd.antennas = captureantennaselection(1);
to increase the capture sample rate to 40 mhz, specify an oversampling factor of 2
.
osf = 2; pd.samplerate = 20e6*osf; pd.capturedatatype = "double"; pd.thresholdmethod = "adaptive";
configure preamble for radio
the 802.11 standard requires that all wi-fi aps must transmit ofdm beacons using non-high throughput (non-ht) packets over a 20 mhz bandwidth. therefore, generate a 20 mhz l-ltf waveform and use one long training symbol from the generated waveform as the preamble to detect wlan ofdm packets.
cbw = "cbw20";
cfg = wlannonhtconfig(channelbandwidth=cbw);
lltf = wlanlltf(cfg,oversamplingfactor=osf);
extract the first long training symbol from the l-ltf waveform.
cyclicprefixlength = 1.6e-6*pd.samplerate; trainingsymbollength = 3.2e-6*pd.samplerate; preamble = lltf(cyclicprefixlength 1:cyclicprefixlength trainingsymbollength);
because the preamble detector requires the preamble to be between –1 and 1, normalize and set the preamble.
preamble = preamble/sqrt(sum(abs(preamble).^2)); pd.preamble = preamble;
to capture the entire first non-ht packet, you must set the trigger offset to a negative value. since you created a matched filter based on the long training symbol in the l-ltf waveform, the offset is at least one legacy short training field (l-stf), one l-ltf cyclic prefix, and one long training symbol.
lstflength = 8e-6*pd.samplerate; pd.triggeroffset = -(lstflength cyclicprefixlength trainingsymbollength 5);
tune preamble detector
configure the adaptive threshold gain, the adaptive threshold offset, and the radio gain values of the preamble detector for the local environment. configuring these values requires manual tuning by exploring the trigger points provided by the plotthreshold
function. for more information on tuning these values, see triggered capture using preamble detection.
for tuning the preamble detector, specify a channel in the 5 ghz band with a known ofdm packet.
in the 5 ghz band, the valid channel numbers are 1–200. however, the valid 20 mhz control channels for aps that use the 5 ghz band are 32, 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 149, 153, 157, 161, 165, 169, 173, 177.
band = 5;
channel = 100;
pd.centerfrequency = wlanchannelfrequency(channel,band);
adjust these values for tuning the preamble detector.
pd.adaptivethresholdgain = 0.3; pd.adaptivethresholdoffset = 0.0005; pd.radiogain = 60;
plot the filter output power, adaptive threshold, and trigger points of the reconfigured preamble detector. the generated figure contains two trigger points for each ofdm packet. each trigger point corresponds to a long training symbol.
when you generate a plotthreshold
figure, if you do not have at least two trigger points for each ofdm packet, readjust the adaptive threshold gain, the adaptive threshold offset, and the radio gain until there are at least two trigger points per ofdm packet.
captureduration = milliseconds(120); plotthreshold(pd,captureduration);
inspect the trigger points by zooming in along the x-axis of the plot. for example, this figure shows a zoomed-in view of an ofdm packet with the trigger points on the correlation peaks.
scan wi-fi channels
specify scanning region
specify the channels in the 5 ghz band for the sdr to scan.
band = 5;
channels = [32 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165 169 173 177];
generate the center frequencies associated with the selected channels and band values.
centerfrequencies = wlanchannelfrequency(channels,band);
receiver design
this diagram shows an overview of the receiver for scanning the selected channels and frequency band.
these steps provide further information on the diagram.
set the center frequency of the preamble detector, then initialize the detection and capture of a waveform for a set duration.
check if the preamble detector detects an ofdm packet.
determine and apply frequency and timing corrections on the waveform, then attempt to recover the legacy signal (l-sig) field bits.
check that the packet format is non-ht.
from the recovered l-sig, extract the modulation and coding scheme (mcs) and the length of the plcp service data unit (psdu). then recover the non-ht data and subsequently decode the mac protocol data unit (mpdu).
using the recovered mac frame configuration, check if the non-ht packet is a beacon.
recover the ssid, bssid, vendor of the ap, snr, primary 20 mhz channel, current channel center frequency index, supported channel width, frequency band, and wireless standard used by the ap.
check if the waveform contains another packet that you can decode.
initialize variables
when you call the capture
function to detect and capture a signal, you must specify the length of the capture and the signal detection timeout. since beacons transmit every 100 ms, set capturelength
to milliseconds(100)
and timeout
to milliseconds(100)
.
capturelength = milliseconds(100); timeout = milliseconds(100);
create a structure (aps
) for storing this information for each successfully decoded beacon.
ssid
bssid
vendor of ap
signal-to-noise ratio (snr)
primary 20 mhz channel
current channel center frequency
channel width
frequency band
operating mode supported by the ap
mac frame configuration
waveform in which the beacon exists
index value at which the non-ht beacon packet begins in the captured waveform
aps = struct(... "ssid",[],"bssid",[],"vendor",[],"snr_db",[],"beacon_channel",[], ... "operating_channel",[],"channel_width_mhz",[],"band",[],"mode",[], ... "mac_config",wlanmacframeconfig,"waveform",[],"offset",[]);
to determine the hardware manufacturer of the ap, select the retrievevendorinfo
box. selecting the retrievevendorinfo
box downloads the organizationally unique identifier (oui) csv file from the ieee® registration authority website for vendor ap identification.
retrievevendorinfo = true; counter = 1; ind = wlanfieldindices(cfg); % begin scanning and decoding for specified channels. for i = 1:length(centerfrequencies) pd.centerfrequency = centerfrequencies(i); fprintf("scanning channel %d on band %.1f.\n",channels(i),band); [captureddata, ~, ~, status] = capture(pd, capturelength, timeout); if ~status % if no non-ht packet is decoded, go to next channel. fprintf("no non-ht packet detected on channel %d in band %.1f.\n",channels(i),band); continue; else fprintf("non-ht packet detected on channel %d in band %.1f.\n",channels(i),band) end % resample the captured data to 20 mhz for beacon processing. captureddata = resample(captureddata,1,osf); searchoffset = 0; while searchoffset% recoverpreamble detects a packet and performs analysis of the non-ht preamble. [preamblestatus,res] = recoverpreamble(captureddata,cbw,searchoffset); if matches(preamblestatus,"no packet detected") break; end % retrieve synchronized data and scale it with lstf power as done % in the recoverpreamble function. syncdata = captureddata(res.packetoffset 1:end)./sqrt(res.lstfpower); syncdata = frequencyoffset(syncdata,pd.samplerate/osf,-res.cfoestimate); % need only 4 ofdm symbols (lsig 3 more symbols) following lltf % for format detection fmtdetect = syncdata(ind.lsig(1):(ind.lsig(2) 4e-6*pd.samplerate/osf*3)); [lsigbits, failcheck] = wlanlsigrecover(fmtdetect(1:4e-6*pd.samplerate/osf*1), ... res.chanestnonht,res.noiseestnonht,cbw); if ~failcheck format = wlanformatdetect(fmtdetect,res.chanestnonht,res.noiseestnonht,cbw); if matches(format,"non-ht") % extract mcs from first 3 bits of l-sig. rate = double(bit2int(lsigbits(1:3),3)); if rate <= 1 cfg.mcs = rate 6; else cfg.mcs = mod(rate,6); end % determine psdu length from l-sig. cfg.psdulength = double(bit2int(lsigbits(6:17),12,0)); ind.nonhtdata = wlanfieldindices(cfg,"nonht-data"); if double(ind.nonhtdata(2)-ind.nonhtdata(1))> ... length(syncdata(ind.nonhtdata(1):end)) % exit while loop as full packet not captured. break; end nonhtdata = syncdata(ind.nonhtdata(1):ind.nonhtdata(2)); bitsdata = wlannonhtdatarecover(nonhtdata,res.chanestnonht, ... res.noiseestnonht,cfg); [cfgmac, ~, decodestatus] = wlanmpdudecode(bitsdata,cfg, ... suppresswarnings=true); % extract information about channel from the beacon. if ~decodestatus && matches(cfgmac.frametype,"beacon") fprintf("beacon detected on channel %d in band %.1f.\n",channels(i),band); % populate the table with information about the beacon. if isempty(cfgmac.managementconfig.ssid) aps(counter).ssid = "hidden"; else aps(counter).ssid = string(cfgmac.managementconfig.ssid); end aps(counter).bssid = string(cfgmac.address3); if retrievevendorinfo aps(counter).vendor = determinevendor(cfgmac.address3); else aps(counter).vendor = "skipped"; %#ok end [aps(counter).mode, aps(counter).channel_width_mhz, operatingchannel] = ... determinemode(cfgmac.managementconfig.informationelements); if isempty(operatingchannel) % default to scanning channel if operating channel % cannot be determined. operatingchannel = channels(i); end aps(counter).beacon_channel = channels(i); aps(counter).operating_channel = operatingchannel; aps(counter).snr_db = res.lltfsnr; aps(counter).mac_config = cfgmac; aps(counter).offset = res.packetoffset; aps(counter).waveform = captureddata; counter = counter 1; end % shift packet search offset for next iteration of while loop. searchoffset = res.packetoffset double(ind.nonhtdata(2)); else % packet is not non-ht; shift packet search offset by 10 ofdm symbols (minimum % packet length of non-ht) for next iteration of while loop. searchoffset = res.packetoffset 4e-6*pd.samplerate/osf*10; end else % l-sig recovery failed; shift packet search offset by 10 ofdm symbols (minimum % packet length of non-ht) for next iteration of while loop. searchoffset = res.packetoffset 4e-6*pd.samplerate/osf*10; end end end
scanning channel 32 on band 5.0.
no non-ht packet detected on channel 32 in band 5.0.
scanning channel 36 on band 5.0.
no non-ht packet detected on channel 36 in band 5.0.
scanning channel 40 on band 5.0.
non-ht packet detected on channel 40 in band 5.0.
scanning channel 44 on band 5.0.
no non-ht packet detected on channel 44 in band 5.0.
scanning channel 48 on band 5.0.
non-ht packet detected on channel 48 in band 5.0.
beacon detected on channel 48 in band 5.0. beacon detected on channel 48 in band 5.0. beacon detected on channel 48 in band 5.0. beacon detected on channel 48 in band 5.0. beacon detected on channel 48 in band 5.0.
scanning channel 52 on band 5.0.
no non-ht packet detected on channel 52 in band 5.0.
scanning channel 56 on band 5.0.
no non-ht packet detected on channel 56 in band 5.0.
scanning channel 60 on band 5.0.
non-ht packet detected on channel 60 in band 5.0.
beacon detected on channel 60 in band 5.0. beacon detected on channel 60 in band 5.0. beacon detected on channel 60 in band 5.0.
scanning channel 64 on band 5.0.
no non-ht packet detected on channel 64 in band 5.0.
scanning channel 100 on band 5.0.
non-ht packet detected on channel 100 in band 5.0.
beacon detected on channel 100 in band 5.0. beacon detected on channel 100 in band 5.0. beacon detected on channel 100 in band 5.0. beacon detected on channel 100 in band 5.0. beacon detected on channel 100 in band 5.0.
scanning channel 104 on band 5.0.
no non-ht packet detected on channel 104 in band 5.0.
scanning channel 108 on band 5.0.
no non-ht packet detected on channel 108 in band 5.0.
scanning channel 112 on band 5.0.
non-ht packet detected on channel 112 in band 5.0.
scanning channel 116 on band 5.0.
no non-ht packet detected on channel 116 in band 5.0.
scanning channel 120 on band 5.0.
non-ht packet detected on channel 120 in band 5.0.
beacon detected on channel 120 in band 5.0. beacon detected on channel 120 in band 5.0. beacon detected on channel 120 in band 5.0. beacon detected on channel 120 in band 5.0.
scanning channel 124 on band 5.0.
no non-ht packet detected on channel 124 in band 5.0.
scanning channel 128 on band 5.0.
no non-ht packet detected on channel 128 in band 5.0.
scanning channel 132 on band 5.0.
no non-ht packet detected on channel 132 in band 5.0.
scanning channel 136 on band 5.0.
no non-ht packet detected on channel 136 in band 5.0.
scanning channel 140 on band 5.0.
no non-ht packet detected on channel 140 in band 5.0.
scanning channel 144 on band 5.0.
no non-ht packet detected on channel 144 in band 5.0.
scanning channel 149 on band 5.0.
no non-ht packet detected on channel 149 in band 5.0.
scanning channel 153 on band 5.0.
no non-ht packet detected on channel 153 in band 5.0.
scanning channel 157 on band 5.0.
no non-ht packet detected on channel 157 in band 5.0.
scanning channel 161 on band 5.0.
no non-ht packet detected on channel 161 in band 5.0.
scanning channel 165 on band 5.0.
no non-ht packet detected on channel 165 in band 5.0.
scanning channel 169 on band 5.0.
no non-ht packet detected on channel 169 in band 5.0.
scanning channel 173 on band 5.0.
no non-ht packet detected on channel 173 in band 5.0.
scanning channel 177 on band 5.0.
no non-ht packet detected on channel 177 in band 5.0.
convert the aps
structure to a table and display the information specified in by using the local function generatebeacontable
.
detectedbeaconsinfo = generatebeacontable(aps,band)
detectedbeaconsinfo=17×9 table
ssid bssid vendor snr (db) primary 20 mhz channel current channel center frequency index channel width (mhz) band mode
_____________________ ______________ ____________________________ ________ ______________________ ______________________________________ ___________________ ____ __________
"classforkids secure" "9a1898beb142" "unknown" 13.532 48 42 "80" 5 "802.11ax"
"classforkids guest" "9e1898beb142" "unknown" 14.314 48 42 "80" 5 "802.11ax"
"classforkids music" "921898beb142" "unknown" 13.211 48 42 "80" 5 "802.11ax"
"test ssid" "961898beb142" "unknown" 13.671 48 42 "80" 5 "802.11ax"
"hidden" "a61898beb142" "unknown" 13.902 48 42 "80" 5 "802.11ax"
"w-inside" "b0b867f3d9b0" "hewlett packard enterprise" 12.655 60 58 "80" 5 "802.11ac"
"w-mobile" "b0b867f3d9b1" "hewlett packard enterprise" 13.278 60 58 "80" 5 "802.11ac"
"w-guest" "b0b867f3d9b2" "hewlett packard enterprise" 13.225 60 58 "80" 5 "802.11ac"
"wlan1234_5" "04d4c451c584" "asustek computer inc." 37.074 100 100 "20" 5 "802.11ax"
"wlan1234_5" "04d4c451c584" "asustek computer inc." 33.754 100 100 "20" 5 "802.11ax"
"wlan1234_5" "04d4c451c584" "asustek computer inc." 34.933 100 100 "20" 5 "802.11ax"
"wlan1234_5" "04d4c451c584" "asustek computer inc." 36.619 100 100 "20" 5 "802.11ax"
"wlan1234_5" "04d4c451c584" "asustek computer inc." 36.484 100 100 "20" 5 "802.11ax"
"w-inside" "b0b867f6b2d0" "hewlett packard enterprise" 29.415 120 122 "80" 5 "802.11ac"
"w-mobile" "b0b867f6b2d1" "hewlett packard enterprise" 29.295 120 122 "80" 5 "802.11ac"
"w-guest" "b0b867f6b2d2" "hewlett packard enterprise" 28.261 120 122 "80" 5 "802.11ac"
⋮
further exploration
the
detectedbeaconsinfo
table shows only key information about the aps. to get further information about the beacons, such as data rates supported by the ap, explore the mac frame configuration in theaps
structure.if you have access to a configurable ap, change the channel width of your ap and rerun the example to confirm the channel width.
local functions
these functions assist in processing the incoming beacons.
function vendor = determinevendor(mac) % determinevendor returns the vendor name of the ap by extracting the % organizationally unique identifier (oui) from the specified mac address. persistent ouis vendor = strings(0); try if isempty(ouis) if ~exist("oui.csv","file") disp("downloading oui.csv from ieee registration authority...") % increase websave timeout if necessary options = weboptions("timeout",5); websave("oui.csv","http://standards-oui.ieee.org/oui/oui.csv",options); end ouis = readtable("oui.csv",variablenamingrule="preserve"); end % extract oui from mac address. oui = mac(1:6); % extract vendors name based on oui. vendor = string(cell2mat(ouis.("organization name")(matches(ouis.assignment,oui)))); catch me % rethrow caught error as warning. warning(me.message "\nto skip the determinevendor function call, set retrievevendorinfo to false.",[]); end if isempty(vendor) vendor = "unknown"; end end function [mode,bw,operatingchannel] = determinemode(informationelements) % determinemode determines the 802.11 standard that the ap uses. % the function checks for the presence of ht, vht, and he capability % elements and determines the 802.11 standard that the ap uses. the element % ids are defined in ieee std 802.11-2020 and ieee std 802.11ax-2021. elementids = cell2mat(informationelements(:,1)); ids = elementids(:,1); if any(ids==255) if any(elementids(ids==255,2)==35) % he packet format mode = "802.11ax"; else mode = "unknown"; end vhtelement = informationelements{ids==192,2}; htelement = informationelements{ids==61,2}; [bw,operatingchannel] = determinechannelwidth(htelement,vhtelement); elseif any(ids==191) % vht packet format mode = "802.11ac"; vhtelement = informationelements{ids==192,2}; htelement = informationelements{ids==61,2}; [bw,operatingchannel] = determinechannelwidth(htelement,vhtelement); elseif any(ids==45) % ht packet format mode = "802.11n"; htelement = informationelements{ids==61,2}; [bw,operatingchannel] = determinechannelwidth(htelement); else % non-ht packet format % exclude b as only dsss is supported mode ="802.11a/g/j/p"; bw = "unknown"; operatingchannel = []; end end function [bw,operatingchannel] = determinechannelwidth(htelement,varargin) % determinechannelwidth returns the bandwidth of the channel from the % beacons ht/vht operation information elements as defined in ieee std 802.11-2020 % section 9.4.2.56 and section 9.4.2.158. msbfirst = false; % ieee std 802.11-2020 figure 9-382 and table 9-190 define each bit in % htoperationinfobits % convert to bits to get sta channel width value in 3rd bit. htoperationinfobits = int2bit(htelement(2),5*8,msbfirst); operatingchannel = 0; if nargin == 2 % ieee std 802.11-2020 figure 9-163 and table 9-274 define each octet % in vhtelement vhtelement = varargin{1}; % vht operation channel width field cw = vhtelement(1); % channel center frequency segment 0 ccfs0 = vhtelement(2); % channel center frequency segment 1 ccfs1 = vhtelement(3); % ieee std 802.11-2020 table 11-23 defines the logic below if htoperationinfobits(3) == 0 bw = "20"; operatingchannel = ccfs0; elseif cw == 0 % ht operation channel width field is 1 bw = "40"; operatingchannel = ccfs0; elseif ccfs1 == 0 % ht operation channel width field is 1 and % vht operation channel width field is 1 bw = "80"; operatingchannel = ccfs0; elseif abs(ccfs1 - ccfs0) == 8 % ht operation channel width field is 1 and % vht operation channel width field is 1 and % ccfs1 is greater than 0 bw = "160"; operatingchannel = ccfs1; else % ht operation channel width field is 1 and % vht operation channel width field is 1 and % ccfs1 is greater than 0 and % |ccfs1 - ccfs0| is greater than 16 bw = "80 80"; end end if operatingchannel == 0 if htoperationinfobits(3) == 1 bw = "40"; secondarychanneloffset = bit2int(htoperationinfobits(1:2),2,false); if secondarychanneloffset == 1 % secondary channel is above the primary channel. operatingchannel = htelement(1) 2; elseif secondarychanneloffset == 3 % secondary channel is below the primary channel. operatingchannel = htelement(1) - 2; else warning("could not determine operating channel.") end else bw = "20"; operatingchannel = htelement(1); end end end function tbl = generatebeacontable(aps,band) % generatebeacontable converts the access point structure to a table and % cleans up the variable names. tbl = struct2table(aps,"asarray",true); tbl.band = repmat(band,length(tbl.ssid),1); tbl = renamevars(tbl,["snr_db","beacon_channel","operating_channel","channel_width_mhz"], ... ["snr (db)","primary 20 mhz channel","current channel center frequency index", ... "channel width (mhz)"]); tbl = tbl(:,1:9); end