- 802.11
-
802.11 (known colloquially as wifi)
is a radio technology used for
wireless local area networks (WLANs).
Compared to other networking technologies,
wifi is quick to setup and inexpensive.
Its main disadvantage is its relative insecurity.
Wifi comprises several standards developed by the
IEEE.
The most notable of these are
802.11a,
802.11b, and
802.11g.
The 802.11 (without the added letters) standard was released in 1997.
Though it was too rudimentary (and too slow) for commercial acceptance
and though it has been superseded by 802.11a, 802.11b, etc., it did lay the
foundation for what has grown into a huge market.
It provided fragmentation,
DSSS, FHSS,
diffused infrared, and most of the
essential technology of today's consumer-grade wireless computer networks.
- 802.11a
-
Issued in 1999,
802.11a is one of a family of standards for
wireless local area networks (WLANs).
It is also sometimes termed WiFi5.
802.11a employs a set of radio channels at the
frequencies of 5.725 GHz to 5.850 GHz
(in the U-NII band).
802.11a's main advantages over the more popular
802.11b are:
- It
offers a higher bandwidth (up to 54 Mbps,
compared to 802.11b's 11 Mbps.)
- It has more channels -- 52 of them -- which
helps avoid radio and microwave interference.
It also can support up to eight networks
simultaneously in an access point's
coverage area without conflict (compared
to 802.11b which can support only three.)
The reasons for its relative unpopularity include:
- It was longer in development, enabling
802.11b products to emerge and first and
capture market share.
-
Due to its higher frequency (5 GHz
versus 2.4 GHz) its transmission range
(distance a signal can reach) is
shorter than that of 802.11b (225 feet
versus 375 feet).
- It demands materials that
are more expensive: GaAs or SiGe rather than CMOS.
The 802.11a standard includes a strategy for falling
back to slower bandwidths when noise is high
or signal strength is low.
These slower bandwidths are 48, 36, 24, 18, 12, 9, and 6 Mbps.
Some implementations of 802.11a include a proprietary
"Turbo" mode (also termed "2X") of 108 Mbps.
802.11a and 802.11b use the same MAC layer
designs; where they differ is in their
PHY layers.
802.11a achieves its higher bandwidth by using
multiplexing and a more efficient error correction
scheme (forward error correction (FEC)).
802.11a uses the following modulation techniques:
- At 6 Mbps it uses PSK with 125 Kbps
for each of its 48 subchannels (125K X 48 = 6M).
- At 12 Mbps it uses QPSK with 250 Kbps/channel
(250K X 48 = 12M).
- At 24 Mbps it uses 16-QAM.
- At 54 Mbps it uses 64-QAM.
- 802.11b
-
The specification for 802.11b was first released in 1999.
It was an amendment to 802.11 which ran at 1 and 2 Mbps.
802.11b was initially termed "High Rate" and
added 5.5 and 11 Mbps. It permits up to 1 watt
of power output but most 802.11b devices use less for
battery power conservation.
802.11b uses 2.4 GHz (details in table below)
and offers a bandwidth of up to 11 Mbps.
2.4 GHz is a crowded part of the radio spectrum.
It is shared by microwave ovens, cordless phones,
medical and scientific equipment, Bluetooth
devices, and many consumer and industrial applications.
Here are the exact frequencies used by 802.11b and 802.11g.
| USA/FCC, Canada | 2.412-2.462 GHz | 11 channels |
| Europe CE/ETSI | 2.412-2.472 GHz | 13 channels |
| Japan | 2.412-2.484 GHz | 14 channels |
| France | 2.457-2.472 GHz | 4 channels |
- 802.11g
-
Like 802.11b, 802.11g operates in the 2.4 GHz band (details in table above).
It offers a bandwidth of up to 54 Mbps.
However, it uses a different radio technology than 802.11b.
When conceived, 802.11g sought to provide the best of both worlds --
the high speed of 802.11a and the low cost of 802.11b.
Its design is a compromise between chip manufacturers with
large investments in incompatible technologies.
802.11g has a total of fourteen channels (in most of the world)
or eleven (in the USA) but,
like 802.11b, only three are non-overlapping, unlike 802.11a's eight.
This enables it to squeeze into a narrower band.
There is 5 MHz between each pair of adjacent channels.
The centerpoint of the bottom frequency is 2.412 GHz.
Each channel is 22 MHz wide.
Hence, the bottom of the bottom frequency is 2.401 GHz
(2.412 GHz minus half of 22 MHz).
The three non-overlapping channels (in practice, the only usable ones)
are 1, 6, and 11.
802.11g has two mandatory modes (every manufacturer must provide these):
CCK and OFDM, and
two optional modes:
Packet Binary Convolutional Coding (PBCC-22) -- 22 Mbps --
and CCK-OFDM-33 -- 33Mbps.
- 802.11h
- This IEEE standard is a refinement to 802.11a.
It unifies standards for the 5 GHz band.
It adapts 802.11a for European regulatory requirements.
It improves the 802.11 MAC and PHY layers to give:
- dynamic frequency selection (DFS)
- transmit power control (TPC)
- 802.11i
- Security enhancements to 802.11
-- This IEEE standard will remedy weaknesses in 802.11 wireless network security,
particularly WEP.
It is currently under development by an
IEEE
working group.
For a superb set of definitions of security terminology, see
RFC 2828.
- 802.11s
- See mesh network.
- 802.16
- See WiMAX.
- 802.1x
- When completed, this
IEEE
standard will provide strong security for both wireless and wired networks.
It will support several authentication modes including RADIUS.
- access control list (ACL)
- One rudimentary security mechanism is the ACL in which the
enforcer has a list of the physical (hardware) addresses of the
devices (usually computers) permitted to access a network.
These addresses are stored in MAC
format. Drawbacks of this mechanism are that it's less
useful to authenticate a hardware device than a user, and
that MAC addresses can be spoofed by imposters.
The advantage is that it's simple and easily administered.
- access point
- A device that connects to a wired network
and which transmits and receives 802.11 signals.
Thus, it acts as the interface between nearby wireless devices such as
users' laptop computers and the wired network.
(Devices that interconnect networks are termed bridges.
Access points are sometime referred-to as bridges.)
Often, the wired network is itself connected to the Internet.
Thus, the access point serves to enable wireless computer
users to connect to the Internet.
The device itself consists of:
- A radio transmitter and receiver
- An RJ-45 wired network interface
- Bridging software
Occasionally, access points are used without wired networks.
In such "standalone" wireless networks, access points serve as
communication buffers, for example when
communication is attempted with a laptop that is in standby mode.
(Laptop computers enter standby mode to conserve battery power.)
To catch them up on data they missed while standing by,
access points buffer the data for these laptops until they awaken.
- ad hoc mode
- See IBSS.
- address resolution protocol (ARP)
- Within an ethernet local area network (LAN), machines identify each other
by MAC addresses.
On the Internet, however, machines identify each other by
Internet Protocol (IP) addresses (see DNS below)
such as 192.100.68.211.
Thus, to reach its final destination, a message must
be delivered to a MAC address which must be resolved from its IP address.
The ARP protocol does this. Within an ethernet LAN,
it broadcasts a message to all the machines asking,
"If this is your IP address, tell me your MAC address."
The responding machine (if any) sends back its
MAC address. Then the sender can deliver the message
and stores the address in its ARP cache for future reference.
- advanced encryption standard (AES)
- This encryption is strong and will replace WEP in
802.1x.
It was developed to replace DES, the algorithm chosen for
use by U.S. government organizations.
It will also be widely used outside of the government.
AES uses the Rijndael algorithm which was developed by Drs. Daemen and Rijmen of Belgium.
The National Institute of Standards and technology (NIST) selected the
Rijndael algorithm for AES because it offers a combination
of security, performance, efficiency, ease of implementation, and flexibility.
The AES specifies three key sizes: 128, 192 and 256 bits.
- analog modulation
- One set of techniques for delivering information electronically
uses a constant-frequency signal (the carrier) to which
a variation of some kind is applied, varying with the information
to be delivered. Several types of variations can be applied:
- Amplitude modulation (AM) -- the voltage (amplitude) of the carrier
is varied according to the data
- Frequency modulation (FM) -- the pitch (frequency) of the carrier
is varied according to the data
- Phase modulation (PM) -- the phase of the carrier
is varied according to the data; that is, the starting point of the
carrier wave is moved around. For example, to deliver 3 bits of data,
8 possible phases must be used: 0°, 45°, 90°, ..., 315°.
- Quadrature amplitude modulation (QAM) -- phase modulation (PM) combined
with two possible voltage levels adds one bit to yield 4 bits of data
(16 possible values).
- association
- When a client becomes part of a network it is said to have
associated. This is accomplished by scanning.
- asynchronous transfer mode (ATM)
- A technology for wide area networking. Uses fiber-optic media. 622 Mbps.
- authentication
- Authentication is the process of determining the identity of a user.
The most common form of authentication is by user name and password.
Other forms use digital certificates, digital signatures, etc.
Many have been tried with wifi including:
- ARAP
- CHAP
- EAP
- MS-CHAP
- MS-CHAPv2
- PAP -- Password Authentication Protocol: Passes the user name and password in plaintext.
It is defined in RFC 1334.
- PPP -- Point-to-Point Protocol:
An encapsulation protocol for transporting IP traffic
over point-to-point links.
PPP is also a standard for the assignment and management of
IP addresses, asynchronous (start/stop) and
bit-oriented synchronous encapsulation,
network protocol multiplexing, link configuration, link quality testing,
error detection, and option negotiation for
such capabilities as network layer address negotiation and data-compression negotiation.
PPP supports these functions by providing an extensible Link Control Protocol (LCP)
and a family of Network Control Protocols (NCPs)
to negotiate optional configuration parameters and facilities.
In addition to IP, PPP supports other protocols including
Novell's Internetwork Packet Exchange (IPX) and DECnet.
(Reference: Cisco.)
- SLIP -- Serial Line Internet Protocol: Documented in
RFC 1055,
was the first protocol for relaying IP packets over dial-up lines.
It defines an encapsulation mechanism but little else.
There is no support for dynamic address assignment,
link testing, or multiplexing different protocols over a single link.
SLIP has been largely supplanted by PPP.
- Token -- Some authentication schemes require a token, possession of a physical object
such as a key fob or slim card.
- attenuation
- Transmitted signals weaken (are attenuated) for a variety of reasons:
- Distance between transmitter and receiver
- Absorption by walls, floors and other obstacles
- Scattering due to reflection by irregular surfaces
- Diffraction (bending around objects)
- Refraction (bending of a wave as it passes through an object)
- Multipath distortion
These attenuations are more pronounced at higher frequencies,
e.g. 5 GHz signals tend to be attenuated more easily than 2.4 GHz signals.
- authorization
- Authorization is the process of determining which service(s)
a user is permitted to use and to what extent.
It requires that the identity of the user be previously
established by some authentication process.
The authenticated user ID is then authorized by
lookup in a file, table, database, or authorization
service such as LDAP.
- automatic private IP address (APIPA)
- On TCP/IP networks (including wireless ones) devices
can communicate only if they are equipped with IP addresses.
The two most common mechanisms by means of which devices receive
these addresses are static and DHCP.
However, it may occasionally happen that a wireless network
has neither of these.
It is reasonable that a collection of devices
on an isolated wireless network to be able to communicate
among themselves without an extensive infrastructure nor
network configuration expertise on the part of its users.
In consumer situations it should just work.
In home networks where a printer is often shared among several
computers, such a scheme is especially useful.
APIPA is Microsoft's solution to this problem.
It is meant for nonrouted small home or business environments
with up to 25 clients.
When a client boots up, has no static IP address,
and cannot find a DHCP server, it uses APIPA to
assign itself an IP address in the 169.254.xxx.xxx block.
Since this block is not routable (Internet routers ignore it)
there is no risk of conflicts with devices on networks elsewhere
in the world even if the isolated network becomes Internet-connected.
The client also configures itself with a default class B subnet mask
of 255.255.0.0. It uses the self-configured IP address until a DHCP
server becomes available, checking every five minutes.
If it detects a DHCP server on the network, APIPA stops
and the DHCP server replaces the IP address with a dynamic one.
APIPA is a fairly new solution (available starting with Windows 98.)
Previously, devices
received 0.0.0.0 as their default addresses which, because
it was duplicated on several devices, prevented
them from communicating at all.
- basic service set (BSS)
- Collectively, an access point
plus a set of wireless clients (usually laptop computers).
See also
EBSS
and
IBSS.
- beacon frame
- Access points periodically announce the time, the data
rates they support and, optionally, their SSID.
(This latter datum can be withheld for security; withholding it prevents
passive scanning.)
These broadcasts enable wireless clients to find and connect
to wireless networks. The data are grouped in a standardized
sequence termed a beacon frame.
- Bluetooth
- Named for a Norwegian pirate by Ericsson, the Norwegian company
that invented it, Bluetooth is a wireless technology that, like
802.11b
and
802.11g
operates in the 2.4GHz band of the radio spectrum.
It is also called piconet, scatternet, and personal area networking (PAN).
Its application is
"walk-up connectivity" -- low-power wireless and data communications by
cellphones, PDAs, and other personal devices.
Communication occurs over short distances, typically within a room.
It uses a "discovery" process in which Bluetooth devices, without
user intervention, detect each other and exchange capabilities and
permissions.
Bluetooth radio modules operate at Power Class 2 (2.5 mW).
Transmission rate is 1 Mbps.
Within the 2.4 GHz ISM band, Bluetooth uses all 79 channels.
Its modulation technique is 2-GFSK
with FHSS at 1600 hops/second.
A piconet is a group of Bluetooth devices communicating together.
One member of the group acts as a master and determines the hop sequence.
A scatternet is a bunch of piconets.
The Bluetooth standard defines five modes.
A Bluetooth device is, at any given moment, in one of these modes:
- Standby
- Sniff/inquire
- Page
- Active
- Park/hold
- bridge
- Devices that interconnect two or more networks are termed bridges.
As they are often used to connect local area networks (LANs) to
wireless LANs (WLANs), access points are
often termed bridges.
- broadband wireless communications
- Broadband wireless is a collection of overlapping technologies
that enable wireless high-speed communications.
The collection includes wifi,
WiMAX, 3G and Ultra-Wideband (UWB) technologies.
- broadband wireless access (BWA)
- See WiMAX
- Carrier Sense Multiple Access (CSMA)
-
When two transmitters transmit simultaneously, a collision occurs and communication fails.
There are two strategies for dealing with this.
One strategy is point coordination function (PCF)
(also called polling) in which the transmitters take turns in
a defined sequence.
The other strategy is CSMA: transmitters listen before sending
and, if they detect other traffic, they wait before transmitting.
There are two variations on CSMA:
CSMA/CD and CSMA/CA.
- CSMA/CA -- CSMA with collision avoidance.
After having made sure the medium is clear (no traffic),
all transmitters (not just those that have detected traffic) always
wait a random amount of time before transmitting.
The receiver then sends an acknowledgement to the sender.
If the sender receives no acknowledgement, it sends again.
Wifi networks use CSMA/CA.
CSMA/CD wouldn't work in wifi due to the
hidden node problem.
- CSMA/CD -- CSMA with collision detection.
Transmitters don't wait but go ahead and
transmit and deal with the consequences when collisions occur.
If it detects a collision, a transmitter waits a random delay time
and then attempts to re-transmit the message.
If the transmitter detects a collision again,
it waits twice as long to re-transmit.
This is called exponential back off.
Ethernet networks use CSMA/CD.
- Cisco
- A Californian manufacturer of networking equipment of all kinds,
Cisco is the dominant wifi vendor. Some of the terminology they use
is their own. Here is a translation table.
| Cisco Term | Generic Term |
| home radio network name | SSID |
| home network | ad hoc (IBSS) mode |
| Aironet Client Utility (ACU) | access point configuration software |
| Link Status Meter (LSM) | NetStumbler and others |
| Client Encryption Manager (CEM) | WEP configuration software |
- code division multiple access (CDMA)
- A technique for sharing a medium using
spread spectrum
and simultaneous transmissions, each with its own encoding.
- Colubris
- A Canadian manufacturer of industrial-strength wifi equipment.
See www.colubris.com.
Other manufacturers include 3Com, Belkin, Cisco, D-Link, Linksys
(recently acquired by Cisco) and Netgear.
- complementary code keying (CCK)
- An error detection and correction technique
that involves XORing the data with 64 eight-bit code words.
By adding redundant information to a transmission, it
enables the receiver to detect and correct errors
without requiring retransmission.
- content filtering
- In a variety of situations -- particularly public ones -- it
is inappropriate to permit computer users to access pornography
or other inappropriate material.
Techniques for restricting such access are termed content filtering.
One way to accomplish this is by means of a DNS proxy.
- dBm (decibels)
- The decibel (abbreviated dBm) is a unit of measure of the power
of transmission signals. Another way of measuring the strength of
these signals is in milliwatts (mW -- thousandths of
a watt). The milliwatt is a linear measure whereas the decibel is
logarithmic (computed as powers of the base of natural logarithms,
2.71828 which for ease of computation is often rounded to 3).
dBm measures power relative to one milliwatt.
1 mW equals 0 dBm. The strength of a signal having power less than 1 mW is
measured in negative numbers of dBm.
For example, -35 dBm is a good, healthy signal
whereas -90 dBm is barely usable or perhaps even too weak to use.
Because dBm is logarithmic, increasing a signal's strength by 3 dBm
means doubling it. Decreasing it by 3 dBm means halving it.
Increasing it by 10 dBm means increasing it tenfold.
Thus, 0 dBm is 1 mW, 10 dBm is 10 mW, 20 dBm is 100 mW, and
30 dBm is 1000 mW (1 watt). 200 mW, the maximum wifi transmission
power permitted by the FCC in the United States, equals 23 dBm.
- digital modulation
- Techniques include:
- RZ -- Return-to-zero: voltage spike = 1, no voltage = 0
- NRZ -- Non-return-to-zero: voltage high = 1, no voltage = 0
(hence the name)
- Polar NRZ -- Positive voltage = 1, negative voltage = 0
- ASK -- Amplitude shift keying: carrier on = 1, carrier off = 0
- FSK -- Frequency shift keying
- GFSK -- Gaussian frequency shift keying
- PSK -- Phase shift keying
See also modulation and
analog modulation.
- direct-sequence spread spectrum (DSSS)
- Wifi is a spread spectrum radio technology;
it uses several frequencies
at once, not just one frequency like, say, the FM radio we listen to in our cars.
DSSS is one of two spread spectrum techniques used in wireless computer networks.
(The other is frequency-hopping spread spectrum, FHSS.)
802.11 explicitly calls for DSSS.
In DSSS, data at the sending station is combined
with a fixed bit sequence called a chipping code.
The chipping code divides the data according to a spreading ratio.
It is a redundant bit pattern that is applied to each bit that is transmitted.
This enables error detection and correction.
If a bit is lost or garbled in transmission,
thanks to the redundancy it can be reconstructed at the receiving end
without requiring retransmission.
Several chipping codes have been designed.
At transmission rates of 1 or 2 Mbps,
DSSS uses one called a Barker code which is four bits in length.
The Barker code is XOR'ed with each data bit.
Thus, the number of bits that must be transmitted
is four times the actual amount of data.
The apparent inefficiency of chipping codes is more than compensated
by the use of the spread spectrum.
At transmission rates of 5.5 or 11 Mbps,
DSSS uses Complementary Code Keying (CCK)
which XORs the data with 64 eight-bit code words.
- dynamic host configuration protocol (DHCP)
- DHCP is a computer network protocol
for centrally assigning and keeping track of Internet Protocol (IP) addresses.
Each computer that accesses the Internet must first have an IP address.
The IP address can be manually entered into the computer or it can be
done automatically by a DHCP server.
The automatic method requires less effort by the user and enables centralized
management of this network resource.
Access points often provide DHCP server service
as one of their features.
- distributed coordination function (DCF)
- The set of rules in 802.11 that call for carrier sense multiple access
collision avoidance (CSMA/CA).
- demilitarized zone (DMZ)
- Occasionally, NAT firewalls cause problems.
For example, an application program such as a game or videoconferencing
will be unable to function under NAT.
To bypass NAT, some
access points
offer a feature named DMZ.
This enables a computer on the local area network to be placed
outside of the NAT firewall.
Computers in the DMZ are not protected from hacker attacks.
Hence, it is best to place them there only temporarily.
The details of how to use the DMZ vary from one access point to
another; see the user manual.
- diversity antenna system
- At high frequencies such as those used by wifi (2.4 GHz and 5 GHz)
multipath distortion is a difficult problem.
One solution -- termed diversity --
is to use two identical antennas separated by a space
of several inches and switch from one to the other (only one is
active at any given moment) when the
signal-to-noise ratio (SNR) is high.
Transmission is done on the antenna on which a signal was
most recently received.
The best access points
use diversity antennas.
When setting up such an access point, be careful to do it properly:
- Install identical antennas. They must have the same gain
and the same coverage pattern.
When the access point switches between them,
the coverage pattern must not change.
- Connect them so they have the same polarization.
- Direct them so they have the same coverage area.
Don't use directional antennas pointed in different directions
nor install omni-directional antennas tilted in two different directions.)
- If you disable diversity, be sure to connect the antenna
to the active antenna port. Without the 50 ohms of resistance
an antenna provides, the radio would eventually burn up.
- domain name system (DNS)
- DNS is the mechanism by means of which
text names such as www.wifi-italia.com are translated to
numerical Internet Protocol (IP) addresses such as 192.100.68.211.
Humans prefer (and can remember) the text names but internally the Internet
communicates numerically.
- DNS proxy
- A software application that runs on a server computer.
It intercepts requests for Internet resources and
sometimes redirects them. A common purpose for doing this
is content filtering.
- digital subscriber line (DSL)
- A DSL line is an ordinary telephone wire used
for digital data.
It is a consumer-grade service provided by local phone companies
for Internet access from the home.
DSL circuits are faster than conventional analog modems
and have largely replaced them.
DSL delivers 1.5 Mbps of bandwidth over conventional
copper pairs (wire).
It achieves this speed by using OFDM.
The ordinary telephone (POTS) can be used simultaneously.
Two common types of DSL are ADSL (Asymmetric DSL -- fast downloading, slow
uploading -- less expensive and commonly used for consumer applications)
and SDSL (Symmetric DSL -- fast communication in both directions, used
for connecting server computers to the Internet.
At the customer's end of the wire, a device named a DSL router is
required (sometimes incorrectly called a DSL modem.)
The computers and access points connect to the router.
- extended basic service set (EBSS)
- Collectively, several access points perhaps with some
overlapping coverage area, plus a set of wireless clients
(usually laptop computers).
See also
BSS
and
IBSS.
- extensible authentication protocol (EAP)
-
EAP is the generic concept of protocols for
the secure transportation of authentication data
such as passwords over 802.11 wireless networks.
For a superb set of definitions of security terminology, see
RFC 2828.
An EAP-based protocol is communicated
between an access point and an authentication server such as a
RADIUS.
The access point initiates the conversation with the server
when it is contacted by a client (most often a PC)
requesting access to the wireless network.
A "back-end" server actually does the authentication
while the access point merely passes through the authentication exchange.
Typically, the server will send an initial Identity Request
followed by one or more Requests for authentication information.
The client sends a Response packet in reply to each Request.
The server ends the authentication phase with a Success or Failure packet.
EAP is not an implementation, it is a framework for implementations.
It is defined in
RFC 2284.
It supports a variety of authentication mechanisms.
Several implementations have been created
and others are under development.
Implementations include:
- EAP-AKA -- Authentication and Key Agreement: Mutual authentication in UMTS mode
and one-way authentication in GSM mode. Includes a description of the signaling procedures
on the various interfaces for WLAN convergence with 3G cellular networks.
- EAP-FAST -- Flexible Authentication via Secure Tunneling:
Tunneled, mutual
authentication protocol without PKI certificates. The tunnel is established with protected-access
credentials provisioned and dynamically managed through AAA servers.
This protocol was developed by Cisco and has been submitted as
a draft (proposed standard) to the IETF.
Since it's only a draft, it doesn't have an RFC number.
The following succinct description is quoted
from that draft as of February, 2004, EAP
Flexible Authentication via Secure Tunneling (EAP-FAST):
EAP-FAST enables secure
communication between a client and a server by using the EAP based
Transport Layer Security (EAP-TLS) to establish a mutually
authenticated tunnel. However, unlike current existing tunneled
authentication protocols, EAP-FAST also enables the establishment
of a mutually authenticated tunnel by means of symmetric
cryptography. Furthermore, within the secure tunnel, EAP
encapsulated methods can ensue to either facilitate further
provision of credentials, authentication or authorization policies
by the server to the client.
Benefits of EAP-FAST include:
- Does not require enforcement of a strong password policy.
- Does not require digital certificates.
- Supports a variety of user and password database types.
- Supports password expiration and change.
- EAP-LEAP -- Lightweight Extensible Authentication Protocol:
Cisco-proprietary solution for mutual authentication using dynamic WEP keys.
Prone to dictionary attack and identity exposure.
Can be used only with Cisco access points.
It serves to communicate authentication data between
Cisco Aironet wireless LAN access points and the Cisco Secure Access Control Server.
To satisfy the authentication challenge specified by LEAP,
the PC of the user to be authenticated must first supply
a valid user ID and later a correct 24 octet MSCHAP response
to an 8 octet random MSCHAP peer challenge.
If it satisfies both tests, the PC receives a session key
which the Cisco access point recognizes and
permits the PC's the session to proceed.
LEAP was superceded in 2003 by PEAP.
- EAP-MD5 -- Message Digest 5 Challenge Handshake Authentication Protocol:
Encrypts the authentication credential (password) into an MD5 hash and compares them at the
authentication server. Similar to CHAP and prone to identity exposure,
dictionary attacks, session hijacking, and man-in-the-middle attacks.
- EAP-PEAP -- Protected Extensible Authentication Protocol:
Tunneled authentication protocol
using server certificates for mutual authentication;
supplicant authenticates using MS-CHAP or GTC.
Uses one PKI certificate at the authentication server.
Both Microsoft and Cisco offer implementations but they're not interoperable.
PEAP was developed by Microsoft, Cisco and RSA Security,
and is now an IETF draft standard.
This EAP implementation uses tunneling (see below)
between clients and an authentication server.
Though PEAP is not proprietary, Microsoft's Windows XP
is currently the only operating system that supports it.
- EAP-SIM -- Subscriber Identity Module:
Mutual authentication and session key agreement using GSM-SIM.
This helps converge WLAN and GSM/GPRS cellular networks.
It does not provide session independence between different sessions.
- EAP-TLS -- Transport Layer Security: Authentication based on PKI certificates.
The server and the supplicant mutually authenticate using their respective certificates.
This is the most secure authentication mechanism.
It is resistant to man-in-the-middle attack.
However, it demands significant complexity on the client side.
- EAP-TTLS -- Tunneled TLS: Two-phased mutual authentication process:
the server authenticates to the supplicant with a certificate,
then the supplicant authenticates using PAP, CHAP, MS-CHAP or GTC.
It requires only one PKI certificate at the authentication server.
It doesn't prevent identity-hiding.
This EAP was developed by Funk Software and Certicom
and is now an IETF draft standard.
It is an alternative to PEAP.
Without the backing of Microsoft and Cisco, its survival is dubious.
- frequency division multiple access (FDMA)
- A technique for sharing a transmission medium in which a band of
frequencies is split into narrow channels.
- FireWire
- The trade name for the communication protocol standardized as IEEE 1394.
400 Mbps.
- forward error correction (FEC)
- FEC is an error correction scheme used by 802.11a.
Of 802.11a's 52 subchannels (distinct carrier signals, each with its own
frequency, 300 kHz apart):
- 48 are for data, and
- 4 are for error correction.
The error correction channels carry secondary copies of the data.
They eliminate the need for retransmission in the event of errors.
- fragmentation
-
The 802.11 specification calls for the use
of a technique named fragmentation in order to provide
communication of acceptable reliability.
Fragmentation is defined as part of the MAC sublayer
of
OSI's link layer (layer 2).
Fragmentation is a collision-avoidance strategy.
A collision occurs when two transmitters
transmit simultaneously. Their transmissions become garbled.
Several strategies have been devised to prevent this;
fragmentation is the one espoused by 802.11.
The underlying principle is that
transmssions that are shorter in duration are less likely
to collide with other transmissions.
Fragmentation keeps transmissions brief.
Longer transmissions are divided into several shorter ones.
Each of these shorter transmissions is termed a frame.
Smaller frames can be communicated with greater reliability
because they present fewer opportunities for transmission errors.
However, fragmentation comes at a cost.
Because each frame must be acknowledged by the recipient
and also has its own header and demands a complete program
cycle to be processed, smaller frames demand more computing resources
for a given amount of data, i.e. are less efficient.
The overhead can be substantial, but in a noisy environment
this may be unavoidable.
- fragmentation threshold
- One of the settings on an access point
(don't mess with this unless you know what you're doing!) is
the maximum frame size, termed fragmentation threshold.
Transmissions whose size exceeds this threshold are divided
into smaller ones.
The purpose of this fragmentation
is to improve the reliability of transmission.
Where there is strong radio interference or other impediments to
reliable communication, it may be necessary to reduce the fragmentation
threshold.
- frequency hopping spread spectrum (FHSS)
- This is a spread spectrum technique
in which, for purposes of security, a transmission consists of a short burst
at one frequency, then a short burst at another, etc.
In order for the receiver to receive the transmission,
it must correctly hop from one frequency to the
next in the same sequence as the transmitter.
This demands a hopping code that is known at
both ends of the transmission but not to eavesdroppers.
The FHSS algorithm includes error detection and re-sending.
In orthogonal FHSS, several messages are delivered simultaneously,
each with its own hopping code, none of which use the same frequency simultaneously.
FHSS has several parameters including:
- Hop time -- how long it takes to hop from one frequency to the next
- Dwell time -- how long it stays on a frequency once it has hopped
As implemented in 802.11,
FHSS uses channels whose frequencies are separated by 1 MHz,
78 hopping sequences, minimum hopping distances of 6 MHz, and
a minimum hop rate of 2.5 hops/second.
- Gaussian frequency shift keying (GFSK)
- A digital modulation technique,
GFSK is implemented in the PMD.
As implemented in 802.11,
at a transmission speed of 1 Mbps it uses 2 levels of frequency shift.
At 2 Mbps it uses 4 levels.
- hidden node problem
- One of the difficult problems in wireless networks is the
hidden node problem.
If two clients were to transmit simultaneously ("collide"),
their transmissions would become garbled.
For reliable communication, only one transmitter can transmit at a time.
To ensure this, a node in the network first "listens" to make sure no
others are transmitting before it transmits.
Ordinarily, all the clients on a wireless network can "hear" each other
and thus coordinate their transmissions to prevent collisions.
However, occasionally two clients will each be capable of communicating
with the access point but not with each other and thus may collide.
(In the diagram, transmitter 1 can "hear" the access point but not
transmitter 2; transmitter 2 can "hear" the access point but not
transmitter 1; hence the two transmitters might attempt to transmit simultaneously.)
This is termed the hidden node problem.
This technique of sharing a medium by first making sure it's not already in use
belongs to a class of solutions termed carrier sense multiple access (CSMA).
There are two ways to overcome the hidden node problem:
request-to-send (RTS) protocol
and
point coordination function (PCF) (sometimes called polling).
- Hiperlan-2
- Hiperlan is a European competitor to 802.11.
It is developed by the European Telecommunication Standards Institute (ETSI).
The current release is Hiperlan-2.
Like 802.11a, Hiperlan uses the 5 GHz band
with a transmission speed of 54 Mbps.
It has some advantages over 802.11 though it is losing
the marketing war.
Here is a technical comparison of Hiperlan and 802.11.
In the PHY layer,
Hiperlan and 802.11 are the same.
The differences are in the link layer (see OSI).
In Hiperlan's version of the link layer, two features are added:
- Radio link control
- Logical link control
Like 802.11, Hiperlan has error correction.
Unlike 802.11, it has automatic channel selection
(in 802.11 a channel is selected manually at the
time of configuration.)
Also unlike 802.11, Hiperlan supports roaming.
In addition to laptop computers,
it supports a broad variety of clients including cell phones,
ATM, and Firewire.
Hiperlan manages media contention differently than 802.11.
It does not use CSMA/CD;
instead, control of the RF medium is centralized at the
access point.
The access point informs its clients (called mobile terminals, MTs)
when they may transmit, using a TDMA algorithm.
During transmission, each client has use of the entire frequency band
for a brief time slot.
Time slots are allocated dynamically with a Quality of Service (QoS)
priority algorithm. Thus, unlike 802.11, Hiperlan can reliably deliver
time-sensitive data especially audio and video.
Hiperlan has a complete complement of security features, especially
including encryption.
Access points and MTs each authenticate the other.
- hypertext transport protocol (HTTP)
- Essentially an adaptation of the protocol of e-mail, HTTP is
the "language" spoken between browsers and web servers for
requesting and delivering web pages and multimedia.
- infrared
- Infrared is a portion of the electromagnetic spectrum
just below light. It is another technology (other than
the radio waves used by wifi) for
wireless networking. It is promoted and standardized by
the Infrared Developers Association (IrDA), especially
a wireless printer protocol.
Communication via infrared light uses pulse position modulation (PPM)
and slot times.
Infrared is more secure than wifi because it is line-of-sight;
it cannot pass through walls or obstacles.
Its range is shorter than that of wifi.
- independent basic service set (IBSS)
- Collectively, a set of wireless clients connected
without an access point, also known as peer-to-peer and
ad hoc operating modes.
See also
BSS
and
EBSS.
- Industrial, Scientific and Medical (ISM) band
- ISM is one of many portions of the radio frequency spectrum
allocated by the FCC for a particular type of use.
The ISM band is intended for use without requiring a license.
Transmissions are restricted to low power.
Wifi is one of the unlicensed uses of the ISM band.
The ISM band consists of a set of frequencies 83.5 MHz wide,
from 2.4 GHz to 2.4835 GHz.
- The Institute of Electrical and Electronic Engineers (IEEE)
- The IEEE
is an international organization that develops standards
for hundreds of electronic and electrical technologies.
It uses numerical codes (like the Dewey Decimal system in libraries)
to identify the various technology families.
The 802 subgroup of the IEEE develops standards
for local and wide area networks with the
802.11 section of the subgroup responsible for
standards for wireless local area networks.
- interframe space (IFS)
- A frame (sometimes called a packet) is a unit of transmission.
Typically, a large message is divided into several frames
which are transmitted independently and reassembled at the
receiving end.
A frame consists of: preamble + header + data.
Separating pairs of frames are interframe spaces (IFS).
There are several types of IFS:
- SIFS -- short IFS, used for ACK messages
- PIFS -- PCF IFS (point coordination function, polling)
- DIFS -- DCF contention
- Internet Engineering Task Force (IETF)
- The IETF is an industry consortium like the IEEE.
It establishes and documents the technology "standards" upon
which the Internet is built.
(They're not really standards because those can be established
only by governmental decree. However, they are accepted as such.)
The official documents created by the IETF are termed
Requests for Comments (RFCs).
- logical link control (LLC) sublayer
- One of two sublayers of the link layer (second from the bottom)
of the OSI model of network communication protocols.
802.11's LLC sublayer is identical to that of wired networks.
All 802.11-specific features of the link layer are confined to the other
sublayer, the MAC sublayer.
- media access control (MAC) sublayer
- One of two sublayers of the link layer (second from the bottom)
of the OSI model of network communication protocols.
For purposes of discussing the architecture of wifi networking protocols,
the OSI link layer is divided into two sublayers: LLC and
MAC.
All 802.11 link layer features are confined to the MAC sublayer.
802.11's LLC sublayer is identical to that of wired networks.
802.11's MAC sublayer calls for CSMA/CA (collision avoidance)
instead of CSMA/CD (collision detection).
It also calls for RTS and fragmentation.
- media access control (MAC) address
- Within an ethernet local area network (LAN), machines identify each other
by 48-bit MAC addresses, sometimes called ethernet or physical addresses.
Every device that can be connected to a LAN has a unique MAC address.
This address is assigned at the time the device is manufactured.
It is burned into the device's firmware chip.
Each manufacturer receives a block of millions of addresses for this purpose.
(Here
is a list of all the manufacturers of ethernet devices and their address blocks.)
These adresses are usually notated as sequences of hexadecimal digits such as
00-50-00-7B-D2-77.
These are sometimes written with colons, e.g. 00:50:00:7B:D2:77
instead of dashes.
For broadcasting (sending to all devices on a network) a special MAC address
is reserved:
FF-FF-FF-FF-FF-FF.
- mesh network (MWLAN)
-
Mesh technology seeks to overcome the short range of 802.11 networks.
As of this writing, it is hampered by a lack of standards.
There are several incompatible MWLAN systems from different manufacturers.
Mesh extension is included in the 802.16 standard,
but it appears likely that 802.11
will develop standardized interoperable wireless mesh first.
The yet-to-be-developed standard already has a designation
-- 802.11s -- and the IEEE has set up an 802.11s working group
to write the specification.
The result may be that when WiMAX is finally deployed
it will face healthy competition from 802.11s.
Mesh network topology is like that of ad hoc wifi networks.
In a full mesh network,
each node is connected directly to each of the others.
In a partial mesh topology, nodes are connected
to some but not all of the other nodes.
It is able to support nodes that are mobile (roaming).
Clients may be laptop computers, PDAs, mobile phones, etc.
There are also static nodes that form the infrastructure.
The official IEEE definition of 802.11s:
An IEEE 802.11 Extended Service Set (ESS) Mesh* is a collection
of APs interconnected with wireless links that enable
automatic topology learning and dynamic path configuration.
[It is] an extension to the IEEE 802.11 MAC.
[It] supports both broadcast/multicast and unicast delivery
at the MAC layer using radio-aware metrics
over self-configuring multi-hop topologies.
[It uses] IEEE 802.11i security mechanisms...
in which all of the APs are controlled by a single logical administrative entity.
- michael
- With 802.11 and WEP,
data integrity is provided by a 32-bit integrity check value (ICV)
that is appended to the 802.11 payload and encrypted with WEP.
However, this does not prevent a hacker using cryptanalysis
from changing bits in the encrypted payload and
updating the encrypted ICV without being detected by the receiver.
In WPA, this form of attack is prevented by an algorithm called Michael.
Michael calculates an 8-byte message integrity code (MIC)
that is placed between the data portion of the 802.11 frame and the 4-byte ICV.
The MIC field is encrypted together with the frame data and the ICV.
Michael also provides replay protection.
A new frame counter in the IEEE 802.11 frame is used to prevent replay attacks.
- modem
- "Modulator-demodulator" -- a device that converts digital signals
to and from computers from and to analog signals as required
for for transmission over telephone lines.
- modulation
- To modulate a signal is to add information to it.
At the receiving end, the signal is demodulated;
the information is extracted from it.
There are numerous modulation techniques.
Some are analog, such as frequency modulation (FM) in which
the information is encoded as a series of variations to the
frequency of the signal, and amplitude modulation (AM) in
which the magnitude of the signal is varied.
By these means music and speech is transmitted to
ordinary radios.
(See analog modulation.)
Other modulation techniques are digital.
These include
phase shift keying (PSK)
and
pulse position modulation (PPM).
(See digital modulation.)
- multipath distortion
- When a radio signal arrives at a receiver by two different paths,
it becomes garbled because the paths are inevitably of unequal lengths.
Multiple paths are typically due to reflections off metallic
objects in the path between transmitter and receiver.
- netmon
- Netmon is a program that monitors networks.
It (or programs like it) is an essential part of every NOC.
Its primary function is to periodically ping each of the sites
it monitors and alert someone if there's no reply.
It also records the results of this activity and generates
a variety of historical displays and analyses of performance.
- network access server (NAS)
- A NAS is a piece of equipment that directly accepts users' connections.
For example, in a wireless network the device serving
as the NAS is the access point.
In a dialup network, the NAS is the switch that connects the
receiving modems to the computers providing the dialup services
(e.g. e-mail and web browsing.)
- network address translation (NAT)
- NAT is used on local area networks for two purposes:
security and Internet access.
To the external network (outside the organization)
only the NAT server is visible, and it appears as a single Internet address.
However, inside the network there can be dozens or even hundreds
of machines. The NAT server assigns to each its own unique internal
address. These addresses are not revealed to the outside world
and in any case are not routable. Hence, these machines cannot
be contacted from the outside and thus are protected from attack.
The second purpose is achieved by not requiring each machine to
have an Internet-wide unique IP address; it must be unique only
within the local network. Access to the Internet is provided
through the NAT server which conceals the internal addresses.
- network operations center (NOC)
- Networks are administered by experts working in a physical
location termed a NOC.
- Network Stumbler (NetStumbler)
- This is our favorite Windows program for detecting 802.11a, b, and g WLANs.
It has several uses: measuring signal coverage ("site surveying"),
detecting other networks that may be causing interference,
detecting rogue (unauthorized) access points,
and wardriving (see scan).
Download it for free from
www.netstumbler.com.
- Open Systems Interconnection (OSI) model
- To help in decomposing into manageable pieces
(termed layers)
the problem of designing networks,
the telecommunications industry has generally adopted a theoretical model called OSI.
It was originally proposed by the International Standards Organization (ISO).
The elements of wifi technology apply to the bottom two layers (layers 1 and 2).
| Layer Number | Layer Name | Wifi Component |
| 7 | application |
| 6 | presentation |
| 5 | session |
| 4 | transport |
| 3 | network |
| 2 | link | LLC |
| MAC |
| 1 | physical | PLCP |
| PMD |
| What Happens at Each Layer |
| Layer Number | Layer Name | Description |
| 7 | Application | The application layer provides
the network services that users see, such as e-mail, the web,
ftp, telnet, DNS, NIS, NFS, and instant messaging. |
| 6 | Presentation | This layer provides independence
from differences in data representation (e.g. encryption)
by translating from application to network format and back.
In the presentation layer, data is transformed into the form
that the application layer can accept.
This layer formats and encrypts data for transmission,
providing freedom from compatibility problems. It is sometimes called the syntax layer. |
| 5 | Session | This layer
establishes, manages and terminates connections between applications.
It layer sets up, coordinates, and terminates conversations, exchanges,
and dialogs between the applications at each end.
It deals with session and connection coordination.
|
| 4 | Transport | This layer provides
transparent transfer of data between nodes (sometimes termed hosts
and is responsible for end-to-end error recovery and flow control.
It ensures complete data transfer.
Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) operate in this layer.
|
| 3 | Network | This layer provides switching and routing technologies,
creating logical paths ("virtual circuits") for transmitting data from node to node.
Routing and forwarding are functions of this layer,
as well as addressing, internetworking, error handling, congestion control and packet sequencing.
Internet Protocol (IP) addresses (such as 192.100.68.37) operate in this layer.
|
| 2 | Data Link | The data link layer defines the format of data on the network.
A commonly-used data format is the network data frame, often called a packet.
It includes a checksum, source and destination address, and data.
The largest packet that can be sent through the data link layer defines
the Maximum Transmission Unit (MTU).
The data link layer handles the physical and logical connections
to the packet's destination, using a network interface.
For example, a host connected to an ethernet network would have
an ethernet interface to connect to the outside world,
and a loopback interface to send packets to itself.
MAC addresses are defined in this layer. |
| 1 | Physical | The physical layer
is the medium itself, e.g.
coaxial cable, fiber, unshielded twisted pairs (UTP), or radio waves.
All media are functionally equivalent.
The main difference is in convenience and cost of installation and maintenance.
Converters from one media to another operate at this level. |
- orthogonal frequency division multiplexing (OFDM)
- This is the the technique by which 802.11a and others overcome the physical
limitation to 20 Mbps due to multipath distortion
which it would otherwise have.
It splits the data into several streams.
Each stream is sent on a distinct channel in
parallel (simultaneously). Each channel actually
uses a lower speed hence there is less multipath distortion
yet higher speed in the aggregate.
The streams are reassembled into the original data at
the receiving end.
- physical layer convergence procedure (PLCP)
- PLCP is one of the two sublayers of wifi's PHY layer
in the OSI network model.
The other sublayer is PMD.
Located in the PLCP software is the logic that listens to the airwaves
for silence before broadcasting, and that receives data from the MAC
sublayer and formats it into frames and the
interframe spaces that separate them.
A frame consists of a preamble + a header + data.
The preamble and header are always transmitted at 1 Mbps.
Depending on how well the medium is performing, the data portion
of the frame is transmitted at 1, 2, 5.5, or 11 Mbps.
- physical medium dependent (PMD)
- PMD is one of the components of the OSI
PHY layer as adapted for 802.11.
In this layer is implemented the electrical transmission method:
DSSS, FHSS,
or diffused infrared, and, for
error correction, Barker code (at 1 or 2 Mbps)
or CCK (above 2 Mbps).
- phase shift keying (PSK)
- Phase shift keying is a digital modulation
technique in which the phase of the carrier signal is varied.
In the simplest type of phase shift keying, the phase is shifted by 180 degrees
to indicate a one. A zero is indicated by no shift. By increasing the number
of phase variations, more bits can be delivered. For example, in quadrature
PSK (QPSK) the phase is shifted by 90, 180, or 270 degrees hence delivering
two bits of data instead of just one.
- plain old telephone service (POTS)
- Also sometimes called dial tone.
- point coordination function (PCF)
- PCF (also termed polling) is a technique for enabling
multiple transmitters to share a medium.
Other such techniques include RTS and
CSMA/CD.
If two transmitters transmitted at the same time their
transmissions would be garbled.
The set of techniques known collectively as CSMA seek to prevent that.
PCF is one such technique.
In wifi with PCF, the access point
acts as "point coordinator".
It broadcasts a beacon frame that tells
the clients to shut up for some period of time.
Then it grants exclusive use of the medium to a single client.
That client proceeds to transmit. When it's done, the client
lets the access point know by transmitting a null data frame.
This technique is especially suited for time-sensitive data
such as video.
802.11 implements PCF in the MAC sublayer
of OSI's link layer.
- polling
- See PCF
- port
- A port is a number in one of the fields of a TCP packet.
It is used by the recipient of the packet to determine which
program (if any) to pass it to. Usually, the software that
makes this determination is the operating system of the server
computer (or, on some Unix machines, a program named inetd).
This computer is typically running several programs simultaneously,
each providing some service to other programs or to other computers
on the network.
Examples of these services include e-mail,
name service (DNS), web service, database management, and many more.
Each of these services communicates with its clients by means
of a specialized protocol.
For example, port 80 and the HTTP protocol are used by browsers communicating with web servers.
Port 110 and the Post Office Protocol (POP)
are used by e-mail clients communicating with a common type of e-mail server.
Here
is the up-to-date, exhaustive list of port numbers.
- Point-to-Point Protocol over Ethernet (PPPoE)
- PPPoE is a protocol used by many DSL Internet Service Providers.
- power management
- For laptop computers and other portable devices,
power management is always an engineering challenge.
A number of strategies have been devised to exact the
maxiumum possible battery life.
For example, built in to the device controllers in
the operating systems of laptop computers are such
modes as sleep, standby and hibernation.
In these modes, the screen is dimmed or blanked,
disk drives are spun down, and wireless network
interfaces are disabled except for brief, periodic
reawakenings to check for new data.
To support this latter power management feature,
many access points buffer
data for sleeping clients. When the client awakes
and contacts the access point it then collects its
buffered data.
There are several power management modes in which a
wireless device may operate, including:
- Constant Awake Mode (CAM) -- the device does
no power conservation
- Maximum Power Save (PSP) -- the device is completely
off the air
- Fast PSP and other intermediate modes (some are vendor-proprietary)
in which a timer or other algorithm is used to awaken the
wireless interface occasionally to check for data.
First, the client synchronizes its clock with that of
the access point by means of the access point's
beacon frame.
Then the device switches off its wireless interface
and switches it back on periodically (every 100 milliseconds
in most algorithms) to query for new data.
The device listens for the access point's
Traffic Indication Map (TIM) that tells which
of the clients currently known to the access point
have buffered data. When the device recognizes its
own name in the TIM it proceeds to fetch its data.
This support by access points for client power management
is available in BSS (infrastructure) mode.
- power over ethernet (PoE)
- This is a technique by which 48V electrical power can be
delivered to network devices. Thus, they needn't be plugged-in
to wall outlets in the conventional manner.
Power is delivered through the unused conductors in standard
unshielded twisted pair (UTP) ethernet cable.
It is especially useful for access
points that, for maximum coverage,
must be installed
on a ceiling or other prominent location
where electricity is not easily available.
- probe
- See scan.
- proxy
- A proxy is an intermediary server that redirects a client's requests.
One common type of proxy provides content filtering.
When the client computer requests access to some network resource deemed
inappropriate, it is redirected to a "request denied" document.
- pulse position modulation (PPM)
- PPM is the modulation technique
employed by devices that communicate wirelessly by means of
infrared light.
- quadrature amplitude modulation (QAM)
- Implementations include 16 levels (16-QAM) and 64 levels (64-QAM).
- quadrature phase shift keying (QPSK)
- See phase shift keying (PSK).
- radadmin
- A program that serves as the user
interface to the radius server.
Typically, it is operated by network administrators
and is password-protected.
- RADIUS server
- The acronym RADIUS stands for
Remote Authentication Dial In User Service.
It is both a protocol (defined in RFCs 2138, 2865, and 2866) and a server.
The server is a software package that provides authentication and accounting services.
The latest radius servers not only authenticate and charge users on dial-in connections;
they provide complete control of access to networks.
Thus, they are the appropriate tool for managing public-access wireless networks.
Included in the software suite is the server program itself, radiusd,
which responds to authentication and accounting requests,
and accompanying programs to monitor
the activity of the server and analyze the information it provides.
This information includes user activity logs and more.
One of the suppliers of this software is GNU; here is
the GNU Radius Reference Manual.
- Request for Information (RFI)
- An initial contact made by a purchaser to a vendor requesting
general information about products or services offered.
- Request for Proposal (RFP)
- A request from a purchaser to a vendor for
specific pricing and description of deliverables.
- request-to-send (RTS) protocol
- The request-to-send (RTS) protocol (sometimes called RTS/CTS
for request-to-send/clear-to-send) is a technique for
sharing a medium among several transmitters.
It is a collision-avoidance strategy; it prevents more
than one transmitter from transmitting at the same time.
In RTS in wifi, each client requests permission from the access point before transmitting.
Next, the access point alerts all clients to back off, then it
gives a CTS to the requestor.
802.11 specifies RTS as part of its MAC sublayer
of OSI's link layer. It doesn't demand that RTS be used at all times,
but only for long (typically over 3000 bytes) data packets.
It is preferable to avoid using RTS when possible
because it imposes significant overhead.
With short data packets, the probability of collision is acceptably small.
The length of the packets for which RTS should be used is termed
the RTS threshold (an access point configuration parameter --
don't mess with it unless you know what you're doing!)
Only packets that are longer than the RTS threshold are
transmitted using RTS.
Lowering the RTS threshold can improve communications when
clients are far apart or there are many of them.
- request-to-send (RTS) threshold
- See hidden node problem.
- Reverse Address Resolution Protocol (RARP)
- RARP does the opposite of the Address Resolution
Protocol (ARP). When a device knows its own MAC address but not
its IP number, it broadcasts to the LAN a message that says, "Here is
my MAC address; tell me my IP address (from your ARP cache) if you know it."
- Request for Comments (RFC)
- The generic name given to a document in the set
managed by the IETF.
Though RFC documents are not explicitly
defined as standards, they are generally perceived as such.
Most manufacturers and developers of Internet-based products and
software adhere to them rigorously. A more complete definition
is here
and the RFCs themselves are here.
- roaming
- Roaming is a feature of wireless communication that transparently
(i.e. without involving the user) enables a client to disconnect from
one access point, cell, or base station and, without interruption,
connect to another.
This requires that the access points, base
stations, or cells have a protocol for communicating between themselves
to enable the handoff.
For example when a user in a car talks on a cell phone and
travels from one cell to the next, the roaming feature of the
cell phone protocol seamlessly hands off the connection from one cell
to the next while the user chatters obliviously.
Unfortunately, 802.11 does not include such a protocol.
Rather, it delegates this service to < href="#osi">OSI layers 3 (network) and 4 (transport).
Hence, it is a vendor-proprietary feature and not standardized.
If you carry your laptop from one wifi network to another, it's very
likely that your connection will be dropped.
- scan
- Scanning is the process by means of which a wireless network client finds
a wireless network. There are two ways this is done, passive and active.
- Passive scan: Walk around with a laptop looking for signals.
Done aggressively, this is called warchalking, wardriving, etc.
In general, the procedure is that
the laptop's software listens for beacon frames
from other wireless devices.
The laptop loops through the broadcast channels listening to each for ten seconds.
- Active scan: Seeking a specific SSID
(wireless network identifier),
a laptop or other wireless device broadcasts an association
request frame (also called a probe).
It then waits for the access point to respond with
a probe response frame.
Once it receives this, it sends an associate request frame that includes
information about its own capabilities.
Then the access point returns an associate response frame
indicating that the laptop now has permission to join the network.
Secure wireless networks withhold their SSIDs (see SSID)
thus making unauthorized association more difficult.
- secure HTTP (HTTPS)
- For electronic commerce on the World Wide Web, ordinary
HTTP
is inadequate because it lacks security;
it communicates in plain text.
HTTPS is HTTP with encryption added.
It was invented by Netscape Communications Corporation.
HTTPS encrypts the session data with one of two methods:
either the SSL (Secure Socket Layer) protocol
or the TLS (Transport Layer Security) protocol.
HTTPS uses port 443.
In web pages that use HTTPS, the URL begins with
https:// rather than http://.
- service set ID (SSID)
- Every wireless network has a name (such as "123ElmStreet")
called a service set ID (SSID).
Most access points come preconfigured with a default SSID,
often the name of the manufacturer.
One purpose of the SSID is to enable overlapping wireless networks
to be distinguished.
A client would associate
(connect) to one chosen from a list of SSIDs.
Most access points
can, for security, be configured to withhold broadcasting
their SSIDs. Thus, to associate with it, a client would
have to know the SSID by some means other than simply
scanning for wireless networks.
- shared wireless access protocol (SWAP)
- A competitor to 802.11,
SWAP (also called HomeRF) is another wireless protocol for consumer applications.
The first version, released in 2000, ran at 1.6 Mbps.
Version 2, released in 2001, ran at 10 Mbps.
Its main advantage over 802.11 is that it includes a QoS (quality of service)
metric that enables it to guarantee priority for time-sensitive data
especially audio and video.
Nonetheless, it has gained very little market share.
- signal-to-noise ratio (SNR)
- The ratio between the power level of the desired signal at the receiver
and the power level of noise (undesired RF energy) at the receiver.
It is expressed as the difference in decibels between the signal and the noise.
Thus, a higher value means better reception.
- simple network management protocol (SNMP)
- A standardized mechanism for remotely monitoring and managing
network resources such as modems, access points, printers,
computers, routers, etc.
- spread spectrum transmission
- The opposite of narrowband (in which a radio transmission is on a single frequency),
spread spectrum transmissions use several frequencies simultaneously.
This is done for security and/or bandwidth.
These techniques include frequency hopping spread spectrum (FHSS)
and direct sequence spread spectrum (DSSS).
- static IP address
- One means by which a device on a TCP/IP network (such as
a wireless one) is assigned an address is statically.
A static IP address is assigned and hand-entered
into the device as part of its setup configuration and it is rarely
or never changed thereafter.
The advantage of this message is its simplicity.
The drawback is that on many networks there is a shortage
of IP addresses and static addressing monopolizes this scarce resource.
Even when the device is turned off the address remains unavailable for
use by other devices. DHCP is the most commonly-used
dynamic (as opposed to static) addressing scheme to overcome this problem.
- Temporal Key Integrity Protocol (TKIP)
- This new mechanism replaces WEP with a stronger encryption algorithm.
TKIP changes the key for every frame,
and the change is synchronized between the wireless client and the AP.
TKIP also verifies the security configuration after the encryption keys are determined.
- time division multiple access (TDMA)
- A technique for sharing a transmission medium in which the
use of the medium is divided into time slots which are then
allocated to the transmitters according to some algorithm.
Some cell phones use this technique for sharing the airwaves,
as does Hiperlan.
- tunnel
- A tunnel is an encrypted connection
that connects two computers across an untrusted network.
For example, retrieving e-mail from a POP server
ordinarily requires sending a login and password "in the clear."
This is vulnerable to eavesdroppers such as network sniffers.
To protect from such threats, tunneling can be done
with an encryption program such as Secure Shell (SSH).
Rather than connecting to the POP server directly,
the user establishes an SSH connection
to the internal network where the mail server resides.
The SSH client software then sets up
a port forwarding mechanism so that POP traffic
is forwarded through the encrypted tunnel.
At the server end, it is delivered to the POP port.
At the client end, the e-mail program thinks
it is talking to the POP server
though in fact it is connected to the SSH program.
Transparently to both client and server,
all communication between them is encrypted.
- virtual private network (VPN)
- VPNs are used by workers working at home, on the road,
or at branch offices to connect in a secure fashion
to remote corporate servers via the Internet.
This is done by means of a type of tunnel.
For example, by tunneling the SMB file server protocol,
VPNs are often used to grant remote access to files on corporate file servers.
Users thus have access from home to all the data on their PCs in the office.
- wifi
- Wireless Fidelity (a wordplay on the 1960s term
Hi Fi for High Fidelity)
meaning the technology of short-range wireless access
to the Internet via IEEE 802.11 transmission protocols.
- transmission power
- One of the settings in wifi equipment
is the amount of electrical energy (the transmission power)
it feeds to the antenna when it broadcasts.
It may in some cases not be desirable to transmit at full power,
for example when the transmissions cause interference to a
neighbor's wireless activity, or when security (transmission
beyond the boundaries of an enterprise) is a concern.
The power of wireless transmissions is measured in milliwatts (mW).
In some countries, the permitted
transmission power is considerably less, e.g. 30 mW.
In the United States, FCC regulations do not permit wifi transmissions
to exceed 200 mW (one-fifth of a watt).
Another commonly-used unit of measure for signal strength
is the decibel, abbreviated dBm.
See dBm for details.
- unlicensed national information infrastructure
(U-NII) band
- The U-NII band is a portion of the radio spectrum
whose use requires no license from the FCC.
It is divided into three portions, the highest of which
is 100 MHz wide between 5.725 and 5.825 GHz and is
used by 802.11a.
| Frequency Range | Maximum Permitted
Transmission Power |
| low band | 5.15-5.25 GHz | 40 mW |
| middle band | 5.25-5.35 GHz | 200 mW |
| high band | 5.725-5.825 GHz | 800 mW (outdoors) |
- WiFi Alliance
- Formerly named WECA, the WiFi Alliance was formed in 1999.
Having as its members over 200 companies, its primary purpose
is to certify compliance of products with the
IEEE 802.11 family of standards.
Those that do are permitted to bear the logo.
- WiMAX
- WiMAX is an "emerging technology" (translation:
nobody uses it yet and the vendors can't agree on a standard)
intended to meet business demand for rapid Internet connection
and integrated data, voice and video services.
WiMAX proponents claim it can extend fiber optic networks and provide
more capacity than cable networks or digital subscriber lines (DSL).
It will have a range of up to 30 km, will integrate seamlessly
with the existing infrastructure used by wireless carriers,
and will operate in either licensed or unlicensed spectrum
in frequency bands between 700 MHz and 6 GHz.
It uses OFDM to overcome multipath distortion.
One of the most compelling aspects of WiMAX technology
is that networks can be created in just weeks
by deploying a small number of base stations
on buildings or poles to create high-capacity wireless access systems.
WiMAX will deliver "last mile"
broadband connectivity in a larger geographic area than Wi-Fi,
enabling T1 type service to business customers and
cable/DSL-equivalent access to residential users.
WiMAX will provide "canopies" of coverage up to six miles wide.
This range and high throughput will enable it to be used as
backhaul carrier infrastructure and for enterprise campuses and Wi-Fi hotspots.
WiMAX will be deployed in three phases.
- Phase one will see WiMAX technology using the IEEE 802.16d specification
deployed via outdoor antennas for subscribers in a fixed location.
- Phase two will roll out indoor antennas
for carriers seeking simplified installation at user sites.
- Phase three will launch the IEEE 802.16e specification,
in which WiMAX-Certified hardware will be available in
portable solutions for users who want to roam within a service area,
enabling more persistent connectivity akin to
Wi-Fi capabilities today.
(See IEEE 802.16
Backgrounder (24 May 2002) and
Intel's
white paper on Broadband Wireless.)
- wired equivalent privacy (WEP)
- WEP is the original, flawed encryption mechanism included
with the IEEE 802.11 standard for wireless networks.
(Encryption is the process of encoding transmissions to thwart eavesdroppers.)
WEP is an optional part of the 802.11 standard;
access point manufacturers can adhere to the standard yet omit it from their products.
We know of none that have done so.
WEP uses a key (encryption password) that is known at both ends of the connection
(the wirelessly-networked computer and the access point).
This is known as a shared private key. Flaws in WEP's algorithm are notorious;
the implementation of the algorithm (RC4) is poor,
and the 24-bit initialization vector can be cracked with conventional equipment.
Using software that today is freely available on the Internet,
a hacker can deduce a WEP key in under an hour.
Furthermore, good security practice dictates that shared private keys
should be replaced periodically yet network administrators find it cumbersome to do so.
When the key is changed on the access point,
all the wireless computer users must be notified of the new key
and they must update it in their configurations in order to continue to use the WLAN.
Even with access points that can support several keys simultaneously,
key management is difficult and therefore rarely done.
Fortunately, new mechanisms are under development (802.11i)
that will remove the necessity of conducting this onerous task.
- wireless application protocol (WAP)
- To deliver services like those on the World Wide Web to
wireless devices such as cell phones, WAP has been developed.
Wireless devices are typically far more limited than
their desktop counterparts in terms of transmission bandwidth.
The verbosity of standard HTTP
makes it too slow for a wireless context.
WAP is essentially a simplified, economized HTTP.
To support WAP, there are gateways
between the web and wireless networks; they translate
from HTTP to WAP.
Thus, web servers needn't support both protocols.
The gateways take web servers' HTTP output and
translate it to WAP thus enabling existing servers
to serve both audiences.
- wired equivalent privacy (WEP)
- This is the name given to the encryption scheme originally
specified for 802.11.
This specification includes only 40-bit WEP (also called
64-bit WEP assuming a 24-bit initialization vector --
40+24=64). Some vendors offer 104-bit (also called
128-bit for the same reason) but this is not described in
the 802.11 spec because it's proprietary.
WEP is being replaced due to the following flaws:
- Changing keys is a nuisance.
- Its 24-bit initialization vector is not hard to crack.
Indeed, there are several free programs available on the Internet for this purpose.
- Its implementation of of RC4 encryption is ill-designed.
The IEEE is working on a complete redesign.
In the interim, another scheme is offered and is widely available,
named wireless protected access (WPA).
The redesigned security mechanism will be released as two IEEE
standards:
- 802.1x -- a generic design that will be applicable to networks
of all kinds including wireless and wired
- 802.11i -- the security part of 802.11
- Wireless Ethernet Compatibility Alliance (WECA)
- See WiFi Alliance
- wireless Internet service provider (WISP)
- Companies that provide any of a variety of Internet-related services
-- such as web site hosting, e-mail service, network access, etc. --
are termed Internet service providers (ISPs).
Those that provide these services on WLANs
are termed WISPs.
- wireless local area network (WLAN)
- A WLAN is a local area network (LAN) that interconnects
computers and related devices with radio waves instead of wires.
- wireless markup language (WML)
- For displaying World Wide Web pages,
wireless devices are typically far more limited in their
resources such as screen real estate than their desktop
counterparts. Thus, for this purpose WML has been developed.
It is essentially "HTML lite", tuned for slower transmission
speed and smaller display devices (such as cell phones.)
WML is an XML-based tagged language.
It has yet to become popular in North America.
However, in Japan a similar language -- cHTML
(compact HTML) -- a product of DoCoMo, delivered by the
protocol termed i-mode (Internet for cell phones)
is in wide usage.
- wireless modes
- Depending on its components and their relationships,
a wireless network can be constructed in a variety of
ways, termed wireless modes:
- IBSS, also called ad hoc or peer-to-peer mode
- BSS, also called infrastructure mode (uses an
access point
- EBSS, like BSS but using more than one access point
- wireless protected access
- This interim implementation of wireless security is not perfect
but is better than WEP and serves as
a temporary fix while 802.11i is under development.
It is designed so that existing access point equipment
can be upgraded by means of firmware updates
and thus won't need to be replaced.
WPA includes the following features:
- RADIUS
- For environments without a RADIUS infrastructure, WPA supports the use of a preshared key.
- EAP
- TKIP
- Michael
- AES
(optional because it may not always be possible
to add AES support through a firmware update to existing wireless equipment,
or some vendors may choose not to)
802.1x authentication is required in WPA.
In the 802.11 standard, 802.1x authentication was optional.