RUCKCast #120 - What Is The RKS TX VAP Anyways?

Ever seen a mysterious SSID called RKS-TX-VAP on your 6 GHz radio that you didn't configure and can't connect to? In this episode, Jim breaks down what the RUCKUS Transmit VAP actually is, how it ties into Multi-BSSID, and why it cuts beacon airtime by over 50%.

Intro music by Alex Grohl, available here:
https://www.youtube.com/watch?v=ZsRWpx8VJ_E
and
https://pixabay.com/users/alexgrohl-25289918/

Transcript

0:06

Hey everybody and welcome back to another episode of the RUCKCast. My name is Jim Palmer and I'm your host. Today I wanted to talk about something that I've been wanting to talk about for a long time. I've just never really had the time or to do it for the show. I've had the time. I've just been doing it for other people in other places and I thought, you know what, it's time to bring it to the audience. It's time to bring it to the listeners, to the viewers. And today I want to talk about something that maybe you've run across, maybe you've seen, you haven't really unknown and really haven't understood what it is. And so today I want to talk about the RUCKUS TX VAP or the RKS TX VAP and that's the RUCKUS TX or Transmit VAP or Virtual AP. This all came about with six gigahertz and there was a feature that was introduced called Multi-BSSID in six gigahertz. There's a lot of different little things that changed in the way that six gigahertz runs, the way the six gigahertz operates, and this just happens to be one of those items. And so I've done some internal training, but so today I said, you know what, I'm going to bring it to the audience, bring it to the show, and I want to talk about what is the RUCKUS TX VAP anyway? What does it mean? Now, like I mentioned, it all sort of came about because of a thing called Multiple-BSSID in six gigahertz. So a little while ago I actually put together some training and so I'm going to take some time now and give the training to you guys. So if you're a RUCKUS insider, you might have already seen some of these slide decks. If not, welcome to being an RUCKUS insider. So let's take a look at my slide deck here. Multiple-BSSIDs in six gigahertz. So it's also known as MBSSID, but it's really multiple-BSSID. And if you don't know what a BSSID is, that's a basic service set identifier. So really, what does this mean? What does this, you know, and so let's talk about it this way. We're going to go back and think about 2.4 and 5 gigahertz. If you had one SSID, you'd have one beacon. Yeah, pretty simple, right? Now, if you had three SSIDs per radio, then you would have three beacons. And more importantly, you'd also have three probe responses. So if there was a probe request that came out, either a broadcast probe request or a targeted probe request, you know, you would get that and be like, you know, targeted one, you're going to get the one SSID, but a broadcast probe request, you're going to end up with, because it's asking, hey, tell me all about all of the SSIDs that you have on this channel. And so the radio says, cool, here's my three, one, two, three. And a lot of times if you're doing over the air captures and you look at those frames, you realize that we just got done announcing them in the beacon. And then we're going to go ahead and do a probe response. That's a directed probe response to whoever asked. And we're going to go, even though we just announced it to the entire channel, that we have these three SSIDs, we're going to go ahead and tell you specifically, because you couldn't listen to the broadcast, you needed to listen, you know, you needed your own personalized engraved invitation. And so what that looks like is when you look at saying this is a five gigahertz capture, and what you'll see is we have three beacons, channel 56. I was doing, you know, this is part of my lab, some 20 megahertz wide, and you got a fast Jimmy OWE, a fast Jimmy PSK mixed, and a fast Jimmy dot one X. That's the FJ. So we're looking at basically the three types of security factors that you would have. Now this is in five gigahertz, but you know, what you can see is that we have this beacon airtime over here on the right hand side. And you can see that depending on, you know, what's contained in the network, different features, different things like that, you end up with a, you know, a little bit more information within that beacon. And so it'll take a little bit extra airtime. And so you're looking anywhere from 0.6 milliseconds, you know, 0.68, 0.70 milliseconds. So that's how much time that's taken to do those three SSIDs. So the total is you have basically two milliseconds of time that's taken up advertising this, and three transmit opportunities, because it's got to transmit, transmit, transmit. And so that's three times that somebody else could have been transmitting else, or the AP could have been transmitting other data, right? So you have three times the workload, three times the time. So now let's take a look at a multi-BSSID. Now if you have one SSID, you have one beacon. That's the same. But I'll ask you, how many of you have just one SSID? Now it might happen, but you know, play along. You generally have more than one. So what we have with a multi-BSSID is if we go back and we look at those three SSIDs that we had before, instead of having three beacons and three probe responses, we actually have one. We have one beacon, one probe response. Because when we look at how that channel is built and how that works, this is a six gigahertz. Now is channel 69, which is one of the tips that is six gigahertz, even though, you know, there is, there is something you could get a CFI of channel 69 and five gigahertz, but this is six gigahertz, mainly because it's 160 megahertz wide. And even though I'm nuts, I'm not that crazy where I'm going to run 160 and five, five gigahertz. But more importantly, what you'll see is you have that you have a new network now, even though we still only have three SSIDs. I'm showing four networks on the screen. But when you take a look at that beacon airtime again, over here on the right hand side, what you're going to notice is it's 0.92 milliseconds for an SSID that we didn't create, we didn't configure. And it's called the RUCKUS TX VAP, RKS TX VAP. And I can't tell you how many times I got questioned by people there to be like when you when they first started getting the six gigahertz stuff, they'd be like, what's this, this SSID? I didn't configure it. It's not mine. But it showed up. And when I try to connect to it, nothing happened. And it's like, well, it's an SSID that's coming off of your AP off of your radio. But it's not something you configured, because this is the multi-BSSID. And what we can see here, when we take a look at it is that beacon airtime, even though it's a lot more than one SSID that we see in five gigahertz, when you take a look at it, it's 0.92 milliseconds as opposed to the two milliseconds, but we're only using one transmit opportunity. So we're getting all of the information out in a single frame instead of having to do it three times. And so what we have is we have three times the workload, same, but we have a 56% reduction in time and a 66% reduction in channel utilization. So that is where that RUCKUS TX VAP and the multi-BSSID. That's why it's there is making our six gigahertz airtime much more efficient. We're saving time, we're saving transmit opportunities, which, you know, if you know me, you know, I like to say, get your clients on, get your clients off. And part of the way we do that is we we become better stewards and we use the spectrum more efficiently. And this is one way to do it. Now, what does it look like when you drill into a RUCKUS TX VAP? Um, this is what you see. You know, we see our normal thing, but you're going to see an information element down there. ID number 71. And it's right down here, you know, and it has, and it's called multiple BSSID. Element ID is 71. You have your bytes, your length is going to change and the max BSSID indicator is three. So eight BSSIDs. And so, but what you're going to notice down in here is down in this section in the details section, you're going to see, you know, because we have three SSIDs that we configured, we're going to have three non transmitted BSSID profiles. So instead of having three individual beacons that are sending out, you know, all this information, we have one frame for the channel, for the, for the radio and contained within there are the things called a non transmitted BSSID profile. Now, what this means is, is that it's not transmitted by itself as a standalone anywhere else on the channel. You're only going to find it contained within this SSID. That's called the RUCKUS TX VAP. So now you can kind of understand where the TX comes from. RKS, easy, RUCKUS, right? TX is transmitted. So now we know that we have a RUCKUS transmitted VAP and the VAP is a virtual AP or a virtual. And what we're saying is this is a virtual network that really doesn't exist except to carry all of this other information. And I'll get into that why in a second, but when you, when you go in and you look at, and you break down each one of these, what you're going to see is the SSIDs that we saw previously, you know, the dot one X and this one's three. So it's in WPA three, the other one was dot one X two. So that was WPA two and then the PSK mixed. So all of that information, you know, the actual SSID itself is contained within information element ID number 71, which is that non-transmitted BSSID profile. And you can see that up there above it, right? If we look right up here, what you're going to see is that non-transmitted BSSID profile. And then when you come over here, you'll actually see, Hey, here's the SSIDs. And here's some more of the information that's about that one specific SSID that's buried it now. And here's the second one that is buried inside of another SSID element, that RUCKUS TX VAP. So it's all embedded inside there, whereas then you have some of the other information that isn't necessarily specific to the WLAN will be contained in the other sections of that frame. And so what you end up happening is you have it all sort of embedded, and then you have, you know, the transmit powers and power constraints, country codes, and all those other things, those end up being outside of that multiple BSSID, you know, those non-transmitted BSSID profiles. So it's all still there. It's just a lot more efficient. Now, we're back here looking at our non-transmitted BSSID profile. So let's take a look at what else we have up here, which is the actual transmitted SSID. So that's where that TX comes from is because this one's actually transmitted. It's telling us the name is telling us, Hey, this is being transmitted. So this is what, you know, this transmitted SSID is what contains all of my other information. So let's take a look at this because this actually kind of gets a little important because any SSID can be used for a multi-BSSID network. The standard doesn't say you have to use this virtual one, a virtual SSID. It can be any SSID that you want. So it, and vendors are allowed to pick and choose how they want to approach this and how they want to do this. So don't get hung up if you see these things and you go, Oh, well, they're doing it one way and somebody else is doing it something different. Yeah, that's the fun of 802.11, right? Like they go, they go, Oh, we're going to create a multi-BSSID feature, but we're not going to explicitly define how this is used. So yeah, you can use whichever SSID you want. And so like we were like, I was kind of breaking down and I'll put it here for you. RKS, that's RUCKUS. TX means we're transmitting and the VAP is a virtual AP or a virtual network. So it's, it's, it's sort of like having, you know, a, a virtual machine, right? You're like, Hey, I'm going to have this VM that's going to live and it's going to contain other things. And it's all sort of doing, running it that way. And so the reason why RUCKUS chose to go with using a virtual network like the RUCKUS TX VAP is because what this allows you to do is you can, you can change the WLAN configurations and it doesn't impact the beacon frames because the beacon frames aren't tied to that specific network. So, you know, like the PSK mixed network that I had before, if that was my, if that was my multi-BSSID, right? Any changes I made to that PSK mixed network would impact the beacons of every six gigahertz network on that radio. So if I had my three SSIDs and I made a change to one, and then all of a sudden the other two stopped working because, you know, if you've ever seen it, if you make a change to the SSID, it will change the beacon because what it has to do is has to rebuild with the new information that you configured in it. So it's got to rebuild that, that beacon frame. So what happens is if you make that change on one network, it impacts all networks. However, because this RUCKUS TX VAP isn't a production network, it's a virtual thing. You can't change it, which is important when you get into things, when we talk about minimum basic rates, because yeah, it's stuck at six. And so that brings up a whole other conundrum that, you know, is still something we're trying to figure out and work on on, you know, because now when you change the minimum basic rate for a network and you say make a 24 and yet the beacon is still going out at six, how does that work? And we're still trying to figure out like how that works. You know, with all the different clients and all the other stuff, but basically the way the reason why RUCKUS did this was so that you could make changes to the SSI to one single SSID and it wouldn't matter. You know, it sort of takes that variability out of your hands because other vendors will let you pick. And again, other vendors will say, no, it's the first network that you create on that radio and then becomes the multi-BSSID that's going to carry all your other ones, which then begs the question of, well, what happens if you have, you know, a section, you know, you have one floor that doesn't have your first SSID you created. So then it has a different one. So how does that work? And then to make things even better for us, some vendors don't even use multi-BSSID at all. So the best way to figure out if you're using a multi-BSSID is look at those beacon air times, because what will happen is you'll see some that have zero beacon air time and you'll have others that are really big, like almost a millisecond, because they're carrying so much traffic or so much data and so much information within the one frame. So some key notes about this. It's limited to four non transmitted BSSID profiles. We saw that indicator about eight. I think that has to do with the size. I'm still actually trying to figure that one out. I did some field testing a couple of weeks ago and I discovered that, yeah, when you get to that fifth SSID, it just doesn't show up. You can enable it, you can turn it on and you'd be like, Hey, it's going to be there. And it's not. So this is another reason to push for things like using, you know, radius and to be able to return all the attributes so that you can, you basically build your networks. This is a very good reason. If you haven't done this and say, Hey, we're going to have one network for our guests, OWE, if you're still doing that for your guests of six gigahertz, you're going to have one network that uses a SAE, simultaneous authentication of equals, which is basically a pre-shared key pass phrase, or you're going to use enterprise WPA three enterprise. I've been telling people like, Hey, you know what, unless you really want your guests on the six gigahertz, like move all of your production traffic using enterprise WPA three enterprise, move that up into six gigahertz, get all of your people that are really going to complain and you have to answer to get those up in six, open up five, let the guests run in 2.4 and five. And if you, if you need to have a network that's not using dot one X, you know, that has that PSK, then use that one too. But that way you're looking at, I guess I should do two networks and six gigahertz. And so this is a really good reason. If you haven't done it to consolidate your networks by security type, we said open OWE, a pre-shared key dot one X. Those are the only three you should really be using. And you use radius attributes to return to get all the VLANs and all the other things you want. Yeah. So you need a second, you'd need a second TX FAP. I've yet to figure out how to make that happen. So yeah, again, keep it down. So limit it to four. The other thing, and we're going to touch on this real quick is six gigahertz networks are then added into the RNR information elements of the 2.4 and the five gigahertz into those legacy beacons. So I want to touch on this really kind of quick because it has a little wrinkle. And so let's take a look at a reduced neighbor report in a legacy beacon. Now we're going to take a look at this here and the SSID is the PSK mixed. Now I know that this is a legacy mode and a non-multi-BSSID because the ID, I know ID element zero is the SSID, which is the transmitted one. And this is the actual SSID, not the RUCKUS TX FAP. So I know that I'm in a legacy band. Which legacy band? Well, when you look at the DSSS parameter set and you go current channels 11, this is in 2.4. But still, even in a 2.4, you down here at the bottom in ID element 201, information element with the ID of 201 is that reduced neighbor report. And what you'll see is it's running on channel 69, which is what we saw in that original in the multi-BSSID capture. We saw that it was channel 69 at 160 megahertz. And we can actually see that identified down here in that reduced neighbor report. So what happens is clients will be scanning and they'll scan 2.4, they'll scan 5. And then they have the, you know, you have 59 channels that they don't scan all 59 channels in six gigahertz. They only scan 15, which is a preferred scanning channel. I might have to do a episode on that one. But anyway, so in order for them, the easiest way for them to discover it, especially if you're running 40 megahertz wide channels, because if you don't know this 40 megahertz wide channels in five gigahertz for say an outdoor stadium, doesn't have a preferred scanning channel. So you rely on a thing called out of band discovery. And out of band discovery hinges on this reduced neighbor report from the SSID itself. And so when you build it in six gigahertz, it shows up in the reduced neighbor report in 2.4 and five gigahertz. So when the clients scan that and they see this reduced neighbor report down here going, oh, we're in channel 69, OP class 134, which is a channel bandwidth of 160. And what we'll see within this reduced neighbor report is here are our BSSID and our short SSID of our networks that are running in six gigahertz. Now, if you remember, I had three. So which two are we looking at here? Don't know because it shows up as a short SSID. Now BSSID is helpful, except it's kind of a pain to go look all that stuff up, right? Because then it's like, okay, now I gotta go look at it. However, if it's not on a channel that is a preferred scanning channel, they're never going to see it. So now this leads us into my last little wrinkle, which is the short SSID. So let's talk about this short SSID. It was actually defined in 802.11-2020. So this thing six years old is when it was ratified. So it's been around for a while because you got to remember six gigahertz started with Wi-Fi 6E, which was 802.11x extended into six gigahertz. So the framework's been there for at this point, six and a half years, if not longer, right? It's limited to four bytes. So it's small, right? Because we're adding more data into the beacon frame. And if you look at it and you're like, oh, EAB2620F, that's Hex. Except it's not. I thought it was. It's actually a CRC32 with a full SSID. So what's a CRC32, you say? Well, you can go to this URL and you can look at it. And it's a way to convert ASCII into something that looks like Hex. It's the same idea of Hex. It's just to get it smaller. So if you take your full SSID and you convert it to CRC32 using the link at that converter, that link I just posted, you get one possible result. So you go, cool, let's take the short SSID that we see in the reduced neighbor report contained in my legacy beacons and let's just reverse it. Let's take that and run it through that converter. And we're going to get more than a lot. In one example, it could have been up to 75,000 different results could be the SSID because it's not a clean reverse conversion. So here's my educated guess, which is pretty educated at this point. And I need to really actually take out the guess and be like, this is what I've figured out is a client is going to be able to determine the CRC32 of a known SSID because it basically says, hey, I can convert that right. That little CRC32 online is just a little script. You dump it in, it converts it. That's contained within the client, the wifi client. So when you tell it, hey, I'm looking for this SSID fast Jimmy PSK mixed, right. It's going to look in the, in the reduced neighbor report and it's going to say, I'm looking for this SSID that I've converted into CRC32. So then I can find it because I know that fast Jimmy mix comes back to EAB2620F. So it goes, cool. That's the one I'm looking for. And it's on this network. If you don't use the exact same SSID and six gigahertz as you do in five or 2.4, and you tell it, hey, I'm looking for this exact SSID, it's going to have a lot harder time finding it because it cannot do the conversion. So the way to do it is you match up and you marry up the beacon frame, right? Because now we're talking about a transmitted SSID. So it's, if it sees a transmitted SSID that is not the same SSID that it's, it's looking for, it's not going to go dig into it. But if it happens to be the exact same SSID, it can go find it in the short SSID. So this means that naming your SSIDs throws in a whole other wrinkle about what this really looks like. Now I have to give credit to a friend of mine, Brian Ward. He went and blogged about this back in 2022. And it was his blog that the links down here and I'll put it in the show notes that allows, they'll basically help me figure all this stuff out. So there you go. This was part of my training deck for teaching the internal stuff. And so that's what the RUCKUS TX VAP is. Anyways, what is it? It's the multi-BSSID that contains all the information that you need to operate at six gigahertz, all contained within a single beacon frame within a single probe response. Now I'm going to throw one more wrinkle at you real quick, talking about probe responses. Probe responses in six gigahertz are a little bit different as well. In 2.4 and five gigahertz, it sends out a broadcast beacon frame and it sends out a directed probe response. So if my client, my phone says, hey, I'm sending out a broadcast and I'm saying I want to know the probe, you know, I'm doing a broadcast probe request, the five gigahertz radios will respond but the receiver, the destination MAC address is going to be just that one client. Now what happens is if you have, you know, if I have my one phone that's doing that and is broadcasting it out, you know, it says, hey, and then my AP talks back and I have my second phone sitting here, right? But the directed probe response only goes to this phone and this phone hears it but it goes, hey, this isn't me. It doesn't listen to it. So then it does its own broadcast probe request saying, hey, now I want to know. In six gigahertz, it's a little different. You can send out your probe request, even a directed probe request to, you know, say, hey, AP, tell me about your networks. Its response is a broadcast probe response, which means that even if this, you know, if one of my phones asks for it, because it's a broadcast, both of the receivers are going to get that. They're going to look at the destination MAC address and go, hey, it's a broadcast, which means I need to listen to it. So it takes that frame and it sends it up the stack because it looks at it and goes, hey, that's me. I'm going to send it up and let the processor process and we can find out, you know, hey, what's in this broadcast? And they go, oh, it's a probe response. That way, in a high dense area where you have a bunch of APs, right? It's a better utilization of the spectrum. So that's what we're looking at in six gigahertz when it comes to beacons. Multi-BSSID, broadcast probe responses. And again, it's really simple to find. All you have to do is just, you know, get a tool and look at the time that beacons take. And if you, if you have a time for each one of those SSIDs, you're not using a multi-BSSID. If you, if you see a bunch of zeros, like I was showing you, you're using a multi-BSSID, which means you have to dig into it to pull all that stuff out. Now, luckily tools like Wi-Fi Explorer Pro has that built in for us and he's already doing all that decoding for us. And so it may, you know, so it just shows up and the only way you can really tell because you don't have to go digging for it. It's all pulled up there in the screen is by, you know, you dig into the advanced details and you'll see all that stuff. So there you go. Thank you for joining me. And hopefully, well, you'll see in about two weeks from now where we get into whatever else I come to come up to, that we want to talk about with. So thank you for joining us and I'll see you on the next one. Hey there, thanks for listening. If you like the show and haven't done so, please like and subscribe. If you want to contact the show directly, you can email us at ruckcast at commscope.com. I do read those emails. To learn more about any RUCKUS products or services that we've talked about on this or any other prior podcast, please check out our about section of the show or the show notes. And as always, thank you for listening.