iPhone 6 Roaming Behavior and Optimization by Cisco.

Phone 6 Roaming Behavior and Optimization

Executive and Recommendations Summary

IOS 8 devices try to roam when their associated BSSID signal falls below –70 dBm RSSI. The IOS 8 devices then scan all channels (without 802.11k) or the target channels communicated by their current AP (with 802.11k enabled), and roam to another AP if its signal is 8 dB better (IOS 8 device in active communication) or 12 dB better (IOS 8 device in idle) than the current AP.

Roaming performances are critical for VoWifi and business-critical real-time business applications. Efficient roaming time is 50 ms. Without 802.11k enabled, dual-band SSIDs, and standard AP density, the total loss of connection for an IOS 8 device can reach 5 seconds for each roam. With 802.11k enabled, higher AP density (AP every 2500 sqft or every 240 sqm), and network designed with 5 GHz, the roaming performances can reach sub-second.

When designing wireless networks for real-time application performances, plan for 5 Mbps per user and 12 – 14 users per AP. Make 5 GHz and 802.11k as part of your design criteria for mobile devices.

Context

Mid November 2014, Apple support published a reference document explaining how IOS8-based devices roam (http:/​/​support.apple.com/​en-us/​HT6463). This blog entry is based on this reference document, but with added lab + real network measurements (to distinguish good intents from practical behaviors in real world).

The roaming behavior is similar for iPhone 6, iPhone 6 plus, iPhone 5c, iPhone 5s, iPad Air, and iPad mini with retina. The probing behavior also depends on the chipset used in the phone. You will see general behavior parameters determined by the OS, but also small timer variations between models determined by the chipset and its driver. For example, does the phone probe once or several times per “probe burst”, how many milliseconds between the probe requests in a given burst, and so on. This document focuses on the general behavior, but the timers shown were measured on iPhone 6, using a Broadcom BCM4339 chipset. The behavior was tested on IOS 8.1.

How Often Does My iPhone 6 Scan?

When you are NOT associated to any SSID, and your screen is off (for example, your phone is in your pocket), your phone will check the surroundings at regular intervals for SSID by sending probe requests. The phone will scan more often if you move (that is, the signal from APs vary, see the When Does My iPhone Roam? section, as the behavior is similar). So let us assume the worst case scenario, you are not moving.

If your cellular data is unavailable and Location (Settings > Privacy > Location Services) is disabled, your phone alternatively uses its real MAC address and a locally administered address. The idea is to temporarily hide your real MAC address for privacy purposes. In that case, the phone sends a burst of probe requests with the real MAC address. The phone then stays silent for a “random interval” (in the order of 140 seconds), before sending between one and six probes with a locally administered address, at 135 or 270 second interval. The phone then stays silent for another random interval (up to 10 minutes) before going back to the real MAC address and restarting the cycle. The phone picks a new locally administered address when switching between real and locally administered addresses.

An example of the behavior is illustrated in the following figure. The horizontal axis represents the capture time in second (capture was taken over 8.5 hours, or 30 K seconds). The vertical axis represents the interval between two consecutive probe requests. The blue values are probes using the real MAC address, and the red values represent probes using a locally administered address. For example, at 5000 second, 322 seconds after the last probe request using a locally administered address, the phone sends a probe request using the real MAC address (blue dot at [5000,322]). After 20 milliseconds, the phone sends a second probe using the real MAC address (point that seems to be at [5000,0], but is in fact at [5000.02, 322.02]). The phone then stays silent for 135 seconds before sending a probe using a locally administered address. The phone then sends two more probes at 135 seconds interval, then two more probes at 270 seconds interval, and stays silent for 204 seconds before sending a probe with the real MAC address.

Notice that some capture and collision artifacts wrongly show locally administered address probes at large intervals (beyond 270 seconds).

When Does My iPhone Roam?