Abstract:
A system, method and device for classifying mobile devices based on frame characteristics and frame content provides a network administrator the ability to better understand actual network use by BYOD (bring your own device) type users, which are becoming more common, giving the ability to better understand actual use beyond the planned for stations factored into a wireless network design.

Description:
BACKGROUND OF THE INVENTION 
     This invention relates to network test and measurement, and more particularly to over the air mobile device detection. 
     The ability to accurately classify mobile devices on a WIPS overlays system is important to wireless network administrators. 
     Since the introduction of portable devices, most notably the first iPhone in 2007, BYOD or Bring your own Device has increased dramatically in enterprise wireless networks. Employees are on average brining 2 to 3 extra wireless devices into work (such as iPhones, iPads, Android phone or tablets, etc.). All of these extra devices were not factored into the design of the enterprise wireless network. Being able to accurately track these devices and separate them from “Stations”, devices which are planned as part of the network, is key to understanding what is the true number of devices that are being allowed to connect to an enterprise network. 
     Current methods to detect wireless devices in an enterprise network involve the use of hardware sensors that passively sniff 802.11 traffic, for example on the 2.4 GHz and 5 GHz frequencies. The sensors systematically scan through all of the channels on an 802.11 wireless network on a continuous basis, and when a wireless device is detected, it is classified as a Station (a known or expected device, such as an employee laptop), an Access Point, or Ad-Hoc. 
     SUMMARY OF THE INVENTION 
     In accordance with the disclosure, the ability to classify mobile devices based on frame characteristics and frame content is provided. 
     Accordingly, it is an advantage of the present disclosure to provide an improved system and method for enterprise network maintenance. 
     It is a further advantage of the present disclosure to provide an improved system and method for detecting and classifying devices on a wireless network. 
     The subject matter of the present technology is particularly pointed out and distinctly claimed in the concluding portion of this specification. However, both the organization and method of operation, together with further advantages and embodiments thereof, may best be understood by reference to the following description taken in connection with accompanying drawings wherein like reference characters refer to like elements. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of a network test instrument embodying the methods and apparatus 
         FIG. 2  is a block diagram of the overall system in which the device operates; 
         FIG. 3  is a flowchart of operational steps of the system and method; and 
         FIG. 4  is a block diagram of an alternative configuration of the system, method and apparatus. 
     
    
    
     DETAILED DESCRIPTION 
     The system according to a preferred embodiment of the present technology comprises method and apparatus to accurately classify smart phones, tablets and other BYOD devices on a WIPS overlay system, allowing a wireless administrator to differentiate between approved wireless stations and other wireless devices. 
     Referring to  FIG. 1 , a block diagram of the overall system, the system suitable comprises one or more sensors  12 ,  12 ′,  12 ″, etc., which are in communication with a management server  14 , and the management server interacts with a database  16 . The sensors monitor wireless traffic, providing analysis to determine device type of devices operating on the wireless network, and send the results to the management server  14 , which sends the information to the database  16  for archiving. The interface between the sensors and server and database can be wired or wireless, or a combination thereof, for example. 
       FIG. 2  is a block diagram of an individual sensor  12 , wherein the sensor includes one or more interfaces  18  which attach the device to a network  20  (which, as noted above, may comprises wired or wireless interfaces and networks, or combinations thereof), one or more processors  22  for operating the sensor, memory such as RAM/ROM  24  or persistent storage  26 , and power supply  28  which may include battery or AC power supplies. A receiver  30  connects to antenna  32 , supplying received signals to decoder  34 , which supplies decoded wireless signals to the processor(s)  22 . 
     The sensor  12  is suitably mounted in a ceiling, for example, or other out of the way location, in an office or factory or other facility to receive and monitor wireless traffic in the area of the sensor&#39;s location. 
     The processor takes the received decoded signals and performs an analysis described in connection with  FIG. 3 . 
     In operation, the sensor passively monitors wireless network traffic received via antenna  32 , and the decoded data is provided to the processor for classifying devices, determining whether a device operating on the wireless network is a station (an approved wireless device configured by the network administrator to be a station on the network) or a mobile device, another device which is not one of the pre-qualified devices on the network. 
     The sensor observes the network traffic (step  36 ) and for an individual device&#39;s packet traffic determines the vendor OUI (step  38 ), the Organizationally Unique Identifier, a 24-bit number that is purchased from the Institute of Electrical and Electronics Engineers, Incorporated (IEEE) Registration Authority. This identifier uniquely identifies a vendor, manufacturer, or other organization which manufactures or sells the mobile device, and is included in the MAC id of the transmitting device that is contained in the data transmitted. 
     When the particular mobile device sends a Probe Request Frame (a frame sent when the device wants to obtain information from another station on the network) additional information becomes available which is used to further classify the mobile device, so the sensor continues monitoring until a Probe Request Frame is observed (block  40 ), which will provide additional information about the mobile device, allowing identification of the device (block  42 ), and the sensor then sends that information to the server (block  44 ). The server can then decide what to do with that data, for example, storing it in database  16  if the device is determined to not be a station, but is instead a BYOD type device. 
     As an example, a mobile device would send a Probe Request Frame to determine which access points are within range. 
     The determined vendor OUI for the device might be, for example, Apple, Samsung, Blackberry, HTC, Sony-Ericsson, Nexus, or Microsoft Surface, etc. 
     The Probe Frame Request includes additional information about the device capabilities, which can also be provided to be stored in the database. 
     Examples of the additional information for a selected set of current devices include:
         For 801.11 n  devices, from the Probe Frame Request, the sensor can identify that the device only supports single spatial stream (which covers every device except Microsoft Surface for currently known devices).   For Apple devices (iPad 1, 2 and 3 and iPhone 4 and 4s), the Probe Frame Request will indicate that Short Guard Interval for 20 MHz is not supported.   For Apple iPhone 5, the Probe Frame Request will indicate that Short Guard Interval for 20 MHz is not supported, plus HT LDPC coding capability is not supported.   For Apple iPhone, 3G and 3GS, the Probe Frame Request will indicate that Supported Rates Tag length=4 and Extended Supported Rates Tag length=8.   For Samsung devices, the Probe Frame Request will indicate that support is provided for single spatial stream only.   For Microsoft Surface, the Probe Frame Request will indicate that support for 2 spatial streams+ Short Guard interval is disabled on both 20 and 40 MHz.       

     As devices are identified, the information is passed to the management server  14 , which stores the device information in the database  16 . The server in conjunction with the database can determine which devices are stations, and which are ‘mobile devices’ or BYOD type devices. A network administrator can then later study the database information to gain a better understanding of network usage and what kinds and numbers of non-station devices are using the network. 
     An alternative embodiment is illustrated in  FIG. 4 , wherein in place of the fixed location sensors, a mobile sensor may be used, for example implemented as a stand alone device or implemented using a laptop computer or other mobile device. In this configuration, a mobile computing device  46  is employed, which may comprise a lap top computer, a specialized hand-held device, mobile phone, or the like, with the mobile device including optional one or more interfaces  18 ′ which allow attachment to remote computers or networks (and again which may comprises wired or wireless interfaces and networks, or combinations thereof), one or more processors  22 ′ for operating the sensor, memory such as RAM/ROM  24 ′ or persistent storage  26 ′, and power supply  28 ′ which may include battery or AC power supplies. A user interface  48  may be provided, to interact with the user and receive operational commands and display results. 
     A receiver  30 ′ connects to antenna  32 ′, supplying received signals to decoder  34 ′, which supplies decoded wireless signals to the processor(s)  22 ′. The receiver, antenna and decoder may be provided as a separate unit  50 , which can comprise an adapter card designed to interface with the device  46 . The unit  50  may further include additional processing to perform additional analysis, or the analysis can be performed by the mobile device  46 . 
     The operation of the decoder  34 ′ may also be provided by the processor(s)  22 ′, in which case the unit  50  would not include a decoder, the raw data from the receiver being provided to processor(s)  22 ′ for decoding. 
     In operation, the mobile device  46 /unit  50  operate as self-contained units, and do not need to report or connect back to a central server as in the earlier embodiment, therefore, the operational steps correspond to  FIG. 3 , with step  44 , “send info to server”, being optional, or, deferred until such time as the mobile device  46  is able to communicate with a server, such as when a technician returns to office or remotely connects to a server/database, if desired. 
     Accordingly, a passive sensor is provided to analyze 802.11 network traffic, looking for devices and traffic anomalies, automatically detecting whether a wireless device is a station or a mobile device, optionally sending that information to a database for later study and use. 
     While a preferred embodiment of the technology has been shown and described, it will be apparent to those skilled in the art that many changes and modifications may be made without departing from the broader aspects. The appended claims are therefore intended to cover all such changes and modifications as fall within the true spirit and scope of the technology.