Legacy Power Save

---

♣ Legacy-PS topics:

♣ What is PowerSave?

PowerSave = Save the Power. PowerSave is a mechanism to save own battery power. This feature is useful for the devices which are mainly battery operated (Example: Mobile, Laptop, Wi-Fi sensor etc). If any device is having contentious power supply (Example: Access Point. Battery operated AP is not common) then PowerSave may be a choice not mandatory.

♣ Why PowerSave is required?

It’s simple! Device can run for longer time on battery.

♣ Is PowerSave Access Point feature or Station feature?

PowerSave is station or client feature. But there is powersave concept for Group Owner [Wi-Fi Direct GO] whose some features are similar as AP.

♣ Why it’s called Legacy?

As name says, its old and initial powersave mechanism. The new powersave is WMMPS which will be discussed separately.

♣ How many types of Legacy PowerSave are there?

To make it simple, there two types of legacy powersave

1. Powersave Poll [PS-POLL]

2. Non-PS-Poll

Note: Client can support either one of the two legacy powersave mechanisms at one time.

♣ How to check device supports Legacy powersave from sniffer capture?

            ♦ The device does not support WMM has to go for legacy powersave.

          ♦ The device does support WMM but does not support WMMPS. In this case you can see all access categories as 0 inside WME Qos info in association request. See below example.

♣ Steps for PS-POLL Mechanism:

To understand it in simple way let’s take one scenario.

Assumptions:

a. One client/station is connected to AP.

b. Client supports PS-POLL mechanism from legacy powersave.

Steps:

1.  After Association response client sends one Null Data packet with power management bit 1 to AP.

2. AP replies with ACK.

This indicates that client is going to sleep and AP agrees on the same. This time onwards AP started buffering any data that are intended for the sleeping client.

3.  When AP has buffer data, it indicates in Beacon frame.

              ♦ Beacon frame has TIM [Traffic Indication Map] field. Under TIM there is Partial Virtual Bitmap to indicate for which AID AP has buffer data.

              ♦ Multicast bit is set to 0 for unicast Data.

4. Client generally wakes up at listen interval time.

5.  STA checks the beacon and if the beacon has AID of this STA, then STA knows that AP has buffer data.

6. STA sends PS-POLL frame to AP.

7. AP sends ACK for PS-POLL.

8. STA is ready to receive buffer data.

9. AP started sending buffer data to STA.

10. Now, let’s assume AP has buffer 3 data packet for STA. Upon receiving one PS-POLL from STA AP sends Data1 to STA and gets the ACK. More data bit is 1 inside the Data1. So, STA understands that AP has more buffer data. STA sends one more PS-POLL frame to get Data2 where more data bit is 1. Again STA sends one more PS-POLL frame to AP to get Data3 where more data bit is 0. This means AP does not have any bugger data. Now STA goes to sleep again.

Here STA does not send any null data with PM=1 to indicate it’s going for sleep again, Why☻?

If we see inside of PS-POLL frame, there PM bit always 1. So STA does not have to send any extra frame to indicate AP about going to sleep. In another way we think is STA is already in powersave but wake up to get the buffer data, that’s it! Cool.

11. AP removes buffer data indication from beacon for this client’s AID. This indicates AP does not have any more buffer data anymore.

♣ Sniffer check for PS-POLL sequence:

Let’s see previous points inside Wireshark capture. Refer screenshot point to match with previous points for better understanding.

For step 11 we should see Partial Virtual Bitmap as 0x0 inside Beacon. In same capture I do not see that beacon so showing another beacon to indicate how it looks like.

♣ PS-POLL frame format:

PS-POLL frame is a special control frame as it does not have Duration field. Instead it has AID and PM bit is always 1. All other fields are as expected.

Let’s see in screenshot

One quick question: If there is no duration then how long other station will defer the medium after listening to ps-poll frame?

There is one fixed time: Whoever listen PS-POLL frame, they defer SIFS+ACK time.

♣ How long client can go for powersave:

In general STA can go for powersave for maximum Listen Interval time (ms) mentioned in Association Request frame. See below screenshot

But note that STA says it will remain sleep for 600ms (above example) , this does not mean STA cannot wake up before 600ms. STA can wake any time as per implementation but waking up at 7^th beacon is expected by AP.

♣ How long AP can buffer data if client does not take buffer data on time?

As we have observed STA will wake up and get buffer data in best scenario. But what if STA does not get buffer data and AP will keep on indicating through Beacon. There has to be some end to this right? So inside AP per AID there is one timer call edging timer, if the edging timer timeouts then AP drops all buffer packet for that STA and reset the timer. There is no standard value for this edging timer, at least not mentioned in spec.

♣ Steps for Non-PS-POLL [Switch to Active Mode or Fast Powersave] Mechanism:

To understand it in simple way let’s take one scenario.

Assumptions:

a. One client/station is connected to AP.

b. Client supports Non-PS-POLL mechanism from legacy powersave.

Steps:

1.  After Association response client sends one Null Data packet with power management bit 1 to AP.

2. AP replies with ACK.

This indicates that client is going to sleep and AP agrees on the same. This time onwards AP started buffering any data that are intended for the sleeping client.

3.  When AP has buffer data, it indicates in Beacon frame.

              ♦ Beacon frame has TIM [Traffic Indication Map] field. Under TIM there is Partial Virtual Bitmap to indicate for which AID AP has buffer data.

              ♦ Multicast bit is set to 0 for unicast Data.

4. Client generally wakes up at listen interval time.

5.  STA checks the beacon and if the beacon has AID of this STA, then STA knows that AP has buffer data.

So steps 1-5 are same as PS-POLL mechanism.

6. As STA supports non-pspoll mechanism. So STA sends NULL frame with PM=0 that means STA is in awake state.

7. Now AP sends all buffer data one by one without expecting any frame like PS-POLL from STA.

8. As long as More Data bit is set to 1 STA should be in awake state. Once more data bit set to 0, then STA sends NULL frame to AP indicating that STA is going to powersave mode. In case of PS-POLL no extra frame was sent to indicate AP that it goes for powersave.

9. AP removes AID from PVB in Beacon.

♣ Sniffer check for Non-PS-POLL sequence:

Let’s see the sniffer capture to understand this.

♣ How do we test PS-POLL or Non-PS-POLL powersave?

              ♦ In generally DHCP packet exchanges will use powersave mechanism from AP side. Like, before AP sending DHCP offer, AP will indicate in Beacon for power save station and follow powersave mechanism depending on STA supports ps-poll or non-ps-poll.

          ♦ We can start ping or iperf data from AP backend to STA wireless IP and see powersave mechanism in sniffer capture.

Basically, any data from AP should use powersave mechanism before sending to sleeping stations.

After legacy powersave we should know about WMMPS.

♣ Download:

PS-POLL_Capture

Non-PS-POLL_Capture

♥♥ If you have any doubts or query please let me know in comment section or send mail at feedback@wifisharks.com ♥♥