19 Wireless Technologies

Question 1

Wireless Personal Area Network (WPAN)

Answer 1

Bluetooth is by far the most popular type of PAN. PANs are low power, they cover short distances, and they’re small. You can stretch one of these to cover about 30 feet max, but most devices on a PAN have a short reach, making them popular for small and/or home offices.

Question 2

Wireless LAN (WLAN)

Answer 2

Wireless LANs (WLANs) were created to cover longer distances and offer higher bandwidth than PANs. They’re the most popular type of wireless networks in use today. The ideal for a WLAN is to have many users connect to the network simultaneously, but this can cause interference and collisions because the network’s users are all competing for the same bandwidth. Like PANs, WLANs use an unlicensed frequency band, which means you don’t have to pay for the frequency band in order to transmit. And again, this attribute has resulted in an explosion of new development in the WLAN arena.

Question 3

Wireless Metro Area Network (WMAN)

Answer 3

Wireless metro area networks (WMANs) cover a fairly large geographic area like a city or small suburb. They’re becoming increasingly common as more and more products are introduced into the WLAN sector, causing the price tag to drop. You can think of WMANs as low-budget, bridging networks. They’ll save you some real cash compared to shelling out for much more costly leased lines, but there’s a catch: to get
your discount long-distance wireless network to work, you’ve got to have a line of sight between each hub or building. Fiber connections are ideal to build an ultra-solid network backbone with, so go with them if they’re available in your area. If your ISP doesn’t offer the fiber option, or you just don’t have the cash for it, a WMAN is a perfectly fine, economical alternative for covering
something like a campus or another large area so long as you’ve got that vital line of sight factor in check!

Question 4

Wireless Wide Area Network (WWAN)

Answer 4

So far, it’s very rare to come across a wireless wide area network (WWAN) that can provide you with WLAN speeds, but there sure is a lot of chatter about them. A good example of a WWAN would be the latest cellular networks that can transmit data at a pretty good clip. But even though WWANs can certainly cover plenty of area, they’re still not speedy enough to replace our ubiquitous WLANs. Some people—especially those shilling stuff on TV—claim to adore their infallible, turbo-charged cellular networks. These terminally happy people are usually watching high-speed video while uploading images and gaming on their smart phones, but I don’t know anyone who lives outside the TV who actually gets that kind of speed. And as for that “coverage anywhere” schtick? Off the set, dead zones and frozen phones are just reality for now. It’s possible we’ll see more efficiency and growth for WWANs soon, but since WWANs are used to provide connectivity over a really large geographic area, it follows that implementing one will separate your cell service provider from a large quantity of cash. So it’s going to come to motivation—as more people demand this type of service and are willing to pay for it, cellular companies will gain the resources to expand and improve upon these exciting networks. Another set of positives in favor of WWAN growth and development: They meet a lot of business requirements, and technology is growing in a direction that the need for this type of long-distance wireless network is getting stronger. So it’s a fairly good bet connectivity between a WLAN and a WWAN will be critical to many things in our future. For instance, when we have more IPv6 networks, the “pass-off” between these two types of networks may be seamless.

Question 5

Wireless Access Points

Answer 5

A component that connects all wireless devices together. Wireless APs have at least one antenna. Usually there’s two for better reception (referred to as diversity) and a port to connect them to a wired network.

APs have the following characteristics:
■■ APs function as a central junction point for the wireless stations much like a switch or hub does within a wired network. Due to the half-duplex nature of wireless networking, the hub comparison is more accurate, even though hubs are rarely found in the wired world anymore.
■■ APs have at least one antenna—most likely two.
■■ APs function as a bridge to the wired network, giving the wireless station access to the wired network and/or the Internet.
■■ SoHo APs come in two flavors—the stand-alone AP and the wireless router. They can and usually do include functions like network address translation (NAT) and Dynamic Host Configuration Protocol (DHCP).

APs don’t create collision domains for each port like a switch does. An AP is a portal device that can either direct network traffic to the wired backbone or back out into the wireless realm. Data sent maintains MAC address information within the 802.11 frames. What’s more, these frames are capable of holding as many as four MAC addresses, but only when a wireless DS is in use. An AP also maintains an association table that you can view from the web-based software used to manage the AP. So what’s an association table? It’s basically a list of all workstations currently connected to or associated with the AP, which are listed by their MAC addresses. Another nice AP feature is that wireless routers can function as NAT routers, and they can carry out DHCP addressing for workstations as well. In the Cisco world, there are two types of APs: autonomous and lightweight. An autonomous AP is one that’s configured, managed, and maintained in isolation with regard to all the other APs that exist in the network. A lightweight AP gets its configuration from a central device called a wireless controller. In this scenario, the APs are functioning as antennas and all information is sent back to the wireless LAN controller (WLC). There are a bunch of advantages to this, like the capacity for centralized management and more seamless roaming. You’ll learn all about using WLC and lightweight APs throughout this book. You can think of an AP as a bridge between the wireless clients and the wired network. And, depending on the settings, you can even use an AP as a wireless bridge for bridging two, wired network segments together. In addition to the stand-alone AP, there’s another type of AP that includes a built-in router, which you can use to connect both wired and wireless clients to the Internet. These devices are usually employed as NAT routers.

Question 6

Wireless Network Interface Card (NIC)

Answer 6

Every host you want to connect to a wireless network needs a wireless network interface card (NIC) to do so . Basically, a wireless NIC does the same job as a traditional NIC, only instead of having a socket/port to plug a cable into, the wireless NIC has a radio antenna.

Question 7

Wireless Antennas

Answer 7

Wireless antennas work with both transmitters and receivers. There are two broad classes of antennas on the market today: omni-directional (or point-to-multipoint) and directional (or point-to-point). Yagi antennas usually provide greater range than omni antennas of equivalent gain. Why? Because yagis focus all their power in a single direction. Omnis must disperse the same amount of power in all directions at the same time, like a large donut. A downside to using a directional antenna is that you’ve got to be much more precise when aligning communication points. It’s also why most APs use omnis, because often, clients and other APs can be located in any direction at any given moment. To get a picture of this, think of the antenna on your car. Yes, it’s a non-networking example, but it’s still a good one because it clarifies the fact that your car’s particular orientation doesn’t affect the signal reception of whatever radio station you happen to be listening to. Well, most of the time, anyway. If you’re in the boonies, you’re out of range you’re out of luck—something that also applies to the networking version of Omnis.

Question 8

Wireless Principles

Answer 8

different types of networks you’ll run into and/or design and implement as your wireless networks grow:

■ IBSS
■ BSS
■ ESS
■ Workgroup bridges
■ Repeater APs
■ Bridging (point-to-point and point-to-multipoint)
■ Mesh

Question 9

Independent Basic Service Set (Ad Hoc)

Answer 9

This is the easiest way to install wireless 802.11 devices. In this mode, the wireless NICs (or other devices) can communicate directly without the need for an AP. A good example of this is two laptops with wireless NICs installed. If both cards were set up to operate in ad hoc mode, they could connect and transfer files as long as the other network settings, like protocols, were set up to enable this as well. We’ll also call this an independent basic service set (IBSS), which is born as soon as two wireless devices communicate. To create an ad hoc network, all you need is two or more wireless-capable devices. Once you’ve placed them within a range of 20–40 meters of each other, they’ll “see” each other and be able to connect—assuming they share some basic configuration parameters. One computer may be able to share the Internet connection with the rest of them in your group. An ad hoc network, also known as peer to peer, doesn’t scale well, and I wouldn’t recommend it due to collision and organization issues in today’s corporate networks. With the low cost of APs, you don’t need this kind of network anymore anyway, except for maybe in your home—probably not even there. Another con is that ad hoc networks are pretty insecure, so you really want to have the AdHoc setting turned off before connecting to your wired network.

Question 10

Basic Service Set (BSS)

Answer 10

A basic service set (BSS) is the area, or cell, defined by the wireless signal served by the AP. It can also be called a basic service area (BSA), and the two terms, BSS and BSA, can be interchangeable. Even so, BSS is the most common term that’s used to define the cell area. So the AP isn’t connected to a wired network in this example, but it provides for the management of wireless frames so the hosts can communicate. Unlike the ad hoc network, this network will scale better and more hosts can communicate in this network because the AP manages all network connections.

Question 11

Infrastructure Basic Service Set

Answer 11

In infrastructure mode, wireless NICs only communicate with an access point instead of directly with each other like they do when they’re in ad hoc mode. All communication between hosts, as well as any wired portion of the network, must go through the access point. Remember this important fact: in infrastructure mode, wireless clients appear to the rest of the network as though they were standard, wired hosts. Figure 19.6 shows a typical infrastructure mode wireless network. Pay special attention to the access point and the fact that it’s also connected to the wired network. This connection from the access point to the wired network is called the distribution system (DS) and is how the APs communicate to each other about hosts in the BSA. Basic standalone APs don’t communicate with each other via the wireless network, only through the DS. Before you configure a client to operate in wireless infrastructure mode, you need to understand SSIDs. The service set identifier (SSID) is the unique 32-character identifier that represents a particular wireless network and defines the BSS. And just so you know, lots of people use the terms SSID and BSS interchangeably, so don’t let that confuse you! All devices involved in a particular wireless network can be configured with the same SSID. Sometimes access points even have multiple SSIDs.

Question 12

Service Set ID

Answer 12

So technically, an SSID is a basic name that defines the Basic Service Area (BSA) transmitted from the AP. A good example of this is “Linksys” or “Netgear.” You’ve probably seen that name pop up on our host when looking for a wireless network. This is the name the AP transmits out to identify which WLAN the client station can associate with. The SSID can be up to 32 characters long. It normally consists of human-readable ASCII characters, but the standard doesn’t require this. The SSID is defined as a sequence of 1–32 octets, each of which may take any value. The SSID is configured on the AP and can be either broadcasted to the outside world or hidden. If the SSID is broadcasted, when wireless stations use their client software to scan for wireless networks. The network will appear in a list identified by its SSID. But if it’s hidden, it either won’t appear in the list at all or will show up as “unknown network” depending on the client’s operating system. Either way, a hidden SSID requires the client station be configured with a wireless profile, including the SSID, in order to connect. And this requirement is above and beyond any other normal authentication steps or security essentials. The AP associates a MAC address to this SSID. It can be the MAC address for the radio interface itself—called the basic service set identifier (BSSID)—or it can be derived from the MAC address of the radio interface if multiple SSIDs are used. The latter is sometimes called a virtual MAC address and you would call it a multiple basic service set identifier (MBSSID). There are two things you really want to make note of in this figure: first, there’s a “Contractor BSSID” and a “Sales BSSID”; second, each of these SSID names is associated with a separate virtual MAC address, which was assigned by the AP. These SSIDs are virtual and implementing things this way won’t improve your wireless network’s or AP’s performance. You’re not breaking up collision domains or broadcast domains by creating more SSIDs on your AP, you just have more hosts sharing the same half-duplex radio. The reason for creating multiple SSIDs on your AP is so that you can set different levels of security for each client that’s connecting to your AP(s).

Question 13

Extended Service Set

Answer 13

A good to thing to know is that if you set all your access points to the same SSID, mobile wireless clients can roam around freely within the same network. This is the most common wireless network design you’ll find in today’s corporate settings. Doing this creates something called an extended service set (ESS), which provides more coverage than a single access point and allows users to roam from one AP to another without having their host disconnected from the network. This design gives us the ability to move fairly seamlessly from one AP to another. For users to be able to roam throughout the wireless network—from AP to AP without losing their connection to the network—all APs must overlap by 20 percent of their signal or more to their neighbor’s cells. To make this happen, be sure the channels (frequency) on each AP are set differently.

Question 14

Repeaters

Answer 14

If you need to extend the coverage of an AP, you can either increase the gain of a directional antenna or add another AP into the area. If neither of those options solves your problem, try adding a repeater AP into the network and extending the range without having to pull an Ethernet cable for a new AP. A wireless repeater AP isn’t connected to the wired backbone. It uses its antenna to receive the signal from an AP that’s directly connected to the network and repeats the signal for clients located too far away from it. To make this work, you need appropriate overlap between APs. Another way to get this to happen is to place a repeater AP with two radios in use, with one receiving and the other one transmitting. This works somewhat like a dual half-duplex repeater. Seems cool, but there’s an ugly downside to this design—for every repeater installed you lose about half of your throughput! Since no one likes less bandwidth, a repeater network should only be used for low-bandwidth devices, like a barcode reader in a warehouse.

Question 15

Bridging

Answer 15

Bridges are used to connect two or more wired LANs, usually located within separate buildings, to create one big LAN. Bridges operate at the MAC address layer (Data Link layer), which means they have no routing capabilities. So you’ve got to put a router in place if you want to be able to do any IP subnetting within your network. Basically, you would use bridges to enlarge the broadcast domains on your network. Armed with a firm understanding of how bridging works, you can definitely improve your network’s capacity. To build wireless networks correctly, it’s important to have a working knowledge of root and nonroot bridges, sometimes referred to as parent and child bridges. Some bridges allow clients to connect directly to them, but others don’t, so make sure you understand exactly your business requirements before just randomly buying a wireless bridge. A point-to-point wireless network is a popular design that’s often used outdoors to connect two buildings or LANs together. A point-to-multipoint design works well in a campus environment where you have a main building with a bunch of ancillary buildings that you want to be able to connect to each other and back to the main one. Wireless bridges are commonly used to make these connections, and they just happen to be pricier than a traditional AP. The thing you want to remember about point-to-multipoint wireless networks is that each remote building won’t be able to communicate directly with each other. To do that, they must first connect to the central, main point (main building) and then to one of the other ones (multipoint buildings). Okay—now let’s get back to that root/nonroot issue I brought up a minute ago. This becomes really important to understand, especially when you’re designing outdoor networks! So look back to Figure 19.10 and find the terms root and nonroot. This figure shows a traditional point-to-point and point-to-multipoint network when one bridge, the root, accepts communications only from nonroot devices. Root devices are connected to the wired network, which allows nonroot devices, like clients, to access the wired resources through the root device. Here are some important guidelines to help you design your wireless networks:
■■ Nonroot devices can only communicate to root devices. Nonroot devices include nonroot bridges, workgroup bridges, repeater access points, and wireless clients.
■■ Root devices cannot communicate to other root devices. Examples of devices that can be roots are APs and bridges.
■■ Nonroot devices cannot communicate to other nonroot devices. But wait, there’s one exception to that last bullet point. If you have a nonroot bridge set up as a repeater AP with two radios, the device must be configured as a nonroot device!
It will then repeat and extend the distance of your outdoor, bridged network

Question 16

Mesh Networks

Answer 16

As more vendors migrate to a mesh hierarchical design, and as larger networks are built using lightweight access points that are managed by a controller, you can see that we need a standardized protocol that governs how lightweight access points communicate with WLAN systems. This is exactly the role filled by one of the Internet Engineering Task Force’s (IETF’s) latest draft specifications, Lightweight Access Point Protocol (LWAPP). Mesh networking infrastructure is decentralized and comparably inexpensive for all the nice amenities it provides because each host only needs to transmit as far as the next host. Hosts act as repeaters to transmit data from nearby hosts to peers that are too far away for a manageable cabled connection. The result is a network that can span a large area, especially over rough or difficult terrain. Remember that mesh is a network topology in which devices are connected with many redundant connections between host nodes, and we can use this topology to our advantage in large wireless installations. Figure 19.12 shows a large meshed environment using Cisco outdoor managed APs to “umbrella” an outdoor area with wireless connectivity. Oh, and did I mention that mesh networks also happen to be extremely reliable? Because each host can potentially be connected to several other hosts, if one of them drops out of the network because of hardware failure or something, its neighbors simply find another route. So you get extra capacity and fault tolerance automatically just by adding more hosts! Wireless mesh connections between AP hosts are formed with a radio, providing many possible paths from a single host to other hosts. Paths through the mesh network can change in response to traffic loads, radio conditions, or traffic prioritization. At this time, mesh networks just aren’t a good solution for home use or small companies on a budget. As the saying goes, “If you have to ask…” As with most things in life, the more bells and whistles, the more it costs, and mesh networks are certainly no exception.

Question 17

Nonoverlapping Wi-Fi channels

Answer 17

In both the 2.4GHz and the 5GHz frequency band, channels are defined by the standards. 802.11, 802.11b, and 802.11g use the 2.4GHz band also known as the industrial, scientific, and medical (ISM) band. 802.11a uses the 5GHz band. When two access points are operating in same area on the same channel or even an adjacent channel, they will interfere with each other. Interference lowers the throughput. Therefore, channel management to avoid interference is critical to ensure reliable operation. In this section, we will examine issues that impact channel management. 2.4GHz Band Within the 2.4GHz (ISM) band are 11 channels approved for use in the United States, 13 in Europe, and 14 in Japan. Each channel is defined by its center frequency, but remember, that signal is spread across 22MHz. There’s 11MHz on one side of the center frequency and 11MHz on the other side, so each channel encroaches on the channel next to it—even others further from it to a lesser extent. This means that consequently, within the United States, only channels 1, 6, and 11 are considered nonoverlapping. So when you have two APs in the same area that are operating on overlapping channels, the effect depends on whether they’re on the same channel or on adjacent channels. Let’s examine each scenario. When APs are on the same channel, they will hear each other and defer to one another when transmitting. This is due to information sent in the header of each wireless packet that instructs all stations in the area (including any APs) to refrain from transmitting until the current transmission is received. The APs perform this duty based partially on the duration field. Anyway, the end result is that both networks will be slower because they’ll be dividing their transmission into windows of opportunity to transmit between them. When the APs are only one or two channels apart, things get a little tricky, because in this case, they may not be able to hear each clearly enough to read the duration field. The ugly result of this is that they’ll transmit at the same time, causing collisions that cause retransmissions and can seriously slow down your throughput—ugh! Therefore, although the two behaviors are different within these two scenarios, the end result is the same: greatly lowered throughput. 5GHz Band 802.11a uses the 5GHz frequency that’s divided into three unlicensed bands called the Unlicensed National Information Infrastructure (UNII) bands. Two are adjacent to each other, but there is a frequency gap between the second and third. These bands are known as UNII-1, UNII-2, and UNII-3—the lower, middle, and upper UNII bands. Each of these bands hosts discrete channels, as in the ISM. The 802.11a amendment specifies the location of the center point of each frequency, as well as the distance that must exist between the center point frequencies, but it failed to specify the exact width of each frequency. The good news is that the channels only overlap with the next adjacent channel so it’s easier to find nonoverlapping channels in 802.11a. In the lower UNII band the center points are 10MHz apart, and in the other two the center frequencies are 20MHz apart.

Question 18

Channel Overlap Techniques

Answer 18

Sometimes it becomes necessary to deploy multiple APs, and here are two scenarios that certainly scream for doing this:
■ You have a large number of users in a relatively small area. Considering the nature of the contention method used by WLANs the more users associated with a particular access point, the slower the performance. By placing multiple access points in the same area on different channels, the station-to-AP ratio improves, and performance improves accordingly.
■ The area to be covered exceeds the range of a single AP and you would like to enable seamless roaming between the APs when users move around in the area. Considering the channel overlap characteristics of both the 2.4GHz and the 5GHz bands, you must implement proper channel reuse when necessary to deploy multiple APs in the same area. It’s also important if you want to deploy multiple APs within a large area to provide maximum coverage.

Multiple APs, Same Area When deploying multiple APs in the same area, you need to choose channels that don’t overlap. With the 2.4GHz band, the channels must have at least four channels’ space between them, and remember—only 1, 6, and 11 are nonoverlapping. When deploying APs in the 5GHz band (802.11a), the space between the channels can be two channels, given that there’s no overlap. Also vital to remember is that when choosing channels in a wide area, they can be reused if there’s enough space between each channel’s usage area or cell.

Question 19

2.4GHz/5GHz (802.11n)

Answer 19

802.11n builds on previous 802.11 standards by adding Multiple-Input Multiple- Output (MIMO), which uses multiple transmitters and receiver antennas to increase data throughput and range. 802.11n can allow up to eight antennas, but most of today’s APs use only four to six. This setup permits considerably higher data rates than 802.11a/b/g does. The following three vital items are combined in 802.11n to enhance performance:
■■ At the Physical layer, the way a signal is sent is changed, enabling reflections and interferences
to become an advantage instead of a source of degradation.
■■ Two 20Mhz-wide channels are combined to increase throughput.
■■ At the MAC layer, a different way of managing packet transmission is used.

It’s important to know is that 802.11n isn’t truly compatible with 802.11b, 802.11g, or even 802.11a, but it is designed to be backward compatible with them. How 802.11n achieves backward compatibility is by changing the way frames are sent so they can be understood by 802.11a/b/g. Here’s a list of some of the primary components of 802.11n that together sum up why people claim 802.11n is more reliable and predictable: 40Mhz channels 802.11g and 802.11a use 20Mhz channels and employs tones on the sides of each channel that are not used in order to protect the main carrier. This means that 11Mbps go unused and are basically wasted. 802.11n aggregates two carriers to double the speed from 54Mbps to more than 108. Add in those wasted 11Mbps rescued from the side tones and you get a grand total of 119Mbps! MAC efficiency 802.11 protocols require acknowledgment of each and every frame. 802.11n can pass many packets before an acknowledgment is required, which saves you a huge amount of overhead. This is called block acknowledgment. Multiple-Input Multiple-Output (MIMO) Several frames are sent by several antennae over several paths and are then recombined by another set of antennae to optimize throughput and multipath resistance. This is called spatial multiplexing. Okay—now that you’ve nailed down our a/b/g/n networks, it’s time to move on and get into some detail about RF.

Question 20

Radio Frequency (RF)

Answer 20

It all starts when an electrical signal like one that represents data from a LAN needs to be transmitted via radio waves. First, the signal is sent to an antenna where it is then radiated in a pattern that’s determined by the particular type of antenna. The pattern radiated from an antenna is an electrical signal called an alternating current, and the direction of the signal’s current changes cyclically. This cycle creates a pattern known as a waveform. The waveform has peaks and valleys that repeat in a pattern, and the distance between one peak or valley and the next is known as the wavelength. The wavelength determines certain properties of the signal—for example, the impact of obstacles in the environment. Some AM radio stations use wavelengths that stretch well over a thousand feet, or 400–500 meters, but our wireless networks use a wavelength that’s smaller than your outstretched hand. Believe it or not, satellites use tiny waves that only measure about one millimeter! Because cable, fiber, and other physical media impose various limitations upon data transmission, the ultimate goal is for us to use radio waves to send information instead. A radio wave can be defined as an electromagnetic field that radiates from a sender, which hopefully gets to the intended receiver of the energy that’s been sent. A good example of this concept is the electromagnetic energy we call light that our eyes can interpret and send to our brains, which then transform it into impressions of colors. Figure 19.17 shows the RF spectrum that we use today to send our wireless data. It is good that our eyes can’t see these kinds of waves, because if we could, we would be so bombarded with them that we wouldn’t be able to see much else! When traveling through the air, certain wave groups are more efficient than others depending on the type of information being sent because they have different properties. So, it follows that different terms are used to define different signals generated in the transmitter when they’re sent to the antenna to create the movements of the electrons generated within an electric field. This process creates an electromagnetic wave, and we use the terms frequency and wavelength to define them. The frequency determines how often a signal is “seen,” with one frequency cycle called 1 hertz (Hz). The size or distance of the cycle pattern is called the wavelength. The shorter the wavelength, the more often the signal repeats itself, and the more often it repeats, the higher its frequency is considered to be when compared with a wavelength that repeats itself less often in the same amount of time.

■■ 1Hz = The RF signal cycle occurs once a second
■■ 1MHz = The signal cycle occurs one million times a second
■■ 1GHz = The signal cycle occurs one billion times a second

Also good to know is that lower frequencies can travel farther, but provide less bandwidth. Higher frequencies have a wavelength with fast repeat times, which means that although they can’t travel long distances, they can carry higher bandwidth. Another important term to get cozy with before we move on and talk about how RF is affected by many factors, is amplitude. Amplitude refers to the strength of the signal and is commonly represented by the Greek symbol α. It has a profound effect on signal strength because it represents the level of energy injected into one cycle. The more energy injected in a cycle, the higher the amplitude. The term gain is used to describe an increase in the RF signal. In Figure 19.19, the top signal has the least amplitude or signal strength and the bottom example has the greatest amplitude or signal strength. By the way, that’s the only difference among each of these signals—all three have the same frequency because the distance between the peaks and valleys in them are the same. Okay, let’s say you’re playing an electric guitar that you’ve plugged into your amp. If you turn up the amp’s volume knob, the increased or amplified signal would look like the one on the bottom. Of note, attenuation also happens naturally the further the signal moves from the transmitter—another reason for the use of amplifiers. We can even use certain antennas to give us more gain, which in combination with the transmitter power can determine our signal’s ability to go the distance. A downside to amps is that they can distort the signal and/or overload and damage the receiver if too much power is pushed into it. So finding the right balance takes experience, and yes, sometimes parting with some good ol’ cash, to score better equipment.

Question 21

Free Space Path Loss

Answer 21

Attenuation is defined as the effect of a signal over the time, or length of a cable or other medium. The signal is weakened the further it travels from the transmitting device. Free space path loss is similar because it’s a limiting factor with regard to the distance that RF signals can successfully travel and be received properly. We call it “Free Space Path Loss” because it isn’t caused by environmental obstacles. Instead, it’s simply a result of the normal attenuation that happens as the signal gradually weakens over the distance it travels. There are two major factors on both ends of a transmission that determine the effects of free space path loss: the strength of the signal delivered to the antenna and the type of antenna it’s delivered to. The AP can amplify the signal to a certain extent because with most APs and many client devices, signal strength can be controlled. This type of signal gain is called active gain. A directional antenna focuses the same amount of energy in one direction that an omnidirectional antenna sends horizontally in all directions. This results in a signal of the same strength being able to travel farther. In this scenario, the antenna provides what we call passive gain, which means that it comes from the particular shape of the antenna pattern itself. On the receiving end, the same factors come into play. First, the receiver has a certain listening strength, called received sensitivity, and second, the shape of the receiving antenna has the same kind of effect on a signal that the shape of a sending antenna does. This means that two highly directional antennas that happen to be aimed perfectly at each other can carry a signal of the same strength much farther than two omnidirectional antennas.

Question 22

Absorption

Answer 22

Since our world isn’t flat and has lots of objects on it, as a signal radiates away from the antenna, it will invariably encounter obstacles like walls, ceilings, trees, people, buildings, cars—you get the idea. Even though the signal can pass through most of these obstacles, a price is paid when it does so in the form of decreased amplitude. Earlier, you learned that amplitude is the height and depth of each wave in the pattern that represents the signal strength. So when the signal manages to pass through the object—which, surprisingly, in most cases it will—however, it always emerges on the other side weaker. This is what’s referred to as absorption, because the people and things the signal passes through actually absorb some of its energy as heat. Important to note is that the amount of signal degradation depends on the nature of what it has passed through. Clearly, drywall is not going to cause the same amount of signal degradation that concrete will, and yes, there are some materials that will block the signal completely. This is why we perform site surveys—to define where the problem areas are and figure out how to get around them by strategically placing AP(s) where they will be able to function with the least amount of obstruction.

Question 23

Reflection

Answer 23

Now you know that absorption occurs when a signal travels through an obstacle and loses some of its energy, right? Well, reflection occurs when a signal strikes an object at an angle instead of directly. When this happens, some of the energy will be absorbed, but some will reflect off at an angle equal to the angle at which it struck the object. The exact ratio of the amount absorbed to the amount reflected depends on how porous the material is that the signal ran into and the angle at which it hit the material. The more porous the material, the more of the signal’s energy will be absorbed by it. Another thing that influences how much of the signal is reflected and how much is absorbed is the signal’s frequency. Signals in the 2.4GHz range can behave differently than those in the 5GHz range. So just remember that these three factors influence absorption/ reflection ratio:
■ Angle of the signal
■ Frequency of the signal
■ Nature of the surface
One of the main problems’ reflection causes is a phenomenon called multipath.

Question 24

Multipath

Answer 24

Multipath occurs when reflection is occurring. Remember, there’s lots of stuff around that reflected signals can bounce off before they finally arrive at the receiver, and since these bounced signals took a longer path to get to the receiver than the ones that took a direct path, it makes sense that they typically arrive later. This is definitely not a good thing—because they arrive later, they’ll be out of phase with the main signal, as shown in Figure 19.21. Remember how the signal wavelength has a recurring pattern? Well, if the pattern of the main signal doesn’t line up with that of the reflected signal, they’re out of phase—and how much they’re out of phase varies in degrees. This is ugly because out-of-phase signals are degraded signals, and if those signals are 120–170 degrees out, multipath can weaken them. This concept is known as downfade. It gets worse too—if they arrive 180 degrees out, they cancel each other entirely, a nasty effect suitably called nulling the signal. If it’s your lucky day and they go full circle, the rogue signals arrive 360 degrees out and blam—they’re right back in phase and arrive at the same time. This boosts the amplitude or signal and is known as upfade. Clearly, being able to deal with multipath events well is an important skill, but for now just one last thought: although I just said how bad multipath can be (and it can be!), IEEE 802.11n can take advantage of this to get higher speeds.

Question 25

Refraction

Answer 25

Refraction refers to a change in the direction of a signal as a result of it passing through different mediums. Since this mostly happens when a signal passes from dry air to wet, or vice versa, it’s more of a concern with long-range outdoor wireless links. As the figure shows, refraction occurs when waves pass through a heterogeneous medium, and some of the waves are reflected and others are bent. Drier air tends to bend the signal away from the earth, whereas humid air tends to bend the signal toward earth.

Question 26

Diffraction

Answer 26

Diffraction happens when a signal bends around an object. Think about what happens when you throw a rock into a quiet pool of water. As soon as your rock plunks in, it sends perfect rings of waves radiating outward from where it sank in all directions. If these waves slam into an object in the pool, you can see the wave bend around the object and change direction. RF signals do this too, and when they do, we experience this in the form of dead spots in places behind, say, a building. Diffraction is commonly confused with refraction, but the two are vastly dissimilar because diffraction bends the RF, whereas in refraction the RF bounces.

Question 27

Scattering

Answer 27

Scattering is a lot like refraction, but the difference is that when signals strike an object, or objects, their scattered reflections bound off in many unpredictable directions instead of just bouncing back off at an angle pretty much equal to the angle at which it hit the object. This phenomenon is caused by the attributes of the object or objects. Here are some objects and conditions that can cause scattering: ■ Dust, humidity, and micro-droplets of water in the atmosphere and rain ■ Density fluctuations within a given object and its surface irregularities ■ Uneven surfaces like moving water and tree leaves The worst thing about scattering is—you guessed it—its unpredictable nature, which makes mitigation efforts more than just a little difficult! All this brings me back to that all-important site survey. I’m repeating this because nothing is more important than performing a thorough one before and after you design a WLAN! There’s just nothing else that can help you to accurately identify, predict, and mitigate RF behaviors; determine proper AP placement; select the right type of antenna(s); or even make adjustments to the physical environment itself if possible (like trimming some trees).

Question 28

Line of Sight

Answer 28

Okay—so while it’s true that in an indoor scenario where there are usually not as many things signals can bounce off of, they still exist there too. So again, do that site survey! Whether your WLAN will only cover a small outside or inside area, signals can usually travel through and even bounce off a few objects and still reach the receiver in fine shape. But when you’re dealing with a larger coverage area using omnidirectional and semidirectional antennas, like in an outdoor area—especially when creating a point-to-point wireless bridge between, say, two buildings—something known as line of sight becomes critical for success. And if you’re faced with creating a long-distance wireless connection using highly directional and/or dish antennas, line of sight becomes even more critical. I want you to understand that line of sight is not as simple as having the center of the two antennas properly lined up. That’s visual line of sight, and RF line of sight and visual line of sight are two different things. Regarding WLANs, RF line of sight is what you need, and to help you understand that, first let’s review how spread spectrum technology works. In narrowband RF, the signal is set to a single frequency and stays there. In spread spectrum, although people talk about channels and the like, the signal is actually being spread across a range of frequencies. What I mean by this is that when we say that a device is using “Channel 6,” that channel is actually 22MHz wide and the signal is spread across the entire 22MHz range. Furthermore, if a signal is spread out like this, it means that all of it, or at least a certain percentage of it, must be received in order for it to be interpreted well. The following obstructions might obscure a line-of-sight link: ■ Topographic features, such as mountains ■ Curvature of the earth ■ Buildings and other man-made objects ■ Trees Even if the visual line of sight is perfect, the RF line of sight can still be lacking if the distance is so far that the curvature of the earth gets in the way.

Question 29

Fresnel Zone

Answer 29

The Fresnel zone is an elliptical-shaped area between the transmitter and receiver that must be at least 60 percent clear for the signal to be received properly. This is very bad. You’ve personally experienced RF line-of-sight blocking if you’ve ever had a tree branch grow a lot over the summer and interfere with your satellite dish. Interestingly, these zones are in alternating bands, with the inner band being in phase, the next being out of phase, and then the next one in phase again. So if one of us could figure out how to block only the out-of-phase band while leaving the in-phase bands alone, it just might be a technological breakthrough.

Question 30

RSSI and SNR

Answer 30

We’ve logged a lot of ink discussing signals and signal strength, but so far, I haven’t told you how these are measured. There are two terms used to discuss signal strength: received signal strength indicator (RSSI) and signal-to-noise ratio (SNR). RSSI is designed to describe the strength of the signal received, and SNR refers to the ratio of the signal to the surrounding RF noise that is always present in the environment. First, let’s talk about RSSI, which is a measure of the amount of signal strength that actually arrives at the receiving device. It’s a grade value ranging from 0 to 255. For each grade value, an equivalent dBm (decibels relative to a milliwatt) value is displayed. For example, 0 in the scale may equal –95dBm and 100 might be –15dBm. So 0 would equal a much greater loss of signal than 100 would. I’ll get into dBm in more detail soon, but for now understand that dBm is not an absolute measure; it’s a relative one. What I mean by relative is that it’s a value referenced against another value—in this case, milliwatts. Decibels are used to measure an increase or decrease in power as opposed to an absolute value, meaning that decibel values come through as positive (gain) and negative (loss). RSSI values are negative and represent the level of signal loss that can be experienced en route with the card still able to receive the signal correctly. Most manufacturers will have a table listing the RSSI that’s required at each frequency. RSSI values can’t be compared from one card vendor to another because each company typically uses a different scale. For example, Company A might be using a scale of 0 to 100, while Company B is using a scale from 0 to 60. Since the scales are different, the resulting RSSI values can’t be compared, right? SNR is a critical comparison of the amount of signal as compared to the surrounding noise. If the level of noise is too close to the level of signal, the signal can’t be picked out from the noise and understood. Think of this as someone whispering in a really loud room. A higher value is good for SNR.

Question 31

Authentication and Encryption

Answer 31

Two types of authentication were specified by the IEEE 802.11 committee: open and shared-key authentication. Open authentication involves little more than supplying the right SSID, but it’s the most common method in use today. With shared-key authentication, the access point sends the client device a challenge-text packet that the client must then encrypt with the correct Wired Equivalent Privacy (WEP) key and return to the access point. Without the correct key, authentication will fail and the client won’t be allowed to associate with the access point. Shared-key authentication is still not considered secure because all a bad guy has to do to get around it is to detect both the clear-text challenge, the same challenge encrypted with a WEP key, and then decipher the WEP key. So it’s no surprise that shared key isn’t used in today’s WLANs. All Wi-Fi certified wireless LAN products are shipped in “open access” mode, with their security features turned off. Although open access or no security sounds scary, it’s totally acceptable for places like public hot spots. But it’s definitely not an option for an enterprise organization, and it’s probably not a good idea for your private home network either! Check out Figure 19.31 to see the open access wireless process. Here, you can see that an authentication request has been sent and “validated” by the AP. But when open authentication is used or set to “none” in the wireless controller, the request is pretty much guaranteed not to be denied. For now, understand that this authentication is done at the MAC layer (Layer 2), so don’t confuse this with the higherlayer authentication we’ll cover later, which occurs after the client is associated to the access point. With what I’ve told you so far, I’m sure you agree that security seriously needs to be enabled on wireless devices during their installation in enterprise environments. But believe it or not, a surprising number of companies don’t enable any WLAN security features, dangerously exposing their valuable data networks and resources to tremendous risk! The reason that these products are shipped in open access mode is so that anyone, even someone without any IT knowledge, can buy an access point, plug it into their cable or DSL modem, and voilà—they’re up and running. It’s marketing, plain and simple, and simplicity sells. But that doesn’t mean you should leave the default settings there—unless you want to allow that network to be open to the public!

Question 32

WEP

Answer 32

With open authentication, even if a client can complete authentication and associate with an access point, the use of WEP prevents the client from sending and receiving data from an access point unless the client has the correct WEP key. A WEP key is composed of either 40 or 128 bits, and in its basic form, it’s usually statically defined by the network administrator on the access point, and on all clients that communicate with that access point. When static WEP keys are used, a network administrator must perform the tedious task of entering the same keys on every device in the WLAN. Clearly, we now have fi xes for this because tackling this manually would be administratively impossible in today’s huge corporate wireless networks!

Question 33

WPA and WPA2: An Overview

Answer 33

Wi-Fi Protected Access (WPA) and WPA2 were created in response to the shortcomings of WEP. WPA was a stopgap measure taken by the Wi-Fi Alliance to provide better security until the IEEE fi nalized the 802.11i standard. When 802.11i was ratifi ed, WPA2 incorporated its improvements, so there are some signifi cant differences between WPA and WPA2. These are each essentially another form of basic security that are really just an add-on to the specifi cations. Even though you can totally lock the vault, WPA/WPA2 pre-shared key (PSK) is a better form of wireless security than any other basic wireless security method I’ve talked about so far. Still, keep in mind that I did say basic! WPA is a standard developed by the Wi-Fi Alliance and provides a standard for authentication and encryption of WLANs that’s intended to solve known security problems. The standard takes into account the well-publicized AirSnort and man-in-the-middle WLAN attacks. So, of course we use WPA2 to help us with today’s security issues because we can use AES encryption, which provides for better key caching than WPA does. WPA is only a software update whereas WPA2 required a hardware update, but you’d be hard-pressed to fi nd a laptop or any pc today that doesn’t have WPA2 support built-in. Pre-Shared Key (PSK) verifi es users via a password or identifying code, often called a passphrase, on both the client machine and the access point. A client gains access to the network only if its password matches the access point’s password. The PSK also provides keying material that TKIP or AES uses to generate an encryption key for each packet of transmitted data. Although more secure than static WEP, the PSK method still has a lot in common with static WEP in that the PSK is stored on the client station and can be compromised if the client station is lost or stolen—even though fi nding this key isn’t all that easy to do. This is exactly why I defi nitely recommend using a seriously strong PSK passphrase that includes a mixture of letters, numbers, cases, and nonalphanumeric characters. With WPA, it’s still possible to specify the use of dynamic encryption keys that change each time a client establishes a connection. WPA is a step toward the IEEE 802.11i standard and uses many of the same components, with the exception of encryption. 802.11i (WPA2) uses AES-CCMP encryption. The IEEE 802.11i standard replaced WEP with a specifi c mode of AES known as Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). This allows AES-CCMP to provide both data confi dentiality (encryption) and data integrity— now we’re getting somewhere!

Question 34

Wi-Fi Protected Access (WPA)

Answer 34

WPA was designed to offer two methods of authentication in implementation. The first, called WPA Personal or WPA (PSK), was designed to work using a passphrase for authentication, but it improves the level of protection for authentication and data encryption too. WPA PSK uses the exact same encryption as WPA Enterprise—the PSK just replaces the check to a RADIUS server for the authentication portion. PSK offers us these benefits: ■ The Initialization vector (IV) is 48 bits and not 24 bits. This increases the number of vector values from over 16 million possibilities to 280 trillion values. Also, they must be used in order and not randomly, which oddly enough increases the security because it eliminates the reuse of IVs—a condition referred to as collisions, not to be confused with collision domains. ■ The key for each frame is changed for each packet, hence the term temporal, or temporary. A serial number is applied to each frame and the serial number, along with the temporal key, and the IV is used to create a key unique to each frame. Furthermore, each frame undergoes per-packet key hashing as well. ■ Centralized key management by the AP including broadcast and unicast keys. The broadcast keys are rotated to ensure that they don’t remain the same, even though at any particular point in time, they will be the same for all stations in the Basic Service Set (BSS). When a PSK is used for authentication, it’s used to derive the Pairwise Master Key (PMK) as well as the resulting Pairwise Transient Keys (PTKs). No worries— I’ll tell you more about those concepts later! ■ Finally, we get a new form of frame check sequence (FCS). The FCS refers to the part of any packet that’s used to ensure that the integrity of the packet is maintained. It’s also used to determine if anything changed in the packet. Here’s a scenario: Through an attack called bit flipping, a hacker could generate a TCP re-send message. The AP will forward this TCP re-send to the wireless space, thereby generating a new initialization vector. A bit-flipping attack allows the attacker to artificially increase the number of IVs, thus speeding up a WEP attack by increasing the chance of duplicates or collisions occurring. TKIP uses a message integrity code (MIC), instead of a regular FCS. MIC can detect almost all changes to a bit in the frame, so it can bust bit flipping much more readily than FCS. If it detects a MIC failure, it will report this event to the AP. If the AP receives two of these failures in 60 seconds, it will respond by disassociating all stations and stopping all traffic for 60 seconds. This makes it impossible for the hacker to recover the key. The only known weakness of WPA PSK lies in the complexity of the password or key used on the AP and the stations. If it happens to be one that’s easily guessed, it could be susceptible to something known as a dictionary attack. This type of attack uses a dictionary file that tries out a huge number of passwords until the correct match is found. Consequently, this is very time consuming for the hacker. WPA3’s big difference is how it can prevent a dictionary attack. Because of this, WPA PSK should mainly be used in a small office, home office (SOHO) environment and in an enterprise environment only when device restrictions, such as voice over IP (VoIP) phones, don’t support RADIUS authentication.

Question 35

WPA2 Enterprise

Answer 35

Regardless of whether WPA or WPA2 is used during the initial connection between the station and the AP, the two agree on common security requirements. Following that agreement, a series of important key-related activities occur in this specific order: 1. The authentication server derives a key called the Pairwise Master Key (PMK). This key will remain the same for the entire session. The same key is derived on the station. The server moves the PMK to the AP where it’s needed. 2. The next step is called the four-way handshake. Its purpose is to derive another key called the Pairwise-Transient-Key (PTK). This step occurs between the AP and the station, and of course requires four steps to complete: a. The AP sends a random number known as a nonce to the station. b. Using this value along with the PMK, the station creates a key used to encrypt a nonce that’s called the snonce, which is then sent to the AP. It includes a reaffirmation of the security parameters that were negotiated earlier. It also protects the integrity of this frame with a MIC. This bidirectional exchange of nonces is a critical part of the key-generation process. c. Now that the AP has the client nonce, it will generate a key for unicast transmission with the station. It sends the nonce back to the station along with a group key commonly called a group transient key, as well as a confirmation of security parameters. d. The fourth message simply confirms to the AP that the temporal keys (TKs) are in place. One final function performed by this four-way handshake is to confirm that the two peers are still “alive.”

Question 36

802.11i

Answer 36

Although WPA2 was built with the 802.11i standard in mind, some features were added when the standard was ratified: ■■ A list of EAP methods that can be used with the standard. ■■ AES-CCMP for encryption instead of RC4. ■■ Better key management; the master key can be cached, permitting a faster reconnect time for the station.

Question 37

WPA3

Answer 37

In 2018 the Wi-Fi Alliance announced the new WPA3, a Wi-Fi security standard to replace WPA2. The WPA2 standard has served us well, but it’s been around since 2004! WPA3 will improve on the WPA2 protocol with more security features just like WPA2 was designed to fix WPA. What’s fun about WPA3 is the naming used to define the handshake as well as the exploits—yes, exploits are already out there! First, remember that WPA2 uses a PSK, but WPA3 has been upgraded to 128-bit encryption and uses a system called Simultaneous Authentication of Equals (SAE). This is referred to as the Dragonfly handshake. It forces network interaction on a login so that hackers can’t deploy a dictionary attack by downloading its cryptographic hash and then running cracking software to break it. Even more fun, the known exploits of WPA3 are called Dragonblood. The reason these Dragonblood exploits are already out is because the protections in WPA2 haven’t really changed that much in WPA3—at least not yet. Worse, WPA3 is backward compatible, meaning that if someone wants to attack you, they can just use WPA2 in an attack to effectively downgrade your WPA3 compatible system back to WPA2! Like WPA2, the Wi-Fi Protected Access security includes solutions for personal and enterprise networks. But WPA3 offers up some very cool new goodies, which pave the way for more powerful authentication and enhanced cryptographic clout. It also helps to protect vital networks by preserving resiliency and offers a cleaner approach to security. Here’s a list of characteristics shared by all WPA3 networks: ■■ Use the latest security methods ■■ Don’t allow outdated legacy protocols ■■ Require the use of Protected Management Frames (PMF) Like us, our Wi-Fi networks have different levels of risk tolerance according to type and function. For the non-public, home or enterprise variety, WPA3 gives us some cool tools to shut down password guessing attacks. WPA3 also works with superior security protocols for networks that require or want a higher degree of protection. As mentioned, WPA3 is backwards compatible and provides interoperability with WPA2 devices, but this is really only an option for companies developing certified devices. I’m sure that it will become a required piece over time as market adoption grows.

Question 38

WPA3-Personal

Answer 38

So how does being able to seriously protect your individual users sound? WPA3-Personal gives us that ability by offering up powerful password-based authentication via Simultaneous Authentication of Equals (SAE). This is a big upgrade from WPA2’s Pre-shared Key (PSK) and works really well even when users choose simple, easy to crack passwords! And like I said, WPA3 frustrates hacker’s attempts to crack passwords via dictionary attacks too. Some additional perks include: ■ Natural password selection: Allows users to choose passwords that are easier to remember ■ Ease of use: Delivers enhanced protections with no change to the way users connect to a network ■ Forward secrecy: Protects data traffic even if a password is compromised after the data was transmitted

Question 39

WPA3-Enterprise

Answer 39

Basically, wireless networks of all kinds gain a lot of security with WPA3, but those with sensitive data on them like networks belonging to financial institutions, governments and even enterprises really get a boost! WPA3-Enterprise improves everything WPA2 offers, plus it really streamlines how security protocols are applied throughout our networks. WPA3-Enterprise even gives us the option to use 192 bit-minimum strength security protocols, plus some very cool cryptographic tools to lock things down tight! Here’s a list of the ways WPA3 beefs up security: ■■ Sweet feature alert: WPA3 uses a system called Wi-Fi Device Provisioning Protocol (DPP), which thankfully allows users to utilize NFC tags or QR codes to allow devices on the network. Like I said, sweet! ■■ Authenticated encryption: 256-bit Galois/Counter Mode Protocol (GCMP-256) ■■ Key derivation and confirmation: 384-bit Hashed Message Authentication Mode (HMAC) with Secure Hash Algorithm (HMAC-SHA384) ■■ Key establishment and authentication: Elliptic Curve Diffie-Hellman (ECDH) exchange and Elliptic Curve Digital Signature Algorithm (ECDSA) using a 384-bit elliptic curve ■■ Robust management frame protection: 256-bit Broadcast/Multicast Integrity Protocol Galois Message Authentication Code (BIP-GMAC-256) ■■ The 192-bit security mode offered by WPA3-Enterprise ensures that the right combination of cryptographic tools are used and sets a consistent baseline of security within a WPA3 network. WPA3 has also improved upon 802.11’s open authentication support by giving us something called Opportunistic Wireless Encryption (OWE). The idea behind the OWE enhancement option is to offer encryption communication for networks without passwords and it works by giving every device on the network its own, unique key. This implements something called Individualized Data Protection (IDP), which happens to come in handy for password-protected networks too because even if an attacker gets a hold of the network password, they still can’t access any other encrypted data!

Question 40

802.11 specifications

Answer 40

IEEE 802.11a specification. 802.11a runs in the 5GHz spectrum, and if you use the 802.11h extensions, you have 23 non-overlapping channels. 802.11a can run up to 54Mbps, but only if you are less than 50 feet from an access point. IEEE 802.11b specification. IEEE 802.11b runs in the 2.4GHz range and has three non-overlapping channels. It can handle long distances, but with a maximum data rate of up to 11Mpbs. IEEE 802.11g specification. IEEE 802.11g is 802.11b’s big brother and runs in the same 2.4GHz range, but it has a higher data rate of 54Mbps if you are less than 100 feet from an access point. IEEE 802.11n components. 802.11n uses 40Mhz wide channels to provide more bandwidth, provides MAC efficiency with block acknowledgements, and uses MIMO to allow better throughput and distance at high speeds.