Revolution Wi-Fi

HP Wi-Fi Direct Printing in the Enterprise

2012-02-10T13:55:00.000-06:00

Have you been thinking that Wi-Fi Direct will mainly be limited to consumer applications? Think again. HP just announced support for Wireless Direct Printing, which allows any Wi-Fi capable device to print directly to the printer when in proximity without connecting through the corporate network.

This solution works by leveraging the Wi-Fi Direct standard that was developed last year by the Wi-Fi Alliance and the Apple AirPrint technology that eliminates software or driver installation on Apple mobile devices. The user simply needs to connect to the Wi-Fi network that the printer advertises, then print.

Pros: Easy printing from mobile devices in the enterprise

This should help simplify support for BYOD (bring your own device) initiatives. Since BYOD typically is also designed with security restrictions around corporate network access, and printers are usually distributed throughout the network, providing access to those printers would be a management headache to say the least.

Also, mobile device printing via Apple AirPrint on a corporate network is not usable at this point due to protocol limitations that prevent printer discovery and access across layer 3 network boundaries. The ability to connect directly to the printer and print documents will allow immediate adoption of AirPrint in the enterprise.

HP Wireless Direct Printing is Easy using AirPrint
(but appears to lack any security)

Cons: Unproven security

The security issues involved with a Wi-Fi network being advertised by a printer that is directly cabled into your network are significant. Printers have historically been easy targets for attackers to gain access to corporate networks due to their lack of focus on security. Just look here! By allowing direct wireless access to the printer, enterprises risk exploitation of numerous printer vulnerabilities which could result in broad internal network access for an attacker.

HP's implementation also appears to use an open Wi-Fi network, which makes the risk even greater! The Wi-Fi Direct faq states the use of a separate "security domain" from the corporate wireless network. What this means is that security of the Wi-Fi Direct connection can be different (and simpler) than security required to access the corporate network. But that doesn't require an open connection. Wi-Fi Direct supports strong WPA2 pre-shared key security and ease-of-setup using WPS. However, HP's documentation implies a wide-open wireless network.

HP Wireless Direct Printing Appears to Lack Any Security

Recommendation: Wait and see

I can't provide a solid recommendation on this technology or use in the enterprise until I learn more about HP's implementation. I have more questions than answers at this point. The prudent path for enterprises will be to wait and see what is discovered about this solution by the community over the coming weeks / months and engage your HP account team to learn more about the solution and security features.

Additionally, verify if the printers that your organization are purchasing support this technology, what the default settings are, and what controls can be put in place to prevent use of this feature until its use is appropriately secured and approved.

Cheers,
Andrew

Wireless Field Day 2 Video Archives

2012-02-07T10:41:00.000-06:00

In addition to all the videos from the Wi-Fi Mobility Symposium, check out the great videos from the subsequent Wireless Field Day 2.

The videos contain technical details on vendor solutions and are filled with answers to the questions that every engineer wants to ask the vendors but few get meaningful replies to. The delegate crew interacts with founders and technical experts at each of the vendors, making these discussions much more valuable than sales product pitches and marketing!

Thanks to Gestalt IT, Tech Field Day, and Prime Image Media for hosting the event!

Video Recordings

COMPLETE WIRELESS FIELD DAY 2 PRESENTATIONS

INDIVIDUAL WIRELESS FIELD DAY 2 VIDEOS

INDIVIDUAL WI-FI MOBILITY SYMPOSIUM VIDEOS

Cheers,
Andrew

Mac OS X Lion Creating Wi-Fi 802.1X Profiles

2012-02-07T08:30:00.000-06:00

Mac OS X 10.7 (Lion) does not allow manual creation or configuration of 802.1X profiles for secure authentication on Wi-Fi and Ethernet networks for typical users. In order to access an 802.1X network in Lion, users are prompted to enter credentials when joining an active network that is in range, at which time it automatically detects the authentication settings that should be used.

The 802.1X tab in the System Preferences > Network > Advanced section no longer allows manual 802.1X profile creation.

Mac OS X 10.7 (Lion) 802.1X Profile Restriction

Lion forces the use of a configuration profile which must be created from Lion Server or using the iPhone Configuration Utility (iPCU). The config file is nothing more than an XML file containing the settings and usually has a .mobileconfig extension. Since Apple has decides to stop selling the Xserver line a year ago, most administrators will rely on the iPCU.

This restriction can be problematic for engineers wishing to test various client configuration scenarios without a live network. Many enterprise environments support multiple EAP types on their authentication servers in order to support various client deployment scenarios. Therefore, an engineer may wish to switch between profiles on the fly to test multiple authentication types. Additionally, user-created 802.1X profiles only work under their own user context, and do not work for pre-login or system level network connections which are of great benefit in enterprise environments for remote management and control when users are away from their desks (e.g. overnight). Finally, it should be noted that the "auto-detection" capability during network join may not work accurately for EAP-TTLS since it assumes use of MSCHAPv2 inner authentication.

To create an 802.1X profile for Lion, download and install the iPCU:

Install the iPhone Configuration Utility

Once installed, launch it from the Applications/Utilities folder in Finder. Start by selecting Configuration Profiles on the left side, then click New.

Create A New Configuration Profile in the iPhone Configuration Utility

Give the profile a name, unique identifier, organization name, and description. Then move on to the Wi-Fi section. Configure the basics like SSID and Security Type, then select one or multiple EAP types supported on the WLAN in the Protocols tab.

Switch to the Authentication tab to configure the credentials that will be used. Most enterprise admins will want to leave the username blank and select "Use Per-Connection Password" when deploying configuration profiles to their users to prompt each user to enter their own unique password instead of hardcoding a username and password. If using EAP-TLS an identity certificate may be selected. Finally, if you are concerned about username exposure with tunneled authentication protocols, provide an anonymous outer identity value so hackers cannot compile a list of valid usernames on your network.

iPhone Configuration Utility Wi-Fi Authentication Parameters

Last, configure the trusted certificates and server certificate names in the trust tab. This allows administrators to define which authentication servers or naming conventions are allowed to authenticate users. This also prevents users from being prompted to trust servers at the time of authentication.

When the Wi-Fi payload and configuration profile is completely finished, select either Share or Export. Share allows you to send the profile via email, whereas Export allows you to export the file to your local filesystem for distribution at a later time.

Note - See this Apple help document for further instructions on using the iPCU.

To install the configuration profile, locate the file (.mobileconfig extension) and double-click it.

Install the iPCU Configuration Profile

You will be prompted to fill-in any per-user authentication fields left blank by the administrator. The profiles can be viewed later in the System Preferences > Profiles section. This is also where you can delete previously installed profiles. The associated 802.1X profile is also visible in System Preferences > Network > Advanced > 802.1X.

802.1X Profile Successfully Installed

This method is not as easy for on-the-fly testing, but should allow administrators to accomplish all necessary tasks.

Cheers,
Andrew

Cisco WLC Now Supports PMK Caching, Finally!

2012-02-06T19:02:00.003-06:00

I was sifting through the newly released Cisco 7.2.103.0 release notes in order to update the feature enhancements that I posted about over at the NSAShow website from the brief availability of version 7.2.101.0. Given my recent article on Wi-Fi Roaming Complexity that included a breakdown of the various types of roaming that exist, I thought it would be pertinent to point out the addition of Static PMK Caching support in the latest version of Cisco WLC code.

From the Cisco WLC 7.2.103.0 Release Notes:

Most client devices only support Static PMK Caching and not Proactive / Opportunistic Key Caching (PKC/OKC). This includes common enterprise devices including Windows 7 and ruggedized mobile devices from Motorola (to name a few).

But Cisco WLCs never supported static PMK caching, only OKC/PKC. This is something that our wireless team went back and forth with Cisco on a few years ago when we were running version 4.2 code. We were testing our Motorola mobile devices as part of our change management process to verify correct operation and performance with a configuration change from WPA-TKIP to WPA2-AES. Previously, we had been using CCKM for fast roaming, but Motorola did not have CCKM support for WPA2. In our traces we would see static PMK caching roams a large percentage of the time. Talking with our Advanced Services support rep. and reading Cisco documentation, we should NOT have been seeing this occur. The only official support within a WLC was for OKC/PKC.

After about a dozen calls with Cisco TAC, trace files being shared, and additional verification, TAC's response was that the WLC actually had enough information to re-assemble the PMKID the client was sending for each individual AP. It wasn't storing it, but was able to regenerate it from other information that was being kept on the client session. So static PMK caching was actually working, but they could not support it. The reason cited was due to memory concerns if they had to cache individual encryption keys for every client on every AP they visited, which could grow quite large. Given a large enough AP deployment and enough clients, I understand this concern.

It was just an interesting case in something working that shouldn't have been :)

With version 7.2.103.0, it's finally nice to see official support for static PMK caching, even though it was working before. I wonder if I execute a "show pmk-cache all" command on a WLC if I'll see multiple entries per wireless client now? I'll have to test in the lab to find out!

Cheers,
Andrew

Bluetooth That Will Make You Cry

2012-02-03T13:16:00.000-06:00

Question: What happens when you put 40 Bluetooth devices in simultaneous operation within 800 sq. feet of each other?

Answer: This...

Spectrum Analysis Capture of 40 Simultaneous Bluetooth Devices

Now think about this on your own: Can you spot the Wi-Fi going on at the same time? No, you say that you can't? Why not? (Please provide your answers in the comments section for this post)

Here's an image of the "baseline" Wi-Fi activity prior to the Bluetooth activity in the same environment. I bet you can spot the Wi-Fi in this one. There's a typical enterprise deployment with APs on channels 1, 6, and 11, plus an iperf performance measurement currently going on across channel 6.

What's Going On Here?
This is a capture of 40 Honeywell Xenon 1902 cordless Bluetooth area-imaging barcode scanners operating at the same time. These units are used in retail environments at checkout registers to provide faster scan rates, ease of mobility, and overall a faster checkout process for customers. The "area-imaging" implies reading of 2D barcodes such as QR codes and such.

Honeywell Xenon 1920 Area-Imaging Cordless Barcode Scanners

Bluetooth is becoming the default communication method for cordless barcode scanners by almost every manufacturer. I did a bit of research on it, and only 2 out of 8 manufacturers of cordless barcode scanners support an alternative to Bluetooth (one used Wi-Fi and another used narrowband at 433 or 910 MHz). But every single one of them provide a Bluetooth option, and it is typically the more prominently displayed option on their websites. I also received information from a good friend, Joel Barrett, that indicates manufacturers are all moving to Bluetooth scanners and support for other options will be phased out. So, if I wanted to choose a different option I could probably get one now, but support would be short-lived and I'd end up having to switch to Bluetooth anyways. Might as well bite the bullet now and figure out how to deploy these in my environment to co-exist [relatively] peacefully with my Wi-Fi network.

Performance Impact
These units are rated as a Class 2 Bluetooth transmitter, meaning they should have a maximum power output of 2.5mW and an estimated range of 10 meters. Sounds nice and low, and one would expect minimal impact to Wi-Fi. But the reality can be far different!

It's important to understand the different impact that Bluetooth can have in an enterprise environment than in a consumer environment. The deployment scenarios can be dramatically different, and a high concentration of Bluetooth devices in a small area directly correlates to decreased performance. Sure, the typical duty cycle of a single Bluetooth device is small. But as Bluetooth device density increases so does Wi-Fi performance impact due to increased CCA busy detection by Wi-Fi devices and increased frame corruption when Bluetooth can't avoid APs on multiple channels. Even if Bluetooth version 1.2 and later capable devices are used that implement adaptive frequency hopping, they cannot avoid interfering with Wi-Fi access points spread out across the entire 2.4GHz frequency band.

In executing Wi-Fi performance testing with these Bluetooth devices our team ran multiple scenarios, changing Bluetooth power levels, pairing status, and scan rates. What we came away with also varied dramatically based on these settings. Our baseline was an 802.11g network with 20 Mbps throughput. The environment is an open-air retail setting at the front register checkout lanes.

Clearly, despite being rated as a Class 2 Bluetooth device, the RF signal was carrying quite far. Luckily, Honeywell has done a good job providing management tools to customize the radio performance of their barcode scanners. By adjusting the power level down we were able to minimize the impacted area as well as the impact to the Wi-Fi network.

What made our situation even more challenging was the desire to deploy VoWiFi around the same time as the cordless barcode scanners in the same environment. Our preference is to use voice handsets that support 5GHz frequency bands, but that may not be possible due to other business considerations on device capabilities and application support (we're still evaluating solutions). So, we ran 2.4GHz voice tests that showed an average 20% frame loss rate when the Bluetooth scanners operated at 10% (0.25mW) and an unacceptable user experience. When the power level was reduced to 1% (0.025mW) the frame loss was much lower and no perceptible voice quality issues could be observed by end-users.

Ultimately, we were able to find a compromise that allowed the use of these cordless barcode scanners while minimizing impact to the Wi-Fi network.

Deployment Considerations
Here are some considerations when deploying Bluetooth in an enterprise environment:

Device Selection
Select Bluetooth devices that are configurable and easy to provision. The device should support modification of all of the settings listed below, and keep those configuration settings across reboots. If a device is factory-reset or the battery dies, it should be able easy to re-apply the custom configuration settings by staff in the field with minimal training and effort.

Recommendation - Purchase "enterprise-class" Bluetooth devices that allow custom configuration.
Device Density
In general, the more Bluetooth devices operating in a confined area, the more impact to the Wi-Fi network. Pretty simple. Each individual Bluetooth device has minimal impact due to very low duty cycle (airtime used), but as more and more devices are added it linearly increases interference and decreases Wi-Fi performance.

Recommendation - Minimize Bluetooth device density as much as possible.
Power Level
The Bluetooth transmission power level, especially in dense deployments, can have a dramatic effect on the impact to a Wi-Fi network. In our testing, reducing power levels from 100% (2.5mW) down to 1% (0.025mW) significantly reduced the impact to the Wi-Fi network, and the range provided was still adequate to meet our business needs.

Recommendation - Reduce Bluetooth transmission power to the lowest setting that still allows reliable functionality for a given deployment scenario.
Bluetooth Pairing
The pairing status of a Bluetooth device can determine how actively the device transmits. A paired device usually transmits much less frequently than an unpaired one. Unpaired devices may constantly search for a base station or partner, often times transmitting very frequently in what many manufacturers call "distress mode". Honeywell also provides a configurable scan timer that adjusts how long an unpaired device will search for its partner. We adjusted this setting down to 3 cycles instead of infinite. It will also scan whenever the trigger is pulled. This minimizes interference in the worst-case scenario that the device gets unpaired.

Recommendation - Establish sound operational practices to ensure Bluetooth devices remain paired at all times. Additionally, adjust scanning timers down to a reasonable level from defaults.
Know Your Environment
Bluetooth impact will also vary based on the environmental characteristics in which it is deployed. In my situation the impact was significant because an "open-air" environment. But that may not be the case in an office with many more walls and obstacles that prevent RF signal propagation. Also, know your Wi-Fi client device capabilities and applications. If you only use data applications like web surfing and file transfer, Bluetooth may not be a big risk. But if you use real-time applications like voice or streaming video, then it could cause usability issues.

Recommendation - Understand how Bluetooth impact will vary based on the facility characteristics and applications deployed on the Wi-Fi network.
Migrate Wi-Fi to 5GHz
If you can't mitigate the performance issues with Bluetooth or any other source of interference in the 2.4GHz spectrum, move your clients over to 5GHz. This one is easy to understand, but can be difficult to achieve in practice. Consider the influx of mobile devices that only operate using a single-radio 2.4GHz chipset. What applications will be used on those devices, and what is the implied or defined service level agreement between the network team and business teams?

Recommendation - Use band steering techniques or different WLAN configurations on the Wi-Fi network to move 5GHz capable clients over to this band.

Andrew's Take
The delivery of business capabilities will always trump non-functional technology requirements (unless your business is technology). As IT professionals we must understand and accept this. Instead of saying "no" to solutions that go against best practices, work to understand the business request and develop a solution that delivers what the business needs. This requires compromise on your part, not every solution can be 100% the best technology. Often times, the best technical solution is NOT the best business solution.

Network administrators should be aware of initiatives to use Bluetooth client devices within their environments. They do not need to block use of these devices outright, but do need to perform proper performance analysis and modify Bluetooth configuration settings to minimize impact to the Wi-Fi network.

This type of scenario also highlights why I prefer to deploy wireless access points with integrated spectrum analysis in my environment. Day-to-day operation of this network requires "always-on" visibility into non-Wi-Fi sources of interference so that I can baseline, trend, and report on network performance. It's also why I prefer a dedicated SpecAn chipset in APs, and am skeptical of 1st-generation Atheros-based solutions that cannot perform concurrent spectrum analysis while serving Wi-Fi clients. They require a dedicated RF / Spectrum mode of operation and have to be taken out of service. I hear that's changing and Atheros solutions can now provide that "always-on" capability, but have yet to see one hands-on or test vendor claims.

Cheers,
Andrew

Wi-Fi Roaming Analysis (Part 2 - Roaming Complexity)

2012-02-02T16:36:00.001-06:00

In Part 1 of this series, I provided a high-level overview of Wi-Fi connection control, the importance of roaming, and what conditions are involved in triggering a client roam.

Now that we have the basics out of the way, let's discuss the large number of roaming variations that exist and the implications of that on performance analysis. Once the client determines to move its network connection to a new AP, the actual roam occurs. This is where things get complicated, because various combinations of authentication and encryption suites require different frame exchanges to complete a roam.

Security Brings Complexity

When Wi-Fi was young, client traffic flowed fast and easy. Clients roamed from one AP to another with nary a care in the world, albeit some inefficient client roaming algorithms did exist. But over time WEP was found increasingly vulnerable to attack and eventually full defeat. The IEEE responded, defining a very "robust" security network, indeed! But with this increased security came new restrictions. Clients had to present their identity to access the network, and the APs had to call their boss for approval (authentication server). And this took time! At first, clients didn't mind. But over time clients grew increasingly impatient, wanting to get where they were going without having to stop. "Why doesn't the AP know who I am? I come through here every day!" they would say. And they were right.

I explain Wi-Fi roaming like interstate traffic. Originally there were simple on-ramps (Open/WEP networks). As the roads required maintenance and repair, toll-booths were erected to collect a fee before use (802.1X). These first-generation tolls were "cash-only" and required every car to stop and pay, which backed up traffic. Eventually, due to increasing demands and volume, these toll-booths were replaced with electronic toll collection, which allows cars to slow down and pay without stopping (fast roaming).

As the 802.11 protocol has grown more mature, it has also grown much more complex. Introduction of more secure networks solved one problem but created another. The need for and lack of standardized fast roaming has led to proprietary vendor enhancements to fill the gap. And lack of coordination among vendors has led to multiple competing methods with fragmented support throughout the industry.

The Many Variations of Wi-Fi Roaming

* Update 2012-02-03: Original table listed 802.1X/EAP as part of CCKM, which is incorrect. The table was updated to reflect this change. *

Note - The initial GTK installation is defined as part of the 4-Way Handshake with 802.11i / WPA2. It has also been observed in the 4-Way Handshake with WPA pre-standard networks, despite not being specified as such by the Wi-Fi Alliance. The GTK exchange is mainly used to update existing group keys and is listed mainly for reference purposes.

Simple Authentication & Roaming Methods
I call the following "simple" methods because they involve simple security protocols relative to the more robust methods involving 802.1X. These methods typically allow clients to complete a roam in <50ms and are very fast. However, the trade-off is lower security which becomes readily apparent when the network must scale beyond some small amount of users, at which point encryption key or pre-shared keys become unmanageable to provision, rotate, and maintain proper access control over.

Open Network
The client performs 802.11 open authentication (2-packet exchange) and 802.11 association (2-packet exchange), at which point data traffic is permitted. Simple, quick, and efficient! Open networks are typically found in hotspot and guest deployment scenarios and may have web authentication via a captive web portal layered on top, in which case the wireless network or other in-line network appliance will only allow DHCP and DNS prior to web login. However, from a layer 2 Wi-Fi perspective, data traffic is unencrypted and presents significant security risks.
Static WEP
When static WEP keys are used for network access control and encryption, clients perform the same steps as an open network roam, going through 802.11 open auth and 802.11 association, then encrypt data frames using the WEP algorithm. No additional authentication exchange occurs with static WEP unless shared key authentication is configured (discussed next). The use of WEP encryption is inferred by the presence of the "Data Protection" bit set in 802.11 header as well as the abscence of a WPA or RSN information element. The use of a correct WEP key is inferred from the ability to decrypt frames at the receiver and verify the ICV (integrity check value). WEP is a legacy security protocol which can be cracked very easily and offers virtually no protection. Do NOT use WEP!
Static WEP with Shared Key Authentication
When an optional shared key authentication method is configured with static WEP, the access point and client exchange an additional challenge handshake and response to confirm that the client holds the correct WEP key prior to allowing it to associate to the AP. The desire to use shared key authentication is signalled within the 802.11 authentication request and response packets in the authentication algorithm fixed parameter field. The use of shared key authentication actually reduces the security of static WEP because versions of the same challenge text are transmitted over the air in both plaintext and hashed, allowing an attacker to recover the WEP key easier. Do NOT use WEP!
WPA/WPA2 Pre-Shared Key
When WPA or WPA2 is configured with pre-shared keys, the client and AP must be configured out-of-band with the proper passphrase, which is used as the master key. The client and AP exchange the 802.11 open auth and association frames before performing a 4-Way Handshake. The handshake facilitates the exchange of random information (nonces). The passphrase, station addresses, nonces, and SSID are all used to transform the master key into a series of sub-keys, one of which is the PTK used for actual data encryption. A WPA2 PSK network is simpler in that the users only require knowledge of the passphrase, but suffers from issues of scalability and is difficult to revoke access when all users use the same passphrase. Traffic from each user is uniquely encrypted, but knowledge of the passphrase along with observation of the 4-Way Handshake can allow any user to decrypt another user's traffic. WPA2 PSK is best used in homes and SMBs where there is a small user base, which is why it is commonly referred to as WPA2-Personal. It is also commonly used with VoWiFi deployment to prevent voice call disruption due to the excessive roaming latency involved with full authentication methods listed below.

Full Authentication & Roaming Methods
The following methods are what I classify as "full auth", meaning they perform a full 802.1X authentication process using a back-end AAA RADIUS server. When implemented without any optimization for fast roaming, these methods are used for both initial connection establishment as well as subsequent roaming between APs. These methods provide robust network security that is enterprise-ready, but the trade-off is much longer authentication time and roaming latency. It is typical for full authentication roams to take >600ms to complete, and can be longer depending on network architecture (e.g. authentication server is across a WAN circuit).

Dynamic WEP
The use of dynamic WEP is provided as a vendor proprietary feature by many manufacturers, and allows the use of 802.1X / EAP authentication with the WEP protocol. After successful 802.11 association, EAP authentiction proceeds using any supported EAP type (with Cisco LEAP being the most common). Unicast and broadcast WEP keys are assigned to the client by the AP using two EAPoL-Key frames after successful EAP authentication, which allows the network to remove reliance on statically configured WEP keys and the ability to dynamically assign unique unicast keys to each client. However, dynamic WEP still relies on the same flawed WEP protocol and does not remediate its inherent issues. There is no method to signal the use of dynamic WEP within the 802.11 frame, and relies on both the client and AP to be properly configured to support this process. (The use of LEAP authentication does use a proprietary Cisco information element, but is not required for dynamic WEP). Dynamic WEP was introduced into the market in Dec. 2000 with the release of LEAP authentication by Cisco. Dynamic WEP should NOT be used!
WPA/WPA2 Full Authentication
When WPA or WPA2 is configured with AAA authentication, user or device credentials are verified using a back-end authentication server. The client and AP exchange the 802.11 auth and association frames, then proceed with EAP authentication. Many different EAP authentication protocols exist and any one of them can be used depending on the customer requirements. EAP protocols require a lengthy communication exchange between the client and authentication server, typically 8 or or more round-trip frame exchanges, which creates significant delay in the roaming process. Since a client can only be associated to a single AP at a time, it must break its previously working data path prior to establishing a new data path. And EAP authentication sits as a large barrier in that path that must be overcome before application data can begin to flow again. Upon successful EAP authentication the AAA server and client derive a master key, similar to what was configured out-of-band in a PSK network, except that the master key is unique to this client session. The AAA server also sends a copy of the master key to the AP (or controller) acting as the authenticator. The AP and client then perform the familiar 4-Way Handshake to transform the master key into a temporal key used for actual data encryption. WPA2 full authentication is the basis for most enterprise Wi-Fi deployments because of the strong security offered. However, it creates significant latency that can disrupt real-time applications such as voice and video. The WPA certification program was introduced in 2003 by the Wi-Fi Alliance prior to final IEEE 802.11i amendment ratification in 2004. The WPA2 certification program was subsequently released in 2004 and expanded in 2005.

Fast Roaming Techniques
The following fast roaming techniques improve upon the full authentication methods by optimizing various steps in the authentication process. A full authentication method is required to establish the initial client connection, after which a fast roaming technique can subsequently be used when roaming between APs to minimize delay. Fast roaming techniques vary in their ability to minimize delay, with the goal to complete a roam in <100ms. Voice traffic typically sends frames every 20ms and requires roaming latency under 100ms to prevent call disruption.

Cisco Centralized Key Management (CCKM) (also called Fast Secure Roaming)
CCKM is a vendor-proprietary fast roaming algorithm developed by Cisco Systems, and is only supported on their access points, both autonomous and lightweight models. CCKM works by caching the encryption key derived after an initial authentication (DWEP EAPoL key exchange or WPA/WPA2 4-Way Handshake) on both the WDS Master and the wireless client. A WDS master role is assigned to a central point of coordination for all the APs in a group, and can be an Autonomous AP, WLSE, or newer wireless LAN controller. When roaming to a new AP, the client increments a re-key number and derives a new PTK key using the BSSID of the new AP it wishes to roam to. The client indicates CCKM support by including a Cisco proprietary information element that includes the next re-key number within the association request frame. The new AP requests the new PTK key from the WDS master and then replies to the client with the association response frame. CCKM reduces the time to complete a roam by removing the EAP authentication and 4-Way Handshake. Roam times can be <50ms in most cases.

CCKM was originally designed for use with LEAP authentication and WEP encryption, but can be used with other EAP authentication methods and encryption ciphers (TKIP or AES) as well. The use of CCKM is advertised by the presence of a vendor-specific AKMP (authentication and key management protocol) within the WPA and RSN information elements used in beacon and probe response frames. It is also indicated by a Cisco vendor-specific information element in 802.11 association request & response frames. Clients must support CCX version 2 at minimum to leverage CCKM with LEAP, version 3 for EAP-FAST, and version 4 for PEAP and EAP-TLS. CCKM was introduced into the market in 2004 with Cisco Autonomous software release 12.2(11)JA.
WPA/WPA2 EAP Session Resumption (also called Fast Reconnect)
Many EAP types used with 802.1X authentication rely on TLS security. TLS relies on a lengthy handshake negotiation to setup a secure communication path between the client and authentication server. This handshake requires a server-side certificate which usually results in authentication of the authentication server to the client. After the TLS handshake completes, the client must then authenticate itself to the server. EAP-TLS accomplishes this with a client-side certificate. Tunneled EAP types such as PEAP and EAP-TTLS use other less secure protocols such as MSCHAPv2 or EAP-GTC inside the tunnel to complete authentication without being directly exposed to an attack. Upon successful EAP authentication, the AP and client perform the familiar 4-Way Handshake to derive the PTK for data encryption.

Once a client has initially authenticated, the TLS session and resulting security context can be cached on both client and server. Upon subsequent re-authentication, the use of the cached TLS session allows use of simpler and shorter handshake process. Additionally, the existence of a valid cached TLS session implies a previously successful authentication, and many EAP types allow the inner client authentication to be skipped. Overall, this typically results in a 50% reduction in frame exchange to the backend authentication server during EAP authentication. The use of session resumption is transparent to the WLAN infrastructure and appears as a normal full 802.1X authentication. However, roam times typically require <300ms to complete, but may be longer depending on network architecture (e.g. authentication server is across a WAN circuit). Although a significant improvement over full 802.1X authentication, EAP session resumption is still not fast enough to support real-time applications such as voice over IP. However, it is well supported in the industry and is common on wireless networks.
WPA2 PMK Caching (also called Static PMK Caching or Fast/Secure Roam-Back)
The client re-uses a previously cached PMK Security Association (PMKSA) from a prior full 802.1X authentication with an individual access point. The PMKSA cache can also be built by pre-authenticating through the existing AP association to the new AP. Once the client roams it will send the PMK Identifier (PMKID) of the cached PMKSA to the access point in the RSN Information Element within the Re-Association Request frame. If the AP has the same PMKID cached it will skip the 802.1X authentication and proceed directly to the 4-Way Handshake. The end-result of a PMK cache roam is functionally equivalent to an OKC and Fast BSS Transition roam, clients just cannot re-use a single cache entry across multiple APs. PMK cache roaming typically requires <100ms to complete.

PMK caching is quite well supported by infrastructure and client devices alike. Unfortunately, its usefulness is limited by the fact that a client must have a cached PMKSA with each access point and this caching is not shared between APs within the same controller or AP group. Also, many clients and APs limit the amount of cached PMK entries due to memory utilization concerns. This means that it reduces how often it can be used, requiring full authentication to each AP the first time it associates. There is also a maximum lifetime for cached PMKSAs, after which time a full authentication is required again. PMK caching is therefore highly dependent on the traffic patterns of your clients. If they roam between the same set of APs most of the time, PMK caching could be a great benefit. If clients often roam to new APs throughout the network then PMK caching is less useful. Reference section 8.4.1.2.1 of the IEEE 802.11-2007 standard. PMKSA caching was introduced in 2004 with the ratification of the IEEE 802.11i amendment.
WPA2 Proactive Key Caching (PKC) (also called Opportunistic Key Caching)
PKC builds on top of the standardized PMK caching, but extends the re-use of a single cached PMKSA across all wireless access points connected to the same WLC or AP group. PKC is not a defined standard by the IEEE, and vendor implementations may vary.

PKC works by caching the PMKSA from an initial client full authentication at a central point of coordination for multiple access points, typically a WLC. When the client roams to a new AP within the same Extended Service Set (ESS), it "proactively" calculates a new PMKID for use with the new AP based on the BSSID of the new AP. The client then sends the newly calculated PMKID to the new AP in the RSN information element of the re-association request. Depending on vendor implementation, the AP will already have a cached PMKSA or PMKID pushed to it by the WLC, or it will query the WLC for the PMKID upon receiving the re-association request. If the AP derives the same PMKID as the client, it will skip EAP authentication and proceed directly to the 4-Way Handshake to derive a new PTK for data encryption.

Essentially, the client can re-use the cached PMKSA, but calculates a new PMKID for use with every AP without needing to perform a full 802.1X authentication. PKC roaming performs similar to both static PMK caching and PSK roaming, requiring <100ms to complete. However, support for PKC is highly variable within the industry, and despite favorable initial adoption by client manufacturers, support has been declining. PKC was introduced by Airespace, Funk Software, and Atheros in 2004, shortly after the ratification of the IEEE 802.11i amendment for robust security networks.
WPA2 Fast BSS Transition (FT)
Given the limitations of static PMK caching, and limited support for proprietary OKC and CCKM fast roaming techniques, the IEEE standardized fast roaming across an ESS with the 802.11r amendment, which was ratified in 2008. An AP advertises support for FT in a new Mobility Domain Information Element (MDIE) in beacons, probe responses, and (re)association responses. The client must also indicate support in an MDIE included in authentication and (re)association requests.

Fast Transition works by having the authenticator (typically a WLC) complete an initial successful 802.1X client authentication and derive a PMK-R0 for the client. The PMK-R0 is used to derive a unique PMK-R1 for each AP within the mobility domain. The authenticator then distributes the keys to other APs using a secure channel (which is not defined by the IEEE 11r amendment). During the initial authentication, the client performs full 802.1X authentication, completes the 4-Way Handshake to derive a PTKSA with the AP (using PMK-R1 key material), and then is allowed access to the network. However, upon roaming the 802.1X authentication and 4-Way Handshake steps may be skipped if a valid PMK-R1 for the new AP is presented by the client in the (re)authentication and (re)association request frames. Therefore, Fast Transition allows roaming faster than static PMK caching and OKC, and on-par with CCKM roaming, typically <50ms.

This is an extremely over-simplified explanation, but will suffice to understand how Fast Transition works. It is also important to note that 11r also allows FT over the distribution system, through the current AP to the new AP, similar to 802.11i pre-authentication. However, I will not cover that topic in this article.

* Notice that many of these fast roaming techniques are restricted to WPA2 only.

Layer 2 versus Layer 3 Roaming
Layer 2 roaming occurs when a client roams from one AP to another AP which both attach to the same client subnet or VLAN.

Layer 3 roaming occurs when a client roams from one AP to another AP which does not attach to the same client subnet or VLAN. If a client is required to acquire a new IP address, existing application connections break which has an adverse affect on network usability. Existing client sessions will either hang or eventually timeout and disconnect.

Wireless controller architectures help eliminate the need for layer 3 roaming by tunneling client data traffic from APs back to the controller as the logical client network attachment point. This way, APs can be spread across a larger physical or logical network environment without impacting clients. However, this also can only scale so large until APs attach to different controllers with different client attachment points, or unique requirements may dictate traffic forwarding to an altogether different network segment (e.g. guest termination in a secured DMZ).

All enterprise Wi-Fi vendors implement layer 3 roaming transparency to clients in order to eliminate the need for a client to acquire a new IP address. This is typically accomplished through coordination between APs or controllers within a logical group to tunnel existing client traffic back to a point within the network that can serve the original client subnet or VLAN. Examples include Cisco's concept of a wireless controller "Mobility Group", Aerohive's concept of a "Hive", etc.

Revolution or Evolution? - Andrew's Take
Roaming is easily one of the most convoluted processes within the Wi-Fi industry. The complexity involved between security requirements, standard and proprietary roaming methods, combined with fragmented infrastructure and client manufacturer support is staggering. Network administrators cannot predict how roaming will perform without observing live clients and analyzing the results. As networks grow and administrators increasingly lose control of devices attaching to the network, it becomes an almost impossible task to ensure adequate performance for every client.

Support for standardized fast roaming is long overdue! As I have written before, it's time for both infrastructure and client vendors to adopt 802.11r Fast BSS Transition. Real-time traffic flows require better performance than can currently be achieved. Support for proprietary fast roaming techniques such as CCKM are available, but are tough to come by for customers and even harder to push adoption by vendors. It's time to stop the marketing spin around WLAN controllers and fast roaming, as Marcus can attest. We have a solution, now we need adoption!

I'm from Nebraska, and as Larry the Cable Guy would say: "Git-R-Done!"

Cheers,
Andrew

Further Reading
For further reading on fast roaming techniques related to CCKM, PMK caching, OKC/PKC, and 802.11r, see the Cisco Aironet Configuration Guide, Cisco Voice over Wireless 4.1 Design Guide, CWNP RSN Fast BSS Transition (free registration required), and the IEEE 802.11r amendment.

For an example packet flow analysis, review my post on PEAP authentication which details the frame by frame exchange for two types of roams that are most common, a full EAP authentication and EAP session resumption.

Other Posts You Might Be Interested In:

Wi-Fi Mobility Symposium Video Archives

2012-01-31T13:59:00.005-06:00

What a fun week! I'm still digesting all of the information discussed at the Wi-Fi Mobility Symposium and presentations by sponsors at Wireless Field Day 2 last week in San Jose, CA. I will be posting my thoughts on various topics covered over the course of the week, but until then everyone catch up on the discussions.

What's great is the awesome crews from Tech Field Day and Prime Image Media recorded all of the presentation and discussions at both events! You can't get a front-row seat to such great conversations with industry leaders anywhere else. Watch all the videos and stay informed on the latest Wi-Fi industry innovations and solutions.

As a recap, the Wi-Fi Mobility Symposium covered topics on mobile devices and BYOD, Gigabit Wi-Fi, and Hotspot 2.0. There are 8 videos available from this event.

Symposium Introduction

Discussion on Industry Topics
Mobile Devices & BYOD

Gigabit Wi-Fi

Hotspot 2.0

Vendor Presentations
Aruba Networks

HP Labs

Ruckus Wireless

Aerohive Networks

Cheers,
Andrew

Measuring Wi-Fi Performance using Ruckus Wireless Zap

2012-01-22T14:28:00.001-06:00

Recently, I was provided a free copy of a Wi-Fi performance testing tool for iOS call ZapPerf for iOS by Zaib (@WLANBook). This tool is a port of the open source Zap test tool released in 2010 by Ruckus Wireless. This spurred me into doing a little performance testing using both the iOS version and the Mac version.

The Zap test tool is a bit different from other performance test tools out there, such as iperf, in that it measures the consistency of performance rather than peak or average throughput. This translates into a better measurement of the usability of a Wi-Fi network to handle real-time traffic that cannot tolerate momentary performance degradation, such as voice and video. For example, streaming a H.264 compressed high-definition Blu-Ray quality video could require a consistent 25-35Mbps of throughput. If performance drops even momentarily the video quality could degrade and result in video pixelation or freezing which would be unacceptable to viewer.

Ruckus published a whitepaper on Characterizing Wireless Network Performance, in which they describe the design of the Zap tool:

Prior to Zap, the focus of existing tools in the market has been on measuring average throughput, not worst-case throughput. Ruckus engineers originally designed Zap to measure and predict what type of performance they could expect most of the time (not just some of the time), using a large number of samples.

The output of the tool is a Cumulative Distribution Function (CDF), which is a representation of the probability of achieving a given throughput level.

Cumulative Distribution Function example shows
the percentage of time the system can achieve a given throughput value

I decided to do some testing with two systems, an iPad 1 and a MacBook Pro (Mid 2010). I also decided to run multiple tests on each system with different QoS value to determine how Wi-Fi quality of service impacts device performance. Both systems were tested with two QoS values: Best Effort (DSCP 0, Zap option -q0x00) and Voice (DSCP 46, Zap option -q0xB8).

Note - The Zap QoS option is a bit confusing, as it requires a hexadecimal value representing the entire 8-bit IP ToS header instead of the only the 6-bit DSCP portion. Hence the hex values above account for the two low-order ECN bits as well.

iPad 1 Results
This is a first-gen iPad 1 which sports an 802.11n 1x1:1 radio chipset capable of 65Mbps raw Wi-Fi speed.

You can see that the performance of the iPad 1 was very similar for both QoS queues. This is likely due to the fact that testing was performed using an 11n access point in a non-congested location with little traffic except for the system under test. The AP and RF spectrum were sufficiently able to deliver a good user experience above 30Mbps at all times (100th percentile).

MacBook Pro (Mid 2010) Results
This is a MacBookPro6,2 Core i7 2.66GHz (Mid 2010) model, which sports an 802.11n 2x2:2 radio chipset capable of 300Mbps raw Wi-Fi speed.

Contrast the performance of the iPad with the MBP. The MacBook is capable of 2 spatial streams and 300Mbps raw speed, which is able to saturate the AP and RF spectrum capabilities more thoroughly. In this scenario, we can see that the Voice queue clearly outperforms the Best Effort queue, all other variables constant. The Voice queue is able to achieve 179Mbps at all times (100th percentile) while the Best Effort queue is only able to match that performance about 90% of the time. The small amount of competing Wi-Fi traffic in the area reduces the guaranteed service level of the Best Effort traffic down to 96Mbps.

Concurrent Voice and Best Effort Traffic
Next, I decided to stress the network a little bit more to see the difference in performance between QoS queues when the network is under heavier load. For this test I used two MacBooks, both capable of 300Mbps, with one in the Voice queue and one in the Best Effort queue.

I was expecting to see a significant performance gap between the Voice and Best Effort queue, highlighting the benefit of QoS traffic prioritization. Here's what resulted:

My results matched my expectations. The stream in the Voice queue significantly outperformed the stream in the Best Effort queue. The Voice stream was able to achieve over 212Mbps for 98% of the time and resulted in worst-case performance of 179Mbps. You will also notice that the performance remained very consistent throughout the test, as indicated by the relatively flat line across the graph.

The Best Effort stream on the other hand saw a more varied performance, indicated by the sloped line in the graph. This stream was able to achieve 146Mbps for 98% of the time, but only 124Mbps worst-case.

Revolution or Evolution? - Andrew's Take
When it comes to Wi-Fi and preparing a network for rich multimedia applications such as video streaming, testing consistency of performance becomes more important than measuring peak or average performance, which can masque temporary degradation when sampling a large amount of data. Using the Zap tool by Ruckus Wireless offers a method to measure the sustainable throughput of a Wi-Fi network that more closely resembles the expected user experience.

Cheers,
Andrew

Podcasts, These Are A Few of My Favorite Things

2012-01-18T13:06:00.001-06:00

If I were to adapt the Sound of Music to technology, it might go something like this:

Routers on rainbows and switches in clouds,
bright fiber optics and warm wi-fi signals,
independent podcasts on relevant topics,
these are a few of my favorite things!

Podcasts are one of my preferred methods to learn and stay up-to-date on technology news. Despite the overwhelming number of tech podcasts out there, I actually find very few that are relevant to my interests or present original content that differentiate the podcast from other news sources. I can't compile a "Top 10" list, it's that small a number.

Technology Podcasts
Here are my favorite technology podcasts. I listen to these regularly and usually do not miss an episode.

Packet Pushers Podcast
Hosted by Greg Ferro and Ethan Banks, this show covers networking technology from an independent engineer's perspective.

On the podcast, we talk about routing, switching, security, firewalls, data center, and industry trends. We collect different topics and discuss them in a round table format. Topics can be “deep dived” where we focus on practical technology issues, or we sometimes review the latest announcements from vendors and discuss the technologies. Whatever takes our interest, we’ll dig into it and decide what the focus will be.
MacBreak Weekly
A TWiT.tv show hosted by Leo Laporte. This show keeps me up-to-date on all the Apple technology and solutions, which typically leads the consumer market.

Get the latest Apple news and views from the top names in Mac, iPhone, iPod, and iPad journalism. Recorded live every Tuesday at 2p Eastern/11a Pacific/1800 UTC.
Windows Weekly
Another TWiT.tv show hosted by Mary Jo Foley and Paul Thurrott. This show keeps me up-to-date on all the Microsoft technologies and solutions, which typically leads the enterprise market.

A weekly look at all things Microsoft including Windows 7, Office 2010 and Xbox, from the foremost Windows expert in the world, Paul Thurrott of the Super Site for Windows. Recorded live every Thursday at 2p Eastern/11a Pacific/1800 UTC.
No Strings Attached Show
Hosted by Blake Krone, Jennifer Huber, Sam Clements, George Stefanick, Chris Lyttle, and myself, this show is all about Wi-Fi. Podcast content is focused on a real-world look at technology and solutions without the marketing fluff. Our goal is to be honest and fair in evaluating the benefits and limitations of Wi-Fi technology, without vendor bashing. We also cover emerging technologies so that Wi-Fi professionals are prepared to plan, design, and integrate new solutions based on these technologies.

Brought to you by some of the brightest and best Wireless engineers from various walks of life. We have two wireless CCIE’s, a couple of CWNE’s, and a handful of other certifications. Each of us brings a different view on the products that we use on a daily basis to provide Wireless networking to the masses, this will hopefully lead to some interesting discussions on the podcasts!

Notable Mentions The following podcasts deserve notable mentions. I check in and listed to episodes occasionally, when the topics are relevant to what I'm interested in. However, I do not listen to every episode.

GigaOm Mobile TechRoundup
Hosted by Kevin C. Tofel. GigaOm is one of my preferred sources for the latest news on technology. The podcast is a recap of major recent news and announcements in the mobile technology space, which is of particular relevance for me due to my work in the Wi-Fi industry which is closely inter-related with most mobile technologies. However, since a lot of the information in the podcast is news-related, it's typically available from other sources and repeats information that I may have already read about elsewhere.
GRC Security Now!
A TWiT.tv show hosted by Steve Gibson and Leo Laporte. This was one my favorite tech podcasts early in my career as I learned about security topics. I still check in every once-in-a-while, but tend to skip many episodes that are not of interest.
Wireless LAN Weekly (currently inactive)
Hosted by Keith Parsons. This was an excellent Wi-Fi specific podcast by one of the best professionals in the industry. Keith summed it up best:

This site is dedicated to those who are involved in the craft of Wireless LANs – folks who work day-in, day-out with Wireless networking. A place to come and learn from, hang out with, and be inspired by other like-minded individuals.

Listening Options
I especially like the options available for listening to podcasts wherever and whenever I choose, and on a multitude of devices.

When I'm out and about around town or travelling I use my smartphone, like pretty much everyone else. I moved away from an iPhone 3GS last fall... big mistake, dumb move, I know (now)! I still haven't found a great podcast manager for Android. At the same time, I am increasingly weening myself off iTunes, for the better. Even when I had the iPhone, I browsed and downloaded podcast episodes directly from the iTunes store on the phone rather than syncing from a computer. I still think there are better podcast apps available for iOS than Android overall, and will likely switch back to an iPhone at some point (probably when version 5 eventually arrives).

When I'm at home or work, I much prefer to listed on one of my Logitech Squeezebox Radio units. It's nice to listen to podcasts on an actual speaker when I'm at my desk or at home in the kitchen, and don't want to wear earbuds or headphones. Additionally, with an optional battery pack I can take my music and podcasts anywhere I can get a Wi-Fi signal (like out on my patio)!

Logitech Squeezebox Radio

Setup and use are simple. Through Logitech's mysqueezebox.com website, I can register, configure, and control all of my units remotely. Application plug-ins are available for many web-based streaming services like Pandora, Slacker, Spotify, and TuneIn Radio. In addition, a podcast plug-in allows configuration of my favorite podcasts by pasting in their RSS/XML source feed URL. The configuration updates on the units immediately. There are also Android and iOS applications for control and synchronization of playback among multiple units. Also, they're very competitively priced based on the features and functionality you get compared to other solutions.

Cheers,
Andrew

What are your favorite technology podcasts? Please share in the comments section below!

NearBuy Announces Captive Portal and Analytics for Retail

2012-01-16T10:01:00.002-06:00

Analytics are the un-sung driver behind retail Wi-Fi hotspots. As I have previously written in 5 Retail Trends Driving Wi-Fi, retailers want to know who their customers are in order to tailor the in-store shopping experience which helps drive customer satisfaction and ultimately increased sales and profit. Consumers are increasingly using and relying on digital communications while in the store to perform product research, price comparison, and to make purchases. Retailers want the same reporting available from physical stores that they already get from their websites. The ability to tap into this information by offering free Wi-Fi to shoppers and report on usage is one of the main reasons retailers are offering hotspots in increasing numbers since late 2010.

NearBuy Systems is focused on helping retailers build competitive advantage from the smartphone revolution. The company has been around for a few years now, first getting retailer's attention with their unique micro-location solution for indoor location based services which combines Wi-Fi with in-store video cameras to reliably achieve aisle-level accuracy, something traditional Wi-Fi only systems struggle to accomplish.

NearBuy is announcing their captive portal solution this week at the NRF (National Retail Federation) Annual Convention & Expo, a show dedicated to showcasing retail industry solutions. The NearBuy captive portal differentiates itself through a rich analytics and reporting engine tailored for retail, dubbed Luneta.

NearBuy - Analytics for Retail Guest Wi-Fi Networks

The company is betting that retailers will want information on shopper behavior in their stores and are willing to invest in a more robust solution than integrated captive portal capabilities within wireless infrastructure equipment. Whereas integrated captive portals provide basic functionality with a focus on enterprise features such as authentication and network VLAN integration, NearBuy focuses on tailoring the guest user experience for a retail environment through frictionless shopper access (one-time registration across repeat visits) and providing rich analytics for the retailer.

Bryan Wargo, the founder of NearBuy, summarizes this trend:

Guest Wi-Fi is a major trend for retailers today. One of the biggest benefits is the ability to understand what shoppers are doing in their stores. With this tool we give them a way to quantify what and where consumers are shopping online while in the store, and what products they are purchasing.

The captive portal solution includes a standard guest access webpage which presents terms of use and can collect shopper identification through email address input. More interesting is the ability to integrate guest access with common web services providers such as Twitter and Facebook, allowing retailers to leverage consumer adoption of social media platforms as an avenue for subsequent customer interaction and outreach. This capability seems intuitive, and I'm surprised others have not offered it already.

The NearBuy captive portal provides
social media login for guest access

The back-end analytics include standard network-centric information on the number of users, new versus repeat users, volume of traffic, and websites visited. However, the Luneta solution differentiates by providing detailed information on consumer shopping behavior, including mobile device types being used, guest conversion (opt-in versus decline rate), mobile applications being used, search terms queried, top products browsed, and products purchased online from within the store. Data can be viewed across the entire retail chain (all stores), or broken down into region, store, or even department level reports.

NearBuy Luneta analytics include retail focused data on
products browsed and purchased by shoppers while in-store

From a technical standpoint, the solution architecture relies on a captive portal server which can live on a physical or virtual server of it's own. Depending on the WLAN architecture and traffic routing, the server can live in the store for distributed forwarding scenarios or at a data center when performing central traffic forwarding. Alternatively, for customers running a Motorola wireless infrastructure, it can be loaded as an virtual image on their NX 9000 series centralized wireless controller to reduce server footprint and offer an integrated solution for lower TCO.

The NearBuy captive portal can be deployed as a standalone server
or integrated as a virtual image running on a Motorola NX 9000 controller

The solution includes a RESTful API for integration with external systems such as corporate data warehouses or real-time systems for customer marketing and outreach while in-store.

For retailers, guest Wi-Fi requires a combination of excellent user experience with rich analytics, something that most solutions don't provide. NearBuy hopes to fill that gap by providing a solution that tailors to retail needs.

More information on this solution can be found on the NearBuy website. In addition, they will be providing product demonstrations this week at NRF in the Motorola booth.

Cheers,
Andrew

Wi-Fi Article Round-Up: CES Edition

2012-01-12T15:52:00.000-06:00

A recap of interesting Wi-Fi and IT industry articles from around the interwebs. For those living in isolation, CES is this week, so much of the news will relate to the show.

Note - I will not be covering CES news surrounding tablets or smartphones. Wi-Fi within those devices are well understood and not really new.

Wi-Fi Articles:

Wireless display technologies will fight to enter the market in 2012 and compete with Apple AirPlay. I don't think they'll gain much traction in 2012, but Marvell and the Wi-Fi Alliance have a better long-term shot than Intel WiDi, as I wrote about earlier this week.

Marvell to Showcase Wi-Fi Display Technology Implemented Across Avastar Family of Wireless Products: "The Wi-Fi Display specification is the basis for an exciting new Wi-Fi Alliance certification program, scheduled for launch in mid-2012. Devices certified under this program can provide a rich audio/video experience between Wi-Fi devices anywhere, at any time, without cables or a connection to an existing Wi-Fi network--all with the multi-vendor interoperability expected from Wi-Fi CERTIFIED."

This standards-based solution has already been adopted by Qualcomm Atheros as well (press release), proving just how important the Wi-Fi Alliance and interoperable standards are in the Wi-Fi industry (hint - we live by interoperability!)

New Wi-Fi Alliance growth predictions:

Wi-Fi Alliance's Wireless Predictions and Projects for 2012: "Recent research data shows that shipment of wi-fi devices is expected to double by 2015. Growth in home wireless networking devices—including TVs, media players and gaming consoles is anticipated to reach 35 percent from 2011 to 2016. Other predictions:
- Wi-Fi is expected to grow 109 percent between 2011-2016 in automotive applications such as infotainment systems, navigation, and traffic monitoring.
- Wi-Fi is expected to grow 39 percent between 2011-2016 in health, fitness, and medical applications.
- Wi-Fi is expected to grow 25 percent between 2011-2016 in smart meters and automation products."

White space Wi-Fi could get faster if Microsoft has anything to say. They have proposed Wi-Fi over Narrow Channels (Wi-Fi NC), which essentially bonds non-contiguous narrowband frequencies into a single Wi-Fi channel that increases available spectrum and therefore bandwidth for white space Wi-Fi.

WiFi-NC : WiFi Over Narrow Channels - Microsoft Research: "We propose WiFi-NC, a novel PHY-MAC design that allows radios to use WiFi over multiple narrow channels simultaneously. To enable WiFi-NC, we have developed the compound radio, a single wideband radio that exposes the abstraction of multiple narrow channel radios, each with independent transmission, reception and carrier sensing capabilities."

Hotspot 2.0 will a recurring theme throughout 2012 (and 2013 for that matter). The ability to provide Wi-Fi hotspot security, ease of use, service and provider transparency, and allow carrier data offload, while doing so with a viable business model for telecom carriers, independent hotspot operators, as well as authentication providers (which, BTW, is not limited to carriers), will be a major milestone for the Wi-Fi industry. Marcus breaks most of this down in his blog post on the subject!

Hotspot 2.0 and the Next Generation Hotspot: "Hotspot 2.0 and the Next Generation Hotspot initiatives are possibly the most exciting areas of wireless progress occurring in 2012. For starters, these developments have a worldwide scope of influence. The technologies that come to market as a result of these programs will directly affect a large portion of the world’s population. If brought to market with extensibility, they could revolutionize the hotspot ease-of-use and security landscapes. These programs deserve the spotlight."

While you're at it, be sure to sign up to learn about Hotspot 2.0 at the upcoming Wi-Fi Mobility Symposium and Wireless Field Day 2 events being held Jan. 25-27th.

Want details of the recent WPS vulnerability affecting Wi-Fi routers? Look no further than the No Strings Attached Show podcast - Episode 02 - Wi-Fi Protected Setup, Battered or Broken?

How about making Eye-Fi, the SD cards that connects to Wi-Fi for automatic picture upload, into an industry standard? Enter the SD Association and the Wireless LAN SD standard!

Wireless LAN SD standard aims to give every SD card that Eye-Fi flair: "The Wireless LAN SD standard announced today is the SD Association's first wireless SD memory card standard combining storage and wireless capabilities. Consumers will be able to transfer pictures, videos and other content wirelessly from most existing digital cameras and digital video cameras to web-based cloud services and between SD devices over home networks."

We've also seen manufacturers embedding Wi-Fi capabilities directly into cameras (Samsung, Kodak), and camcorders too (JVC, Gobandit Live). Watch out Eye-Fi, time to shift into new territory to keep the sales flowing! Also, check out this Toshiba FlashAir wireless LAN SD hands-on video!

Toshiba FlashAir Wireless LAN SD Card

Or how about embedding an Android phone into a true point-and-shoot camera, with this interesting twist on the merger of the two capabilities in the Polaroid SC1630.

Polaroid's Frankenstein Camera / Android Phone, the SC1630

Okay, I will throw one smartphone news item at you... how about more and more phones supporting dual-band Wi-Fi. There have been others prior, I'd just like to highlight the growing trend. 5GHz phones - "Make it so!"

Notice support for 5GHz standards (11a/n) with a 1x1:1 configuration
capable of up to 150Mbps if it support 40Mhz wide channels (not verified)

Indoor location services - Google is trumpeting their indoor location and navigation technology in Google Maps 6.0. I first heard of this being deployed in my neck of the woods, at the Mall of America, and now it's at CES.

Google Maps indoor navigation: yeah, it works at CES: "Google Maps 6.0 brought a promise of indoor navigation back in November of last year, but outside of a few dozen airports, transit hubs and retail outlets, we had no idea where it was or wasn't implemented. Turns out, Google (smartly) mapped out lots of Las Vegas before the annual Consumer Electronics Show"

I'm concerned with the hype surrounding this service as over-zealous media analysts predict this will revolutionize indoor navigation and appear at most retail stores. Sure, one-off venues likes malls make sense, but an inordinate amount of time goes into mapping the venue. Don't expect large retail chains to be spending the labor and money to map each and every one of their thousands of stores anytime soon! Indoor location just ain't THAT easy :)

Home automation solutions continue to keep plugging away, hoping to find a place in consumer's hearts. Right now most of them are standalone solutions, lacking whole-home automation at an affordable price for the masses.

Belkin announces WeMo home automation system; controls electrical outlets with your smartphone, motion: "WeMo works with a home's existing electrical system and requires only a Wi-Fi® network and free smartphone app to set up and control. Simply plug the WeMo Home Control Switch into any electrical outlet and then plug in any device, such as a lamp, into the WeMo Home Control Switch. Through the free smartphone app, the item then can be turned on or off remotely or scheduled to turn on and off at set times."

Also check out the Motorola Connected Home Gateway (tour and video).

Belkin WeMo Electrical Outlets

Wi-Fi video surveillance and baby cameras are also quite popular (see Dropcam, Samsung). Smart appliances are also back at CES this year, same as last year (see LG, Samsung). While we're at it, let's make it Siri voice-activated too! Oh, and don't forget this weird Withings Wi-Fi connected baby scale!

Samsung SmartHome Wi-Fi Washer, Dryer, and Mobile Application

IT Industry Articles:

NFC built into MicroSD cards could bring faster consumer adoption, for uses including information retrieval (such as Google Places or Sony SmartTags), information exchange, and contactless payment (mobile wallets).

Moneto NFC microSD to bring contactless features to any Android phone: "DeviceFidelity and Spring Card Systems have teamed up on a NFC-capable microSD card that will hopefully forgo the need of buying specific mobile handsets for the privilege of contactless payments. "

Also check out this Cirque Glidepoint NFC-enabled laptop trackpad. I'm not sure how this would be of practical use, but it's interesting, that's for sure.

NFC MicroSD Card

Home networking could be made easier with higher-speed powerline networks. I think consumers will still prefer Wi-Fi, but powerline could be an attractive option for older homes with thick construction material that hinders RF propagation. Given powerline's checkered performance history and problems with power strips, filters, and surge protectors, I think it still faces challenges with consumer adoption.

HomePlug Alliance AV2 specification promises gigabit class networking over electrical wires: "With MIMO functionality (multiple-input and multiple-output) at its core, the new specification features gigabit class speeds and comes from a decade of field tests. What's more, the new standard promises to bring greater in-home coverage beyond WiFi capabilities while maintaining compatibility with existing HomePlug AV / IEEE 1901 products."

Comic for the Week:

Don't Kitchen Sink Me, Dude!

Cheers (and happy reading)!
Andrew

Wireless Display Technologies Challenge Apple AirPlay

2012-01-09T08:06:00.002-06:00

At CES this year two separate announcements are being made that could prove 2012 to be the year of wireless display technologies. Solutions are being promoted by Intel and Marvell, with the latter in partnership with the Wi-Fi Alliance, which are looking to disrupt the current in-home and peer-to-peer wireless display market currently dominated by Apple with their AirPlay streaming technology. Will either solution be able to challenge Apple's dominance? 2012 may prove to be a defining year for the wireless display market.

Intel is announcing expanded support for their WiDi technology. Intel Wireless Display (WiDi) compatible laptops and TV adapters have been around since early 2010. It requires specific laptop system specifications, including an Intel Wireless-N adapter. Earlier this year that Intel incorporated WiDi support for DRM protected DVD and Blu-Ray content, in an attempt to expand consumer interest.

Intel WiDi streams video from laptops to your HDTV
through a compatible adapter using 802.11n Wi-Fi

Until now, use of WiDi required an separate external receiver that connected to the television display. Such single-use type devices have not attracted much attention or interest from consumers. Intel's announcement at CES focuses on embedding WiDi technology into other set-top boxes and directly into televisions through a partnership with several System-on-a-Chip manufacturers that supply the components in such devices. This should help achieve broader reach for WiDi technology by being embedded into more consumers devices and eliminating the need to buy a separate single-purpose WiDi receiver.

In another announcement, Marvell and the Wi-Fi Alliance are announcing a standards-based Wi-Fi Display technology. Marvell is a silicon manufacturer of many of the wireless chipsets found in consumer electronic devices. By partnering with the Wi-Fi Alliance, Marvell hopes to drive greater adoption of their components into OEM devices through the use of a standards-based wireless display technology that will be interoperable with the large install base of Wi-Fi compatible devices.

To accomplish this, the two organizations have developed a complete Wi-Fi display software stack that is platform independent, allowing other manufacturers to eventually implement the solution. The stack includes link provisioning, management, video transcoding, HD video transport over Wi-Fi, and content security support with DRM. Link provisioning is likely built on-top of the Wi-Fi Direct peer-to-peer protocol developed by the Wi-Fi Alliance and announced this time last year at CES, but that has not been confirmed. The Wi-Fi Alliance will launch a certification program that will be available mid-2012.

This software stack is extensible to a variety of System-on-a-Chip (SoC) platforms and can take advantage of any hardware acceleration for video transcoding and security. By incorporating this technology into its wireless products, Marvell is enabling an entire ecosystem of Android and Windows based mobile devices, Wi-Fi Display HDMI dongles, DTVs, Blue-ray players and set-top boxes, such as Google TV.

However, both technologies face an uphill battle to garner enough consumer interest and market adoption to compete with Apple, whose AirPlay audio and video streaming technology currently reigns king in the wireless multimedia streaming market.

Apple's dominance in both the mobile device and digital content distribution markets have positioned AirPlay as the dominant solution. Leveraging multiple solutions in a coherent and integrated fashion has been Apple's strength and creates an ecosystem that is compelling to consumers. Apple is able to leverage existing devices that people have with their iPhone, iPad, iPod, Apple TV, Airport Express, and Mac (iTunes) solutions and build an integrated service at virtually no cost to consumers. Furthermore, leveraging their content management and distribution through iTunes, consumers have even more reason to buy set-top boxes like the Apple TV which can also stream cloud-based content in addition to in-home streaming from personal libraries.

Apple AirPlay enables audio and video streaming across Wi-Fi networks

Intel will face problems competing due to their use of proprietary technology, which is similar to Apple's approach but lacks the device install base and content management ecosystem that is core to Apple's strategy. Reliance on Intel wireless chipsets available only in laptops and not mobile devices further hinders adoption as consumers clearly prefer mobile devices these days. And without a content management or distribution solution, Intel will have trouble convincing users to buy WiDi compatible receivers or set-top boxes.

Marvell and the Wi-Fi Alliance are taking a better long-term approach with a standards-based solution that will be able to leverage compatibility with any Wi-Fi capable device on the market. However, it will take time for the WFA to develop interoperability certification and manufacturers to integrate Wi-Fi Display capability into equipment. Ultimately, this may eventually prove to be an integrated feature of most mobile and home theater consumer electronics, but only time will tell. This solution also faces a similar content management and distribution problem as Intel, leaving consumers with a potentially dis-jointed solution.

Revolution or Evolution? - Andrew's Take
Apple clearly has an advantage in the wireless display and multimedia streaming market with AirPlay due to their end-to-end ecosystem with mobile devices and content management that has proven to be their core strength. Intel is taking a proprietary, closed system approach, which will limit device support and availability to Intel equipped laptops and a small contingent of set-top boxes. Marvell and the Wi-Fi Alliance is taking a more open, standards-based approach, but it will take time for manufacturers to adopt and deploy the technology. And both solutions still lack the cohesive ecosystem that differentiates Apple from the rest of the market.

Ultimately, Apple is able to leverage that ecosystem of devices, software, and streaming in a integrated, seamless fashion that creates greater value for consumers. Unless these new solutions can offer broad availability and compatibility across the consumer electronics industry, I don't see how they can effectively compete with Apple. Marvell and the Wi-Fi Alliance are in the best position to execute on that vision, but it will take time. 2012 may prove to be a year where these vendors test market strategy and look to gain manufacturer support, but don't expect to see a large amount of devices available on the market. AirPlay will still reign king for some time to come.

Cheers,
Andrew

NSAShow Podcast - E02 - Wi-Fi Protected Setup, Battered or Broken?

2012-01-09T07:00:00.000-06:00

In episode 02 of the show, Andrew vonNagy hosts and welcomes guests Matthew Gast from Aerohive and Dan Cybulskie from Simply Wi-Fi to the show to talk about the recently announced Wi-Fi Protected Setup vulnerability. Matthew brings Wi-Fi expertise to the show through his work at Aerohive, participation in the IEEE 802.11 standard, and as acting task chair for Wi-Fi Alliance security task groups. Dan brings extensive Wi-Fi security knowledge and has performed quite a bit of research into the WPS vulnerability since the announcement.

Head on over the the NSAShow website to see the full show notes and listen to this episode!

Cheers,
Andrew

NSAShow - A New Wi-Fi Podcast!

2012-01-04T20:49:00.005-06:00

A new podcast for the New Year!

I'd like to point my readers' attention to a new Wi-Fi podcast, the No Strings Attached Show (NSAShow).

As Wi-Fi professionals, we felt the void left after the Wireless LAN Professionals podcast was concluded (big love to Keith for creating such an awesome resource for the community). A few of us even contributed to other networking focused podcasts, such as the highly successful Packet Pushers Podcast. But overall there is just a lack of relevant discussion on Wi-Fi topics available.

The NSAShow podcast is intended to fill that gap with high-quality, independent, wireless content by providing regular discussion on current Wi-Fi industry topics. Podcast content will be focused on a real-world look at technology and solutions without the marketing fluff. Our goal is to be honest and fair in evaluating the benefits and limitations of Wi-Fi technology, without vendor bashing. We will also cover emerging technologies so that Wi-Fi professionals are prepared to plan, design, and integrate new solutions based on these technologies.

With this in mind, we created the No Strings Attached Show.

Contributors:
Our hosts come from varying backgrounds within the industry, but two things are constant - we are all independent and each of us has a genuine passion for Wi-Fi. We love learning, designing, deploying, and supporting the technology and are not bound by devotion to any one vendor. This means a lot to us! It helps keeps us focused on Wi-Fi as a technology for the greater good, without vendor bias.

Our contributors come from various VARs, partners, and enterprise customers, providing the show and our listeners with insights on technology from various perspectives. We also bring our collective years of experience to the show, so we can cut through the proverbial fat and focus on the aspects that matter most in real-world deployments. We hope this translates into content that people care about and want to listen to.

Blake Krone	Digital Lifestyle	@BlakeKrone
Sam Clements	SC-WiFi	@Samuel_Clements
Jennifer Huber	Wireless CCIE, here I come!	@JenniferLucille
Andrew vonNagy	Revolution Wi-Fi	@RevolutionWiFi
George Stefanick	My 802.11	@wirelessguru
Chris Lyttle	WiFi Kiwi’s Blog	@WiFiKiwi

Episode #1 - Tools to Become an RF Whisperer
In this episode we take a look at some of the software tools used by some of the top Wireless engineers on a day to day basis. We start of by looking at Ekahau Site Survey and AirMagnet Survey Pro. Each of these applications have their pros and cons as we explain their differences and how they work. Next we roll into RF analysis tools such as Cisco Spectrum Expert, Metageek Chanalyzer, and finallyAirMagnet SpectrumXT. Listen as the discussion goes from what’s the best software tool to use to a hot topic out there today: where is Cisco’s USB adapter to keep up with the ever changing form factors of laptops? Finally we end the show with a brief discussion regarding packet capture tools like Wireshark, WildPackets, and AirMagnet WiFi Analyzer.

We hope you enjoy this first episode, we had a lot of fun recording it and are looking forward to your feedback for future episodes!

*Note - Episode 1 was originally published earlier today (4-Jan) for several hours until an error with the episode was brought to our attention and the episode was pulled temporarily. If you listened to the show at that time, then you likely missed the last topic segment and show closing (about 12 min). Please listen to the episode again at this time to hear the full show content. Our apologies as we work out the kinks (we're new to this after all).

Future Episodes
The team plans to release podcast episodes on a regular basis. Unlike the first episode, not all of us will be on every show. We will take turns hosting episodes as topics and expertise dictate, likely one or two of us per-show.

We have tons of ideas for shows already, but welcome ideas and submissions from the community! Additionally, we plan on bringing guests onto the show to discuss relevant topics and have a few lined up already.

The podcast team will be present at the upcoming Wi-Fi Mobility Symposium and Wireless Field Day 2 events in late January, so keep an eye out for coverage of those events.

How to Follow the Show
Simply stated, we have a passion for Wi-Fi and want to facilitate knowledge sharing within the industry. But we can't do it alone! After all, we don't know everything about Wi-Fi. That's where we bring in guests to share relevant information on the show with the broader community. Through the associated website and blog we will also incorporate listener feedback and input. If you're a vendor or Wi-Fi professional and would like to contribute to the podcast or blog, contact any one of us.

So head on over to the website, subscribe to the full-site RSS feed or the podcast-only RSS feed, follow @NSAShow on Twitter, and subscribe to the podcast in iTunes. Then leave us a comment if you have feedback or something to share!

Let us know what you think!

Cheers,
Andrew

Wi-Fi Article Round-Up: 2012-Jan-04

2012-01-04T10:51:00.000-06:00

A recap of interesting Wi-Fi and IT industry articles from around the interwebs.

Wi-Fi Articles:
Check out the brand new No Strings Attached Show (NSAShow) podcast for Wi-Fi professionals! It's an independent podcast created to focus on Wi-Fi industry topics. We hope you enjoy it!

E01 – How to Become an RF Whisperer: "Welcome to episode 1 of the NSA Show Podcast! In this episode we take a look at some of the software tools used by some of the top Wireless engineers on a day to day basis."

WPS (Wi-Fi Protected Setup) is severely compromised due to weaknesses in protocol design.

Researchers publish open-source tool for hacking WiFi Protected Setup: "On December 27, the Department of Homeland Security's Computer Emergency Readiness Team issued a warning about a vulnerability in wireless routers that use WiFi Protected Setup (WPS) to allow new devices to be connected to them. Within a day of the discovery, researchers at a Maryland-based computer security firm developed a tool that exploits that vulnerability, and has made a version available as open source."

This impacts SOHO and consumer use and should not be of concern for most enterprises. I'm baffled why WPS would be used instead of a standard WPA Pre-Shared Key (PSK); the only reason I can conjure is that WPS doesn't require router setup of any kind by the user, which is probably simpler for some technically illiterate users. There is some raw data on the scope of potential impact (26.3% estimated) based on public wardriving data collected by Dan Kaminsky and WIGLE. An exploit tool is in the wild, having been quietly worked on by Tactical Network Solutions for over a year. WPS PINs can be cracked in 4-10 hours folks!
Also read the detailed paper submitted to CERT. Home users should disable WPS if possible. A demo is available by Dan over at NCI.

White-space Wi-Fi, now approved (in one city, at least)!

Wireless CCIE, here I come!: White Spaces - new wireless space launched: "KTS Wireless is the first manufacturer of a wireless device to take advantage of the white spaces spectrum re-allocation for wireless communications. They have participated in city wide trials of white space usage in Claudeville, VA and Wilmington, NC."

More info is available over at Ars Technica and Engadget.

There are so many Wi-Fi predictions for 2012, but I like this one the best!

Ruckus Wireless Wi-Fi predictions for 2012: "Wi-Fi capacity will become just as important an issue as Wi-Fi coverage in 2012 and service providers will have to deploy Wi-Fi networks with the bandwidth to cope with highly populated and dense environments"

Also check out these Wi-Fi predictions by PC Magazine (consumer focused), and inversely a list of things in tech that won't change in 2012 by GigaOm (I personally like #10 - The MacBook Air is what you get, and you'll like it!).

Wi-Fi offload will be most successful with user-controlled Wi-Fi offload preferences (not carrier controlled)!

Kineto looks to broaden potential of Wi-Fi off-load: "The potentially more compelling new feature is Smart Offload,which allows carriers and end users to choose and prioritize traffic to be off-loaded to Wi-Fi according to the whether the hotspot they are off-loading to is public or private. That feature could help carriers and users avoid the off-loading of especially sensitive traffic to public hotspots where inconsistent performance may be encountered,while letting them automatically off-load all of their traffic when logged on to a reliable private hotspot."

Most of the discussion about carrier offload focuses on data traffic and so-called "seamless" offload which implies automatic connection control by the carrier. I think that is the wrong approach, as most Wi-Fi networks are private and connections should be visible and controlled by the end-user while maintaining ease of use through persistent preference settings in the device. Offload of voice, messaging, and RCS services could also provide a more compelling offload proposition for users, especially where cellular coverage is spotty even for voice calls.

DHCP has bigger implications on the performance and security of wireless LANs than you might expect. Find out why by reading this great blog post by Marcus Burton over at CWNP.

DHCP for Wireless LAN Clients: "poor DHCP planning for your network could have a significant impact on WLAN service availability. For that reason, and for troubleshooting problems that will inevitably arise, any WLAN engineer should know the three primary ways to manage DHCP in a WLAN: bridging, relay, and proxy. We spend a lot of time and energy improving our RF environments; it would be a real shame to let DHCP ruin client connectivity."

This has to be a first of some sort! Kuala-Lumpur is mandating Wi-Fi access in some city food courts. Operators must comply by April!

Eateries to offer Wi-Fi service in April: "THE requirement for restaurants and eateries in the city centre to be Wi-Fi ready will be enforced by City Hall as early as April."

Also in the "weird news" category, Japanese vending machines now offer free Wi-Fi hotspots. Japan always takes gadget-craze to a whole new level!

Japanese vending machine doubles as WiFi hotspot -- no purchase required: "Japanese company Asahi has just unveiled an advanced dispenser that's capable of doubling as a WiFi hotspot, so good luck getting through the mobs of leechers just to buy a soda. The machine sends out the internet waves free of charge and covers about 164 feet around it"

IT Industry Articles:
What should a healthy partnership between a vendor and a VAR look like? Here's one VAR perspective on the challenges and some potential solutions by Matthew Norwood.

You Never Mentioned Me To The Client: "How bad do you want people to sell your product? If you put all of the load on the partner or distributor, with minimal contribution from the vendor side, don’t expect to get mentioned to clients. That’s not a partnership. It’s a pyramid scheme."

A true look at spectrum holdings by the major U.S. cellular carriers is eye-opening! Verizon has a definitive advantage over AT&T. Clearwire is also in a good position if it can bring a solid solution to market.

Meet the spectrum bosses: "While AT&T was distracted trying to buy T-Mobile, Verizon Wireless quietly negotiated deals with the cable providers to buy up their unused SpectrumCo 4G licenses. The Yankee Group has prepared a nifty graphic that details the current spectrum holdings of the big boys in the top 10 markets as well as what Verizon could gain by buying up the cable operators licenses"

Michael Mace at Mobile Opportunity explains the real reason why WebOS failed: lack of a killer feature. Sure there were performance problems and some bugs, but that's normal for new operating system. It needed more time and patience to work out those bugs. But HP jumped ship too soon, and Palm never gave consumers enough reason to pick up the platform in the first place.

Mobile Opportunity: Why Web OS Really Failed, and What it Means for the Rest of Us: "Palm was not rich enough and HP was not patient enough to keep investing after the first versions showed a lot of flaws. And more importantly, there was nothing compelling enough about either product to make people buy it despite those flaws."

Other Articles:
On the personal improvement, self-actualization front, read this list of 30 things you should STOP doing. There are so many good points in this article, that I won't call out any in particular. Just go read it!

30 Things to Stop Doing to Yourself: "As Maria Robinson once said, “Nobody can go back and start a new beginning, but anyone can start today and make a new ending.” Nothing could be closer to the truth. But before you can begin this process of transformation you have to stop doing the things that have been holding you back."

On the lighter side, I absolutely LOVE this!

John Lennon’s Imagine – WiFi Version
"Imagine there’s no interference
Clients with neg 60 RSSI
No wireless baby cameras
No end users with MiFi
Imagine all the mobile devices, supporting 11a"

Comic for the Week:
Siri strikes again!

Cheers (and happy reading)!
Andrew

Wi-Fi Mobility Symposium, Live 25-Jan-2012

2011-12-27T13:58:00.001-06:00

The Wi-Fi Mobility Symposium will take place on Jan. 25th, 2012 in San Jose, CA live and streaming on-line at the Tech Field Day website.

This one day event will bring together panelists from industry vendors developing the latest Wi-Fi technology with the larger community to discuss emerging solutions and provide a vision for the future. Stay tuned for a full list of panelists as they are announced prior to the event. Organized by the Gestalt IT crew of Stephen Foskett and Matt Simmons, and will be moderated by independent industry experts Marcus Burton and myself.

Tickets for free attendance will be available through EventBrite. Be sure to join the conversation on Twitter by following @TechFieldDay, @SFoskett, @standaloneSA, @MarcusBurton, @RevolutionWiFi, and the rest of the Wireless Field Day 2 delegate and sponsor participants.

Topics of discussion will include:

Mobile Devices & BYOD - The appeal of the latest generation of smartphones and tablets is undeniable. Consumers are buying mobile devices in record quantities, replacing sales of traditional PCs and laptops, and becoming more tech-savvy than ever. And now they want that flexibility and ease-of-use in the workplace too. The industry is calling this trend the "consumerization of IT" and one thing is clear, enterprise IT departments have little say in the matter due to executive level sponsorship. Symposium panelists will present the challenges and opportunities with mobile devices in the workplace, and discuss solutions that allow IT departments to effectively enable workforce mobility without compromising corporate data security.
Hotspot 2.0 - Public Wi-Fi hotspots are predicted to grow at an astounding rate, quadrupling in number from 1.3M to 5.8M between now ant 2015 according to the Wireless Broadband Alliance (WBA). Due in large part to the growing demand for mobile data by consumers and the lack of available capacity on cellular data networks (even after LTE upgrades), Wi-Fi offload has become a key strategy for most mobile network operators. Recognizing this need, the Wi-Fi Alliance and WBA teamed up to create the new Wi-Fi Certified Hotspot program which promises to provide a cellular-like user experience by streamlining Wi-Fi network selection and access. Hotspot operators will also be able to leverage cellular or 3rd party credential providers to facilitate network access and to provide data security. Symposium panelists will present the business drivers for the next generation of Wi-Fi hotspots, and discuss progress made by industry participants to bring Hotspot 2.0 solutions to market.
Gigabit Wi-Fi - Speed is king. The desire for in-home video and multimedia distribution is growing as consumers increasingly adopt more dynamic time-shifted and location-shifted media consumption behaviors. Wireless networking is the preferred method due to its ease-of-use, ubiquity, and low-cost compared to wired network installation. Two separate standards are being developed to enable higher capacity and support for multiple high-def video streams: 802.11ac provides gigabit speeds for multi-room access and ensures backward compatibility with existing Wi-Fi equipment in the 5GHz frequency band, while 802.11ad provides multi-gigabit speeds at much shorter ranges but does not provide compatibility due to operation in the much higher 60GHz frequency range. Symposium panelists will present the benefits and development progress for both standards, and discuss use-cases within the home as well as enterprise environments.

Community discussion will be facilitated through live attendance as well as Twitter for those not able to attend in-person.

Supplemental material will also be provided through support from the Packet Pushers Podcast and the brand-new No Strings Attached podcast for Wi-Fi professionals!

We hope you will join us for this informative event on the future of the Wi-Fi industry!

Cheers,
Andrew vonNagy

P.S. - For a feel of what the Symposium is all about, check out the previous OpenFlow Symposium organized by Tech Field Day!

Wi-Fi Article Round-Up: 2011/12/22

2011-12-22T14:56:00.001-06:00

A recap of interesting Wi-Fi and IT industry articles from around the interwebs.

Author's Note
Since my last article round-up, Google has decided to completely gut the sharing features from within Google Reader, which includes notes, tagging of external articles not in your subscriptions, and lack internal sharing capabilities. Everything has been ported over to Google+, which is not nearly as useful. Therefore, an RSS feed of my shared articles is no longer available from my shared article feed (only historical shared items from before the change in November). I'm still looking for an alternative solution.

Wi-Fi Articles:
Wireless Tech Field Day 2 is coming this January, and we're adding to the mix with the Wi-Fi Symposium the day prior! Symposium topics will include the rise of mobile devices, BYOD, hotpsot 2.0, and gigabit Wi-Fi.

Wi-Fi Mobility Symposium – San Jose, CA: "Wireless networks are everywhere, and mobility is the order of the day from the enterprise to the consumer space. Wi-Fi technology is changing as a result, and the industry will come together to present a vision of the future at the Wi-Fi Mobility Symposium!"

Speaking of gigabit Wi-Fi, consumers can expect products to emerge in 2012 with enterprises following in 2013.

Another milestone for 802.11ac and gigabit wireless LANs: "One-gigabit wireless LAN products should enter the retail channel for the 2012 holiday season thanks to the fact that the 802.11 working group concluded balloting on the proposed 802.11ac standard last summer, meaning enterprise-focused products should follow in 2013."

Wi-Fi market growth shows no signs of slowing down. Find out why from Kevin over at CWNP.

What happens in Wi-Fi after 2015? | CWNP - Enterprise Wi-Fi Career Certifications: "Three studies: Informa Telecoms & Media / Wireless Broadband Alliance, Cisco, and IDC. One conclusion: between now and 2015, Wi-Fi is going to explode."

Still skeptical of those reports that Wi-Fi hotspots will grow dramatically in the next few years? Carrier Wi-Fi is only one reason, retail Wi-Fi could be even bigger! Brick and mortar retailers can take back the momentum from e-commerce retailers by opening up that in-store Wi-Fi! Here's why:

The Smartphone and the Revival of Impulse Purchases: "nothing compares to the instant gratification of buying it in the store with the comfort that they have done their research and they are getting a good price. The price doesn’t have to be the same as lowest online price - it just has to be close enough to offset the additional value the consumer receives from buying their products within the store, such as taking the product home with them immediately as opposed to waiting, and having the ability to easily return the product to the physical store if they need to instead of shipping it back to the online retailer."

Also check out my article on 5 Retail Trends Driving Wi-Fi while you're at it.

Ruckus Wireless released ChannelFly, joining the crowd in automatic and [dare I say] intelligent Wi-Fi channel selection... with a twist. Instead of passively listening to channels, Ruckus claims a better method is to actively measure performance with live clients to determine the optimal channel for operation. I'll reserve judgement until I see it in action (hopefully at Wireless Field Day 2).

Ruckus joins real-time wireless channel selection fray: "Ruckus access points enabled with ChannelFly use the dynamic frequency selection [DFS] feature of the 802.11h IEEE standard to bring wireless clients with them as they migrate from one Wi-Fi channel to another to perform real-time wireless channel selection analysis."

Any engineer can relate to this article. A fictional short-story on falsely accusing the network infrastructure for application problems!

Falsely Accused: The Wireless Controller Story - Your NCI: "This is another tragic case of the victim turning out to be our perp. Once we started looking at the evidence, it was clear that the WLAN controller was being falsely accused. After that, it was a simple matter of following the evidence back to the victim."

This Cisco newsroom release proposes using public VPNs as a solution to insecure Wi-Fi hotspot access. This is bad advice which is backwards-facing rather than forward-looking. Mobile access today requires an excellent user experience, and VPNs are not the solution. Secure hotspots are, which is why I find this article strange. Is the writer not aware of Cisco's efforts in carrier Wi-Fi and Hotspot 2.0 solutions?

Reducing the Risks of Public Wi-Fi - The Network: Cisco's Technology News Site: "One solution is to have corporate users connect to public Wi-Fi networks using public VPNs. These are less secure than corporate VPNs since they provide encryption only from the device to the service provider, not all the way through to the corporate network. But they do protect the most vulnerable zone, the Wi-Fi link and associated local area network."

IT Industry Articles:
A fascinating story on the history of Silicon Valley!

The Secret History of Silicon Valley » ÆtherCzar: "Entrepreneur Steven Gary Blank delivers an outstanding lecture on “The Secret History of Silicon Valley.” The story is in large part how Frederick Terman invented the culture of entrepreneurship at Stanford and Silicon Valley in the aftermath of World War II."

Why should we love a company or their products? Because they differentiate and are "evangelistic" about their products.

Why I Don’t Love Your Company Or Your Products. | In Search of Tech: "There is no differentiation from everyone else. There is nothing special about them. Their marketing stinks. Their ability to execute stinks. All they can do is jump up and down like a spoiled little child demanding that you notice them, but when you do take time to notice them, there is absolutely nothing remarkable about them."

Other Great Articles:
Forbes dives into why large companies lose great talent. It's not all about the money, it's about igniting their talent with exciting work and empowering employees to innovate.

Top Ten Reasons Why Large Companies Fail To Keep Their Best Talent - Forbes: "large established companies have a tremendous advantage in retaining their top talent and don’t. I’ve seen the good and the bad things that large companies do in relation to talent management. Here’s my Top Ten list of what large companies do to lose their top talent"

Follow that by reading this article from the Corporate Executive Board on the bleak outlook for employee retention and what IT organizations need to do to about it

CEB Tech Views » A Bleak Outlook for IT Employee Retention: "Only 25% of IT employees show a strong inclination to stay with their current employers and the number continues to fall. In response, IT leaders must take another look at the how they attract and retain key employees"

Comic for the Week:
I'm becoming a HUGE fan of the 1.00 FTE webcomic!

Cheers (and happy reading)!
Andrew

5 Retail Trends Driving Wi-Fi

2011-12-21T09:00:00.000-06:00

Mobile shopping often requires in-store Wi-Fi

Retail Wi-Fi networks have long been dominated by inventory management applications and services that enabled a more productive workforce and leaner operations. However, brick-and-mortar retail is being disrupted due to the explosive growth from pure e-commerce competitors offering [often] lower prices and a more personalized shopping experience. In addition, the e-commerce sales channel offers deeper product information, community reviews, and greater levels of localization and customization that resonate with consumers.

Brick and mortar retail must adapt to compete in this new environment. A key component of this adaptation is delivering new IT solutions while leveraging the physical assets of the storefront, mixing the benefits of in-store product "touch-and-feel" with the personalization of e-commerce shopping. Merging these two worlds together will create an enhanced shopping experience through the use of mobile Internet devices, often connected through Wi-Fi networks.

Here are 5 retail trends that are driving Wi-Fi growth and new capabilities in retail organizations.

Consumer Interaction and Business Analytics
Physical retailers have the most influence over consumer purchase decisions in the store, when they are standing in front of the product they are weighing whether or not to buy. Historically, this has been through in-aisle marketing and signage. However, customers are increasingly equipped with mobile Internet access and turning to external sources of information in real-time while within a retail store. This has been coined the emergence of the "smart shopper". These external sources of information are much more comprehensive than what the retailer can provide through traditional in-aisle marketing and signage, and this leaves the physical retailer at a big disadvantage.

Physical retailers are turning to multi-channel initiatives to enable in-aisle consumer interaction on mobile devices. Multi-channel is the broad alignment of in-store, online, and mobile retail channels into a cohesive experience and set of services for the consumer. It can also include mail-order, catalog, and telephone channels as well. This is accomplished through cross channel integration of back-end systems for product information, inventory, pricing, promotions, order fulfillment, and unified CRM (customer relationship management) systems for a complete view of the customer across all channels. It provides conveniences and benefits for the consumer such as consistent pricing, ship-to-store, ship-to-home, expanded assortment, unified checkout (in-store and online product), list and gift/wedding registry management, and more.

The emergence of the "smart shopper"

Guest Wi-Fi

mobile applications

business analytics

Digital wallets can improve retailer
"wallet share" and brand loyalty

Mobile payment and digital wallets

location based services

Deloitte predicts that in 2011, 25 percent of North American big box and anchor tenant retailers will begin offering free in-store Wi-Fi access to shoppers... [and] cellular signals can be highly variable: weak signals and low speeds are common, especially deep inside a store. Without Wi-Fi, the in-store online experience is often frustrating and dissatisfying… When shoppers do in-store online comparison shopping, preliminary and anecdotal evidence suggests the likelihood of purchasing appears to go up, not down. A common reason why shoppers do not make a purchase is that they are paralyzed by the lack of knowledge: “is this item available elsewhere for a much better price?” When an online search reveals that competitor’s prices are similar, many shoppers proceed with the purchase at the store they are in, rather than drive around just to save a few dollars.

- Source: Deloitte (also see this video presentation)

Empowering Sales Associates

smart mobile devices

Smart mobile devices and apps can empower sales associates

Expanded-aisle

Mobile POS

The In-Store Digital Experience
The in-store experience is critical to connecting and engaging customers with relevant merchandise and marketing information to capture their attention and turn browsers into buyers. Increasingly this means replacement of printed signage with one-way or interactive digital solutions that provide real-time, dynamically updated content that can be roll out in minutes or hours, instead of days or weeks.

Retailers are deploying one-way digital signage and electronic shelf labels in aisles and on end-caps, which can be updated immediately once changes have been decided by corporate staff, replacing long lead times for printing and distribution of paper signage materials. Digital signage is expensive, cannot be placed at every desired location, and locations requirements will change seasonally with product. Therefore, these systems will require portability. Running Ethernet cabling to every possible location is also not financially attractive, so these systems will rely on Wi-Fi networks for management, monitoring, and content retrieval. Interactive digital kiosks are migrating from fixed location solutions to mobile solutions as well.

Connected electronics require Wi-Fi for
product demonstrations and consumer interaction

Connected electronics allow retailers to showcase Internet-connected consumer electronics capabilities and increase sales. Consumer devices such as televisions, DVD/Blu-Ray players, gaming systems, music systems, computers, tablets, and smartphones are integrating more digital content and streaming services as core product features which drive differentiation and purchase decisions. Retailers will need to connect these devices to in-store Wi-Fi to demonstrate these capabilities to consumers to enhance the shopping experience. At the same time, provisioning and management of these devices will be challenging due to their lack of enterprise features, high churn rate (as product assortments change), and necessity for well-developed in-store processes and staff training.

Expanding Branch Office Services
In order to remain competitive, retail organizations must deliver better customer service in their physical stores. This is accomplished by migrating away from traditional lean-branch operational models focused on cost reduction to a more sophisticated service-rich operational model within the store. Deploying integrated and context-aware services into the store for both sales associate and customer use will translate into a better shopping experience, return visits, and brand loyalty.

New services such as robust wireless telephony solutions can enable better availability and improve responsiveness of sales associates for customer assistance by tying service desks to every associate in real-time, as well as provide push-to-talk integration for integrated in-store communications. Digital video services over wireless enable increased security by providing real-time video feeds to in-store security personnel, and can enable videoconferencing for merchandise planning and collaboration with headquarters staff. Location based services allow retailers to provide relevant services to customers, such as targeted promotions that appeal to today's cost-conscious consumer or in-store navigation (wayfinding) to improve the customer shopping experience. Location services will also require the Wi-Fi network to be deeply integrated with back-end marketing systems, making it more integral to core retail business operation.

Traditionally, these types of services were only available within campus networks due to the cost of deployment into highly distributed branch offices. However, virtualization and deeper integration between network and application architectures are making these services available for branch offices at more reasonable costs.

Increasingly, retail Wi-Fi networks are providing more intelligent capabilities rather than serving as a basic network access mechanism. As a rich source of real-time and context-aware data, retailers are exposing Wi-Fi network information through APIs for consumption by broader enterprise services and applications. Wi-Fi networks are becoming highly-integrated with core business systems.

High Availability
The modern retail branch Wi-Fi network must be highly available, even more so than the wide-area network (WAN) circuits back to the main office or data centers. This requires site survivability without loss of functionality. Survivability of historically centralized services such as directory, RADIUS, DHCP, and DNS will need to be to in place to prevent failure of local network connections and applications, service outages, loss of business functionality, and impact to core retail business operations.

High availability can be accomplished either through deployment of centralized services down to each branch or by installation of an intelligent wireless network. Deployment of services to each branch can be a very expensive undertaking, requiring physical or virtual server deployment, licensing, maintenance, data replication, higher WAN bandwidth, and extensive growth of management and monitoring tools for these distributed services. Alternatively, an intelligent Wi-Fi network can dynamically adjust for the loss of central services and provide site survivability for a period of time until those services can be restored. It can accomplish this through a robust software feature set that integrates RADIUS, provides credential caching with directory services, and dynamically monitors central services to intelligently transition to local network survivability when required. What's better is that this functionality is built into the network and doesn't require deployment of additional hardware, software, or management tools.

Revolution or Evolution? – Andrew’s Take
Modern retail branch wireless networks must provide a high capacity, performance-rich, distributed, scalable, highly available, and stable architecture that also provides intelligent, context-aware services that integrate directly into back-office merchandising, marketing, and analytics systems. Wi-Fi networks are migrating from a best effort inventory focused service, to a core retail business enabler that demands much higher performance and service levels. Along with this shift, business partners and key stakeholders will take a much more involved and active role in determining network requirements to support core business capabilities. IT organizations must understand and navigate this change effectively to be considered business partners rather than an inflexible organization the business teams will seek to bypass.

Cheers,
Andrew vonNagy

This article originally appeared on the Cisco Mobility blog as a 3-part series (Part 1, Part 2, Part 3).

R.I.P. Bluetooth

2011-12-20T10:30:00.000-06:00

Bluetooth is a technology that, in many respects, consumers and IT professionals have a love / hate relationship with. Developed as comprehensive protocol stack back in a time when personal area network (PAN) solutions were complex and Bluetooth provided a solution that was low-cost, low-power, and relatively robust (compared to alternatives at the time).

However, I would propose that Bluetooth is becoming largely irrelevant in the face of newer technologies that supplant its capabilities with more feature-rich, capable, and robust solutions. The need for a comprehensive solution stack is being greatly diminished, and increasingly will only impair new capabilities from being developed and brought to market in a timely fashion.

I think it's only a matter of time until the Bluetooth capabilities are completely supplanted by new technologies. Wi-Fi Direct provides an easy-to-use personal area networks (PAN) where its predecessor, Ad-Hoc Wi-Fi, failed. It also provides backward compatibility with all existing Wi-Fi enabled systems. Cost and battery life concerns of Wi-Fi have also largely been addressed. Apple AirPlay and AirDrop protocols provide simple solutions for audio / video streaming and file sharing (over Wi-Fi). NFC enables short-range, one-time, transaction oriented information transfer. Add to that the emergence of feature-rich mobile platforms and a robust mobile application development community, and the need for integrated protocol stacks like Bluetooth seem greatly diminished if not completely irrelevant.

Meanwhile, the Bluetooth ecosystem appears increasingly fragmented. Bluetooth 3.0 and 4.0 provided newer features, but are not backward compatible with previous generations of Bluetooth technology. Recent news also seems to indicate that Bluetooth is clinging to newer technologies in an attempt to maintain relevancy. Consider that almost all recent Bluetooth development has focused on leveraging other technologies to extend its capabilities and useful life. Bluetooth 3.0 (and later) leverages Wi-Fi for high-speed data transfer, and the Bluetooth SIG announced device pairing using NFC will soon be supported.

The one gap remaining to Bluetooth replacement will be embedded devices, such as audio peripherals, medical/fitness instrumentation, and in-car systems, that cannot easily be upgraded or replaced in the short-term. Manufacturers will slowly drop support for existing Bluetooth solutions, and opt to develop new solutions based on alternative technologies. This will leave Bluetooth hanging around for use with legacy systems for a few years, albeit with one foot in the grave.

But ultimately it appears that Bluetooth's fate has already been decided.

R.I.P. Bluetooth, you just don't know it yet.

Cheers,
Andrew

Wireless Video Streaming Products Using Wi-Fi, Not Waiting for WiGig or 802.11ad

2011-12-19T18:03:00.000-06:00

Wireless video streaming solutions aim to
reduce the cabling mess behind your television set

Wireless video streaming, specifically cable replacement technologies, are emerging in the marketplace. Standards are being defined to fill this need with WiGig and 802.11ad in the 60GHz frequency band.

But consumer electronics companies aren't waiting around, using existing 5GHz U-NII unlicensed bands with 802.11n.

Intel Wireless Display (WiDi) compatible laptops and TV adapters have been around since early 2010. It requires specific system specifications, including a Wireless-N adapter. But it wasn't until earlier this year that Intel incorporated WiDi support for DRM protected DVD and Blu-Ray content, expanding consumer interest.

Intel WiDi streams video from laptops to your HDTV
through a compatible adapter using 802.11n Wi-Fi

And consumer electronics manufacturers are getting into the game too, with devices such as Actiontec's MyWirelessTV which are already available on the market.

The Actiontec MyWireless TV Kit streams video between any two
HDMI compliant devices by utilizing 5GHz 802.11n Wi-Fi

While SmallNetBuilder gave a glowing review of the units, significant questions remain. Actiontec specifies utilization of 802.11n technology, but the product is not currently certified by the Wi-Fi Alliance. Additionally, the MyWirelessTV user manual (PDF) is especially vague on key implementation details such as security. Actiontec claims the units are pre-paired and support push-button sync, most likely for use when pairing additional receivers. Does this use Wi-Fi Protected Setup (WPS)? Likely not, given the lack of WFA certification. Also, the product specifications list wireless security as "Standard Wi-Fi Security". That's intentionally vague! Why the lack of transparency, Actiontec?

Revolution or Evolution? - Andrew's Take
I think video streaming in the home will catch on quick. People hate fussing with cables, want more flexibility in where they place set-top-boxes, are increasingly desiring multi-room viewing capabilities, have gotten used to time-shifted viewing with DVRs and will want that extended to mobile devices, and want something that "just works".

I think it's also safe to assume that cable replacement technology will also be adopted in the enterprise and education markets. Numerous use-cases exist, and in-room video projectors could likely drive adoption by itself. No more tugging on cables and moving tables to accommodate projector placement during meetings! And if there is one thing the Wi-Fi industry has taught us already, it's that consumer adoption and demand will push its way into the enterprise.

Wi-Fi engineers should be prepared to ensure compatibility and performance of wireless video technologies alongside corporate Wi-Fi networks. In the short-term this means 802.11n. Long-term, WiGig and 802.11ad may alleviate co-existence concerns. The question will be, how fast will solutions emerge and when will your business want the technology?

My only ask is that consumer electronics companies take more care to ensure interoperability with existing Wi-Fi networks by achieving WFA certification, and being transparent with product specifications. In the meantime, I'd love to get my hands on one of these kits for Wi-Fi analysis :)

Do you have any experience with wireless video streaming and cable replacement solutions? Leave a comment below, I'd love to hear your findings!

Cheers,
Andrew

Wi-Fi Roaming Analysis (Part 1 - Connection Control)

2011-12-19T08:10:00.000-06:00

Advanced protocol analysis is becoming an increasingly important skill for Wi-Fi engineers as networks grow increasingly sophisticated and complex. The wireless LAN market is a tremendously innovative and fast-changing landscape, and the skills necessary to understand and dissect their inner workings are highly valuable.

One of the most important aspects of building a successful enterprise wireless LAN is ensuring adequate Wi-Fi roaming performance. However, Wi-Fi roaming is a complex subject due to the many variations of Wi-Fi security found in the marketplace and the historical difficulty in being able to easily gather and analyze roaming data.

In this series I will provide an overview of Wi-Fi roaming, how it works, and provide readers with guidance on how to capture, measure, and analyze wireless roaming performance of clients within their own environments. In addition, I'll highlight a few professional tools and tricks of the trade to make this process simpler than manual analysis.

Wi-Fi Roaming Definition
Roaming, in the context of an 802.11 wireless network, is the process of a client moving an established Wi-Fi network association from one access point to another access point within the same Extended Service Set (ESS) without losing connection (e.g. within a defined time interval, usually in the range of a few seconds).

It is also helpful to distinguish between different wireless connection scenarios that may occur. Delineation will provide a better understanding of how and when each scenario will occur, why variations in performance between scenarios exist, and aid in establishing performance baselines.

Initial Connection - The client has no previous 802.11 association to the ESS (any AP advertising the same SSID). This situation requires the client to perform all required connection and authentication steps defined in the network policy before network access is achieved. The time required for a client to perform an initial connection will be the same as wireless roaming unless fast roaming or session caching techniques are implemented. The length of time required to complete full 802.1X authentication in secure wireless environments is considerably longer than in open or pre-shared key (PSK) networks, making implementation of fast roaming techniques highly desirable. It may even be required depending on the network architecture and applications implemented (e.g. branch / remote office networks with central RADIUS across the WAN increase the time to complete EAP authentication and can render real-time voice applications unusable).

Wireless Roaming - The client has an established 802.11 association to an infrastructure AP and migrates its connection within the same ESS to another AP. Association to the new AP terminates the previous AP association either implicitly or explicitly (only one association is allowed at a time, per the 802.11 standard). The goal of a wireless roam is to identify an alternate AP that can provide better service to the client than the current AP.

Wireless client roaming algorithms are typically optimized to minimize the time required to transition between APs in order to avoid network access disruptions to client applications. This can be accomplished through fast roaming or session caching techniques that eliminate some of the authentication steps. Fast roaming can only occur after an initial connection has been performed to ensure the client has successfully completed all required authentication and authorization required by the network policy.

Connection Termination & Re-Establishment - The client has an established 802.11 association, but the performance severely degrades to the point that the connection is rendered unacceptable. The client and/or AP is required to recognize the degraded connection, which may not be explicitly apparent, then terminate and re-establish a connection from scratch. A connection could degrade for a number of reasons, including interference, multipath (with older 802.11a/b/g clients), excessive packet error rate, out of range, roam not completed within the client's time threshold, etc.

When analyzing client roaming events it will be necessary to determine if the client performed a wireless roam or if it terminated and re-established its network connection. A terminated connection requires solutions to remediate underlying issues affecting network stability, versus the focus of wireless roaming which is to improve performance.

Additionally, identifying which situation is occurring can be incredibly valuable when performing protocol analysis and troubleshooting in order to determine what may be occurring with a client network connection when the client cannot be directly observed (e.g. remote troubleshooting).

Connection Control
Wi-Fi network connection establishment and roaming is decentralized, being controlled almost entirely by the client. The 802.11 standard explicitly places control of wireless connection establishment in the hands of clients by defining various logical services and breaking implementation out between clients and access points.

Think of the AP as a hotel concierge:
"Welcome to the Distribution System! You're
requested Association is ready."

Some of these services require integration with external networks (e.g. the distribution system [DS] outside the basic service set [BSS]), which is not defined by the 802.11 standard but is typically an 802.3 wired Ethernet network. These services are only implemented in wireless access points, and include association and dis-association services among others. It is important to understand that although APs provide association services for client stations, it is the client station that invokes the association process. It may be difficult to conceptualize how client stations control connection establishment when the association service is only implemented within APs. However, remember that the 802.11 standard defines "services", and the AP provides the association service for the client who invokes the service.

Furthermore, the access point is responsible for association services in order to inform the broader network of the STA to AP mapping, and for data delivery between stations across the network. This mapping is also the reason why an 802.11 client station can only be associated to a single AP at a time to ensure that the network can deliver data to the correct AP.

Infrastructure Influence
Wi-Fi infrastructure vendors have developed proprietary features to influence client behavior. One example of this is the Cisco Compatible Extensions (CCX) program which includes AP assisted roaming through neighbor reports, fast roaming enhancements, RF scanning, client reporting, and roaming diagnostics. Another example is the band-steering feature provided by many vendors, which typically works by delaying probe responses to dual-band clients in order to influence them to join a 5GHz BSS instead of 2.4GHz BSS (otherwise many clients "stick" to 2.4GHz with high prejudice, although manufacturers are starting to change this preference due to the increasing prevalence of 5GHz Wi-Fi networks). Finally, the IEEE has standardized a set of radio resource enhancements with the 802.11k amendment that allows the infrastructure to send "Neighbor Reports" to the client to aid the client scanning and roaming decision. See the CWNP whitepaper on RSN Fast BSS Transition (free registration required) for more information on 802.11k and neighbor reports.

Proprietary Client Implementations
Since the connection is controlled by the client station, it typically relies on an internal algorithm developed by the manufacturer to determine when a wireless roam should occur. Client roaming algorithms are not standardized and are proprietary intellectual property of each manufacturer. This results in highly variable client roaming performance based on manufacturer implementation approaches and variations.

However, from a high level perspective, all client stations typically perform the same general steps when roaming, which includes:

Passive / Active scanning in the background to identify other APs that are within range
Client roam triggers (exact algorithms are vendor proprietary, but are commonly based on signal strength thresholds, RSSI heuristics between APs, data rate shifting, retry and error rates)
Active scanning to confirm the new AP is still available
Roam to the new AP

Comparison to Cellular Networks
For comparison, consider connection control similarities and difference between Wi-Fi roaming and cellular handover mechanisms. Cellular networks may implement a variety of handover protocols to transfer a mobile station between source and target cells, ranging from network-controlled to mobile-station-controlled depending on the standard being implemented (AMPS, CDMA, GSM, etc). Modern cellular networks typically rely on decentralized handover, similar to Wi-Fi, but define key enhancements to ensure connection reliability. Soft-handover in CDMA networks allows a mobile station to establish a connection to the target cell before breaking the connection to the source cell, thereby reducing the chance of service disruption. Standards such as 3GPP, which defines GSM and LTE networks, specifies that handover triggering (section III) is defined by the network core but implemented by mobile stations (user equipment) to improve consistency and performance. Finally, rigorous and thorough testing of every mobile phone is performed by mobile network operators (MNO) before certification is granted for activation on their networks (the GCF is one example).

Note - Wi-Fi roaming is most comparable to cellular handover. In contrast, cellular roaming refers to service acquisition outside of the subscriber's home location or network provider, and should not be confused with Wi-Fi roaming.

Wi-Fi engineers should take away a few concepts from this comparison. First, soft-handover is likely not realistic for Wi-Fi networks due to typical enterprise multi-channel architectures based on frequency division of adjacent APs (similar to GSM). Second, standardized handover triggering is within the realm of possibility, and the central definition of trigger mechanisms is feasible with modern coordinated Wi-Fi architectures (typically involving a controller, but not required). However, the need for such standardization will need to become much more apparent before action by the IEEE or Wi-Fi Alliance is considered. Perhaps the industry will begin talking about such measures as MNOs take more prominent roles within the Wi-Fi standard and certification processes due to carrier Wi-Fi adoption.

Perhaps the most important takeaway is the approach to endpoint certification implemented by mobile network operators. By taking control of endpoint certification prior to activation and use on the network, MNOs more tightly control their network ecosystem to achieve desired performance levels. Wi-Fi networks will never be able to achieve such levels of control due to the use of unlicensed spectrum. However, Wi-Fi network administrators can (and should) implement similarly rigorous client testing and verification procedures to optimize network performance.

Importance of Wi-Fi Roaming Analysis
Consider - modern wireless networks require high performance to concurrently support voice, data, and real-time video, high capacity Wi-Fi to support an influx of mobile Internet devices, and ultra-low latency performance to support vertical industry solutions such as automated warehouses, robotics, and medical instrumentation.

Wi-Fi network design and optimization is a complex undertaking, with numerous features, configuration options, and environmental variables that can make achieving a high performance network difficult. Roaming analysis provides insight into how decisions made on wireless architecture, network design, client selection, and configuration impact overall network performance.

Performing Wi-Fi roaming analysis will enable network architects and engineers to:

Baseline current client roaming performance
Analyze gaps between current network performance and application requirements
Identify opportunities to improve and optimize performance
Implement changes to infrastructure and client devices to optimize performance
Take more active control to ensure network performance matches desired service levels

Be sure to check back in for the next article in this series which will cover the complexity brought about by security protocols and the many resulting variations of wireless roaming.

Cheers,
Andrew

Many thanks to Marcus Burton at CWNP for technical review and contribution to this post!

It's Coming! Wireless Tech Field Day 2

2011-12-13T10:12:00.003-06:00

Wireless Field Day 2 -
Getting all up in your Wi-Fi!

It's coming.... Wireless Tech Field Day 2! Are you ready?!

It's been almost one year since the first-ever Wireless Tech Field Day (WFD1) took place in sunny San Jose, CA. Stephen Foskett and the team at Gestalt IT are back at it, preparing for a second go-round with even more Wi-Fi tricks up their sleeve for the viewing audience. WFD2 will be the community's pre-eminent source for the latest news on industry direction and advancements, and lively discussion around solutions to meet the growing need for Wi-Fi in all types of environments. It will take place Jan. 25-27th in Silicon Valley and on-line in real-time.

A lot of change has occurred in the industry in one year. Wireless field day 2 will cover the latest advancements in Wi-Fi technology, likely including:

Broader availability of 3-spatial stream access points
Evolution of Wi-Fi architectures (controller versus controller-less anyone?)
The mobile craze sweeping enterprises (including BYOD trends and solutions)
Beamforming advancements that improve device connectivity and reduce interference
Hotspot 2.0 progression with cellular to Wi-Fi authentication (and derivatives)
Spectrum Analysis growing in importance with increasing utilization of both 2.4 and 5 GHz bands
... and probably a few surprises along the way too!

Tech Field Day events are made special by the three groups involved: delegates, sponsors, and community viewers. I call it the "Tech Field Day Trifecta!"

The Tech Field Day Trifecta

In attendance will be some of best independent industry experts ... our team of delegates who will poke and prod the vendor sponsors to get past marketing fluff and talk down 'n dirty about the future of Wi-Fi. Delegates come from a broad range of backgrounds, including training and certification providers, vendor partners, consultants, and customers.

Marcus Burton	CWNP	@MarcusBurton
Sam Clements	SC-WiFi	@Samuel_Clements
Daniel Cybulskie	SimplyWiFi	@SimplyWifi
Rocky Gregory	Intensified	@BionicRocky
Tom Hollingsworth	The Networking Nerd	@NetworkingNerd
Jennifer Huber	Wireless CCIE, here I come!	@JenniferLucille
Blake Krone	Digital Lifestyle	@BlakeKrone
Chris Lyttle	WiFi Kiwi’s Blog	@WiFiKiwi
Andrew vonNagy	Revolution Wi-Fi	@RevolutionWiFi

Vendors will host the sessions, preparing presentations, hosting discussions, providing live demonstrations of technology in action, and fielding hard-hitting, brutally honest, thought-provoking questions from delegates that should make for some great discussion. The mix of vendors covers both large and small companies, and their differing approaches to delivering Wi-Fi solutions highlights the rapid pace of innovation in this industry.

	AeroHive	@Aerohive
	Aruba	@ArubaNetworks
	Ekahau	@Ekahau
	HP	@HP_Networking
	Meraki	@Meraki
	MetaGeek	@MetaGeek
	Ruckus	@RuckusWireless

Vendors, don't forget to bring the bacon (both figuratively and literally, or even bacon as a service)! Dirty chai will also be welcomed. Our delegate crew loves to be challenged with thought-provoking new ideas while avoiding the doldrums of presentation slides. Let's sink into the nitty-gritty with demonstrations, hands-on labs, and honest discussions.

Xangati "brought the bacon" at Tech Field Day #5

Both delegate and vendor groups will have a few returning faces from WFD1, as well as some new faces to provide some new perspective and opinions.

Community viewers, are you prepared to:

Tune-In to the live video feed that will be hosted on the TechFieldDay website?
Interact in real-time on social media?
Contribute to the discussion and get answers to your most relevant and pressing Wi-Fi questions?
Learn about new and exciting innovations that are coming in the world of Wi-Fi?

The industry sponsors are set. The independent delegates have been picked. In-depth discussions are imminent. We ask that you, the community of viewers, get involved. This event is for the community more than for the delegates. We want to hear your discussion, thoughts, and questions live during the sessions so we can drill into the information that is relevant.

It's coming! Be prepared. Get involved!

Cheers,

Andrew

P.S. - Stay tuned, we may have another trick up our sleeve related to this event!

* Updated 2011/12/22 to include HP as a sponsor.

BYOD - A Symptom of Poor IT Service Delivery

2011-12-08T10:03:00.001-06:00

Does What You Deliver Match What Was Asked For?

Enterprise mobility and BYOD are both hot topics these days. However, I think the two topics are too often lumped together when they shouldn't be because most BYOD discussion involves mobile devices.

Fellow IT bloggers Tom Hollingsworth (@networkingnerd) and Bill Hill (@virtual_bill) posted articles around the BYOD trend (see Tom's article and Bill's article). These articles, along with numerous other blog posts, public discussions, and different viewpoints expressed within the IT community have led me to voice my opinion on this topic. I wrote once already about the need to focus enterprise mobility on building organizational value, but didn't directly discuss the interaction between enterprise mobility and BYOD.

The focus of much of the general discussion by IT workers that I have noticed centers around how this trend is hitting IT departments, reactions to whether IT should provide services to personal mobile devices, how the IT department can secure data, and how to address device support.

I think these are important questions that are yet unanswered to a large extent. However, it feels like these conversations within IT circles are still missing the point. Engineers like us field requests, start determining requirements, limitations, impacts, and trying to execute on delivery. I hear concerns over supportability and security for both endpoint devices and corporate data. In other words, we love to solve problems. However, in so doing we tend to focus on non-functional requirements without proper perspective on functional strategy definition. Implicitly, large assumptions are made that BYOD is a solution that must be delivered. In most cases, it's NOT!

Instead, we should be taking a step back to understand where this request is coming from, why the request is being made (on a pretty large scale), determine the real request (rather than what may be directly asked for), and develop a strategy that solves the underlying business needs. Let's not just form a knee-jerk reaction to the request, assume that personal devices are the path forward, and start throwing up barriers to make ourselves feel better and commiserate with one another.

Here's what I'm driving towards:

BYOD is fundamentally an employee reaction to poor IT service delivery!

Whoa! Shocking statement, right?! Let's take a step back at the purpose of technology within the organization. It's my opinion that many IT departments get so caught up in running an IT organization, fielding requests, and being order takers, that they lose sight of their responsibility - to partner with the larger organization to deliver services that meet business objectives. Let's face facts, many individuals within IT are seriously hampered by lack of communication skills with business partners, have trouble interacting with non-technical staff and translating business objectives into sound IT strategies and solutions, and this turns into a large case of "group-think" whereby the IT organization keeps it's head down and drives incremental technology updates without understanding or delivering solutions that are best for the business.

I think this is bore out by the dissatisfaction of most employees with the end-user computing platforms deployed by corporate IT departments. Corporate laptops run slow because of layers upon layers of software that undermines usability of the system to the point that employees stop using them.

It's my belief that employees and business teams turn towards BYOD because it's a tangible solution to very real problems they experience every day - namely the dissatisfaction and poor performance of current end-user computer platforms in the workplace which undermines employee productivity, and the lack of appropriate enterprise mobility solutions being delivered by the internal IT organization which prevents business flexibility and new operational capabilities.

And let's get real, IT organizations are not only seeing this trend in the end-user computing space. Developers are turning to outside SaaS solutions for development platforms, Infrastructure as a Service (IaaS) is maturing fast, and cloud services, while mainly private clouds for large organizations today, will begin migrating to hybrid and public cloud solutions in the near future. Now not all of this can be attributed to poor IT service delivery, but don't kid yourself into thinking this isn't at-least part of the reason (if not a very large part).

What corporate IT organizations need to do about enterprise mobility and BYOD is straight forward but can be a tough pill to swallow - focus on IT service delivery that aligns with business capabilities! This may mean that many IT departments take a critical look at themselves and acknowledge that gaps exists. Some IT organizations are fast on this migration path, whereas others may not have even started.

Bill hits the nail on the head in his article when he says:

IT needs to engage with the business to keep them abreast of concerns. Open dialogue with the business will help ensure technological expectations meet some sort of equilibrium between what IT feels is appropriate and what the business feels is necessary.

Consider the following:

Understand that some business processes can be better-served with mobile solutions
The fundamental "ask" by business teams is to enable mobility within the organization

BYOD is largely a by-product of evolving business needs intersecting with dissatisfaction of current solutions delivered by the IT organization

Prioritization of business processes that will most benefit from mobility should occur

Mobile-everything is not realistic, at least not right away. Focus on adding value to core business capabilities through the tactical use of mobile solutions where it makes sense.

An approach to mobile endpoint, software, and applications need to be defined that best matches the business use-cases

This could be corporate-liable, personal-liable, or a hybrid approach for endpoints
The application development approach will be critical to success, requiring close integration between mobile applications and business processes, not simple migrating existing applications to mobile platforms or standing up VDI workarounds.

Business processes will need to be re-designed with mobile workflow in mind
IT organizations must better understand core business capabilities by partnering with business teams and become an integral participant in solution definition

The fact is that most business teams and individuals outside of IT are now tech-savvy and are defining their own solutions without the aid of the IT organization because of frustrations surrounding lack of IT agility, flexibility, and delivery time, and the delivery of solutions that do not meet business needs.
Many IT workers don't have or want to develop business skills, according to fellow blogger Matthew Norwood (@matthewnorwood). This is okay! Technical roles exist to define and execute technology strategy, not business strategy. These skills are still tremendously valuable. However, the IT organization as a whole must have business skills, and IT leadership must be cognizant of filling both business consultant roles and technology architect / engineer roles within the skillsets of their teams.

This should be a wake-up call for IT organizations, which are being required to shift into a service delivery organization to meet modern business requirements. We must adopt a mindset that focuses on providing strategies and solutions that meet business capabilities / requirements first and meeting non-functional requirements second. If we can't deliver the fundamental capabilities the business teams need, they will look elsewhere (as they are already doing in many instances). It doesn't matter if we build the most technically elegant mouse trap that kills mice with 100% reliability, if it doesn't solve the infestation problem then it's a failure.

Does Your IT Organization Have An
Infestation of Mice?

That's my 0.02¢ (okay maybe 0.05¢).

Cheers,
Andrew

Site Redesign and Updates

2011-11-30T09:10:00.001-06:00

I always strive to publish high quality content on this blog, but it's always been a bit on the bland side in the design department. Part of that is due to the limited options with free hosting courtesy of Google / Blogger, but part of it is also due to my poor artistic abilities :) I'll admit, I'm not the most creative person when it comes to artistic design for this website or in general. I've also been a bit cheap and not hired a graphic artist to create a logo or paid for web hosting that would allow more flexibility in the site's design.

Well, that's not changing for now...

I'm going to remain hosting with Blogger until I have a good incentive to move off. It would probably require a venture into independent consulting, where a more professional website with my own domain and advertising can be properly displayed.

Until then, I've updated this site with a new theme and graphic logo in the header. I feel it spruces up the place a bit, albeit within the constraints of free hosting that I previously mentioned.

The New Website Logo

I'd also like to direct the attention of my readers to the additional pages on this site (along the top bar, below the logo), especially the Article Archives by Topic. Hopefully this page will make it easier to navigate the blog and find articles of interest, rather than the old method of combing through the archives by date published (which is still available in the right column).

A few other updates worth mentioning:

Mobile Optimization - The site is also now optimized for mobile browsers, so you can read articles and blogs directly from your smartphone or tablet in a much easier format. There is no separate URL, just link or browse to this site and it should detect your browser automatically.
Favicon - You should be able to easily distinguish my blog within your favorite RSS feed reader when in a visual viewing mode (such as Flipboard for iOS). It's essentially the same as the logo, only in a smaller size.
What I'm Reading - Unfortunately, I've had to remove this section due to the recent changes to Google Reader and removal of the native "Sharing" functionality and replacement of sharing to Google+. This is a big disappointment to me, since sharing to G+ is not as friendly as the native sharing was, and doesn't allow power readers to find shared articles or see archives of shared articles as easily as before. Additionally, I used to share articles from across the web with the "Note in Google Reader" bookmarklet, but this no longer works either. Now I can no longer tag or share articles that are not in my RSS reader list, which is unfortunate.

Thanks for the input from friends on Twitter, who helped me review and tweak the new design!

Cheers,
Andrew

Carriers About to Reverse Course on Free Wi-Fi?

2011-10-31T18:26:00.000-05:00

Warning: This is an opinion post, something I rarely do. This story just got me so riled up I had to post some thoughts on it.

In case you haven't seen this story yet, Dailywireless.org posted about "Carriers Kill Free Wi-Fi". I think this is a horrible development, and here is why...

I'll say this only once, carriers that either charge for Wi-Fi access or count Wi-Fi usage against data caps will alienate their [former] customers.

You can't start offering a service for free because it reduces your cellular network/backhaul costs and reduces your network congestion, then turn around and realize that you could making another buck elsewhere off the service. You started FREE, and making a change to PAID Wi-Fi will not work. It's now a commodity and no-one, I mean no-one, will want to pay for it. Just look at what happened to the hospitality industry. Yeah, almost all hotels offer FREE Wi-Fi now, and they had the fortune to start off as a paid service setting consumer expectations up front. Cellular telcos will have no such leeway, in fact just the opposite.

Oh, not to mention the fact that FREE Wi-Fi will be so prevalent even without carrier Wi-Fi networks that users will just go elsewhere (trust me on this one :). When every cafe, bookstore, and retail shop will be offering FREE Wi-Fi within the next year or two, consumers will see this shift in policy as nothing but greed.

Carriers will be better able to retain customer loyalty by giving away Wi-Fi than by charging for it. Try that for a marketing tactic... "Unlimited data on our Wi-Fi network. You know, because we're cool like that!"

The Dailywireless story is about Shaw Communications up in Canada. But you can see the writing on the wall for other carriers. AT&T, you're the largest U.S. carrier with skin in the game. Keep it FREE. We like it that way. I don't mean to single you out, and I don't know what your plans for Wi-Fi are. But looking at where other U.S. carriers are with Wi-Fi offload (Verizon - nada; T-Mobile - struggling; Sprint - who?), it's only natural that the U.S. market is really yours at this point.

Wi-Fi uses unlicensed frequency - FREE! It's built into the technology's DNA. Don't screw with my Wi-Fi! It gets me all riled up!

Not-so-cheery,
Andrew