TELE301 Lecture Wireless Networking

Size: px

Start display at page:

Download "TELE301 Lecture Wireless Networking"

Audrey Anthony
5 years ago
Views:

TELE301 Lecture 6 802.11 Wireless Networking Cameron Kerr Telecommunications Programme University of Otago Some IEEE 802 Standards 802.1 is Bridging and Management 802.1x 802.

802.11a 54Mbit, 5Ghz, Less common than 11g, but technically superior. 802.11g 802.11 Family 54Mbit, 2.4GHz, Current de-facto standard. Compatible with 11b.

) 4 AP Access Point STA Station Basic Service Set (BSS) A group of stations that communicate with each other and an access point, in an area called a basic service area.

(cont.) Infrastructure Ad-Hoc (Wireless) Distribution System (WDS) Backbone of multiple APs, and the inter-ap communication. Usually Ethernet, may be wireless. 802.

7 Requires an AP to associate to. Higher layers of networking stack configured using same methods as you would any wired ethernet station.

1 TELE301 Lecture Wireless Networking Cameron Kerr Telecommunications Programme University of Otago Some IEEE 802 Standards is Bridging and Management 802.1x is Ethernet is Wireless b, a, g is Broadband Wireless MAN b 11Mbit, 2.4GHz, Boom-time technology a 54Mbit, 5Ghz, Less common than 11g, but technically superior g Family 54Mbit, 2.4GHz, Current de-facto standard. Compatible with 11b. Mixed or exclusive operation. 3 Structural Overview Terminology Terms. (cont.) 4 AP Access Point STA Station Basic Service Set (BSS) A group of stations that communicate with each other and an access point, in an area called a basic service area. 5 ESS Multiple BSSs can be linked using a distribution system to create an Extended Service Set. (E)SSID (Extended) Service Set Identifier. The name of the network Terms. (cont.) Infrastructure Ad-Hoc (Wireless) Distribution System (WDS) Backbone of multiple APs, and the inter-ap communication. Usually Ethernet, may be wireless F defines the Inter Access-Point Protocol (IAPP), but use is limited. Mode Either Independent (Ad-Hoc) or Infrastructure (aka Managed). Ad-Hoc BSS is termed an IBSS. 7 Requires an AP to associate to. Higher layers of networking stack configured using same methods as you would any wired ethernet station. Most commonly DHCP is used, as wireless nodes are more often mobile. Further security measures may be employed to manage security risks associated with wireless. 8 Nodes with the same IBSS get together without any need for network infrastructure such as an AP, or network level services such as DHCP, DNS. Can use ZeroConf protocols to manage IP addresses etc. (if IP is used.) 9

Signal Strength Signal Level Strength of the received signal. Noise Level Strength of the noise (non-signal energy) Link Quality Signal to Noise ratio Transmit Power Radiated power.

"2 So a 10dB antenna would boost a signal a bit more than 2x2x2=8 times. A 32dB parabolic dish! 210 = 1024 times.

2 Signal Strength Signal Level Strength of the received signal. Noise Level Strength of the noise (non-signal energy) Link Quality Signal to Noise ratio Transmit Power Radiated power. (How loud we speak) Receive Sensitivity How well we can pick up signals (hearing) 10 Decibels (db) A relative, logarithmic quantity used for easily working with antennas. +3dB! "2 So a 10dB antenna would boost a signal a bit more than 2x2x2=8 times. A 32dB parabolic dish! 210 = 1024 times. dbi is db compared to an isotropic radiator (a theoretical omni antenna), and is often used for rating antennas. dbm (db relative to 1 milliwatt) or just mw is often used for rating transmit power for transmitters. 11 Finding a Network Passive scanning listens for AP beacons. Listens on each channel for a certain dwell time. Won t detect closed/hidden networks. Active scanning sends Probe Requests. On each channel. Requests a particular ESSID or any. Produces a scan report with learned ESSIDs 12 Finding a Network (cont.) or passively scan in monitor mode. Some wireless NICs can allow the station to see all wireless frames on the channel. Getting hard to find, but you Prism II chips can do this, as can others. Useful tool for wireless admins. Used by products such as Kismet or AirSnort. Commonly used for War-driving etc. Monitor mode is not needed for clients. 13 Authenticating Authenticates user or machine before being able to use the network. Consumer devices provide at least MAC filtering. Valid MAC addresses can be observed, and changed. Modern enterprise networks often have username/password. Or it could be nothing. You could perform authentication at a higher layer. (replacing or supplementing wireless auth) Such as for VPN authentication. 14 Associating Purpose is to register the station with the distribution system. So other APs in the same ESS know which AP to send frames to. Not applicable to IBSSs. When you move from AP to AP in the same ESS, the wireless distribution system (WDS) takes care of re-associating with the new AP (handoff ). 15 Security Proto. Overview WPA WPA Enterprise, i MAC Filter List Not a security protocol. Access Control by (changeable) MAC address. ACLs can be stored centrally using RADIUS. WEP (Wired Equivalent Privacy) Most common denominator. Minimal protection. Pre-Shared Key Large amount of work to change. 16 WiFi Protected Access Subset of i that was released when WEP flaws became a barrier to adoption. WPA Personal WEP with short-lived changing keys. Temporal Key Integrity Protocol (TKIP) Different key per user/session/packet Reported problems with native Windows XP support. 17 WPA Enterprise 802.1x for user authentication Port based authentication framework. Extensible Authentication Protocol (EAP) Requires RADIUS backend i WPA2 and i is too new for general use. WPA2 is the WiFi Alliance s name for approved i implementations. Advanced Encryption Standard (AES) 18

MAC Filtering WEP Configuration WPA Personal We either statically configure client MAC addresses, or get them from a RADIUS

Can be given in either HEX or ASCII Note that 64bit=40bit, and 128bit=96bit 20 The password or pre-shared key is the same

21 WPA Enterprise Mobility Transitions Compared to Ethernet Enterprise allows for username/ password authenticati on.

STA monitors signal strength and quality of neighbouring APs in that ESS.

IP changes, so MobileIP required to be seamless. 23 Both use 48-bit IEEE 802 MAC addresses. Where Ethernet uses CSMA/CD, 802.

11 is ACK d Ethernet has no notion of association. Otherwise, its just like Ethernet.

Hex-pattern layout for nonoverlapping channels. But don t forget that space is 3D. Limit number of nodes to about 30 per AP.

3 MAC Filtering WEP Configuration WPA Personal We either statically configure client MAC addresses, or get them from a RADIUS server. 19 WEP of any key-size is easily broken in under a second after 5-10 million packets. Can be given in either HEX or ASCII Note that 64bit=40bit, and 128bit=96bit 20 The password or pre-shared key is the same for everyone. How much effort would be required to change it? 21 WPA Enterprise Mobility Transitions Compared to Ethernet Enterprise allows for username/ password authenticati on. 22 No transition BSS transition Layer 2. IP doesn t change, seamless roaming. STA monitors signal strength and quality of neighbouring APs in that ESS. AP new informs AP old that STA has moved upon receipt of a reassociation request from STA. ESS transition Layer 3. IP changes, so MobileIP required to be seamless. 23 Both use 48-bit IEEE 802 MAC addresses. Where Ethernet uses CSMA/CD, uses CSMA/CA RTS/CTS with RTS Threshold. Also provides booking of network. Every frame on is ACK d Ethernet has no notion of association. Otherwise, its just like Ethernet Wireless Layout Keep APs with overlapping coverage at least three channels apart. Hex-pattern layout for nonoverlapping channels. But don t forget that space is 3D. Limit number of nodes to about 30 per AP. 25 Locating Access Points Considerations Backbone network connection. Power supply AC supply Power over Ethernet (PoE) modules or switch. Desired coverage area. AP-antenna distance (loss) Environmental conditions Wind disturbance; Rain; Sun (heat) 26 Power over Ethernet Uses the two unused pairs in Fast, disconnecting those pairs from the Ethernet (GigE not usable) Some switches have PoE enabled ports. 27

Antenna Types Omni-directional Directional Antennas

High-gain Omni Diversity antennas Directional 10dBi

cantenna. Trade off polar coverage for distance.

Antennas Frying scoop parabolic Coffee Can Waveguide

NZ innovation, using cheap USB WiFi sticks and cheaper

Sniper Rifle Hotspots Parabola from cardboard and foil.

34 This allows an attacker to launch any existing

distance. same frequency as 802.11b and 802.

) Deny access to the client through the gateway.

4 Antenna Types Omni-directional Directional Antennas Omni-directional 15dBi Yagi AP with antenna diversity High-gain Omni Diversity antennas Directional 10dBi Panel Panel, Yagi, Parabolic Shown is a Wave-Guide cantenna. Trade off polar coverage for distance. Sometimes advertised with its azimuth and elevation to show coverage area. 19dBi Parabolic 7dBi High-Gain Omni DIY Antennas Frying scoop parabolic Coffee Can Waveguide Antennas are pretty simple, and you can make ones without too much bother. The Pringles can antenna that made DIY WiFi popular. NZ innovation, using cheap USB WiFi sticks and cheaper Chinese cook-ware. I made this recently. The diameter is the important dimension, with enough length. Hopefully ~12dBi Easy Parabolic Bluetooth Sniper Rifle Hotspots Parabola from cardboard and foil. Can be used to boost signal for a simple dipole. 34 This allows an attacker to launch any existing Bluetooth attack at a Bluetooth uses the much greater distance. same frequency as b and g, so the same antennas work. Presented at DefCon Captive Proxy (NoCatAuth, BlueSocket et al.) Deny access to the client through the gateway. Intercept www activity, redirect to gateway. User inputs username/password, accepts AUP and minimises browser. Username and password could come from a ticket printer, or input credit card details. User is now allowed through the firewall. Browser will refresh, keeping access alive. Can tie in to pre-paid minutes. 36

5 Security Problems Bandwidth stealing You are responsible for their actions. Access to wired network and other wireless nodes ARP Poisoning Man-in-the-middle attacks also of wired network if not routed AP Spoofing 37 Proxy authentication by Username. Can t be transparent. Careful firewalling. Risk Control ARP Monitoring, Routing, not switching between wireless distribution network and main wired network. Good key management. Use a Virtual Private Network (VPN) for sensitive data. 38 Uses of Wireless When cables are a hassle/liability#! Transient networks#! Hotspots#! Backup links#! Reliability# " Security (can be managed)# " Speed# " 39 References Wireless: The Definitive Guide Matthew S. Gast; O Reilly & Associates ISBN: Security Bruce Potter & Bob Fleck; O Reilly & Associates ISBN:

Family Structural Overview

Family Structural Overview Some IEEE 802 Standards TELE301 Lecture 5 802.11 Wireless Networking David Eyers Telecommunications Programme University of Otago 802.1 Bridging and Management 802.1X,... 802.3 Ethernet 802.11 Wireless