When looking at data transmissions over a wireless network, there is a clear pattern in regards to computers going to sleep. A computer going to sleep is part of a power saving behavior employed by most operating systems. The sleep section starts as part of a screensaver or by having the display turn off so that the display does not encounter image burn from set images appearing on the screen in the same location for a long period of time. Once the display is turned off, the computer hard disk will start to spin at a slower rate. By spinning down the hard drive the computer will start to conserve power.

The computer can also turn off running programs or place them on hold to help conserve power. Some of the processes that can go idle are networking related. If a computer is not actively transmitting data, like downloading an image, the network is not being used and is only consuming power. What the computer will do is turn off the network process by broadcasting to a network router saying that it is going to go idle. If an incoming transmission is received, the router will send a message to the computer which will cause it to become active. Sometimes the message will not be received until a user interacts with a computer.

An example of a sleeping computer receiving a message would be a cellular phone. The Android operating system allows a phone to sleep during certain hours of the night to conserve energy. There is also an automatic update process that occurs at a certain time which is set by the user. Depending on the user settings this update process can wake the phone and cause updates to start downloading. This would cause the phone to wake from its sleep mode and become active. Windows updates behave the same way by default.

Using a Wireshark capture, one can look at the sleep announcements by filtering out the data from a capture with wlan.fc.pwrmgt==1. This filter only shows the sleep announcement packets. In a test capture from class, only .5% of the packets were sleep requests. The frames mostly come as NULL announcements with a size of 53 bytes. The arrival time for these packets occurred right after midnight.

Since a computer user is likely to sleep in the middle of the night, there is a good chance that there will be multiple sleep announcements arriving around the same time period every day. This is due to the behavior of the computer user and can be set in the operating system. The average time between sleep announcement packets was thirty seconds.

In each frame, the packet only contains a header and an IEEE 802.11 section. The Radiotap header has a length of 25 and shows the data rate of 36.0 Mb/s. Since there is little information in the frame, the data rate should be consistently high. The IEEE section of the frame contains no data. It is a NULL function even though it is considered as a data frame.

The frame is sent to the main router as all of the other data has been. The transmitter sends the frame as it is about to enter sleep. The router can also let the transmitter know if another device is trying to contact the transmitter. In the case of a sleeping phone, if a call is incoming the phone will wake and take the call. The main purpose of sleep is to conserve energy, not disrupt communication.

Communication with a sleeping device will be slowed however, as the device will have to wake before sending a response. In the case of a spun down hard drive, the hard drive will have to starting spinning at full speed before communication can continue. In a solid state drive, there is no spinning so the response time will occur faster.

Based on the small percentage of frames sent regarding sleeping computers, one can make the assumption that sleep announcements would not disrupt a computer network greatly. There wouldn’t be a great cause of concern for collisions and other data disruptions as each device on the network would typically only send one announcement. Repeat announcements might be sent but they would only occur after the original announcement. They would not cause collisions if all of the computers on a network went to sleep at the same time. To combat large collision problems based on computers sleeping at the same time, one could stagger sleep times for computers on the same network.