EasyMesh

Recently during a training I got a request from a participant what EasyMesh is and if it is interesting in some cases. I did some research on it and with this I wanted to share my results.

What is EasyMesh ?

We know meshing as a system that can cooperate and form a unified network. Meshing is typically used in locations where we don’t have to opportunity to provide structured cabling, as a solution we build a mesh to connect 2 access points together. Typically the 2 access points are from the same vendor.

EasyMesh is very suitable for home and small office Wi-Fi networks. The main benefit is that we can build a mesh setup from multiple different vendors and have seamless roaming.

Reference : https://www.wi-fi.org/discover-wi-fi/wi-fi-easymesh

The initial release of EasyMesh certification was in June 2018 by Wi-Fi Alliance, now we are having the 5^th version of EasyMesh since December 2022. To make it practical I have checked the Wi-Fi alliance website and found me a few devices that are EasyMesh compatible.  I have used the Zyxel DX3301-T0 and the TP-Link RE705X, so in my test setup I will build a mesh between a Zyxel gateway and a TP-Link extender.

Test setup

I installed the Zyxel DX3301 gateway and provided it with an internet connection, by default EasyMesh is enabled on the Zyxel gateway. In Zyxel terms this is called MPro Mesh, for now I have disabled it to show the setup without meshing enabled. The Zyxel gateway was running a 40MHz wide channel on 5GHz with the SSID EasyMesh and WPA3/SAE security enabled. You do get a notification that WPS onboarding is not possible when using WPA3.

The mesh AP I used was a TP-Link RE705X device to build the mesh, just like with the Zyxel router I have a switch button to enable EasyMesh but for Zyxel it was called Mpro Mesh. The client device should roam from the Zyxel router to the TP-Link extender using EasyMesh.

Procedure

The EasyMesh SSID was configured with WPA3, the initial connection was from my phone to the Zyxel gateway. In the screenshot below we see the Authentication frames and the Association request and Association Response connecting to the Zyxel gateway.

In the Association Response you will notice a new information element called Multi-AP extension to facilitate EasyMesh.

EasyMesh is using IEEE 1905 that works as a network handler, this standard was published by IEEE in April 2013 and operates in between the network layer and the data layer. The IEEE 1905.1 standard is providing an abstraction layer to interact with different vendors and devices, this sub-layer is exchanging Control Message Data Units (CMDU) frames with other EasyMesh neighbors. These CMDU frames contains an 8 octet header and a variable length of TLVs.

In the PCAP I made using WPA3 authentication I notice some of the IEEE 1905 frames but because of the encryption they didn’t make any sense. As the receiver address I did see this persistent mac address but I couldn’t read the data or I couldn’t see TLVs being exchanged. In the frame below you could see that the TP-Link extender was communicating with the Zyxel gateway towards the IEEE 1905.1 address but the data was encrypted.

What I did capture was the roaming event from the Zyxel gateway to the TP-Link extender. In the screenshot below we see the 4 SAE authentication frames and afterwards the Reassociation request. In the Reassociation request we notice the current AP was the Zyxel gateway and we are roaming towards the TP-Link extender.

In the end we complete the roaming event with the 4 way handshake between the Apple mobile device and the TP-Link extender. To get more visibility in the TLVs that are being exchanged in the CMDU frames I performed a factory reset on both the Zyxel gateway and the TP-Link extender and re-created the setup but now I did the setup with an open network. Using the EasyMesh SSID as an open network gave me the visibility I was looking for. Wireshark now marked these frames as IEEE 1905 protocol frames

Below is an example of the topology discovery frame that is selected, you can see all the TLV types that are used.

Because of the extensive list TLVs that can be used it would take me too far now to handle all these. But for now you may have a high-level overview what EasyMesh technology can mean for you.

After reviewing EasyMesh I have 1 question left, is this technology being used by ISP to provide residential Wi-Fi and seamless roaming throughout peoples houses ? If you could connect a Wi-Fi extender from a certain vendor with a cable modem from another vendor, that would might solve some home-user problems where clients stick to the cable modem instead of roaming to the Wi-Fi extender.