A Locating Method for WLAN based Location Service
Victor Lang
National Lab of Software Development
Environment
Department of Computer Science
Beihang University, Beijing 100083, China
Email: lang@nlsde.buaa.edu.cn
Abstract
General Wireless Local Area Network (WLAN)
based location systems use the Received Signal
Strength (RSS) as location fingerprint without any
additional changes to the WLAN infrastructure.
However, in real environment RSS are impacted by
many factors, such as multiple path transmission
(Multi-Path), temperature, body, etc, which harm the
accuracy of location. This paper presents a method
which uses both the angle of arrival (AOA) and RSS as
location fingerprints based on AP scanning. Compared
to other WLAN based location systems, this method
takes advantages of fewer AP, less suffering from the
influence of signal and higher accuracy. Furthermore,
in some “clean” outdoor/indoor environments, the
method can even used to locate WLAN clients without
the radio map which is the basic infrastructure of
general WLAN based location systems. Finally, this
paper analyzes the characteristics of the AP scanning
based location systems, and makes a further discussion
on client-side location system using the same method.
Keywords: Location Service, WLAN, AP Scanning,
Directional Antenna, Angle of Arrival, Received Signal
Strength
1. Introduction
The improvement of wireless network makes the
mobile communication available everywhere in
people’s lives. Many businesses are managed or being
managed to serve for mobile client customers at
different locations. For example, GPS (Global Position
System) can guide people outdoors, and cellular
telecom network based location service can be used in
some emergency services such as E-911.
In recent years, location fingerprinting techniques
using existing wireless local area network (WLAN)
Proceedings of the 2005 IEEE International Conference on e-Business Engineering (ICEBE’05)
0-7695-2430-3/05 $20.00 © 2005 IEEE
Authorized licensed use limited to: INTERNATIONAL ISLAMIC UNIVERSITY MALAYSIA. Downloaded on June 6, 2009 at 04:30 from IEEE Xplore. Restrictions apply.
Cynthia Gu
Wireless Network Group, Bell Labs
Email: zgu@bell-labs.com
infrastructure have been suggested for indoor areas
where the GPS does not work well [12]. IEEE 802.11
based WLAN has large distributions within parks,
communities, skyscrapers and homes. WLAN based
Location service provides location information of
WLAN clients, which can support various magic and
considerate business services within the scope of
WLAN network such as guiding visits, locating a
special meeting room, finding a certain individual, etc.
Generally, Received Signal Strength (RSS) [6],
Signal-to-Noise (SNR) [7] are original characteristics
which were generally used in many location systems
and projects. Those systems use them as location
fingerprints rather than angle of arrival (AOA) or time
of arrival (TOA) for determining the location of
WLAN client.
This paper will present a method using both AOA
and the RSS as location fingerprints, which can help
locate the WLAN client more easily and accurately.
2. Related work
Wireless location service has been developed in
many institutions, such as Microsoft Research (MSR),
Intel Research Seattle and MIT. Infrared and WLAN
are the primary infrastructures used by them.
Generally, WLAN based location systems work in
two phases: offline phase and online location
determination phase. [10] In the offline phase, RSSs
from each access points are collected and recorded at
selected location points in the scope of location area,
and result the radio map which build the mapping
relation between the vector of RSSs (location
fingerprint) and the real location. In the online location
phase, the vectors of RSSs are real-time collected by
WLAN clients. And Different estimation algorithms
[6] [7] [10] [11] [12] are used in different location
systems to search the radio map to estimate the
location of WLAN clients.
 MSR began their WLAN based indoor location
service research by Paramvir Bahl, and built RADAR
system. In the offline phase, RADAR uses RSSs from
multiple access points (APs) positioned to provide
overlapped radio map in the area of interest. And in the
online location phase, it combines empirical
measurements with signal propagation modeling to
determine user location and thereby enables location
aware services and Applications [6].
Access points used by RADAR are installed with
Omni antennae, and the received signal strength
collected on each point is decreased following the
path-loss formulas. Each access point can provide its
particular radio map, and multiple APs can provide
multiple radio maps. On each radio map, the particular
RSS values are distributed like contour lines in indoor
2-D space. Each element in the vector of RSSs
collected by WLAN client from an AP can indicate an
large distributing area in the related radio map. And all
elements of the vector will result the overlapped
distributing areas that determinate the closest location
of WLAN client.
So, RADAR system requires that a mobile user
must be able to see three or more APs to finish the
location service. The more APs the user can see the
more accurate locations the system can reach. The
median resolution of the RADAR system is in the
range of 2 to 3 meters, about the size of a typical office
room.
Nibble is another location service for WLAN
environment developed in UCLA. It uses signal-to-
noise ratios instead of the more commonly used RSS
as location fingerprint, and uses Bayesian network to
infer the location of device [7]. Nibble can be used
both indoor and outdoor, and requires WLAN adapters
to support the collection of both signal strength and
noise signal strength.
It is very difficult to increase the accuracy of
location for those systems which use RSS or SNR as
the only location fingerprint, though there are many
perfect optimal estimation algorithms being applied.
The main reason is that RSS and SNR from APs are
dominated by reflections, diffractions, and scattering of
radio waves within an indoor environment. So signals
from an AP will generally reach the receiver via
multiple paths (termed the Multi-Path phenomenon)
[6]. Multi-Path causes the fluctuations of signal
strength to the receiver. Furthermore, temperature,
humidity and body are also the causes of the
fluctuations of signal (Figure 1). Those factors cannot
be eliminated in real environment. The range of
fluctuation is proportional to that caused by signal loss
on distance, and it introduces many errors in location
service.
Figure 1. The fluctuations of RSS under indoor
environment.
Because both RSS and SNR are suffered from
complex indoor environments, so they can’t be taken
as trustable elements for higher accuracy location
service. This paper tries to discuss a more practicably
improved method to infer the location of mobile users.
3. Directional antenna based location
method
In this section, we will present the method which
utilizes the directional of arrival in additional to signal
strength in WLAN based location service.
Directional antennae can transfer the signal of
WLAN at the defined angle from access point. Figure
2 displays one of many signal patterns of directional
antennae. The directional antenna focuses the power of
signal within the range of overlay angle and cut the
transmission signal on the other orientation. So, if a
mobile user is on the way of the directional antenna’s
orientation, it will receive the enhanced signal,
otherwise, the received signal strength will be
weakened.
Figure 2. The sample signal pattern of directional
antenna
Directional antennae are used to build point-to-point
WLAN connection or . But, if directional antennae are
used with access points to communicate with WLAN
client directly under Basic Service Set (BSS) mode,
like what is displayed in Figure 3, then WLAN client
A will gain the strongest signal because it locate within
the overlay angle of AP’s directional antenna, and
client B, C and D will gain the differently weakened
signal from access point for their different angle of
arrival from antenna.

Proceedings of the 2005 IEEE International Conference on e-Business Engineering (ICEBE’05)

0-7695-2430-3/05 $20.00 © 2005 IEEE
Authorized licensed use limited to: INTERNATIONAL ISLAMIC UNIVERSITY MALAYSIA. Downloaded on June 6, 2009 at 04:30 from IEEE Xplore. Restrictions apply.
 Furthermore, if AP can rotate its directional antenna
horizontally with a fixed speed to scan the WLAN
clients, for example, 12 seconds per round (Angle
Velocity: 30嘙/s). Then each mobile user can collect a
time-sequence fluctuant RSSs. The pinnacle of RSSs
will be reached every cycle time (12 seconds) as soon
as the AP’s directional antenna turns to the right
orientation.
This paper defines the action above as AP scanning.
The antenna’s angle of arrival when RSS reaches the
maximum is denoted as the maximum angle of arrival
(MAOA). The maximum of RSS collected by WLAN
client during AP scanning is denoted as the maximum
received signal strength (MRSS).
In fact, in real office environments, the maximum
RSS will not always be reached exactly when AP’s
directional antennae face to the WLAN clients due to
the Multi-Path signals. But the maximum RSS will still
be reached when the antenna turn exactly to a special
angle. So the real location of WLAN client still keeps
the mapping relation with the antenna’s angle of
arrival, which is enough for the indoor location service.
We will take both MAOA and MRSS as location
fingerprints in determining the location of WLAN
client. In the following paragraphs, we will present the
location service on the AP scanning, and analyzes its
characteristics by comparing with RADAR system.
wireless LAN, enabling stations to establish and
maintain communications in an orderly fashion [2].
WLAN clients collect beacon frames from APs and
record the RSS on selected points of the radio map,
and then calculate the MAOA and MRSS for different
APs. Each selected point in the radio map records the
vector: R=[ R1,R2,… Rn], Ri=( MAOAi, MRSSi,
APi), n is the number of APs.
MRSS is the mean of the maximum RSSs, which
is collected at the same time when MAOA is collected.
Because MAOA is difficult to be calculated directly,
and the Angle Velocity of AP scanning is fixed, then
we replace the MAOA with the time interval during
which AP’s antenna turns from a base angle (BA) to
MAOA. The time interval is denoted as ¨T, ¨T =
Tmax – T0
Tmax is the timestamp of reaching MAOA, and
T0 is the timestamp of reaching BA. BA is defined by
system.
Then the vector is changed to:
R=[ R1,R2,… Rn], Ri=( ¨T i, MRSSi,
APi), n is the number of APs
There’re still other elements recorded in the radio
map by other location systems such as the orientation
or the altitude of WLAN clients [6][12]. Those
elements can also be added to current radio map to
improve the estimate of WLAN client’s orientation.

AP
C
A

Horizontal View
B

Figure 3. Access point configured with directional

antenna is used under Basic Service Set (BSS)
WLAN mode.
The WLAN based location system is generally
divided into offline phase and online phase. In the
offline phase, the radio map is built by collecting
MAOA and MRSS at selected points. We place three
access points (Netgear WG302, 802.11b/g) in the floor
as shown in figure 4. All access points are installed
with directional antennae (12 dBm) and assistant
equipments that can drive directional antennae to do
AP scanning. All APs are enabled to broadcast Beacon
frame. The beacon frame, which is a type of
management frame, provides the "heartbeat" of a

Proceedings of the 2005 IEEE International Conference on e-Business Engineering (ICEBE’05)

0-7695-2430-3/05 $20.00 © 2005 IEEE
Authorized licensed use limited to: INTERNATIONAL ISLAMIC UNIVERSITY MALAYSIA. Downloaded on June 6, 2009 at 04:30 from IEEE Xplore. Restrictions apply.
 Figure 4. Multiple access points do AP scanning, formula is applied to make the analysis processes more
and WLAN clients collect MRSS and ¨T from clear.
different APs at the selected measure points on the Within the 2D space, a particular access point can
radio map. build its unique signal radio map according to its
unique location.
Ri = (¨Ti, MRSSi, APi) is the basic element of the
RADAR system installs APs with omni antennae,
vector of each measure point, and relates to the real
so the radio map of signal will follow the path-loss
location or area on the building map. The more APs we
formula in all directions with the center of access
use, the more records will be added to the vector on the
point.
same measure point of the radio map.
L = 20 log(d) + 20 log(f) + 36.6
In the online location phase, every WLAN client
Where L is the loss in dB, d is the distance between
should synchronize its system time with background
transmitter (AP) and receiver (WLAN clients) in miles,
system in advance, this step assure the right result of
and f is the frequency in Megahertz (MHz).
¨T. Ri can be collected at WLAN clients side or
If the original transmit power of AP is P, the signal
collected from APs. All Ri are reported to the
strength collected by WLAN client on a point of radio
background location service. Then location system can
map is p, then
use many estimation algorithms to estimate the
p = P –L = P -20log(d) -20log(f) - 36.6
location of WLAN client. There are many different
Because f equals to 2.4 GHz in the 802.11 (b/g)
algorithms discussed by [6], [7], [10], [11], [12]. This
WLAN networks, p is the function of d.
paper focuses on the method which introduces MAOA
p = f(d)
and MRSS as location fingerprints rather than RSS.
The radio map of signal strength is the concentric
The estimation algorithms of location system can just
distribution. Therefore, theoretically three or more
refer to them.
overlapped radio maps with different centers ( here, a
The MAOA indicates the angle of arrival, while
center is the location of a AP) will be need to locate an
MRSS indicates the “distance” between AP and
particular point within 2D space , that’s why RADAR
WLAN client. Here, “distance” is the radio loss
system requires at least three or more APs [6]. It
distance but not the real distance between two points.
requires that WLAN client must be able to receive
The MAOA will not be affected directly by Multi-
three or more access points’ signals anywhere, or
Path, temperature and humidity, and it adds another
there’re chances to mark the wrong location.
dimension to the radio map which generally only takes
But, for AP scanning based radio map, with the help
the RSS or SNR as location fingerprint. Then we can
of directional antennae, the strength of transmission
modify the location of WLAN client (results only from
signal on all directions is variable when AP is
the estimation based on RSS dimension) with the help
scanning. The time interval during which AP’s antenna
of MAOA dimension, that decreases the errors in
turns from a base angle (BA) to MAOA is denoted as
estimation.
¨T, and the difference angle between the base angle
Also, in a “clean” indoor or outdoor environment,
and the angle of MRSS is denoted as z, and the angle
the MAOA can be taken independently as location
velocity is U, then
fingerprint to estimate the location of WLAN client.
MRSS = P –L = P - 20log(d) -20log(f) - 36.6,
And, with the help of MAOA and MRSS, the number
d =10 ^ [(P -MRSS - 20log(f) - 36.6) / 20 ] , and
of APs needed by location system is much decreased.
z = U*¨T
We will discuss them in next section.
If we ignore the affects from reflections,
diffractions, penetration and scattering of radio waves,
4. Analysis of AP scanning method then d is the direct distance between AP and WLAN
client. So, we can locate a point in 2D space with (d, z)
Location service based on AP scanning is low cost and the center point (x, y) of a relevant AP. Only one
and easy to implement. Directional antennae can be AP is enough for location service under this ideal
purchased at low price, or even made by oneself [1]. situation.
The driver equipment also has many economic choices. In real indoor environment, the affects from
AP scanning based Location service system takes reflections, diffractions, penetration and scattering of
the advantages of fewer equipments and higher radio waves must be taken into count. Then, both d and
accuracy compared to general WLAN based Location z are not indicating the real distance and angle from
service systems (RADAR, NIPPLE and other similar AP to WLAN client. So the radio map needs to be
systems) which utilize the exist WLAN infrastructure measured in offline phase. And some estimation
without any changes. We will show them through the algorithms are developed to estimate the location based
comparing with RADAR system. The simple path-loss

Proceedings of the 2005 IEEE International Conference on e-Business Engineering (ICEBE’05)

0-7695-2430-3/05 $20.00 © 2005 IEEE
Authorized licensed use limited to: INTERNATIONAL ISLAMIC UNIVERSITY MALAYSIA. Downloaded on June 6, 2009 at 04:30 from IEEE Xplore. Restrictions apply.
 on the radio map and the location fingerprint collected
real-time in the online phase.
Multiple APs can certainly help the estimation of
WLAN client’s location more quickly and accurately,
because they result the overlapping of multiple radio
maps, and decrease the suffering caused by
fluctuations of signal strength from any APs.
In a “clean” 3D space, basic requirements of APs
supplied by pure WLAN based location service system
(RADAR etc) is 4, and that needed by location system
based on AP scanning is 2. AP scanning based location
system still has advantage on the cost of WLAN
infrastructure.
WLAN based location system can not only locate
mobile user in indoor environment, but also works in
outdoor environments such as squares, campuses, or
parks. Some “clean” outdoor environments have fewer
affects from Multi-Path, and AP scanning based
location system can indicate the real location of mobile
user directly by the distance (Deduct from MRSS) and
the angle of arrival from current AP (Deducted from
MAOA) without the radio map and estimation
algorithms.
There are still some defects of AP scanning, and the
fluctuation of signal on client side caused by AP
scanning is one of them. This fluctuation will severely
influence the performance of communication between
WLAN clients and APs. The multiple antennae are
required to resolve the problem. Access point can
configure a primary antenna and a slave antenna. The
primary antenna is configured with omni antenna,
which supplies basic signal strength needed by normal
communication, and the slave antenna is configured
with directional antenna to do AP scanning.
5. Conclusions and future work
This paper presents and analyzes a method of
implementing the WLAN based location service using
the angle of arrival and signal strength techniques. The
method discussed above is AP centered, and,
directional antenna can also be used in WLAN client
centered location systems. If a WLAN client is
installed with an micro directional antenna, and
cooperates with some hardware and software to track
the WLAN signals from access points or other mobile
users, then WLAN management systems can take the
advantage of WLAN client centered locating device to
detect the illegal invasive access points in true location
or manage a large number of APs, and in addition, we
can locate other mobile users in Ad-Hoc network
Proceedings of the 2005 IEEE International Conference on e-Business Engineering (ICEBE’05)
0-7695-2430-3/05 $20.00 © 2005 IEEE
Authorized licensed use limited to: INTERNATIONAL ISLAMIC UNIVERSITY MALAYSIA. Downloaded on June 6, 2009 at 04:30 from IEEE Xplore. Restrictions apply.
environment. To what had not be discussed in this
paper, our further works include optimizing the existed
estimation algorithms based on both MAOA and
MRSS location fingerprints, and the research about
client side based location system is also included.
10. References
[1] O'Reilly, Rob Flickenger,Wireless Hacks, 2003
[2] ANSI/IEEE, Std 802.11, 1999 Edition
[3] T. W. Christ, P. A. Godwin, "A Prison Guard Duress
Alarm Location System", Proc. IEEE International Carnahan
Conference on Security Technology, October 1993
[4] P. Enge, and P. Misra, “Scanning the Special
Issue/Technology on the Global Positioning System”
Proceedings of the IEEE, Special Issue on GPS, Vol. 87, No.
1, pp. 3-15, January 1999. 11
[5] Tong Liu, Paramvir Bahl, Imrich Chlamtac, Mobility
Modeling, Location Tracking, and Trajectory Prediction in
Wireless ATM Networks, IEEE JOURNAL ON SELECTED
AREAS IN COMMUNICATIONS, VOL. 16, NO. 6,
AUGUST 1998
[6] Paramvir Bahl and Venkata N. Padmanabhan Microsoft
Research,RADAR: An In-Building RF-based User Location
and Tracking System,Infocom 2000
[7] Castro, P., Chiu, P., Kremenek, T. and Muntz, R., A
probabilistic room location service for wireless networked
environments. in UbiComp 2001, (2001), 18-34.
[8] H. Maass, “Location-Aware Mobile Applications based
on Directory Services,” MobiCom ’97, pp. 23-33, September
1997
[9] O'Reillyˈ 802.11 Wireless Networks - Definitive Guide
ˈApril 2002
[10] M. Youssef, A. Agrawala, and A. U. Shankar, “WLAN
Location Determination via Clustering and Probability
Distributions,” in IEEE PerCom 2003, March 2003.
[11] M. Youssef and A. Agrawala, "On the Optimality of
WLAN Location Determination Systems," Communication
Networks and Distributed Systems Modeling and Simulation
Conference, January 18-24 2004.
[12] Kamol Kaemarungsi, and Prashant Krishnamurthy,
"Modeling of Indoor Positioning Systems Based on Location
Fingerprinting ," IEEE Infocom, Hong Kong, March 2004.
[13] S.Ganu, A.S.Krishnakumar, P.Krishnan, "Infrastructure-
based Location Estimation in WLAN Networks," IEEE
Wireless Communications and Networking Conference
(WCNC 2004).
[14] P. Krishnan, A.S. Krishnakumar, Wen-Hua Ju, Colin
Mallows, and Sachin Ganu, "A System for LEASE: Location
Estimation Assisted by Stationary Emitters for Indoor RF
Wireless Networks," IEEE Infocom, Hong Kong, March
2004.