Gaining insight on friendly jamming in a real-world IEEE 802.11 network

Abstract

Frequency jamming is the fiercest attack tool to disrupt wireless communication and its malicious aspects have received much attention in the literature. Yet, several recent works propose to turn the table and employ so-called friendly jamming for the benefit of a wireless network. For example, recently proposed friendly jamming applications include hiding communication channels, injection attack defense, and access control. This work investigates the practical viability of friendly jamming by applying it in a real-world network. To that end, we implemented a reactive and frame-selective jammer on a consumer grade IEEE 802.11 access point. Equipped with this, we conducted a three weeks real-world study on the jammer's performance and side-effects on legitimate traffic (the cost of jamming) in a university office environment. Our results provide detailed insights on crucial factors governing the trade-off between the effectiveness of friendly jamming (we evaluated up to 13 jammers) and its cost. In particular, we observed - what we call the power amplification phenomenon - an effect that aggravates the known hidden station problem when the number of jammers increases. However, we also find evidence that this effect can be alleviated by collaboration between jammers, which again enables effective and minimally invasive friendly jamming

Friendly Jamming on Access Points: Analysis and Real-World Measurements

“…Because the selected chipset is supported by different kernel driver and firmware, we developed the required software from scratch making the new system back-compatible with the old configuration files 3 .…”

“…This is a great challenge as such components are typically underpowered which makes it hard to meet the timing constraints imposed by reactive jamming (which already pose a challenge for powerful software-defined platforms [2]). For customer-grade equipment, solutions to the underlying engineering challenges, such as reactive jamming, have begun to emerge only recently [3], [38].…”

“…Position-Dependence. In open-space testbed experiments (e.g., [3], [42], [43]) the hit ratio monotonically decreases with the jammer's distance from the receiver. In contrast to this, behavior in our in-door scenario is quite erratic and there are weak positions even close to a victim receiver (cf.…”

A High Efficiency MAC Protocol for WLANs: Providing Fairness in Dense Scenarios

“…Like many other cards, its behaviour is ruled by a firmware code that controls the underlying hardware (including the radio, carrier sense and FIFOs) in real time. In particular we used the BRCM4318KBFG PCI card as it is supported by the OpenFWWF [25] open-source firmware, an alternative to the original code from the manufacturer that has been recently considered as development platform in several research projects [15], [24], [37]- [39].…”

Emitter localisation from reception timestamps in asynchronous networks

“…For our measurement testbed we use WRT54GL devices from Linksys. This choice was motivated by several reasons: i) their price is very affordable, less then 40 USD on ebay; ii) they run a very robust OpenWRT distribution based on Linux Kernel 2.6.32; iii) their wireless Network Interface Card (NIC) is compatible with OpenFWWF [37], an open source firmware that replaces the original binary-only software from Broadcom and has been widely used as research platform [38], [39], [40]. The basic version of OpenFWWF implements a fully working Distributed Coordination Function (DCF) and timestamps each incoming packet with the value of the Basic Service Set clock, sampled by the underlying hardware when a preamble is In each scenario, six nodes were kept fixed at locations marked by squares.…”