CompTIA Network+ Cert Guide: Wireless Networking

This chapter is from the book 

Upon completion of this chapter, you will be able to answer the following questions:

• What are the components that create wireless networks?
• What are the characteristics of 802.11 wireless standards?
• How is spread spectrum technology used in wireless networking?
• What is the function of the beacon management frame?
• What are the factors that cause wireless interference?
• How can wireless networks be secured?

One of the bigger changes in the networking world since the release of the previous Network+ exam is in wireless networking. Networks of all shapes and sizes incorporate wireless segments. Home wireless networking has also grown significantly in the past few years.

As you know, wireless networking enables users to connect to a network using radio waves instead of wires. Network users within range of a wireless transceiver (transmitter/receiver), known as an access point (AP), can move around an office freely without needing to plug in to a wired infrastructure. The benefits of wireless networking clearly have led to its growth.

Today, wireless local area networks (WLAN) provide a flexible and secure data communications system used to augment an Ethernet LAN or in some cases to replace it altogether. This chapter explores the many facets of wireless networking starting with some of the devices and technologies that make wireless networking possible.

Foundation Topics

Understanding Wireless Devices

In a common wireless implementation, an AP connects to the wired network from a fixed location using standard cabling. The wireless AP receives and then transmits data between the wireless LAN and the wired network infrastructure.

Client systems communicate with a wireless AP using wireless LAN adapters. Such adapters are built in to, or added to, devices such as PC cards in laptops, PDAs, or desktop computers. Wireless LAN adapters provide the communication point between the client system and the airwaves via an antenna.

This section describes the role of APs and antennas in a wireless network.

Wireless Access Point

Wireless APs are both a transmitter and receiver (transceiver) device used for wireless LAN (WLAN) radio signals. An AP is typically a separate network device with a built-in antenna, transmitter, and adapter. APs use the wireless infrastructure network mode to provide a connection point between WLANs and a wired Ethernet LAN. Recall from Chapter 1, "Introduction to Computer Networking," that wireless networks use the ad-hoc network topology and the infrastructure topology. The ad hoc is a peer-to-peer network design, and the infrastructure topology uses an AP. APs also typically have several ports enabling a way to expand the network to support additional clients.

Depending on the size of the network, one or more APs might be required. Additional APs enable access to more wireless clients and expand the range of the wireless network. Each AP is limited by a transmissions range, which is the distance a client can be from an AP and still get a useable signal. The actual distance depends on the wireless standard used and the obstructions and environmental conditions between the client and the AP. Factors affecting wireless transmission ranges are covered later in this chapter. Figure 7.1 shows an example of an AP in a network configuration.

As mentioned, an AP is used in an infrastructure wireless network design. Used in the infrastructure mode, the AP receives transmissions from wireless devices within a specific range and transmits those signals to the network beyond. This network can be a private Ethernet network or the Internet. In infrastructure wireless networking, there can be multiple access points to cover a large area or only a single access point for a small area, such as a single home or small building.

When working with wireless APs, you need to understand many terms and acronyms. In this section we define some of the more common wireless acronyms you will see both on the exam and in any wireless networking documentation.

• Service Set Identifier (SSID)—A network name needed to connect to a wireless AP. It is like a workgroup name used with Windows networking. 802.11 wireless networks use the SSID to identify all systems belonging to the same network. Client stations must be configured with the SSID to be authenticated to the AP. The AP might broadcast the SSID, enabling all wireless clients in the area to see the SSID of the AP. For security reasons, APs can be configured to not broadcast the SSID or to cloak them. This means that client systems need to be given the SSID name by an administrator instead of it automatically being discovered by the client system.

  Note: SSIDs

  One element of wireless security involves configuring the AP not to broadcast the SSID name. This configuration is done on the AP.

• Basic Service Set (BSS)—Refers to a wireless network that uses a single AP and one or more wireless clients connecting to the AP. Many home offices are an example of a BSS design. The BSS is an example of the infrastructure wireless topology. Wireless topologies were discussed with other network topologies in Chapter 1.
• Extended Service Set (ESS)—Refers to two or more BSS sets connected, therefore using multiple APs. The ESS creates WLANs or larger wireless networks and is a collection of APs and clients. Connecting BSS systems enable clients to roam between areas and maintain the wireless connection without having to reconfigure between BSSs.
• Extended Service Set Identifier (ESSID)—The ESSID and the SSID are used interchangeably, but there is a difference between the two. The SSID is the name used with BSS networks, and the ESSID is the network name used with an ESS wireless network design. With an ESS, not all APs necessarily use the same name.
• Basic Service Set Identifier (BSSID)—Refers to the MAC address of the BSS AP. The BSSID is not to be confused with the SSID, which is the name of the wireless network.
• Basic Service Area (BSA)—When troubleshooting or designing wireless networks, the BSA is an important consideration. The BSA refers to the coverage area of the AP. The BSA for an AP depends on many factors, including the strength of the AP antenna, interference in the area, and whether an omnidirectional or directional antenna is used.

Wireless Antennas

A wireless antenna is an integral part of overall wireless communication. Antennas come in many shapes and sizes, with each one designed for a specific purpose. Selecting the right antenna for a particular network implementation is a critical consideration and one that could ultimately decide how successful a wireless network will be. In addition, using the right antennas can save money on networking costs because you need fewer antennas and access points.

Many small home network adapters and access points come with a nonupgradeable antenna, but higher-grade wireless devices require that you decide which antenna to use. Selecting an antenna takes careful planning and requires an understanding of what range and speed you need for a network. The antenna is designed to help wireless networks do the following:

• Work around obstacles
• Minimize the effects of interference
• Increase signal strength
• Focus the transmission, which can increase signal speed

The following sections explore some of the characteristics of wireless antennas.

Antenna Ratings

When a wireless signal is low and influenced by heavy interference, it might be possible to upgrade the antennas to create a more solid wireless connection. To determine the strength of an antenna, we refer to its gain value. But how do we determine the gain value?

Consider a huge wireless tower emanating circular waves in all directions. If you could see these waves, you would see the data waves forming a sphere around the tower. The signals around the antenna flow equally in all directions (including up and down). An antenna that does this has a 0dbi gain value and is referred to as an isotropic antenna. The isotropic antenna rating provides a base point for measuring actual antenna strength.

An antenna's gain value represents the difference between the 0dBi isotropic and the power of the antenna. For example, a wireless antenna advertised as a 15dBi antenna is 15 times stronger than the hypothetical isotropic antenna. The higher the decibel figure, the higher the gain.

When looking at wireless antennas, remember that a higher gain value means stronger send and receive signals. In terms of performance, the general rule is that every 3dB of gain added doubles the effective power output of an antenna.

Types of Wireless Antennas

When selecting an antenna for a particular wireless implementation, you must determine the type of coverage used by an antenna. In a typical configuration, a wireless antenna can be either omnidirectional or directional. The choice between the two depends on the wireless environment.

An omnidirectional antenna is designed to provide a 360-degree dispersed wave pattern. This type of antenna is used when coverage in all directions from the antenna is required. Omnidirectional antennas are good to use when a broad-based signal is required. For example, by providing an even signal in all directions, clients can access the antenna and associated access point from various locations. Because of the dispersed nature of omnidirectional antennas, the signal is weaker overall and therefore accommodates shorter signal distances. Omnidirectional antennas are great in an environment in which there is a clear line of sight between the senders and receivers. The power is evenly spread to all points, making omnidirectional antennas well suited for home and small office applications.

Directional antennas are designed to focus the signal in a particular direction. This focused signal enables for greater distances and a stronger signal between two points. The greater distances enabled by directional antennas allow a viable alternative for connecting locations, such as two offices, in a point-to-point configuration.

Directional antennas are also used when you need to tunnel or thread a signal through a series of obstacles. This concentrates the signal power in a specific direction and enables you to use less power for a greater distance than an omnidirectional antenna. Figure 7.2 shows an example of a directional and an omnidirectional antenna beam.

802.11 Wireless Standards

802.11 represents the IEEE designation for wireless networking. Several wireless networking specifications exist under the 802.11 banner. The Network+ objectives focus on 802.11, 802.11a, 802.11b, 802.11g, and 802.11n. All these standards use the Ethernet protocol and the CSMA/CA access method.

The 802.11 wireless standards can differ in terms of speed, transmission ranges, and frequency used but are similar in terms of actual implementation. All standards can use either an infrastructure or ad-hoc network design, and each can use the same security protocols. The ad-hoc and infrastructure wireless topologies were discussed in Chapter 1.

The IEEE 802.11 standards include

• IEEE 802.11—There were two variations on the initial 802.11 wireless standard. Both offered 1 or 2Mbps transmission speeds and the same radio frequency (RF) of 2.4GHz. The difference between the two was in the way in which data traveled through the RF media. One used frequency hopping spread spectrum (FHSS), and the other used direct sequence spread spectrum (DSSS). These technologies are discussed in the next section. The original 802.11 standards are far too slow for modern networking needs and are now no longer deployed.
• IEEE 802.11a—In terms of data rate, the 802.11a standard was far ahead of the original 802.11 standards. 802.11a specifies data rates of up to 54Mbps, but communications typically take place at 6Mbps, 12Mbps, or 24Mbps. 802.11a is not compatible with other wireless standards 802.11b and 802.11g.
• IEEE 802.11b—The 802.11b standard provides for a maximum transmission data rate of 11Mbps. However, devices were designed to be backward compatible with previous standards that provided for speeds of 1, 2, and 5.5Mbps. 802.11b offers a transmission range of up to 100ft with 11Mbps data rate and 300ft operating a 1Mbps data rate. 802.11b uses a 2.4GHz RF range and is compatible with 802.11g.
• IEEE 802.11g—802.11g is a popular wireless standard today. On average, 802.11g offers wireless transmission over distances of 150 feet and a data rate of 54Mbps compared with the 11Mbps of the 802.11b standard. Like 802.11b, 802.11g operates in the 2.4GHz range and is therefore compatible with it.
• IEEE 802.11n—The newest of the wireless standards listed in the Network+ objectives is 802.11n. The goal of the 802.11n standard is to significantly increase throughput in both the 2.4 GHz and the 5 GHz frequency range. The baseline goal of the standard is to reach speeds of 100 Mbps but given the right conditions, it is estimated that the 802.11n data rates might reach a staggering 600 Mbps. In practical operation, 802.11n speeds will be much less.

Table 7.1 highlights the characteristics of the various 802.11 wireless standards.

Table 7.1. 802.11 Wireless Standards

IEEE Standard	Frequency/Media	Speed	Topology	Transmission Range	Access Method
802.11	2.4GHz RF	1 to 2Mbps	Ad hoc/infrastructure	20 feet indoors.	CSMA/CA
802.11a	5GHz	Up to 54Mbps	Ad hoc/infrastructure	25 to 75 feet indoors; range can be affected by building materials.	CSMA/CA
802.11b	2.4GHz	Up to 11Mbps	Ad hoc/infrastructure	Up to 150 feet indoors; range can be affected by building materials.	CSMA/CA
802.11g	2.4GHz	Up to 54Mbps	Ad hoc/infrastructure	Up to 150 feet indoors; range can be affected by building materials.	CSMA/CA
802.11n	2.4GHz/5GHz	Up to 600Mbps	Ad hoc/infrastructure	175+ feet indoors; range can be affected by building materials.	CSMA/CA

The Magic Behind 802.11n

Following on the heels of 802.11g is the 802.11n standard. It is significantly faster and travels greater distances than its predecessor. But how is this done? 802.11n takes the best from the 802.11 standards and mixes in some new features to take wireless to the next level. First among these new technologies is multiple input multiple output (MIMO).

MIMO is unquestionably the biggest development for 802.11n and the key to the new speeds. Essentially, MIMO uses multiplexing to increase range and speed of wireless networking. Multiplexing is a technique that combines multiple signals for transmission over a single line or media. MIMO enables the transmission of multiple data streams traveling on different antennas in the same channel at the same time. A receiver reconstructs the streams that have multiple antennas as well. By using multiple paths, MIMO provides a significant capacity gain over conventional single antenna systems, along with more reliable communication.

In addition to all these improvements, 802.11n enables channel bonding that will essentially double the data rate again. The 802.11b and 802.11g wireless standards use a single channel to send and receive information. With channel bonding, it is possible to use two channels at the same time. As you might guess, the capability to use two channels at once increases performance. It is expected that bonding can help increase wireless transmission rates from the 54Mbps offered with the 802.11g standards to a theoretical maximum of 600Mbps.

Wireless Radio Channels

Radio frequency (RF) channels are important parts of wireless communications. A channel is the band of RF used for the wireless communication. Each IEEE wireless standard specifies the channels that can be used. The 802.11a standard specifies radio frequency ranges between 5.15 and 5.875GHz. In contrast, 802.11b and 802.11g standards operate between the 2.4 to 2.4835GHz range.

As far as channels are concerned, 802.11a has a wider frequency band, enabling more channels and therefore more data throughput. As a result of the wider band, 802.11a supports up to eight nonoverlapping channels. 802.11b/g standards use the smaller band and support only up to three nonoverlapping channels.

It is recommended that the nonoverlapping channels be used for communication. In the United States, 802.11b/g use 11 channels for data communication; three of these—channels 1, 6, and 11—are nonoverlapping channels. Most manufacturers set their default channel to one of the nonoverlapping channels to avoid transmission conflicts. With wireless devices, you have the option of selecting which channel your WLAN operates on to avoid interference from other wireless devices that operate in the 2.4GHz frequency range.

When troubleshooting a wireless network, be aware that overlapping channels can disrupt the wireless communications. For example, in many environments, APs are inadvertently placed close together—perhaps two access points in separate offices located next door to each other or between floors. Signal disruption can result if channel overlap exists between the access points. The solution is to try to move the access point to avoid the problem with the overlap, or change channels to one of the other nonoverlapping channels—for example, switch from channel 6 to channel 11.

You would typically change the channel of a wireless device only if a channel overlap occurs with another device. If a channel must be changed, it must be changed to another nonoverlapping channel.

Table 7.2 outlines the available wireless channels. When deploying a wireless network, it is recommended that you use channel 1, grow to use channel 6, and add channel 11 when necessary, because these three channels do not overlap.

Table 7.2. RF Channels for 802.11b/g

Channel	Frequency Band
1	2412MHz
2	2417MHz
3	2422MHz
4	2427MHz
5	2432MHz
6	2437MHz
7	2442MHz
8	2447MHz
9	2452MHz
10	2457MHz
11	2462MHz

Table 7.3 shows the channel ranges for 802.11a; 802.11n has the option of using both channels used by 802.11a and b/g.

Table 7.3. RF Channels for 802.11a

Channel	Frequency Band
36	5180MHz
40	5200MHz
44	5220MHz
48	5240MHz
52	5260MHz
56	5280MHz
60	5300MHz
64	5320MHz

Spread Spectrum Technology

Spread spectrum refers to the manner in which data signals travel through a radio frequency. With spread spectrum, data does not travel straight through a single RF band; this type of transmission is known as narrowband transmission. Spread spectrum requires that data signals either alternate between carrier frequencies or constantly change their data pattern. Although the shortest distance between two points is a straight line (narrowband), spread spectrum is designed to trade off bandwidth efficiency for reliability, integrity, and security. Spread spectrum signal strategies use more bandwidth than in the case of narrowband transmission, but the trade-off is a data signal that is clearer and easier to detect. This chapter reviews three types of spread spectrum technologies: frequency hopping, direct sequence, and Orthogonal Frequency Division Multiplexing (OFDM).

Frequency-Hopping Spread Spectrum (FHSS) Technology

Frequency-Hopping Spread Spectrum (FHSS) requires the use of narrowband signals that change frequencies in a predictable pattern. The term frequency hopping refers to hopping of data signals between narrow channels. For example, consider the 2.4GHz frequency band used by 802.11b. This range is divided into 70 narrow channels of 1MHz each. Somewhere between 20 and several hundred milliseconds, the signal hops to a new channel following a predetermined cyclical pattern.

Because data signals using FHSS switch between RF bands, they have a strong resistance to interference and environmental factors. The FHSS signal strategy makes it well suited for installations designed to cover a large geographical area and where the use of directional antennas to minimize the influence of environmental factors is not possible.

FHSS is not the preferred spread spectrum technology for today's wireless standards. However, FHSS is used for some lesser-used standards and for cellular deployments for fixed Broadband Wireless Access (BWA), where the use of DSSS is virtually impossible because of its limitations.

Direct-Sequence Spread Spectrum (DSSS) Technology

With Direct-Sequence Spread Spectrum (DSSS) transmissions, the signal is spread over a full transmission frequency spectrum. For every bit of data sent, a redundant bit pattern is also sent. This 32-bit pattern is called a chip. These redundant bits of data provide for both security and delivery assurance. Transmissions are safe and reliable because the system sends so many redundant copies of the data, and only a single copy is required to have complete transmission of the data or information. DSSS can minimize the effects of interference and background noise.

As for a comparison between the two, DSSS has the advantage of providing higher security and signal delivery than FHSS, but it is a sensitive technology, affected by many environmental factors.

Orthogonal Frequency Division Multiplexing

Orthogonal Frequency Division Multiplexing (OFDM) is a transmission technique that transfers large amounts of data over 52 separate, evenly spaced frequencies. OFDM splits the radio signal into these separate frequencies and simultaneously transmits them to the receiver. By splitting the signal and transferring over different frequencies, the amount of cross talk interference is reduced. OFDM is associated with 802.11a, 802.11g amendments, and 802.11n wireless standards.

FHSS, DSSS, OFDM, and 802.11 Standards

The original 802.11 standard had two variations, both offering the same speeds but differing in the RF spread spectrum used. One of the original 802.11 standards used FHSS. This 802.11 variant used the 2.4GHz radio frequency band and operated with a 1 or 2Mbps data rate. Since this original standard, wireless implementations have favored DSSS.

The second 802.11 variation uses DSSS and specifies a 2Mbps peak data rate with optional fallback to 1Mbps in noisy environments. 802.11, 802.11b, and 802.11g use the DSSS spread spectrum. This means that the underlying modulation scheme is similar between each standard, enabling all DSSS systems to coexist with 2, 11, and 54Mbps 802.11 standards. As a comparison, it is like the migration from the older 10Mbps Ethernet networking to the more commonly implemented 100Mbps standard. The speed was different, but the underlying technologies were similar, enabling for an easier upgrade.

Table 7.4 provides a comparison of wireless standards and spread spectrum used.

Table 7.4. Comparison of IEEE 802.11 Standards

IEEE Standard	RF Used	Spread Spectrum	Data Rate (Mbps)
802.11	2.4GHz	FHSS	1/2
802.11	2.4GHz	DSSS	1/2
802.11a	5GHz	OFDM	54
802.11b	2.4GHz	DSSS	11
802.11g	2.4GHz	DSSS	54
802.11n	2.4/5GHz	OFDM	600 (theoretical)

Beacon Management Frame

Within wireless networking is a frame type known as the beacon management frame (beacon). Beacons are an important part of the wireless network because it is their job to advertise the presence of the access point so systems can locate it. Wireless clients automatically detect the beacons and attempt to establish a wireless connection to the AP.

The beacon frame is sent out by the AP in an infrastructure network design. Client stations will send out beacons only if connected in an ad-hoc network design. There are several parts of the beacon frame, all of which are used by the client system to learn about the AP before attempting to join the network. This information includes the following:

• Channel information—The channel used by the AP.
• Supported data rates—The data transfer rates identified by the AP configuration.
• SSID—The name of the wireless network name.
• Time stamp—Synchronization information. The time stamp is used by the client system to synchronize its clock with the AP.

These beacons are transmitted from the AP about every 10 seconds. The beacon frames add overhead to the network; therefore, some APs enable you to reduce the amount of beacons sent. With home networks, constant beacon information is not necessary.

Before a client system can attempt to connect to an AP, it must first locate it. There are two methods for AP discovery: passive and active. In passive detection, the client system listens for the beacon frames to discover the AP. After it is detected, the beacon frame provides the information necessary for the system to access the AP.

With active scanning, the client station transmits another type of management frame known as a probe request. The probe request goes out from the client system looking for a specific SSID or any SSID within its area. After the probe request is sent, all APs in the area with the same SSID reply with another frame, the probe response. The information contained in the probe response is the same information included with the beacon frame. This information enables the client to access the system.

Configuring and Troubleshooting the Wireless Connection

Now that we have reviewed key wireless settings, let's take a look at an actual wireless connection configuration. Figure 7.3 shows the configuration screen of a wireless access point.

As you can see from the screen capture, the settings for this wireless router are clearly laid out. For instance, you can see that the wireless connection uses an SSID password of Gigaset602 and wireless channel 11. Each wireless access point might differ in the layout but all have similar configuration options.

The configuration screen on a wireless AP enables you to adjust many settings for troubleshooting or security reasons. This section identifies some of the common settings and terms used on an AP.

• SSID—This configuration uses an SSID of Gigaset602. The SSID can be changed in a large network to help identify its location or network segment. For troubleshooting, if a client cannot access a base station, make sure that they are both using the same SSID. Incompatible SSIDs are sometimes found when clients move computers, such as laptops, between different wireless networks. They obtain an SSID from one network, and, if the system is not rebooted, the old SSID won't enable communication to a different base station.
• Channel—This connection is set to use channel 11. To access this network, all systems must use this channel. If needed, the channel can be changed using the drop-down menu. The menu lists channels 1 through 11.
• SSID broadcast—In their default configuration, wireless access points typically broadcast the SSID name into the air at regular intervals. This feature of SSID broadcast is intended to enable clients to easily discover the network and roaming between WLANs. The problem with SSID broadcasting is that it makes it a little easier to get around security. SSIDs are not encrypted or protected in any way. Anyone can snoop and get a look at the SSID and attempt to join the network.
• Authentication—Typically, you can set three options for the authentication to be used:
  • WEP-open—The simplest of the three authentications methods because it does not perform any type of client verification. It is a weak form of authentication because there is no proof of identity.
  • WEP-shared—Requires that a WEP key be configured on both the client system and the access point. This makes authentication with WEP-shared mandatory and therefore more secure for wireless transmission.
  • WPA-PSK—Wi-Fi Protected Access with Pre-Shared Key (WPA-PSK) is a stronger form of encryption in which keys are automatically changed and authenticated between devices after a specified period of time or after a specified number of packets has been transmitted.
• Wireless Mode—To access the network, the client must use the same wireless mode as the AP. Today most users configure the network for 802.11g/n for the faster speeds or a combination of 802.11b/g/n because they are compatible.
• DTIM Period—Wireless transmissions can broadcast to all systems; that is, they can send messages to all clients on the wireless network. Multiple broadcast messages are known as multicast or broadcast traffic. Delivery traffic indication message (DTIM) is a feature used to ensure that when the multicast or broadcast traffic is sent, all systems are awake to hear the message. The DTIM setting specifies how often the DTIM message is sent within the beacon frame. The DTIM setting by default is 1. This means that the DTIM message will be sent with every beacon. If the DTIM is set to 3, every third beacon will include a wake up call.
• Maximum Connection Rate—The transfer rate is typically set to Auto by default. This enables the maximum connection speed. However, it is possible to drop the speed down to increase the distance that the signal travels and boost signal strength due to poor environmental conditions.
• Network Type—This is where the network can be set to use the ad-hoc or infrastructure network design.

Configuring Communications Between Wireless Devices

To work with wireless networks, it is important to have a basic understanding of the communication that occurs between wireless devices. If using an infrastructure wireless network design, there are two key parts to the network: the wireless client, also known as the station (STA), and the AP. The AP acts as a bridge between the STA and the wired network.

As with other forms of network communication, before transmissions between devices can occur, the wireless AP and the client must first begin to talk to each other. In the wireless world, this is a two-step process involving association and authentication.

The association process occurs when a wireless adapter is first turned on. The client adapter immediately begins to scan across the wireless frequencies for wireless APs, or if using ad-hoc mode, other wireless devices. When the wireless client is configured to operate in infrastructure mode, the user can choose a wireless AP to connect with. This process might also be automatic with the AP selection based on the SSID, signal strength, and frame error rate. Finally, the wireless adapter switches to the assigned channel of the selected wireless AP and negotiates the use of a port.

If at any point, the signal between the devices drops below an acceptable level, or if the signal becomes unavailable for any reason, the wireless adapter initiates another scan looking for an AP with stronger signals. When the new AP is located, the wireless adapter selects the new AP and associates with it. This is known as reassociation.

With the association process complete, the authentication process begins. After the devices associate, keyed security measures are applied before communication can take place. On many APs, authentication can be set to either authentication. The default setting is typically open authentication, which enables access with only the SSID and the correct WEP key for the AP. The problem with open authentication is that if you don't have other protection or authentication mechanisms in place, your wireless network is totally open to intruders. When set to shared-key mode, the client must meet security requirements before communication with the AP can occur.

After security requirements are met, you have established IP-level communication. This means that wireless standard requirements have been met, and Ethernet networking takes over. Basically, a switch occurs between 802.11 to 802.3 standards. The wireless standards create the physical link to the network, enabling regular networking standards and protocols to use the link. This is how the physical cable is replaced, but to the networking technologies there is no difference between regular cable media or wireless media.

Several components combine to enable wireless communications between devices. Each of these must be configured on both the client and the AP:

• (Extended)Service Set Identifier (SSID/ESSID)—Whether your wireless network uses infrastructure mode or ad-hoc mode, an SSID is required. The SSID is a configurable client identification that enables clients to communicate to a particular base station. Only client systems configured with the same SSID as the AP can communicate with it. SSIDs provide a simple password arrangement between base stations and clients.
• Wireless channel—RF channels are important parts of wireless communications. A channel refers to the band of frequency used for the wireless communication. Each standard specifies the channels that can be used. The 802.11a standard specifies radio frequency ranges between 5.15 and 5.875GHz. In contrast, 802.11b and 802.11g/n standards operate between the 2.4 to 2.4835GHz ranges. Fourteen channels are defined in the IEEE 802.11b/g/n channel set, 11 of which are available in North America.
• Security features—IEEE 802.11 provides for security using two methods: authentication and encryption. Authentication refers to the verification of the client system. In the infrastructure mode, authentication is established between an AP and each station. Wireless encryption services must be the same on the client and the AP for communication to occur.

Troubleshooting Wireless Signals

Because wireless signals travel through the atmosphere, they are susceptible to different types of interference than standard wire networks. Interference weakens wireless signals and is therefore an important consideration when working with wireless networking.

Interference is unfortunately inevitable, but the trick is to minimize the levels of interference. Wireless LAN communications are typically based on radio frequency signals that require a clear and unobstructed transmission path.

The following are some factors that cause interference:

• Physical objects—Trees, masonry, buildings, and other physical structures are some of the most common sources of interference. The density of the materials used in a building's construction determines the number of walls the RF signal can pass through and still maintain adequate coverage. Concrete and steel walls are particularly difficult for a signal to pass through. These structures will weaken or at times completely prevent wireless signals.
• Radio frequency interference—Wireless technologies such as 802.11b/g use an RF range of 2.4GHz, and so do many other devices, such as cordless phones, microwaves, and so on. Devices that share the channel can cause noise and weaken the signals.
• Electrical interference—Electrical interference comes from devices such as computers, refrigerators, fans, lighting fixtures, or any other motorized devices. The impact that electrical interference has on the signal depends on the proximity of the electrical device to the wireless access point. Advances in wireless technologies and in electrical devices have reduced the impact these types of devices have on wireless transmissions.
• Environmental factors—Weather conditions can have a huge impact on wireless signal integrity. Lightning, for example, can cause electrical interference, and fog can weaken signals as they pass through.

Many wireless implementations are found in the office or at home. Even when outside interference such as weather is not a problem, plenty of wireless obstacles exist around the office. Table 7.5 highlights a few examples to be aware of when implementing a wireless network indoors.

Table 7.5. Wireless Obstacles Found Indoors

Obstruction	Obstacle Severity	Example Use
Wood/wood paneling	Low	Inside wall or hollow doors
Drywall	Low	Inside walls
Furniture	Low	Couches or office partitions
Clear glass	Low	Windows
Tinted glass	Medium	Windows
People	Medium	High volume traffic areas where there is considerable pedestrian traffic
Ceramic Tile	Medium	Walls
Concrete blocks	Medium/high	Outer wall construction
Mirrors	High	Mirror or reflective glass
Metals	High	Metal office partitions, doors, metal-based office furniture
Water	High	Aquariums, rain, fountains

Site Surveys

When placing a wireless access point when troubleshooting wireless signals, a wireless site survey is recommended. The wireless site survey is an important first step in the deployment of a wireless network; it enables the administrator to identify the wireless signal coverage area, potential interference area, and channel overlap and helps determine the best place to put an access point. Without the wireless site survey, it is blind placement.

A site survey will often include two key elements: a visual inspection and an RF inspection. A visual inspection of an area helps the administrator identify elements that might limit the propagation of wireless signals. This can include mirrors, concrete walls, metal racks, and more. The visual survey helps isolate the potential location of the AP.

In addition to the visual survey, testing software on laptops and handheld wireless survey devices can be used to test the signal integrity. These devices test for coverage voids, map any signal leakage from your building, discover the existence and location of rogue access points, channel overlaps, determine effects of neighboring access points, and more. Without using such a device, it would be impossible to detect unforeseen wireless deployment problem areas. For this reason, site surveys are one of the first steps in the deployment of any wireless networks.

Troubleshooting AP Coverage

Like any other network media, APs have a limited transmission distance. This limitation is an important consideration when deciding where an AP should be placed on the network. When troubleshooting a wireless network, pay close attention to the distance client systems are from the AP.

When faced with a problem in which client systems cannot consistently access the AP, you could try moving the AP to better cover the area, but then you might disrupt access for users in other areas. So what can be done to troubleshoot AP coverage?

Depending on the network environment, the quick solution might be to throw money at the problem and purchase another AP, cabling, and other hardware to expand the transmission area. However, you can try a few options before installing another wireless AP. The following list starts with the least expensive solution and progresses to the most expensive:

• Increase transmission power—Some APs have a setting to adjust the transmission power output. By default, most of these settings will be set to the maximum output; however, it is worth verifying just in case. As a side note, the transmission power can be decreased if you try to reduce the dispersion of radio waves beyond the immediate network. Increasing the power provides clients stronger data signals and greater transmission distances.
• Relocate the AP—When wireless client systems suffer from connectivity problems, the solution can be as simple as relocating the AP to another location. It might be that it is relocated across the room, a few feet away, or across the hall. Finding the right location will likely take a little trial and error.
• Adjust or replace antennas—If the AP distance is not sufficient for some network clients, it might be necessary to replace the default antenna used with both the AP and the client with higher-end antennas. Upgrading an antenna can make a big difference in terms of transmission range. Unfortunately, not all APs have replaceable antennas.
• Signal amplification—RF amplifiers add significant distance to wireless signals. An RF amplifier increases the strength and readability of the data transmission. The amplifier provides improvement of both the received and transmitted signals, resulting in an increase in wireless network performance.
• Use a repeater—Before installing a new AP, you might first want to think about a wireless repeater. When set to the same channel as the AP, the repeater takes the transmission and repeats it. So, the AP transmission gets to the repeater and then the repeater duplicates the signal and passes it forward. It is an effective strategy to increase wireless transmission distances.

Wireless Troubleshooting Checklist

Poor communication between wireless devices has many potential causes. The following is a review checklist of wireless troubleshooting presented in this chapter:

• Auto transfer rate—By default, wireless devices are configured to use the strongest, fastest signal. If you're experiencing connectivity problems between wireless devices, try using the lower transfer rate in a fixed mode to achieve a more stable connection. For example, you can manually choose the wireless transfer rate and instead of using 11Mbps, the highest rate for 802.11b, try 5.5Mbps, 2Mbps, or 1Mbps. The higher the transfer rate, the shorter the connection distance.
• AP placement—If signal strength is low, try moving the AP to a new location. Moving it just a few feet can make the difference.
• Antenna—The default antenna shipped with wireless devices might not be powerful enough for a particular client system. Better quality antennas can be purchased for some APs, which can boost the distance the signal can go.
• Building obstructions—Wireless RF communications are weakened if they have to travel through obstructions such as metal and concrete.
• Conflicting devices—Any device that uses the same frequency range as the wireless device can cause interference. For example, 2.4GHz phones can cause interference with devices using the 802.11g/n standard.
• Wireless channels—If connections are inconsistent, try changing the channel to another nonoverlapping channel.
• Protocol issues—If an IP address is not assigned to the wireless client, an incorrect SSID or incorrect WEP settings can prevent a system from obtaining IP information.
• SSID—The SSID number used on the client system must match the one used on the AP. Typically, the default SSID assigned is sufficient but might need to be changed if switching a laptop between different WLANs.
• Encryption—If encryption is enabled, the encryption type on the client must match what is set up in the AP.

Securing Wireless Networks

Many strategies and protocols are used to secure LAN and WAN transmissions. What about those network transmissions that travel over the airwaves? In the past few years wireless networking has changed the look of modern networks, bringing with it an unparalleled level of mobility and a host of new security concerns.

Wireless LANs (WLANs) require new protocols and standards to handle security for radio communications. As it stands today, wireless communications represent a significant security concern. When working with wireless, you need to be aware of a few wireless security standards, including Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), WPA-2, and 802.1X. Before we get to describing each, let's define a few terms.

Defining Access Control, Authentication, Authorization, and Encryption

Wireless security, like all computer security, is about controlling access to data and resources. It is important to understand the difference between authentication, authorization, and access control. Though these terms are sometimes used interchangeably, they refer to distinct steps that must be negotiated successfully to determine whether a particular request for a resource will result in that resource actually being returned. This is true for both a wired and wireless network.

Access control refers to any mechanism, software or hardware, used to restrict availability to network resources. To secure a network, it is necessary to determine which users will be granted access to various resources. Access control provides the design strategies necessary to ensure that only permitted users have access to such resources. It is a fundamental concept and forms the basis of a strong and secure network environment.

Although the concept of access control is easily understood, implementing it can be complex. Access to every network resource, including files, folders, hard disks, and Internet access, must be controlled. This is a difficult task in large network environments.

Authentication verifies the identity of the computer or user attempting to access a particular resource. Authentication is most commonly done with the presentation of credentials such as a username and a password. More sophisticated identification methods can include the use of the following:

• Smart cards
• Biometrics
• Voice recognition
• Fingerprints

Authorization determines whether the person, previously identified and authenticated, is enabled to access to a particular resource. This is commonly determined through group association; that is, a particular group might have a specific level of security clearance. For instance, a group security policy might enable the school secretaries access to some data while locking students out.

Encryption is the process of encoding the data sent over remote connections, and it involves scrambling the usernames and passwords used to gain access to the remote network. Encryption is the process of encoding data using a mathematical algorithm that makes it difficult for unauthorized users to read the data if they can intercept it. The algorithm is actually a mathematical value known as a key. The key is required to read the encrypted data. Encryption techniques use public and private keys; public keys can be shared, and private keys cannot.

A key is a binary number that has a large number of bits. As you might imagine, the bigger the number or key, the more difficult it is to guess. Today, simple encryption strategies use 40 to 56 bits. On a 40-bit encryption, there are 2⁴⁰ possible keys; 56-bit encryption has 2⁵⁶ possible keys. That's a lot of keys. Remember that without the correct key, the data cannot be accessed. Although the number of keys associated with lower-grade encryption might seem amazing, they have been cracked by some high-end, specialized systems. That makes necessary higher-grade encryption: Many online transactions require 128-bit encryption, and other applications support encryption as high as 1,024 bits. (If you have time, try to calculate the key combinations for these higher-grade encryption strategies.)

Wireless Authentication and Encryption Methods

Now that we have a better idea of what authorization, authentication, and encryption are, we can look at the protocols and methods used to achieve wireless security. As an administrator for a wireless network, you will certainly be using these security features, and you will certainly be asked questions about them on the Network+ exam.

Wired Equivalent Privacy (WEP)

Wired Equivalent Privacy (WEP) was the first attempt to keep wireless networks safe. WEP was designed to be easy to configure and implement, and originally it was hoped that WEP would provide the same level of security to wireless networks as was available to wired networks. For a time it was the best and only option for securing wireless networks.

WEP is an IEEE standard introduced in 1997 designed for securing 802.11 networks. With WEP enabled, each data packet transmitted over the wireless connection would be encrypted. Originally, the data packet was combined with a secret 40-bit number key as it passed through an encryption algorithm known as RC4. The packet was scrambled and sent across the airwaves. On the receiving end, the data packet passed through the RC4 backward, and the host received the data as it was intended. WEP originally used a 40-bit number key, but later specified 128-bit encryption, making WEP that much more robust.

WEP was designed to provide security by encrypting data from the sending and receiving devices. In a short period of time, however, it was discovered that WEP encryption was not nearly as secure as hoped. Part of the problem was that when the 802.11 standards were written, security was not the major concern it is today. As a result, WEP security was easy to crack with freely available hacking tools. From this point, wireless communication was regarded as a potentially insecure transmission media.

There are two types of WEP security: static and dynamic WEP. Dynamic and static WEP differ in that dynamic WEP changes security keys periodically, or dynamically, making it more secure. Static WEP uses the same security key ongoing. The primary security risks are associated with static WEP, which uses a shared password to protect communications. Security weaknesses discovered in static WEP means that WLANs protected by it are vulnerable to several types of threats. Freely available hacking tools make breaking into static WEP-protected wireless networks a trivial task. Unsecured WLANs are obviously exposed to these same threats as well; the difference being that less expertise, time, and resources are required to carry out the attacks.

Wi-Fi Protected Access (WPA)

Security weaknesses associated with WEP provided administrators with a valid reason to be concerned with wireless security. The need for increased wireless security was important for wireless networking to reach its potential and to bring a sense of confidence for those with sensitive data to use wireless communications. In response, the Wi-Fi Protected Access (WPA) was created. WPA was designed to improve the security weaknesses of WEP and to be backward compatible with older devices using the WEP standard. WPA addressed two main security concerns:

• Enhanced data encryption—WPA uses a temporal key integrity protocol (TKIP), which scrambles encryption keys using a hashing algorithm. Then the keys are issued an integrity check to verify that they have not been modified or tampered with during transit.
• Authentication—Using the Extensible Authentication Protocol (EAP), WEP regulates access to a wireless network based on a computer's hardware-specific MAC address, which is relatively simple to be sniffed out and stolen. EAP is built on a more secure public-key encryption system to ensure that only authorized network users can access the network.

WPA was designed to address the security shortcomings of WEP by introducing support for mutual authentication and using the Temporal Key Integrity Protocol (TKIP) for data encryption. TKIP is discussed in the next section. The security features of WPA have been improved upon with WPA2. WPA2 enhances security by using Advanced Encryption Standard (AES) instead of TKIP to secure network traffic making it more secure. AES, also known as Rijndael, is a block cipher encryption standard. AES can create secure keys from 128 bit to 256 bit in length.

Both WPA and WPA2 are vastly more secure than WEP and, when properly secured, there are no currently known security flaws for either protocol. However, due to the AES protocol, wherever possible it is recommend to use WPA2.

Temporal Key Integrity Protocol (TKIP)

As mentioned previously, WEP lacked security. The Temporal Key Integrity Protocol (TKIP) was designed to address the shortcomings of the WEP security protocol. TKIP is an encryption protocol defined in IEEE 802.11i. TKIP was not only designed to increase security but also to use existing hardware, making it easy to upgrade to TKIP encryption.

TKIP is built on the original WEP security standard but enhances it by "wrapping" additional code both at the end and the beginning of the data packet. This additional code modifies the original code for additional security. Because TKIP is based on WEP, it too uses the RC4 stream encryption method, but unlike WEP, TKIP encrypts each data packet with a stronger encryption key than available with regular WEP.

TKIP provides increased security for data communications, but it is far from the final solution. TKIP provides strong encryption for home user and nonsensitive data, but it might not provide a level of security necessary to protect corporate or more sensitive data while in transmission.

802.1X

802.1X is an IEEE standard specifying port-based network access control. 802.1X was not specifically designed for wireless networks; rather, it provides authenticated access for both wired and wireless networks. Port-based network access control uses the physical characteristics of a switched local area network (LAN) infrastructure to authenticate devices attached to a LAN port and to prevent access to that port in cases where the authentication process fails. There are three main components to the 802.1X framework:

• Supplicant—The system or node requesting access and authentication to a network resource.
• Authenticator—A control mechanism that enables or denies traffic to pass though a port.
• Authentication server—The authentication server validates the credentials of the supplicant trying to access the network or resource.

During a port-based network access control interaction, a LAN port adopts one of two roles: authenticator or supplicant. In the role of authenticator, a LAN port enforces authentication before it enables user access to the services that can be accessed through that port. In the role of supplicant, a LAN port requests access to the services that can be accessed through the authenticator's port. An authentication server, which can be either a separate entity or colocated with the authenticator, checks the supplicant's credentials on behalf of the authenticator. The authentication server then responds to the authenticator, indicating whether the supplicant is authorized to access the authenticator's services.

The authenticator's port-based network access control defines two logical APs to the LAN through one physical LAN port. The first logical AP, the uncontrolled port, enables data exchange between the authenticator and other computers on the LAN, regardless of the computer's authorization state. The second logical AP is between an authenticated LAN user and the authenticator.

In a wireless network environment, the supplicant would typically be a network host, the authenticator could be the wireless network switch or AP, and the role of authentication server would be played by a Remote Authentication Dial-In User Service (RADIUS).

RADIUS is a protocol that enables a single server to become responsible for all remote access authentication, authorization, and auditing (or accounting) services. RADIUS functions as a client/server system. The remote user dials in to the remote access server, which acts as a RADIUS client, or network access server (NAS), and connects to a RADIUS server. The RADIUS server performs authentication, authorization, and auditing (or accounting) functions and returns the information to the RADIUS client (which is a remote-access server running RADIUS client software); the connection is either established or rejected based on the information received.

Securing the Access Point

Any wireless access point ships with a default configuration that is not secure. Before deploying a wireless network it is important to configure the AP not only with encryption but also to secure other settings to prevent attack. The following checklist identifies some of the settings that can be secured.

• Changing default AP password—The wireless AP ships with a generic password. One of the first steps is to change this public password to prevent unauthorized access to the AP.
• SSID broadcast—The wireless router is configured to broadcast the SSID to make it easy to find for wireless clients. It is possible to choose not to broadcast the SSID making the network invisible to detection.
• Disabling DHCP on AP and using Static IP—Many wireless APs distribute IP information automatically using the DHCP protocol. If someone was trying to access the AP and was successful, DHCP makes it easy for them to get a valid IP address. To help secure the AP, it is possible to disable DHCP and create static IP addresses for each legitimate device connected to it. The static IP would need to be configured on the client workstation.
• MAC filtering—Most APs enable for MAC filtering, which is enabling only specified MAC addresses to be authenticated to the AP. There are ways to get around MAC filtering, but the average user would not make the effort to find out how. Each client system connecting to the access point would need to have its MAC address listed in the MAC filter.

Summary

Several wireless standards fall under the 802.11 banner, including 802.11a, 802.11b, 802.11g, and 802.11n. Each of these standards has different characteristics, including speed, range, and RF used. Wireless networks are typically implemented using ad-hoc or infrastructure network design. Many types of interference can weaken the wireless signals, including weather, obstructions such as trees or walls, and RF interference.

Three types of spread spectrum technologies are reviewed in this chapter: frequency hopping, direct sequence, and Orthogonal Frequency Division Multiplexing. Each is associated with a particular wireless networking standard.

Many strategies and protocols secure wireless transmissions, including Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), WPA, AES, and 802.1X. WEP was proven to be insecure but is still widely used. AP uses TKIP to encrypt potentially sensitive data. RADIUS also increases security and acts as an authentication server.

When configuring a wireless network, the client and the AP must be configured with the same characteristics. If the AP uses 802.11a, so must the client. The same holds true for the SSID and the security settings.