Freakquency

Why we need (and should already have) a 4 channel plan in 2.4GHz

2009-10-08T13:10:00.000-07:00

A long time ago I took the original AirMagnet Academy class. At the time it was known as AM-101. In the class I was taught that there were 14 channels in the 2.4GHz ISM spectrum for 802.11b. I also learned that there were only 3 non-overlapping channels because the AP spreads out it's signal in a channel mask 20MHz wide. So an AP on channel 1 would use the frequencies from 2.402GHZ to 2.422GHz. Channel 6 would go from 2.427 to 2.447 and channel 11 would use 2.453 to 2.472. Channel 14, I was told, was not used here in the USA because it was too close to 11 and would overlap it so the FCC mandated we not use it.

It took me 2 more years before I realized that the FCC had allocated the channels (in my opinion) incorrectly and that channel 14 was in the wrong place. I just never actually looked deeply enough nor calculated it out enough to catch it. Then one day I did calculate it and said, "hmm".

Lets take a look. Each channel is positioned 5MHz over from it's neighbor and the counting starts at 2.412 (I assume this is so someone doesn't try and put an AP up on 2.400GHz and have the left hand side 10Mhz hang out into the 2.3GHz spectrum.) So channel 1 is 2.412 and channel 2 is 2.417 channel 3 is 2.422 etc. Reference here.

Here this should help:

Notice what happens above channel 13, suddenly it jumps from 2.472 to 2.487. Why? I have no idea. It always remained a mystery to me.

Nowadays, however, we have a very crowded frequency range. Every mother's son has an AP not to mention all the non-802.11 interferers. This makes it hard to find room to breathe. I recently went back to my original spreadsheet and tried to see if we could use some of that real estate up around channel 14.

I was pleasantly surprised to see that if we continue to extend the 5HMz per channel philosophy up all the way to 2.497 GHz we can create channels 14, 15 and 16. This allows us to put an AP on (the newly created) channel 16 at 2.487 that will not overlap with channel 11 and will also not leave the 2.4 range. Nirvana!!

See?:

An interesting byproduct of this would be 2 non-overlapping 40HMz wide 802.11n bands as well. One from 2.402 to 2.447 and another from 2.452 to 2.497.

Unfortunately, I learned while researching this that the FCC will not allow use from 2.4835 GHz to 2.5 GHz. This is probably legacy from outdated military radar or other radios that caused similar restrictions in the UNII bands as well. The regulation may be found here

Which is really too bad. Funny enough, we found a way around military interference with 802.11h using Dynamic Frequency Selection and transmit power control in the 5GHz band. Why can't we do the same here, we could really use the bandwidth regardless of Voidmstr's Law. What do you think?

Disposable Income??

2009-06-09T17:02:00.001-07:00

Well here we are, half way through 2009. This year saw the culmination of, arguably, the worst financial crisis since the Great Depression. Yada yada yada. We have heard this all before.

I thought we were going to talk about Wi-Fi?

Well today I thought I would talk about disposable computers. Several weeks ago an associate of mine saw her beloved 17 inch iMac G5 all-in-one start to shut down for no apparent reason. She had Apple Care and had no problem trucking it down to the local Apple Store Genius Bar for a looksie.

They had her Mac for a week and then called and said, "you better come down here". When she got there they broke it to her gently, her mac was dead. The logic board was failing and a replacement would cost more than the worth of the unit. A few tears were shed before she realized this would mean she would need a new iMac - STAT!

So she cam home with a new improved 20 inch, Aluminum Bezel, Glass front, 2.66GHz Intel Core 2 Duo iMac .

The poor old unit sat next to the front door accumulating dust until I stripped some parts off of it and sent the remainder to the recycling plant here in San Francisco where they are used to this kind of recycling, as I am sure they are elsewhere these days.

I felt bad. Seemed like a waste.

Then I did the worst thing a husband can do to a Wife's computer. I spilled a drink on my wife's MacBook. I freaked out, flipped the unit over, yanked out the mag-safe power cable and the battery and spent the next several hours wiping it down and blowing air through the unit to get it dry. I failed, the next morning she had a host of keyboard and restart issues. She was not happy, however, to her credit, she was not super mad at me either, just at the situation.

So, guess what I did? Yep. I took the unit down to the Apple Store, where again the Genius Bar Dude said it was covered by AppleCare and that they would call us in a few days and tell us what was up. And guess what the verdict was? 800 dollars, 100 dollars cheaper than the Brand New Macbook. Worth the investment? Probably not.

Now here is where most folks would start to rail against the new disposable society. Everything from cell phones to TVs are all disposable now. Right? Wrong.

Not me. Why? Well I have a small contribution to make to help stop this madness.

I found two places that were willing, with a little effort, to show me how to take care of these problems myself. No fancy Apple Store Genius, know-it-all, Fixer Upper, dude (BTW, most of the time, they do not even do their own repairs at Apple, they farm it out). It should be mentioned that I am no stranger to this kind of stuff. Awhile back I repaired my first original AirPort Basestation by replacing a burnt out capacitor. Heck, a logic board replacement for the MacBook doesn't even involve soldering

The first site I am sharing is run by a pair of guys who were in college and decided to try and fix their Mac themselves, then they were fixing their pals computers and then, weell, they said, You do it. They started iFixit. Ifixit will sell you the parts and show you how to replace them. This, of course, voids the warranty, but, hey, you were going to throw it out and get a new one anyway, right?

Here is their story in their words

It bugged us that most consumer devices lacked repair instructions. We think it should be easy for people to learn how to fix things.

So we wrote some instructions the first chance we got. And we posted them online, for free. For the first time, it was easy for someone with no technical background or experience to take apart a Mac. Our step-by-step instructions were enabling people to repair Macs they wouldn't have been able to repair on their own.

We thought the instructions would be useful to our customers -- and they were. But it turned out that they were useful to a lot of other people as well! We've heard repair success stories from forensic detectives, field translators, and even kids. From New York to Alaska, Tibet to the Faroe Islands, people have used our guides to fix their stuff. They saved money, they kept their Macs out of the landfill, and they did it completely by themselves.

And the amazing thing? They enjoyed doing it. It's fun to take stuff apart. It's interesting to see what's inside that magic iPod you carry around every day. It's gratifying to fix it with your own hands. Don't believe us? Try it! Fix your Mac yourself. Show a friend how to fix something.

We're all in this thing together, and if we work together we can fix the planet. Join us.

Neat! And they are helping the environment while making a good buck or two in the process. Oh, and not just Macs, Nintendos, Palm Pre's, iPones and iPods, and even bananas

Next up, I found there guys, The Powerbook Medic folks. Theyare similar to iFixit in that they sell parts and show you how to fix stuff. They also will fix it for you (for a reasonable fee) and they also have video tutorials on YouTube

Lastly, they have made their own Mac Tablet PC from an old MacBook - it looks pretty sweet

The total cost to fix my Wife's Macbook now looks to be around $250-$350. A far cry from the $800 plus I was quoted to do the same thing by the Apple Store. Don't get me wrong, AppleCare is awesome. It has saved my bottom so many times. Well worth every penny, but aside from that, do we really need to be tossing out so many electronics in this day and age?

So it turns out you do not have to chuck out that pretty awesome Apple MacBook after all. I am sure there are sites for Dell, Toshiba, Gateway, Sony and homegrown BYO (build it yourself) FrankenPuters and others as well. A quick google search shows you that anyone can do this kind of repair.

Oh, now, how I wished I could go back and get that iMac G5.

UPDATE!

We finally got the MacBook back from Apple and now it will not boot. It booted before, just had crazy keyboard shenanigans. Now, Dead.

So now we have to move forward with the plan. I will update as I do it.

Personal PSKs (Wi-Fi Masterminds)

2009-05-28T08:11:00.000-07:00

I participated in a virtual roundtable discussion with some other tech savvy minds over at WiFiJedi's (Douglas Haider's) Blog. The topic was Pre-Shared Keys and some of the new techniques Aerohive and others are bringing to the table. You can find the discussion here.

Let me know how I did.

Maturation of the WiFi Market

2009-04-23T18:08:00.001-07:00

I think we are reaching a stage where people are actually starting to depend on their wifi networks the way they do their wired ones. They expect blanket coverage everywhere. Network Admins are starting to actually trust these networks now as well.

How did I reach this conclusion? Well, I was told this by a very large healthcare organization. This company has over 60 thousand employees and hundreds of locations. I was teaching a class in WLAN management when a couple of router guys chuckled in the back of the room. You see, to them wifi was a part time gig. They managed the core. I would have said something however, I never had to. Another attendee, a real leader in the group, took over and said, "You wired guys want to chuckle but let me tell you, moving forward, wireless networking will be the primary access method for all new connections and applications."

I was stunned as this was a pretty hefty statement to make in front of a vendor (me).

And this is not the only place I heard this. I was recently at the headquarters for a major media company. I mean really major. The WLAN Admin Exec. said almost the exact same thing.

Are we reaching a milestone? I think so. I think mobile devices are pushing this forward. It was all fine and good that companies provide wifi for big ol' laptops but when people have an iPhone in their pocket and are surfing the web non-stop round the clock... Well, let's just say, people can get pretty demanding for something they never had before but are getting used to using everyday.

To illustrate my point, please watch this comedian from the Conan O'Brien show. His name is Louis CK and he is spot on. If you are impatient, tune to 1:55 for the particularly poignant part.

Ahh, yes. I remember it well... Last refuge for the lost.

2009-03-26T10:43:00.000-07:00

Waaaaayyyy back in the day, right after I moved to NYC I discovered an online social network. This was a social network of fugitives from the law, writers, misfits, artists, rock stars and geeks. I logged in several times a day and was amazed at what I read. Some of it psychadelic and off the wall but most of it compelling and intelligent. As with all social networks, I, the n00b, posted what I thought at the time, were intelligent ideas on computers, politics, civil rights, books, movies and whatever else came into my scheming and much younger head. I argued and I lost. I argued and I won. But mostly I made friends and learned.

I learned how to use Internet tools. I learned how some folks hacked and phreaked. I learned how to get along with those I disagreed with. I learned that many of those ideas I did not like were at least as valid as mine and in many cases these discussions caused me to change my mind. I discovered what I really felt about things by being challenged. It was social. It was lifechanging.

This social network was on the Internet in 1992 however it had no web page - since web browsers had not been invented yet (that would come a year later). In fact, it didn't even have a GUI. just this strange ASCII welcome image:


/\_-\(:::::::::)/\_-\
<((_))  MindVox  ((_))>
\- \/(:::::::::)\- \/

I met some very interesting people there. Like voidmstr, the person who would later be quoted for voidmstr's law, "Bandwidth expands to fit the waste available." Also, reive, galt, leq, dross, evan, sassy, and tomwhore. All names in 8 lowercase characters or less as required at the time. I also met some famous people there, like Billy Idol, Wil Wheaton, Charles Platt and Bruce Sterling. But it was the core users of the bandwidth forum on Mindvox and #mindvox on EFnet that made it for me. Smart people. Inciteful people. I knew them and they knew me even though I only ever saw a small handful of them face to face - once - (at a William Gibson reading in Central Park, no less).

The point I am trying to make here, or more factually, the idea my wife pointed out. Is that it took 17 years for the Internet to realize that social networks are where it is at. Meanwhile, way back in 92' and 93' folks were already aware of this. Mindvox, The Well, Panix. Folks who hung out there, they had social networking down. And the best part was, you networked with folks who, at the begining at least were not friends and acquaintances. It was like a micrcosm of New York City itself. Shoved face to face with a bunch of strangers and forced to deal with them.

I think, all criticisms of the current UI and direction aside, Facebook and others get it all wrong. There is no confrontation with "the other", it is all about you and your homies, your posse, your family. There really is no tolerance for arguement and, like twitter, no space to do it in anyways.

Well, maybe there is a chance to get back to what mindvox had initially. That cowboy, f%#& You!, "Hell's Angel's of the Internet" type of community. How?

Mindvox might be back.

In many ways I fear it's return. I fear that all my memories of it's initial incarnation will disappear in an Ibogaine forum haze. Or that, more likely, folks will be too busy with life and work and surfing the Tubes of the The Internets to offer real discussion and input worth reading.

I am hopeful, however. +)=[ dood! ]=(+

Digg It!

How to find a WiFi antenna?

2009-02-09T11:50:00.000-08:00

Finding the right Wifi Antenna is a pain in the connector. When I meet with WLAN managers the most often asked question about antennas is, "Where can I get one that is camoflaged or hidden in some way?" Most antenna sales or manufacturers websites are really bad. Either these websites haven't been changed since 1997 or the are broken or just plain unusable.

I get a lot of requests for sources of antennas. Not high gain, site to site antennas. Not parabolic or Backfire. Not a 4 foot long ultra-high gain omni.

All the requests I get are for one simple thing. A disguised antenna. This could be an antenna that looks like a smoke detector, an alarm light, a speaker grill or anything except a wifi antenna. In almost every case the antenna must do 2.4GHz and 5GHz. More recently it also must do 802.11n.

How hard is it. I am pretty good at Google but I have a real hard time finding one. Everytime I look I get pages that look like this:

Now why is that? I searched for "camouflaged WLAN antenna" and I get the above. When what I want is this:

Anyway, here a short list of websites I have fouond for wifi antennas. If you have a better resource, especially for camoflaged antennas, please post a comment.

WiFi Antennas|| RadioLabs

WLANMall.com

WLANAntennas.com

Sub-$300 internet tablet

2009-01-19T10:16:00.003-08:00

I like this idea a lot. No applications, just a browser in a sub-$300 tablet. Personally, I would prefer it be sub-$100. What do you think?

The Sky is Falling!!

2008-12-16T11:18:00.000-08:00

My Brother-in-law sent me an email the other day that made me wonder about how WiFi is progressing with most folks at home.

For me WiFi is my occupation and my hobby. I get a thrill that most people would find unbearable out of debugging wireless network problems and analyzing layer 2 management frames. But I sometimes forget that most folks just want their WiFi to work. Take note that my B-in-law is no slouch at solving networking issues. As a developer of WebBased applications via Linux and as the maintainer of a (as he puts it), "3-tier, cross-platform application development framework, written in Python atop the wxPython GUI toolkit" I am pretty sure he can handle a couple of wireless packet issues. Here is the email:

Bruce,


Of late, it seems all my neighbors are getting 2Wire/AT&T
DSL wifi routers.I think their signals are interfering with 
mine. What channel should I put myself on given this list 
I just got from kismet, although I've seen the number of 
devices at almost twice this list:

Channel   AvgSignal   SSID
1         22       2WIRE365
1         18       2WIRE341
5         19       2WIRE248
6         18       pete
6         18       2WIRE675
9         28       2WIRE219


I've also seen devices on channels 3, 10, and 11. I'm
currently on channel 8 (previously on 3) and 8 seems better,
but still not great. I'm going to be wiring fast ethernet
wired connections to [name omitted]'s office and my office,
but it would be nice to be able to wander around the house
without the connection dropping sporadically (I watch my
wifi signal go from 5 bars to 0 bars, stick there for 5 
seconds, and go back to 5 bars, and 10-20 seconds later,
the same thing happens). Then several hours may pass with 
no incident.

Maybe someone's microwave or cordless phone is interfering?

Any ideas other than putting ugly repeaters all over the house?

Thanks!

I feel for him. This is a common problem. 2WIRE and other manufacturers of consumer grade access points don't really get WiFi. If they did they wouldn't have the devices auto-choose interfering channels like channel 5 or 9. I do not mind that they sample the air and select an unused channel but please select a non-overlapping channel instead. I also have had my share of issues in my 120 year old home in San Francisco. Normal 802.11b/g doesn't like old fashioned plaster and lathe walls. It also doesn't like the 40-60 APs on my block all vying for the same airspace and sure as heck hates my 15 year old 1200 watt microwave oven.
Then I read about one of my favorite technology writers, Andy Intakho suggesting we go back to wires. I saw the first post at Glenn Fleishman's WiFiNetNews site and followed the link to Andy's. It is an amusing read but I am a little perplexed. Andy does not share the steps he tried to solve the issue. He doesn't share the equipment he was using that gave him such frustrations. We have no sense of why he made what is, IMHO, a rash decision to abandon the future for the past.

Glenn Fleishman has it right when he suggests,

"Andy, maybe you need a working 802.11n router and some modern hardware? Or maybe your apartment building is simply being bombarded by untoward RF interference.
Don’t get me wrong: I like my copper Ethernet wiring, too, especially when I’m moving big files around my network. But with Draft N, I’m more likely to have a gating factor at my Internet gateway or a particular computer’s ability to shoot files over a given protocol than I am by the network’s raw speed."

As a former Apple loyalist, I would have suggested the Apple Airport Extreme with both 2.4gHz and 5gHz 802.11n (and a ton of other high-end features). It is easy to setup, easy to use and goes really fast!

However, I also see both Andy's point and that of my Brother-in-law. It shouldn't be this hard. The average home user should not have to worry about "RF Interference" this and "Channel Congestion" that. It should just work.

So whose responsibility is this? The manufacturers? The IEEE? The WiFi Alliance guys?

Maybe I am limiting my future as a WiFi engineer but I would like to see it fixed. If a groundswell of disaffected WiFi users starts now, with WiMAX on the horizon, 3g-4g cellular becoming really popular and iPhone users now having the same bandwidth as the DSL in my last apartment, we might see the sky falling after all.

XKCD on Moving and WiFi

2008-08-26T10:33:00.000-07:00

XKCD, funniest geek comic strip ever.

Where the hell is Matt?

2008-07-15T07:09:00.000-07:00

There is no real reason to post this other than it made me happy.

Where the Hell is Matt? (2008) from Matthew Harding on Vimeo.

Cease and Desist!

2008-04-12T08:31:00.000-07:00

My ISP (Speakeasy) sent me a nice letter recently informing me the Eurpopean Union's copyright infringement division was displeased with me. The said that based on these allegations, I would be in violation of the Speakeasy Acceptable Use Policy. "How can that be?", thought I. I buy my music on iTunes, I do not partake in bittorrent, limewire or any other version of the now dead Napster (old school version not the new subscription based system) music/file-trading system Hell, I pay for stuff!. I have encoded all my purchased CD's and boxed them away but I keep them to myself. In fact I am a true supporter of "legitimate" digital music use via iTunes or any other service that, in some way, supports the artisits that create the music I love. This includes freely distributed music a la Radiohead.

So why was the European Union comin after me? Speakeasy's Tech Support and Security groups were very helpful in pointing out to me that they could track streams of file sharing originating at my IP address. So I thought deeply about this (for 2 seconds) and arrived at the most logical conclusion. My neighbors were connecting to me via Free The Net, the Meraki based San Francisco free wifi network and uploading/downloading music to their hearts content. I have 2 repeaters on my roof and 4 others in houses nearby providing firewalled access to the Internet. This made me sad. I was very pleased to provide an un-asked for service to my neighbors who may not have - or may not be able to afford - Internet access. I wrote to Meraki explaining my dilemma and asked of there was someway to restrict my neighbors from conducting file trading on my network.

People in my hood are sharing music over my wireless network and
abusing my speakeasy acceptable use policy. Speakeasy.net has warned
me that any continued abuse will result in disconnection of my
service. Therefore I must inform you that unless you can lock it
down so only port 80 is being used I will have to disconnect the
Meraki repeaters and access points from my network.

I am very sorry. This seems like a real shame. I was very eager to
participate in "Free the Net" but now I am a bit saddened that folks
are abusing it.

Please get back to me and let me know if there is anything you can do
on your end.


They replied back with...

Hey Bruce,

grr. that's really irritating. but actually what's surprising is that
we haven't had to address this issue so far. as far as blocking
everything but port 80: I don't think any of us would be happy with a web-only Internet connection, so that doesn't seem like a good answer. to me it seems the real solution here would be to figure out who the culprit is and block them.

I looked on your gateway and didn't see anyone transferring an
inordinate amount of traffic. do you happen to have any idea who it is? do you know if it is bittorrent they are using? maybe they are using a different gateway at least part of the time (probably mine, hehe).

next week I guess we can figure out how to set up the right counters on your gateway so that we can figure out who it is (any insight or additional info you can provide would obviously be super helpful). hopefully Speakeasy can wait that long. if you need to unplug, we understand, but leaving your repeater plugged into power would at least soften the blow.

ugh,

So far they have found no way to track or stop the activity and I love my Speakeasy service. So I have no choice. Until such a time as I can trust my neighbors not to conduct activity that the European Union deems as illegal or until Meraki finds a way to filter this traffic out, I must disconnect my network from "Free the Net". I still have repeaters on my roof but they are no longer connected to my network, file traders now siphon off some other guys pipe or tube or truck that backs up and unloads Internet.

Comments and suggestions, as always, are very welcome.

Al Gore: New thinking on the climate crisis

2008-04-10T06:23:00.000-07:00

Probably somewhat off topic, but I am a fan of Al and I aggree we are at a crisis crossroads. Time to get busy.

WiFi Enabled Bag!

2007-11-01T12:51:00.000-07:00

OK, Admission. The previously lauded WiFi enabled Shirt SUCKED! It had this big plasticky velcro'y patch on the front. I just couldn't wear it. I thought it would be more integrated. So...

My wife the genius (BTW, she is a geek, too. She really wanted me to order her one. So I did). She takes one look at her shirt and says, " I am not going to wear this but I have an idea."

She tears the shirt apart and buys herself a new bag/backpack/purse. She cuts a hole in the front of the bag for the cable. Sews the felt backing used to secure the velcro to the front of the bag. Puts the battery pack and cable into an internal pocket and away we go. WiFi enabled bag!!!

This is way more cool than the lame shirt. Now she carries this to work proudly, letting all around her know if they can surf via WiFi or not.

WiFi enabled shirt?!!!

2007-10-05T07:52:00.000-07:00

As if some geeky clothing designer and an Uber-RF-Nerd had a dorky lovechild, ThinkGeek has launched the first WiFi enabled SHIRT!!!

I am not kidding. this a a wearable WiFi detector that illustrates the strength of the WiFi signal with glowing bars and antenna and the words, "802.11" underneath.

I cannot wait to wear this to the next, "I can't get a date with nobody/Star Trek/D&D/comic book/video game/networking convention"

Look, Drool and count the days till it is released.

WLAN IDS and the bizarre world of security exploits

2007-09-20T09:28:00.001-07:00

If you make security software (or any software, for that matter) sooner or later you will create what I technically refer to as a booboo. A security vulnerability in your software that raises the ire of your customers and make you feel foolish and sad. Not to worry, mateys, this happens to all software manufacturers. The important thing to remember here is how you handle it. Are you going to be a Pro or a shmuck? Recently, AirDefense (why no dot com?), a WLAN IDS manufacturer had just such and incident. Is this uncommon? Relatively so. Is it dire? Not really. Are you just sniping at your competitor? Kind of, but in the interest of disclosure, we had an incident a long time ago as well so, dear friends, I feel their pain.

Let's talk about what happened first. The vulnerability as explained here happens when you send a specially crafted HTTPS request, which will cause the HTTPS service on the system to crash. It appears from my quick glance as if you need to authenticate first and also be on the segment from which you can administer the system. So what is this? Granted it can bring down the sensor but actually it appears to be a "tempest in a teacup". You need to be the admin or snarf the admin login in order to cause a denial of service to one of probably many tens or hundereds of sensors. Unlikely at best.

So how was this handled? Professionally, in my humble opinion. AirDefense contacted the people who reported the exploit and directed them to a patch for it as reported here, "Solution: Update to the latest firmware version"

AirMagnet had a similar experience Last October. And we handled it the same way. Here is our official response to the problem from back then:

Re: Airmagnet management interfaces multiple vulnerabilities
AirMagnet vendor response below -

(1) The vulnerabilities are tested against an over-a-year old AirMagnet Enterprise product,
(2) Some of these vulnerabilities have been patched and fixed in AirMagnet Enterprise version 7.0.x,
(3) All vulnerabilities are now completely fixed by AirMagnet Enterprise version 7.5 build 6307 and later.
(4) AirMagnet customers can download patches from MyAirMagnet support web site (http://www.airmagnet.com/my_airmagnet/index.php)

So to summarize, there are a lot of security professionals out there who are trying to make a name for themselves and do it in an industry, like the WLAN industry, that is going places. They spend all their time looking for these exploits and I, for one, am glad they do. They keep us honest and ensure that we are doing our very best to protect our customers. Are their motives pure? Debatable but mostly. Do they sit down afterwards and talk amongst themselves about what l@m3rz those software guys are? You bet! Should I take it personally? Nah.

The Myth of the Self-Monitoring WLAN

2007-07-30T09:36:00.000-07:00

Recently, as you all probably know by now, Duke University had a WLAN meltdown. The CIO, Tracy Futhey (Comment here) and the assistant IT director, Kevin Miller (Comment here) have put to rest the notion that the Apple iPhone caused it. Cisco has issued an advisory to the effect and Apple assisted in the effort.

I am not going to go into the details of what happened or why. Suffice it to say that mobile handhelds of all types, not just iPhones, send a lot of ARP traffic and the Cisco infrastructure was not ready for it. The quote at Network World explains that, "The advisory finally makes it clear that the iPhone simply triggered the ARP storms that were made possible by the controller vulnerabilities. Any other wireless client device, moving from one subnet to another apparently could have done the same thing."

What I will point out, however, is the problem we in the Wi-Fi community have today with the following simple delusion, "Your WLAN infrastructure as a cohesive, integrated, single-vendor solution is all anybody needs. It is self monitoring and self healing." I talk to a lot of people about which WLAN solution they are going to purchase and implement and I am always surprised by how many believe that the AP and controller vendor has all the answers. Don't get me wrong, I am a huge fan of this type of solution. Central management is critical for even medium sized organizations of 50 or more APs, much less larger ones that may a few hundred or even thousands. Manually changing the configuration of each AP is not a viable solution in these cases. The Admin needs assistance. And the story sounds so great, "Implement our solution and it will fix itself when it breaks and protect itself when security policies are breached." Who wouldn't want that?

But the truth is a little more complicated. As we have seen from previous posts, sometimes the solution doesn't behave the way your business practices need. Similarly, sometimes there are security problems within the infrastructure itself. So what to do?

This will sound like an advertisement for the company I work for and I apologize ahead of time but there is a very good reason I continue to work there. Mainly, I believe in the message.

When the Duke network went down and the Assistant IT director looked at his WLAN infrastructure dashboard, what did he see? I have not spoken with him directly but my guess would be it said, "hey man, it ain't me. Everything looks good from my end" So what did he do? he pulled out a sniffer and got to work. With packet traces in hand and assistance from Cisco and Apple he solved the problem. Did the infrastructure fix itself? Did it correctly identify the problem and solution? No. A patch is now needed to keep this from happening again.

One should not blame the infrastructure for not getting this right at the outset nor should one blame Mr. Miller. He was correctly reading what the controllers were telling him. But it shows how important it is to have a separate, 3rd party solution also available to get down to the bits and bytes or even spectrum analysis (if the problem should be something other than 802.11 protocol madness.)

There are a few great WLAN security vendors out there and they make 3rd party, best of breed solutions for monitoring the security of your WLAN (one of which recently got snatched up pennies on the dollar and will probably be rolled into another integrated, self-healing, self-monitoring role; against my better judgment.) There are an even smaller number who both monitor your security and your connectivity and performance and give you great troubleshooting tools built-in (insert shameless plug here). These should be your trusted advisor's when things go wrong. I am in no way suggesting that they would have identified the problem and cause and given a solution at Duke either (although I think they at least would have shown alerts for denial of service and strange traffic behavior.) What I am suggesting is that with them in place you now have a set of tools to assist in solving the problem. Remote packet and/or spectrum analysis. Alarm thresholds that can be set by the admin and will continue surveillance. Reports. System-to-system notifications. Graphs of speed and traffic type. Lists of who is connected to what and how. All the things you would need to get to the bottom of any problem in that invisible Luminiferous Ether.

Cisco Ripples - DCA and RRM - Help is on the way

2007-07-27T13:36:00.000-07:00

Since I first published " The Ripple Effect" back in February I have heard from many folks who have validated the effect but to my chagrin, I have had no solution to offer. Well thankfully there are smarter people than me out there and solutions have started to appear.

I was alerted to the fact that Medical Connectivity consulting recently put Cisco in their sights and quoted my blog with regard to Dynamic Channel Assignment and RRM causing issues. The Web, being the great time waster that it is, lead me on a journey. As I read the article I clicked here and there and next thing I knew I was looking at a forum at Cisco that was talking about this exact phenomena.

One of the forum posters had some great suggestions to eliminate this problem in the future. Bruce Johnson at Partners Healthcare offered this solution,

"We saw the majority of DCA events were triggered by Interference from Rogue APs. After we disabled Foreign AP Avoidance the number of channel changes dropped by an entire order of magnitude (1000s to 100s). We disabled Cisco AP Load Avoidance and this reduced the number of DCAs within an order of magnitude (100s less).

DTPC will power-up APs to max levels to provide a 3-neighbor -65 RSSI coverage "grid" and 7921s will power up to follow suit (up to their max Tx Power). Other clients with higher Tx power may send the APs to max power causing a mismatch with IP phones.

You can decrease the tx-power-threshold so the "grid" won't be as hot (default is -65, change to -71 or -74):

config advanced 802.11a tx-power-control-thresh <-50 to -80>
config advanced 802.11b tx-power-control-thresh <-50 to -80>

and reduce the coverage hole detection threshold (reduce Min SNR level in RRM Thresholds) to suppress the power-up activity."

Bruce seemed on track with this fix. the problem is that it isn't a fix. It shuts off the RRM and DCA so that the WLAN would remain stable. So where is the benefit of a controller based system?

He does note that a fix is forthcoming from Cisco, "They are revamping the behavior of RRM in the WLC 4.1 Maintenance release." Which is later confirmed by a Cisco employee, Saurabh Bhasin a TME,

"With the 4.1 Maintenance Release(MR) due out on cisco.com shorly, many improvements based on such feedback have been brought into RRM's algorithms ? improvements aimed at allowing administrators to fine-tune their RRM-run WLANs where desired. These enhancements will allow for greater control over both the channel and power output selection algorithms, so administrators may assist RRM in being either more or less aggressive in such decisions, depending on application and network needs. Additionally, enhancements have been made to the management and reporting of all RRM information and configuration alterations to allow for better tracking of RF environmental fluctuations and to assist in keeping track of RRM activity. Further technical detail on the inner workings of these enhancements will be available very soon in an update to the above-mentioned RRM Whitepaper."

The paper he references is found here http://www.cisco.com/warp/public/114/rrm.html and explains a lot of what we are all seeing. (here is the PDF version)

So here is to hope that WLC 4.1 Maint. Rels. fixes it. As an aside, Bruce Johnson is skeptical,

"Its all well and good to make things work for Intel and the CCX/CCKM compliant crew, but if you have any of the other brands of WLAN NICs (like those made by medical device manufacturers, who won't subscribe to fast roaming features until they're adopted by the IEEE) you are best keeping RRM disabled until it delivers on its promise as stated in the following 802.11TGv Objectives draft:

Service and Function Objectives

Solutions shall define mechanisms to provide the service listed below.

[Req2000] TGv shall support Dynamic Channel Selection, to allow STAs to avoid interference. Solution shall be able to change the operating channel (and/or band) for the entire BSS during live system operation and be done seamlessly with no intermittent loss of connectivity from the perspective of an associated STA. Solution shall not define algorithm for channel selection."

Review of Nokia N800 for Wireless LANs

2007-06-10T15:22:00.000-07:00

Bruce asked if I'd write up a review of my experiences with the Nokia N800 - here you go...

Earlier this year Nokia released an updated version of their popular Nokia N770 Internet Tablet. The N800 excels at being a small, light-weight, device capable of WiFi as well as Bluetooth access to the Internet.

I could go on an on about how this little device has changed how we access the Internet in our home. Instead of lugging around laptops, we have a couple of N800s that the kids access for Internet queries, (just what High School did ‘King James’ go to – while watching the playoffs), to googling, to streaming music, conducting mulit-user IM sessions, to just about anything you’d want to use the Internet for – but in a very small package.

The screen resolution is amazing! If the iPhone has this screen, I’ll be in line to buy one. Even though I’m so old now I have to use bi-focals to read the small stuff – I’m comfortable with the N800’s little screen – the resolution makes it possible to fit so much in a little package.

But for the interest of this Blog I’ll move on to the use of the N800 in a wireless analysis mode.

I saw an announcement for a new piece of wireless security gear – called a Silica. This software/hardware bundle puts the intelligent penetration attacks and exploits of Immunity’s Canvas software in a small Nokia. It looked WAY COOL and I *wanted* to have one. But the $3,600 cost felt a bit prohibitive.

I’ve since had a chance to play with a Silica – and was suitably impressed – I still haven’t parted with the $3,600 but here’s a bit of a review of the tool.

This is a customized version of the Canvas tool – shoehorned into this small form-factor Linux device (Nokia N800) It is VERY easy to use. Just turn it on and click the start scan…

It will run through a series of scans of the local wireless networks, then attempt to penetrate using a variety of currently known exploits to find and exploit holes in your wireless LAN. It’s like having a little team of hackers sitting in you hand.

I’ve found it to be easy to run with the Nokia in your pocket. Very unobtrusive! – but in reality it takes up to 20-25 minutes to do a full attack against a single AP. Not like while doing a real penetration test you’ll have an excuse to ‘hang around’ a specific area waiting for the attack to finish. (Though you could easily hide the device and come back to pick it up later – but that $3,600 cost will probably make you think twice about leaving it outside of your view)

The reports it gives are in HTML format – you can just e-mail them to yourself, or copy them off onto the SD cards used by the N800

It does a pretty cool thing when attacking a MAC-Filtered AP – it automatically finds an associated STA and spoofs it MAC address to get associated.

It doesn’t do ANY WEP Cracking or WPA cracking, or anything but the exploits that are in Canvas.

Ok, now for the less expensive, yet still fun stuff using a Nokia N800. As part of our Wireless LAN Security Assessment Toolkit course development. We came across the N800s, fell in love with them, then re-arranged and re-wrote many of our course lab exercises to specifically use the N800s. We added wVoIP, video over IP, as well as catching IM traffic, web browsing, and other conversations sent over wireless to use the N800 as our client of choice when ‘watching’ the open Wireless LANs and re-constructing conversations via packet capture.

Then we thought, “is there anything more we can use the N800s for”?

Since the N800 is just a little Linux computer… we added SSH, Terminal Shell, VNC, FTP, etc. to the system. Then once we got that running, it was a quick couple of steps to get Kismet and Metasploit running!

So just using Open Source software we were able to take the little $400 Nokia N800 and make it ‘like’ a Silica!

Just slip this little ‘bad boy’ in your pocket running kismet and go WarWalking to get all the APs in your area, including finding ‘hidden’ SSIDs. Or, start Metasploit and let ‘r rip – attempting whatever known exploits are available for Metasploit.

(By the way – this is NOT a fast device for Metasploit – but Way Cool to have running)

On the other hand – it makes a great Kismet platform!

We’ve got ours running the classroom with GoogleTalk and Gizmo Project for wVoIP and IM – but you have to have a Wifi access to use it, so this wont’ take the place of your cell phone. (It is possible to pair this device via Bluetooth to a cell phone running G3 speeds – but the easy way is with Wifi)

One more thing that is just *fun* to use the Nokia N800 and Wireless LANs – and I found this out by accident. I was testing in our offices a new access point – so I had the N800 associate to this new AP and started a ‘Hitcast’ session listening to some Internet Radio station. I kind of liked the station and so put the ‘radio’ in my pocket so I could have some tunes with me as I finished up writing up the analysis of this new AP. I checked my watch and realized the mail would have arrived, so I went out to the mailbox – down a long flight of stairs, outside the steel-sided building my office is in, and across the parking lot to the community mailbox to check the mail.

It wasn’t until I was heading back up the stairs and a co-worker commented on my choice of music that I noticed this little wonder continued to stream music the entire way. Thus was born the Audio Site Survey! Just associate, then walk till the music drops… Simple easy and leaves your hands free to work on other things while doing a fairly decent site survey. Cool!

There you go – a quick review of the Nokia N800 and how one might use it with Wireless LANs – if you want to see more about our Wireless LAN Security Assessment Toolkit class, check it out over at www.hotlabs.org/wlsat - as part of Bruce’s Blog you can use the discount code ‘Bruce1071’ to get $1,500 off the class.

Enjoy!

Keith Parsons - Managing Director

Institute for Network Professionals

Ripple Effect - Redux

2007-05-03T09:09:00.000-07:00

Early in the year I posted an article about how the Cisco WLAN controller system may behave strangely in some conditions. I got some email from some folks that had major issues with it. One poster said that, "Before Cisco purchased the technology from Airspace, they had already put dampeners in the RRM so the hysteresis you describe wouldn't occur." This is just plain wrong. Cisco wants to sell more switches and routers and they found out if they purchased the Airespace system they would do just that but they did not make this significant change before releasing it with their name on it. And they are still changing the behavior of the WCS today because this problem still exists.

Did I lose you? As a refresher for those who did not see the original article it is posted HERE.

Since I published that comment back in early February I have spoken to quite a few people who have seen the same effect in their environments in recent months. One network engineer wrote, "I can vouch for having observed this recurrent DCA behavior, also in a hospital environment (12-24 channel changes per day across 10 floors of APs, as you depict in your example). The architecture is not alerting us to this being the result of interference or noise (no WLC or WCS events of either type), and the RSSI of rogue APs is above the threshold required for triggering DCA (neg 85dB)."

I was asked by the nay-sayers what Cisco told it's customers to do and here is what that same engineer said, "We have been told by Cisco that the 100mW AP neighbor beacons, used to determine the picture of the network, does not get input into DCA. Cisco claims these 100mW beacons are used only for dynamic power control, which we hold static -- do you think this voids the dynamic algorithms? Other docs say the RSSI of neighbor APs is the most important criterion in DCA behavior! In lieu of noise and interference alerts we can only surmise its the APs themselves that are the cause of their own DCA ripple effect."

This is just one example. I also have spoken to other folks who say that the Aruba system they are running does not do this. They say it is much more stable and after the original "learning" time it settles down and stays that way as long as the network is in use. I think this makes sense, why change the whole network because of one interferer? Better to be alerted to the fact and deal with it yourself.

I am collecting comments on this and would like to post more testimonials about this effect. If anyone wants to support this claim publicly, please feel free to drop me a line to bruce@hubbert.org or comment to this post. My goal here is not to raise hysteria but get things fixed and level the playing field. The infrastructure vendors tend to pitch the idea that they offer a panacea for all wifi woes and I feel that that is just a flavor of "Kool-Aid" I am unwilling to drink.

Meraki - Staunton, VA

2007-05-03T08:45:00.000-07:00

Another great grass roots wifi project is being lead by a group of folks out in Staunton Virginia. With 19 nodes up as of today, the 3rd of May, it looks like it is doing well.

Again, I must say, citizens and grass roots efforts beat out commercial or governmental efforst all the time. Less bloat, less waste. These efforts are similar to the way we as world citizens take it upon ourselves to act responsibly on the road, or by taking the effort to recycle our bottles and cans. It is also parallel to the user created content wave sweeping the Internet. Not only do we want to get news and opinion our own way we want to get services our way too. And just like we don't mind spending some of our time to create that content we do not mind spending some our time and bandwidth to add wifi services.

Drop in on Staunton VA and take a look at http://www.stauntonwifi.org/ and let them know what a great job they are doing!

My Meraki Mesh Node - Update

2007-04-20T15:53:00.000-07:00

Meraki is a pretty cool company. I don't say that just because I am some bleeding heart liberal (even though I am) and they have a rather humanistic desire to get inexpensive Internet connectivity out to "the next billion people". Nor do I say it because they like to be polite network citizens and not go for the capitalistic jugular. But also because they have their head in the right spot and treat people decently and still make money doing it. nice. Liberals want to get rich too!

Not long after getting the free (as in "beer") Meraki node set up I purchased two new minis. I purchased these to learn about how they work and for fun and to "hack-on". I mean, heck, they were pretty inexpensive. Soon after I put these nodes up using the same SSID as Meraki's project so they would associate to it and I gave them to my neighbors. At this point Meraki contacted me. I guess they were monitoring the "Free the Net" WLAN and they sent the following note...

Hi Bruce,

We noticed that you ordered a couple of Meraki Minis and have set up your own network with the name "Free the Net". We are very psyched that you're so motivated and excited to help out with the project, and we'd love to help out. :) For starters, you definitely don't need to spend your own money, we'd be delighted to provide Minis for any of your neighbors who you can get involved. We would also really love to have the repeaters in the "Free the Net" project be in our existing network in Dashboard, so that they'll all show up on our one network map and we can see the aggregated usage numbers and all of that in one place. I totally understand that as a WiFi guy you'd probably like to play around with Dashboard some yourself -- could we offer to send you a couple more Minis to play with, and let us add your neighbors' repeaters to our existing network?

Thanks a bunch, and again, we appreciate your help with the project!

What great folks! A few days later 2 more nodes showed up and now I have two to "Play" with and two that will soon be migrated to the "Free The Net" project. I have all four up now on a new SSID and when I attach my laptop to them I get a nifty splash page from Meraki. This is of course because my new mesh of 4 (lets call them "Unchained") automatically saw another Meraki node ("Free The Net") and linked to it. as an aside, I think, if I plug one of my "Unchained" nodes into my Internet connection they will dis-associate from "Free The Net"

Now here is the real surprise, After you click the, "Take me to where I was going" link you get a new bar at the top of your browser window that scrolls advertising for local businesses. Now, I have no idea if these businesses are paying for this. I assume they are, but who knows. But think of the revenue opportunities.

The bar is very discrete. Thin and lean. the rotating text ads are very low key and I didn't even notice it for quite a few days. Also there is a request for input in a box if you click the "?" icon.

Lastly, there is a "search local" box that allows you to search for businesses and other stuff in your local area based on your Latitude and Longitude (actually, the Lat Long of the node you are associated with). Very hip.

The Result then takes you to a Google Local page. Nice.

All in all, when you add this idea and the strategy to get a percentage of money that Meraki makes off of your monetizing you own mesh hotspot, the large orders of nodes going to other cities and countries desiring a quick and easy way to get their citizens connected to the Internet and the fact that Google buys Meraki nodes to extend their mesh into peoples homes and businesses, Meraki is poised to pay off that Sequoia investment in nothing flat.

I have been "Geeked"

2007-04-10T14:34:00.000-07:00

I got this last week but was too busy to post it. Dennis Smith of such famous blogs as Jobgeeks and wirelessjobs has "Geeked" me. Thier site has this as it's tagline, "...the Job is what gives a Geek his power. It's an energy field created by all living things. It surrounds us and penetrates us. It binds the galaxy together." (Original quote from Alec Guinness during casting interview for role as Obi-Wan Kenobi). Or not."

Here is the initial email that made me famous:

Hey Bruce - just wanted you to know that you've been geeked.

Well, sort of.

I author a few blogs - wirelessjobs.com is my main blog, but I also keep up a blog called JobGeeks.com. And I recently started a new weekly posting called, "JobGeek O' the Week."

Unfortunately for you : ), you've been dubbed this week's geek.

Hope the pending fame and fortune doesn't go to your head.

Take care,
Dennis Smith

Personally, I think they are selling themselves short. I fear the outcome of this potential flood of traffic as previous award winner, Jeremy, seems to have had quite the deluge. Here are quotes from their site:

I hope you fair better than last week's Geek.

I hear Jeremy has since had to buy a new server (the crash was pretty severe due to the increased traffic), and, he's had to escape to the underground blogging community (where all A-Listers eventually go so they can blog, shop, and simply walk the streets in peace - far away from the masses vying for their ~~attention~~ link-love).

Well, what can I say. I would like to thank all those that made this possible. My mom, My beautiful wife, Lisa, without whose support this wouldn't have been possible, my kids, my agent, Morty...

WiFi on the highway: Avis to offer 3G-to-802.11 bridge

2007-04-10T12:28:00.001-07:00

Start-up Autonet Mobile and car rental giant Avis are partnering to offer renters a device that will provide laptop users with WiFi access on the road. You can take "on the road" literally in this case, as the device is designed to create a WiFi hot spot accessible from within

Meraki AirMagnet Stats

2007-04-02T14:24:00.000-07:00

Some folks have requested more technical details on the Meraki nodes so I am uploading some AirMagnet Laptop Analyzer images for your perusal. Let me know what you think.

(Click an image to enlarge it)

Here, for example is the AirMagnet Start screen showing the 3 nodes I have up

And here we have the Infrastructure page showing how they are viewed.

But the details that most folks have been asking for is here on the Channel Page (notice the bytes and frames. Very good data speeds for the most part. Since the beacon interval is set to 500ms I have the channel scan time set to 750ms)...

...and here on the main portion of the Infrastructure page. I also had the Spectrum Analyzer integration enabled. For this image I selected the main "root" node to analyze.

Meraki - Dallas freenet

2007-03-30T15:31:00.000-07:00

Entrepenuership in action. If you want to see how another mesh deployment is going, cruise on over to http://www.dfwfreenet.org/ and see how they are doing. they have a great wiki and a node map up and running. So far they only appear to have 5 nodes up and running but I could see this going big. Support them by laying out a measeley $49 bucks for your own node and go to town!