Not your fathers WiFi

My kindle reading list

Tue, 23 Oct 2012 21:10:18 +0200

I’ve been asked if I could share what kind of technology publication I own and read on my Kindle devices. So I thought why not put them up here.

I use Kindle (on all of my devices) for the technical reference books all the time. It makes my job so much easier (and flights so much shorter).

This is the list at the moment (in no particular order). For any 802.11 professional I wholeheartedly recommend CWNP study guides:

Implementing 802.1X Security Solutions for Wired and Wireless Networks by Geier, Jim
Active Directory: Designing, Deploying, and Running Active Directory by Allen, Robbie, Desmond, Brian, Richards, Joe, Alistair G. Lowe-Norris
Microsoft® Windows Server™ 2003 Inside Out (Inside Out (Microsoft)) by Stanek, William R.
VMware Cookbook: A Real-World Guide to Effective VMware Use by Helmke, Matthew, Troy, Ryan
Advanced Penetration Testing for Highly-Secured Environments: The Ultimate Security Guide by Allen, Lee
Vim and Vi Tips: Essential Vim and Vi Editor Skills, 3rd ed. By Artymiak, Jacek
Windows Powershell Pocket Reference (Pocket Reference (O’Reilly)) by Holmes, Lee
Managing iOS Devices with OS X Lion Server by Dreyer, Arek
SNMP Over Wi-Fi Wireless Networks by Kerdsri, Jiradett
CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide by Gibson, Darril
IP Design for Mobile Networks by Wainner, Scott, Grayson, Mark, Shatzkamer, Kevin
Building the Mobile Internet (Networking Technology) by Grayson, Mark, Shatzkamer, Kevin, Wierenga, Klaas
802.11n: A Survival Guide by Matthew Gast
802.11 Wireless Networks: The Definitive Guide, Second Edition by Matthew Gast
Fundamentals of LTE (Prentice Hall Communications Engineering and Emerging Technologies Series) by Andrews, Jeffrey G., Ghosh, Arunabha, Muhamed, Rias, Zhang, Jun
Session Initiation Protocol (SIP) : Controlling Convergent Networks (McGraw-Hill Communication Series) by Russell, Travis
Linux Networking Cookbook by Schroder, Carla
How to Use the Unix-Linux vi Text Editor by Smith, Larry
Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems by Sanders, Chris
Nmap Cookbook: The Fat-free Guide to Network Scanning by Marsh, Nicholas
The Ubuntu Beginner’s Guide - Fourth Edition (Computer Beginner’s Guides) by Moeller, Jonathan
Working at the Ubuntu Command-Line Prompt (Linux Nitty Gritty) by Thomas, Keir
Telecommunications Essentials, Second Edition: The Complete Global Source (2nd Edition) by Goleniewski, Lillian, Jarrett, Kitty Wilson, (editor)
OmniGraffle 5 Diagramming Essentials by Olsen, Ruben Olsen
Essential SNMP by Mauro, Douglas R., Schmidt, Kevin J. Low Tech Hacking:
Street Smarts for Security Professionals by Wiles, Jack, Lowther, Sean, Gudaitis, Terry, Jabbusch, Jennifer, Rogers, Russ
Zenoss Core 3.x Network and System Monitoring by Badger, Michael
Understanding Linux Network Internals by Benvenuti, Christian
Cacti 0.8 Beginner’s Guide by Urban, Thomas
Kismet Hacking by Brad Haines, Frank Thornton, Michael Schearer
How to Config ISP for CentOS for Server by Ho, Phuong
FreeRADIUS Beginner’s Guide by van der Walt, Dirk
CWSP Certified Wireless Security Professional Official Study Guide: Exam PW0-204 (CWNP Official Study Guides) Coleman, David D., Westcott, David A., Jackman, Shawn M., Harkins, Bryan E.
BackTrack 5 Wireless Penetration Testing Beginner’s Guide by Ramachandran, Vivek
CCNA Wireless Official Exam Certification Guide (CCNA IUWNE 640-721) by Carroll, Bran
CWAP Certified Wireless Analysis Professional Official Study Guide: Exam PW0-270 (CWNP Official Study Guides) by Coleman, David D., Westcott, David A., Miller, Ben, Mackenzie, Peter
CWDP Certified Wireless Design Professional Official Study Guide: Exam PW0-250 (Study Guide Pw0-250) by Jackman, Shawn M., Swartz, Matt, Burton, Marcus, Head, Thomas W.
CCNA Official Exam Certification Library (CCNA Exam 640-802) (3rd Edition) by Odom, Wendell
Deploying and Troubleshooting Cisco Wireless LAN Controllers by Gress, Mark L., Johnson, Lee Learn
RouterOS by Burgess, Dennis
Official Exam Prep Guide: Wireshark Certified Network Analyst by Chappell, Laura
CWNA Certified Wireless Network Administrator Official Study Guide: Exam PW0-104 (CWNP Official Study Guides) by Coleman, David D., Westcott, David A.

I think this is it. I’ll add new ones as I extend my reading list. Plus vendor white papers are a great resource as well.

Enjoy,

Gregor

Here comes the beast. WFD3

Sun, 23 Sep 2012 23:27:00 +0200

We all heard it before. 802.11ac is the next big thing in WiFi (while I disagree with that personally, believing 802.11u will bring more significant changes to the industry) bringing multi gigabit speeds to our WiFi devices.

A couple of SOHO vendors have already introduced 802.11ac products but it is well known that enterprise gear is slower at adopting new technology as it needs to mature to cope with enterprise requirements.

The industry consensus is that we will be seeing enterprise 802.11ac capable APs in second half of 2013, depending on the vendor.

A couple of months ago Cisco introduced a new, flagship 3600 series AP. It is 4x4:3 behemoth with a module slot for future expansion. Fist module introduced was the security module but more interesting is the announcement of 802.11ac module.

Cisco was a returning presenter for WFD3 having skipped the WFD2 event. In comparison to WFD1, they have been much better prepared for this one. One of the highlights was demoing a working 802.11ac module.

And it was impressive. 550 - 700 Mbps of pure WiFi bliss. Come on, look at the pretty colours. But as with any alpha release the screenshot below is not representative of what we can expect with fully matured 802.11 ac standard. Speaking of the standard, just looking at the utilisation of the spectrum, one can observe that no arbitration is performed on the 802.11ac demo. See my comments on the picture below.

Still, Cisco is the first enterprise vendor that demoed 802.11ac in any factor or form, so kudos to them.

Cheers,

Gregor

WFD3 - Thanks for the experience.

Fri, 21 Sep 2012 21:43:00 +0200

I have been invited to attend Wireless Field Day #3 as a delegate last week. The event was held in greater San Jose area where we were hosted by bunch of WLAN vendors.

In short, it was great. Extremely condensed but very focused, entertaining and well organized

I realy have to take my hat of to Stephen Foskett /@sfoskett) and all of the GestaltIT crew for organization of the event. I can not even phantom the time and effort it took to organize this. Come on, just check the video material Benjamin Freedman and the rest of the crew did on the event. And it was all live streamed:

http://www.youtube.com/user/stephenfoskett?feature=results_main

Mr. Foskett. You rock sir!

PRESENTERS:

This was the third iteration of WFD. I’ve watched first two events via live streaming so I have seen previous presentations by vendors, the good and the bad. All in all I must say that the vendors learned and I can say that all of the presentations were satisfying.

The presenters were, in order of appearance: Wildpackets, Aerohive* (dinner, no streamed event), Metageek, Ruckus Wireless, Tanaza, Meraki, Aruba, Cisco and Juniper.

HIGHLIGHTS:

I will be writing about each presentation separately but I just wanted to highlight some things that I found particularly cool:

Bob Friday, CTO of Cisco opening the presentation for Cisco and talking about 802.11u and WiFi impact on carrier market. His presence on the event not only gives extra value to the event itself but also shows the dedication of a giant like Cisco to WLAN vertical. The WiFi industry is growing my friends, fast and furious.

I also enjoyed listening about the HW design from super smart people like Jay Pochop, Director of Engineering at Juniper Networks and the “dirty neardy” team, Victor Shtrom and Bill Kish from Ruckus Wireless.

So do your self a favour, watch the videos at this link: http://www.youtube.com/user/stephenfoskett?feature=results_main

Cheers,

Gregor

WFD#3. What I'd like to see.

Mon, 10 Sep 2012 14:35:46 +0200

Upgrading to Mountain Lion on my iMac broke a couple of things. One thing I like with the update though is the new, slick integration of the notification.

And it was displaying “WFD#3 - tomorrow” as I set behind the keyboard today. I am very excited to be able to be a part of this event.

Events focused on the WiFi industry are few and far in between. So I was very aware of the previous events and followed live streaming sessions and watched recordings of the first two events. So I was able to watch all presentations. There were good ones and there were ~~bad~~ less than good presentations.

WFD#3 is organised by Gestalt IT. Read more about the event here: http://techfieldday.com/event/wfd3/

Also, I am very excited that Keith Parsons is joining us as a delegate. Keith is a giant in the WiFi industry, a friend and a mentor. You can follow Keith on twitter on @KeithRParsons and read more about the wonders of the WiFi on his webpage: www.wlanpros.com

So what are my expectations of the vendors presenting?

TO ALL VENDORS / PRESENTERS

I know what marketing is for. I appreciate competition. I understand hows and whys of FUD and I do not hold that against anybody but please… the group attending will be technically sound, with the hands on the equipment expertise and experience. So we will cry bloody murder if you go that way. Just focus on the technical problems and the solutions your product line provides.

Please do the hands on as much as possible. Labs, wires sticking out of the products, etc. I’d also like you to talk about your support capabilities and support flow. How do you go about helping your customers, what are the procedures your customers have to go trough to get help, etc.

General topics of interest: data offload, 802.11r, 802.11u, 802.11w (client support finally showing up), IPv6.

TO INDIVIDUAL VENDORS (in alphabetical order):

AEROHIVE NETWORKS:

One of the three fastest growing WLAN companies (all three are presenting on the event) is interesting because of the extreme focus on particular market verticals: enterprise, education and health. While they can successfully cater others there are features not being persued aggressively. I’d like Aerohive to talk about IPv6, northbound APIs from HiveManager to the OSS for huge networks, integration to HMS for hospitality vertical and future 802.11u support. Also talk about 802.11r.

“Yes, 802.11u will be widely accepted and used outside carrier and WISP verticals. Mark my words”.

ARUBA NETWORKS:

The leader of bells and whistles supported, Aruba Wireless is a company to be respected. I’d like to hear about Aruba’s vision of the development in regarding to centralised, or distributed network controll. While not providing fully distributed controll, Aruba has options of providing controllerless solutions with their Insant line and controller solutions to the customer. The diplomatic answer is “we are not religius in architecture”. Fair but still, what is your vision with WiFi going further, introduction of 802.11ac, introduction of MIMO capable tablets and smartphones…

I’d also like Aruba to talk more about it’s oudoor portfolio. It has been more than a year since Aruba purchased Azalea and its mesh productline. What is the status of integration of the product?

“And yes. Market is growing, you are making good sales. But when will the licensing be simplified?. BTW I’d like to have a presentation about Aruba licensing to understand it fully”.

CISCO:

The big daddy of the enterprise WiFi. I’d like to hear more about virtual WLC and cloud WLC offerings. What is the roadmap regarding the feature discrepancy between WLC/virtualised WLC and cloud based WLC. Cisco indoor AP line is slick and robust at the same time. With the blue led it is just as strong brand as is the logo itself. So what is that about with the ~~ugly~~ not so good looking outdoor units? And what is with the interfaces placing on the units. And the weight? And…. Lets just talk about it.

Cisco is also the leader in 802.11u. What is the potential of the standard. How does Cisco see it implemented in various industries? Talk about data offload architecture as well.

“I know about 802.11ac module. Its sweet. Cool, you will probably be talking about it. Just do not go overboard with this, pretty please.”

JUNIPER NETWORKS:

Whoa! Where have you been? Its hard to have any really and concrete expectations about this vendor. Juniper acquired Trapeze in late 2010. So, what is new besides the logo? Is the product running JUNOS (now that wold be sweet). Juniper being a bit behind the game in the fast growing enterprise market, what are you bringing to the game?

“Just no extensive powerpoint, pretty please. And good luck, nothing better than more competition out there for further developing WiFi”.

MERAKI:

The best looker of the group. GUI design to die for. Simple, elegant and it works. I have had no extensive hands on the equipment my self, other than just clicking trough the GUI. So I’d like to see some labs, maybe some performance testing (delegates running iperf clients to an iperf server behind a Meraki AP, L2 roaming, L3 roaming…). I’d also like to understand what happens when the connection between the APs and cloud controller gets broken? How do the APs communicate to each other then? What features are not supported, etc?

“Sure, I’d like to see switches and firewalls as well. But with as much hands on as possible please.”

METAGEEK:

Love you guys. That is all.

“Seriously. I have nothing but respect for Metageek. Building affordable yet extremely useful troubleshooting equipment has become standard for them. And seriously. No WiFi vendor acquired Metageek to this date? The GUI experience alone would make it worthwhile.

RUCKUS:

The bark is getting louder and louder. Are we making bets yet? Acquisition (and by whom) or IPO?.

I always enjoyed presentations from Ruckus. They have guys that can just nail it. On the topics though, I’d like them to talk about 802.11u (use cases, vision), SSG ~~phantom~~ platform (show me the money!!!), data offload options with SSG, Channelfly feedback from deployments…

“Or if Victor does his excel presentation again. Maybe even teach us how to do it. That would be cool enough for me”.

TANAZA:

A relative unknown of the bunch, Tanaza is not pursuing the enterprise or carrier verticals but is providing tools for simplifying small deployments. I do not have specific expectations for this one, but am looking forward to learning something new.

“Dazzle us. That is all.”

WILDPACKETS:

Arguably one of the most robust and feature full frame/packet capture tool vendor out there. I do not have any experience with it so I am looking forward how it compares to the tools I know and use (CommView for WiFi and Wireshark). I’d also like to see if the 802.11u standard capture is supported.

“I know what I am going to read on the plane to prepare for this presentation - CWAP book”.

See you all out there!!!

Cheers,

Gregor

Wireless Field Day 3

Sat, 14 Jul 2012 22:55:00 +0200

Woohooo. Daddy is going to Disneyland! Well not exactly but I sure feel like a kid being invited to attend Wireless Field Day 3 as a delegate. Having followed this event for the past few years I am super excited to be able to experience this first hand.

So what is all the commotion about?

Brilliant folks at Gestalt IT lead by Stephen Foskett (you can follow him on Twitter @@SFoskett) came up with the brilliant idea of organizing events where vendors in different IT fields would pitch their solutions and product to a group of independent professionals and those would write, post, twit about their experience based on vendor presentations.

And we are not talking about classical sales presentations here, remember, the attendees are all very technical so the presentations are very tech focused, often bringing the “nerd meeter to score 10/10). So who are the delegates?

Ryan Adzima A Boring Look @radzima

Tom Carpenter CWNP @carpentertom

Sam Clements SC-WiFi @samuel_clements

Daniel Cybulskie Simply WiFi @SimplyWiFi

Rocky GregoryIntensified @bionicrocky

Jennifer HuberI ♥ WiFi @JenniferLucille

Blake KroneDigital Lifestyle NSA Show @blakekrone

Chris LyttleWiFi Kiwi’s Blog @wifikiwi

Sean RynearsonWiFiGeeks @Srynearson

Scott StapletonNot your fathers WiFi @scottpstapleton

George Stefanickmy802.11 @wirelesssguru

Gregor Vučajnk802dot11 @gregorvucajnk

All the delegates are well known and respected in the WiFi community so the presentations should be fun!

At this point there are three vendors confirmed for the event with a couple more to be announced shortly:

www.meraki.com

www.wildpackets.com

www.ruckuswireless.com

Oh. Almost forgot. The event will be held on September the 12th trough 14th in San Jose, and there will be live streams available for all the viewers together with an onslaught of blog posts, twitter feeds and gazzilons of photos coming from the delegates and vendors themselves.

Cheers,

Gregor

p.s.: I love WiFi.

Hotspot 2.0/Passpoint blog series part 1

Thu, 05 Jul 2012 12:41:00 +0200

Passpoint Capabilities and requirements for APs

I think the requirements and capabilities of Passpoint certification would be a good start to the this blog series. To be able to support features introduced with 802.11u standard and get certified by WiFi Alienace to comply with Passpoint certification specific requirements from equipment vendors and operators has to be met.

To be able to make the user happy and user internet experience buttery smooth, the technical requirements have to be met by mobile device, access point devices, hotspot operators and service providers.

To make sure that all devices have the same authentication method the following credential types and EAP methods have to be supported:

If using certificate as a credential type, EAP-TLS EAP method has to be used,
if using SIM or USIM credentials, EAP-SIM and EAP-AKA must be supported,
if using username and password (with serv side certs) credentials, EAP-TTLS with MSCHAPv2 has to be supported.

Personally I see WiFi Alliance extending the EAP methods to MD5, LEAP and PEAP (keep calm, I am just kidding about MD5 and LEAP), to make it easier for enterprises to adopt 802.11u. Contrary to the common believe 802.11u can bring tons of added value to enterprise networks.

So lets browse trough required capabilities for the Access Points:

WPA-2 enterprise only. No WEP and TKIP supported (thank you!!!),
All EAP methods listed above,
The “Internetworking” information element supporting “Venue Info” and “Homogeneous extended service set identifier or HESSID” fields as defined in 802.11u standard (do not worry, I will explain in details every element for my blog readers convenience),
The “Roaming Consortium” information element has to be supported (again referring to 802.11u standard),
Interworking bit in the “Extended Capabilities” information element has to be set to comply with 802.11u,
The “Basic Service Set Load” element has to be supported as it contains the information on the current device population and channel utilization in the Basic Service Set,
These ANQP elements (Access Network Query Protocol, defined in 802.11u… yes, we will talk extensively about this bugger) has to have: “Venue Name” information, “Network Authentication Type” information, “Roaming Consortium” list, “IP Address Type Availability” information, “Network Access Identifier Realm” list, “3GPP Cellular Network” information, “Domain Name” list.
Hotspot 2.0 (HS) specific ANQP elements have to be supported: “HS Query list”, “HS Capability list”, “Operator Friendly Name”, “WAN Metrics”, “Connection Capability” and “Network Access Identifier Realm query”.
Proxy ARP service has to be supported to comply with 802.11v-2011, Amendment 8.
L2 traffic inspection and filtering has to be implemented if the Access Network type element is set to “Free Public Network” or “Chargeable Public Network”.
AP has to have the capability to disable downstream forwarding of multicast and broadcast frames,
AP has to have the ability to disable P2P cross connect. This is done by advertising the P2P Manageability attribute with the Cross Connection Permitted field set as 0.

Enough for the part one of the series. I will continue with mobile devices, operators and service providers requirements on the next blog and then we will dive deep into the 802.11u standard itself.

Cheers,

Gregor

Hotspot 2.0 - Passpoint. The next huge step in 802.11 technology blog series INTRO.

Fri, 29 Jun 2012 20:41:22 +0200

WiFi Aliance started with the certification of 802.11u spec called WiFi certified Passpoint certification program. The program itself will be released in two parts, starting with Rrelease 1 focusing on network selection and security, followed with Release 2 covering online signup and policy provisioning.

This blog series will focus on the Release 1 certification and its requirements. I will cover these topics in-depth, probably a separate blog post or more for each one bullet points below:

* Required Capabilities for Access Points,

* Required Capabilities for Mobile Devices,

* Requirements for Operators,

* Requirements for Service providers,

* Deep dive into 802.11u MAC ANQP (access network query protocol) elements :

* Hotspot query list,

* Hotspot capability list,

* Operator friendly name,

* WAN metrics,

* Connection capability,

* Network access identifier home realm query,

* Operating class indicator.

* Hotspot procedures,

* Mobile devices procedures,

* Etc.

During the writing of the blog series I may steer away from the topic as I see fit or if any good questions arise from the readers.

Cheers, Gregor

Ruckus Wireless Channelfly feature

Fri, 10 Feb 2012 22:05:34 +0100

As posted in my previous blog, I will be writing some articles about vendor presentations on WFD2. I’ve picked up WFD2 video n. 152 on vimeo to start with.

GT Hill demonstrates Ruckus Wireless’ ChannelFly technology from Stephen Foskett on Vimeo.

Ruckus Wireless introduced a feature called Channelfly in the 9.3 main stream code (this feature has been tested for some time now in 9.2.x code but with selected customers). Channelfly is a method of statistically picking the most potent channel (ie, the channel with the most capacity). It uses statistical prediction (based on the info gathered in the break in period) to allocate channel with the most capacity (looking at throughput (L3) not data rate (L2)). Ruckus has posted a video explaining predictive capacity here (its still weird seing David Stiff running with the pack after all this years preaching Cisco) and the Channelfly whitepaper PDF can be found here.

Basic idea of Channelfly is that the capacity is spread trough the whole spectrum and not just on the standard channels (channel 1, 6 and 11 for 2.4 GHz). In other words, even in dense deployments, non standard channels like 4 or 10 may carry more capacity and if so it should be used. Furthermore, based on the data gathered in measuring the throughput on channels, the AP may be predicting the time of the day that one channel is better and on another time of the day that the other channel preferred.

I will not go in detail why are we talking about the standard and non standard channels but it has to do with a WiFi being a CSMA/CA technology and a contention based technology. In a few words, a station (AP or the end user device) has to listen to the channel before transmitting. If two stations contend at the same channel, when one is transmitting, the other backs off. If they are on channels 1 and 2, even though the channels have huge overlap (same contention domain), they can both transmit at the same time. This usually results in collisions and consequently retransmissions and dropped performance. Ruckus wireless has another technology going hand in hand with Channelfly though and that is Beamflex. So there is a great probability that the collision domains for data frames (utilizing antennas beam forming) will be separated even though both stations management and control plane domain overlaps (mind you that the beam forming is a Tx operation only). (this paragraph may be quite archaic. I will write an article explaining this in more details latter or maybe even do a video with a whiteboard as a tribute to my man GT Hill).

For me personally, using unstandard channels is nothing new. I’ve learned by my experience with Strix Systems mesh solution that using unstandard channels can be beneficial. At the time I was complaining to this vendor that the APs seem to prefer channels 4, 10, etc., and what I did (and not listening to their suggestions to let it be) was actually switching of any non standard channel to get “better” results. Strix Systems uses a proprietary mesh algorithm collecting data that also results in exceptionally good channel selection for capacity. The difference with Ruckus is that the channel selection in time becomes a proactive action, not a reactive one.

As a company focusing on the carrier market, Ruckus hit the nail on the head with this technology. The places that are used for WiFi coverage can be a jungle (outdoor downtown locations, HD deployments, etc), typically used for data offload for the carriers. There, every byte counts. As they like to say, “its the throughput that matters”.

With Ruckus announcement of the feature a number of comments from the industry came to life. The loudest comment was that with AP changing channels it disrupts the active connection with its associated clients. To combat the ill affect of the channel switching, Ruckus utilizes a 802.11h standard feature called CSA (channel switching announcement). CSA is implemented with every vendor device that supports the operation on DFS channels (UNII-2 and UNII-2e bands respectively) but is not limited by standard on any frequency or mandatory for implementation if not operating in DFS channels. Cisco and Aruba, just to name a few, have long supported CSA, especially for HD deployments. As by GT Hill statement, a lot of new end user devices support the CSA, even on 2.4 GHz (our bellowed fruit devices as an example). I would love Ruckus to provide a list of clients they have found supporting CSA.

Geek intermezzo #1: Channel switch announcement element is present in beacons and probe responses frames. It comprises of Element ID, Length, Channel switch mode, New Channel number and Channel switch count. CSA is also used in Channel switch announcement action frames that can be send in between beacon frames to announce channel changes to any station that did not receive beacon frame. It is also used to instruct stations not to send any traffic until after the channel switch. To ensure contention priority, the AP uses PIFS (point coordination function interframe space) when transmitting CSA.

In layman terms, what CSA does is to announce the end user devices that the AP will be switching channels. If successful, after the switch, no reauthentication is needed and all stations go about their business as usual. The caveat is that not all devices support CSA (again, the implementation is optional) so any device not understanding CSA will stay at previous channel and break the connection. Then it will again actively and passively scan the channels and hopefully finding its SSID. Needless to say this is disruptive to most applications used over WiFi.

Geek intermezzo #2: Feature request for all protocol analyzer vendors. It would be swell if the protocol anlyzer would actively move with the AP when CSA announcement would be read (even in the interface being in monitor mode). This should offcource be an option (on/off).

Overall effect of the Channelfly technology has been proven by real world implementations. There are a couple of Ruckus customers that did the pilot of the technology that I am aware of. One is Towerstream in New York (more than 1000 Ruckus APs in downtown Manhattan, New York) and the other is The Cloud (one of the biggest European hotspot provider), now owned by Sky in the UK. I believe that is actually The Could that pointed the capacity improvement when using non standard channels to Ruckus. The Cloud, as a service provider, is tunneling all the traffic to the core as a means of being able to do the billing based of the data usage and was able to spot the difference. The capacity improvements are said to be 25% and better. This is huge.

So the Channelfly technology is a winner, is it not? Well not so fast. Its working well for the carrier market but not so much ready for the enterprise in my opinion.

What I am most concerned with is the overall effect on the VoIP devices. It is not the channel switching that bothers me but rather using 11 (or 13 channels in EU) for VoIP device probing. The end devices in WiFi are very unfaithful, always looking for a better deal. When not actively transmitting/receiving, these devices are hopping on other channels probing for better networks (based on L1/L2 information and not throughput mind you). Good practice is to disable all channels but (1,6,11 if we are talking about 2.4 GHz deployment) so the devices only hop on those channels when probing. So what is the big deal? Its the battery life of the end devices. Any active usage of the WiFi chipset uses battery life and with current battery technology and devices form factor (small and pretty) its a regular problem achieving a meaningful battery life of devices (at least a full shift of 8 hours is expected). Now Channelfly loses its advantage and purpose if we do not use the whole range of channels.

In the video though GT Hill has menitoned that Channelfly improvements are being made and that they are addapting it to enterprise as well. A couple of features menitoned was application awareness (I guess this means if there is an active voice call, the switching will not be done at that time but wait for the voice call to end), 802.11h awareness (this is where I need to do some more research as as I am aware only beacon frames and probe responses frames contains CSA) among others.

That’s it for now,

Gregor

Wireless tech field day 2

Thu, 09 Feb 2012 20:26:00 +0100

Tech field day is an event organized by Gestalt IT, focusing on bringing the network vendors closer to its customers. What they do is organize events, bringing a dozen independent network professionals together directly to vendors. The event is 2 days long, and is divided in 6 slots all together. Each vendor has a slot (2 hours) to engage with the delegates (as the invited independent network professionals are addressed).

Wireless field tech day (abbreviated as WFD) is a subset of field tech days and as the name implies it focuses on the WLAN industry. A fortnight ago, a second consecutive WFD was organized, following the first one that was held a year ago.

For the first time a WiFi mobility symposium was held prior to the WFD, where industry giants were discussing topics as BYOD and mobile devices, 802.11u protocol, 802.11ac/ad protocol (gigabit WiFi). The whole event was streamed live and also recorded:

A couple of additional videos of panelists introduction (Devin Akin of Aerohive, GT Hill of Ruckus Wireless, Carlos Gomez and Peter Thornycroft of Aruba and Paul Congdon of HP)are available on Vimeo for all interested.

As for the WFD2, the vendors presenting were as follows: Aerohive Networks, Metageek, Ekahau, Meraki, Aruba Networks, Ruckus Wireless and HP (not necessarily in that order).

The delegates present were as follows (source: http://techfieldday.com/2012/wfd2/):

Marcus Burton of CWNP Twitter: @MarcusBurton
Sam Clements of SC-WiFi Twitter: @Samuel_Clements
Daniel Cybulskie of SimplyWiFi Twitter: @SimplyWifi
Jeremy Gaddis of Evil Routers Twitter: @JLGaddis
Rocky Gregory of Intensified Twitter: @BionicRocky
Tom Hollingsworth of The Networking Nerd Twitter: @NetworkingNerd
Jennifer Huber of Wireless CCIE, here I come! Twitter: @JenniferLucille
Blake Krone of Digital Lifestyle Twitter: @BlakeKrone
Chris Lyttle of WiFi Kiwi’s Blog Twitter: @WiFiKiwi
Matthew Norwood of In Search of Tech Twitter: @MatthewNorwood
George Stefanick of Wireless LAN Professionals Twitter: @WirelesssGuru
Andrew vonNagy of Revolution Wi-Fi. Twitter: @RevolutionWiFi

Wireless field day as an event is something special. Its not just the unique format but the fact that the whole event is live streamed to the internet and recorded. Based on the recordings available I will make a series of blog articles. I will not focus on recapping the presentations (you can watch the recordings yourselves) but I will comment on the topics of the presentations and end with my personal take on it.

Till then,

Gregor

WPA2-PPSK; very undersold security feature

Tue, 29 Nov 2011 21:22:24 +0100

WiFi is the most secure and the least secure network technology there is. Or is it that WiFi is the easiest to implement and the hardest to implement? Or perhaps that WiFi is the most user-friendly and the least user-friendly network technology?

In my opinion, all of the statements above are true. If implemented correctly, WiFi is the most secure network technology there is (well, let us compare it to common WWAN networks such as cellular, WiMAX, etc and 802.3 wired networks). A discussion on this topic could fill up a book, so we will just take it for granted ☺.

However, there is a price to pay for security. The most secure, 802.11 WPA2-Enterprise (802.1X port based security) offers the highest level of security. It requires managing and easy access to both infrastructure as well as end client devices to work, though. It requires appropriate network infrastructure. And it requires time and qualified personnel for implementation and maintenance.

On the other hand, there is an option of an open (in the full sense of the word) network with WiFi. An end user just clicks on the available open network and gets connected. Even “better”, most operating systems will kindly offer the option to remember the network, so when the end user connects again (turns the PC back on) he will be connected to the network automagicaly.

There is also an option of using WPA2-PSK (I will not cover WEP and WPA security protocol in this blog entry) with TKIP and AES encryption. While AES encryption is preferable and “more” secure, 128 bit TKIP (RC4 based) has not yet been broken. From the encryption standpoint WPA2-PSK can only be broken by dictionary attacks (short, simple passphrases). When using strong passphrase, WPA2-PSK is unbreakable to date. The problem with WPA2-PSK is that anybody that wants to connect to the network has to have the passphrase. This is okay for SOHO networks, but presents a big challenge to enterprise networks (has to be changed regularly, difficult to prevent passphrase leaking, etc.). Once potential attackers get hold of the passphrase, all they have to do is to capture the 4 way handshake and they can begin decrypting data in real time).

If we apply this to the verticals we can see that the WPA2-PSK is good for SOHO verticals, WPA2-enterprise for big government, enterprise networks and open and unprotected access is good for nothing (this authors humble opinion). Do not confuse captive portal in combination with open access a security feature because it is not. Note that with 802.1X another problem occurs. The ability to maintain connectivity when roaming gets compromised, especially maintaining real time applications such as VoIP. While with normal WPA2-PSK a client roams within 50ms the roaming with 802.1X is much longer.

So what about schools, hotels (the whole hospitality sector), smaller hot-spot operators, restaurants, bars, and even small to middle sized business? Implementing 802.1X to these verticals is both pricy and impractical. Providing WPA2-PSK is not enough. What about secure fast roaming?

Enter the WPA2-PPSK.

PPSK stands for Personal Pre-Shared Key or Private Pre-Shared Key. This technology is implemented by two vendors, Ruckus Wireless (as Dynamic-PSK™) and Aerohive Networks (Private Pre-Shared Key™).

So what it does is combine the security of 802.1X (not quite but close enough) and the simplicity and performance of WPA2-PSK. If WPA2-PSK had to be shared among everybody in the network and thus creating a single point of attack, the PPSK allows for a unique passphrase of every end client (device and/or user) in the network. Therefore, if the passphrase is compromised, attackers have to locate the end user/client (first difficulty) and capture correct 4-way handshake to be able to decrypt the data payload. But they do so only for this unique client.

PPSK, while based on the standard, is a proprietary (different) implementation of two companies, Aerohive Networks and Ruckus Wireless and have some similarities and differences. A little birdy told me that because the PPSK (in generic term) has been patented that there could be some legal battle between the two concerning PPSK. If it turns out to be true, this would be a shame.

www.ruckuswireless.com

Ruckus Wireless implements its Dynamic PSK in combination with their Zero IT technology. First time users connect to a wired port and authenticates via captive portal with their unique login credentials. The credentials are checked against ZoneDirector (controller) or AAA server. Once authenticated, the user downloads the temporary applet to their PC, Mac, iPhone, etc. Dynamic PSK creates a 63 byte encryption key (unique for each user) while Zero IT application configures the client device for the WLAN network. Once finished, the end client device is tied with this unique key and ZoneDirector (Dynamic PSK authenticates user machine and not the user. If user authentication is mandatory, there is a second step available, the Web Authentication). The beauty of ZeroIT method is that the end user is unaware of the passphrase and cannot compromise it by conventional methods.

If the end device is not supported by the ZeroIT (Linux, terminal devices, etc), the dynamic keys can be created in batches and stored to a spreadsheet for manual configuration. Dynamic keys have a configurable life time. When they expire, the whole process must be repeated.

In my experience, ZeroIT is more suitable for enterprise and education as initial configuration still has to be performed. With batch key creating, the key can be given to the end customer on receipt (bars, restaurants…) or on a coupon (hospitality sector).

www.aerohive.com

Aerohive implementation of PPSK is similar. While they do not have the automatic provisioning available they do have few features unavailable with Ruckus Wireless: manual setting of expiration of individual PSK, automatic mailing of generated keys to single user or bulk users, role based PSK (dynamic VLAN, Firewall, Tunneling and QoS policies).

Which is better? I do not know. Each has its advantages but both are unique in WLAN world and are a great option for authentication when 802.1X and WPA2-PSK just don’t cut. Here is the comparison chart of WPA2-PPSK for convenience:

source: http://www.theruckusroom.net/2009/06/the-greatest-form-of-flattery.html

It is the same EIRP, so why does antenna gain mater?

Tue, 29 Nov 2011 21:21:50 +0100

I had an interesting discussion yesterday with a potential client. He was curious why I had not used any omni antennas in the proposed design, but rather opted for sector antennas with higher gain.

“The power level (EIRP) is the same. You have to set it up on 200 mW (U-NII-1 power limit in my country). I understand noise considerations for using sector antennas in 2,4 GHz but this is a 5 GHz channel. You will get no noise on 5GHz! Omni antennas are much cheaper and will surely be enough here.”

Let me rephrase the dilemma. Is using 100 mW power on a radio with 3 dBi antenna the same as using 20 mW power on a radio with 10 dBi antenna? In both cases you have the same EIRP – 200 mW (I have disregarded the loss from the cables and connectors for the sake of better understanding. I am also using arbitrary numbers.)

Short answer? NO!

So let’s do a little math here, shall we?

Let us set up two nodes (AP) 200m apart in outdoor environment. There is a clear RF line of sight available. In the first scenario we use 3 dBi antennas with 100mW power on both radios and in the second scenario we use 10 dBi antennas with 20 mW power on both radios. In both cases, the EIRP is 200 mW.

If we calculate the free space loss (on the 5150 MHz) the expected Signal Strength value at the point of receiving antenna would be close to -70dBm. In both cases.

I said the antennas make a difference, haven’t I? Here is where the “secret” ingredient comes in. Antenna gain works both ways! Yes, it increases the magnitude of the output power, but- more importantly- it also increases the signal presented to the receiving radio. Therefore, the receiving radio will get a stronger signal if a higher gain antenna is used.

Lets look at our calculations again. We have calculated the Signal Strength Value at 100m will be around -70 dBm. Now lets see how the 3dBi and 10dBi antennas affect this value and what gets presented to the radio.

By using 3dBi antenna at the 200m we present the Rcv signal strength value of -66.8 dBm to the radio while 10 dBi antenna gives us -59.8 dBm Rcv signal strength value.

Let me go even further. If I wanted to get the same Rcv signal strength using the 3dBi antennas, I would have to place the two nodes closer than 100m. Or, if the -66.8 dBm strength was my goal using 10 dBi antennas, then I could separate the nodes by more than 500m.

So there is the difference! If you can, spend more money on higher gain antennas. It is always better, especially in outdoor deployments, as you get a greater budget link available.

There are also negative issues with using higher gain antennas, though. The radio will be presented with the stronger signal, but noise will also be stronger. Here is where the proper design is very important. But that is a topic for another blog post.

Best effort design

Tue, 29 Nov 2011 21:21:18 +0100

Luxul has a wide range of antenna products available, but I almost exclusively use flat panel sector antennas for backhaul and X-WAV Hemispeherical omni antennas for the client access. Obviously, I use different gain and different patterns dependent on the need and location.

Indoors, the distance (or rather the lack of it) does not really lead to any significant difference in performance when comparing horizontal, vertical, circular or slant polarization. Outdoors, when close to AP, the performance is similar. However, an increase in distance from the AP results in a significant decrease of performance when using vertical polarized antenna (in comparison to a circular one).

Below is a real world example- I have tested Pacific Wireless Omni antenna vs. Luxul Wireless circular antenna. In both cases EIRP was set to 400 mW (I did the test on 100 mW EIRP also, but I can’t find results ☺. The performance difference was similar, though).

There was a discussion on Twitter last week amongst WLAN professionals about different kinds of antennas. It all started with an exchange of opinions about Ruckus wireless patented beam-forming antenna system, later merged with a discussion about antenna polarization and the impact of MRC when penetrating walls and different obstacles.

Devin Akin argued that the polarization loses are negligible in indoor deployments and “if SNR is low at AP, then client is too far away from AP or there are RF obstacles. Bad design?”

I mostly agree with this. While not always easy or simple, a good design for an indoor network can be achieved even if using APs with simple rubber duck omni antennas for whatever design goal needed (I would still rather use Ruckus beam forming, though).

What about outdoor WLAN networks?

In my opinion, there are no good designs in outdoor networks, especially if we are talking about WMAN or WWAN network supporting multiple applications (like VoIP/RFID applications). There are only best effort designs (my attempt at WLAN g33k humor).

The biggest difference between planning/designing indoor or outdoor network is the locations available for mounting wireless nodes. The most common places used are public lighting poles. In this post, I will not go into detail about all the troubles connected with lighting poles, but 24/7 electricity, mounting consoles and wire to the core also limit the number of appropriate locations available.

So how do we make a bad design a better design? I do it by using multi radio nodes and directional antennas with circular and/or 45 degree cross polarization. As for power output, I always make compromises. The goal is to bring down the power as much as possible and try to equate it to the weakest client device. With laptops or smartphones that is around 30 mW. At the same time, I have to have coverage (Keith, coverage is not easy ☺). So I tune power up accordingly.

Hopefully, by now you understand what I mean by best effort design.

So how do I make the design better? I use “better” antennas. The antennas I use the most (80% of my deployments) are Luxul wireless antennas.

Luxul wireless antennas use circular polarization for better (optimal) RF performance. For those interested to learn more about physics behind circular polarization, Wikipedia has a really good article about it: http://en.wikipedia.org/wiki/Circular_polarization

Source: www.wikipedia.org

As you can see, even though the signal strength was better when using Pacific Wireless vertical omni antenna, the Iperf tests show much better performance using circular polarized antennas at greater distances.

Moreover, it is not just the distance. When doing wireless mesh, I must be careful about backhaul connection, as well. While most of the time I am able to achieve clear line of sight (or rather RF line of site) there are often obstacles like trees or buildings. Circular polarization makes my job much easier.

I also have a couple of hotels covered by “outside in” method. Mind you that this is not conventional, but if the performance meets the demand, you will cover the hotel rooms much easier (and be much more cost effective) that way. By using circular polarization I get enough signal penetration, so I can provide a good service for hotel guests (internet access, 95% DL). The number of AP used in this case is much smaller in comparison to installation of indoor APs.

I have had little experience with MIMO outdoor antennas, but hopefully by next week I will receive the new 2x2 MIMO antennas from Luxul for testing. What they did is that they combined two flat panel antennas, one with left hand circular polarization and the other with right hand circular polarization.

I must also add that the installation of Luxul wireless antennas is very easy and that they are quite forgoing if you sometimes make a shortcut and install them not strictly by the book.

There are many “short cuts” made in this installation. But it works good non the less.

What antennas are you using for the outdoor deployments? If you have any good results or maybe even comparison between different vendors, please do share.

Right tool for the job

Tue, 29 Nov 2011 21:19:54 +0100

Everyone has a tool case of some sort at home. Every once in a while I need to tighten up a screw, cut something in half or just smash something. And I do not use one tool to do all of the tasks. I would not choose a hammer to cut something in half, for example. While some might use a knife to cut a paper I would probably choose scissors for the job, right?

Choosing the Wi-Fi equipment is similar.

As an independent WLAN professional, I have the opportunity to choose the best Wi-Fi equipment for the job at hand. I have hands-on experience with limited professional Wi-Fi equipment, therefore, please free to comment. So here is my “tool box” (in no particular order):

Ruckus wireless:

Ruckus has made great steps in terms of making deployments easy and fuss-free. Their biggest advantage over other vendors is utilizing beam forming on the antenna side. They implement a number of vertically and horizontally polarized antennas in an AP casing (the number of antennas and thus antenna patterns varies in different models). Once the client is connected to AP, the AP chooses the best possible pattern by activating three antennas and directing the RF to the client. The rest of the antennas form the RF shield by blocking RF noise in the opposite direction of the client.

Together with the optimized RF Ruckus uses great multicast to unicast translation method so you can stream up to two full HD streams through wireless in somewhat polluted RF environment. Very easy and efficient for IPTV via wireless!

I mostly choose Ruckus for hotel environments, libraries, public hotspots and similar because they are really easy to set up and manage at affordable price.

Ruckus is the OLFA blade in my tool case. Affordable, precise tool. Easy to work with and easy to manage.

Xirrus:

Xirrus products integrate up to 16 APs (twelve a/n radios and four a/b/g/n) into one single enclosure. For a layman this sounds nothing special, but for more RF literate professionals this is amazing. Stacking more Wi-Fi chipsets close to each other is an accident waiting to happen. Xirrus manages to bypass the laws of physics by utilizing a combination of great material, great design and not least, a proprietary SW that controls all of the integrated APs. This way, Xirrus nodes can provide access to a great number of clients in a small space. Integrated directional antennas also provide an extended reach.

I have very little experience with Xirrus nodes, but this will be my tool of choice for seminars, large gatherings, fairs and similar.

Xirrus is the sledgehammer in my tool case. It brings a punch when I need it.

Cisco systems:

Now, there is a name that every network professional is familiar with. Cisco uses good HW components, familiar management and (important!) the best documentation in the business. They are also making progress in development. One of my favorite new features is their utilization of the RF analyzer. Along with the Wi-Fi chipset of choice they use a dedicated HW for constant monitoring of the RF range the AP is operating in. If the budget allows for it, Cisco is (almost) always a good choice.

I use Cisco in enterprise environments, especially if there is VoIP or RFID involved.

With Cisco, the person wielding the tool is as important as the tool itself. Once it gets tough, it is extremely easy to get support from experienced Cisco wireless professionals.

Strix Systems:

Definitely one of my favorite wireless vendors. Strix Systems is the only product for big outdoor mesh (proper, layer 2, low latency) deployments I currently know of. They do not use WDS, but a proprietary L2 protocol for mesh connections while using up to 6 radios to keep the throughput high and latency low trough multiple hops (10 hops is no problem for Strix Systems network). They also have a product that allows fast roaming (up to 120 km/h in city environments and more than 300 km/h with trains) while maintaining the performance. There are only a handful of other vendors that successfully use multiple radios for mesh, but Strix is by far the most robust, easy to manage and even easier to scale solution.

Strix Systems is the scaffold in my tool box (yes, I carry a big tool box). Robust, scalable and up in no time.

Mikrotik:

Now, here is an interesting product. Mikrotik produces its own RouterOS installed on a series ofRouterBoards. RouterOS is a full blown router with some additional features like a captive portal and accounting while RouterBoards are a series of HW products preloaded with RouterOS. You can build yourself a router, wireless router or an AP to suit your exact need. And the best thing is they are dirty cheap. If the project is not to big (demanding) but you still need a full range of functionality, Mikrotik is a good choice.

Mikrotik is also a good choice for hospitality sector, especially small to medium sized businesses with limited budget. Added feature captive portal and accounting integrated helps, too.

Mikrotik is a Letterman tool in my toolbox. I can do practically anything with it, but I would not count on it for heavy lifting.

So what is in your tool box? Please share, comment.