Slashdot Mirror
Building a Wireless Network for an Apartment Complex?
itwerx asks: "I've been asked to design a wireless infrastructure for an apartment complex. Tenants will pay an 'access deposit' and a monthly surcharge to get a PCMCIA/PCI/USB network card along with free installation and, of course, wireless Internet access. The buildings are arranged such that 2 WAP's per building should cover all the tenants (one WAP per side, far enough away to get line-of-sight through the windows). I do have a few concerns, however. All help is appreciated and when we're done we'll put up a HOWTO!"
"My concerns are the following:
- Interference between WAP's (there's several buildings) - there are enough channels if we go 802.11a but cost is a concern.
- Management of 'hitchhikers' - we're planning on manual assignment via DHCP/MAC address for tenants with others having all their HTTP requests get directed to an info page. Anybody done something different?
- Interference from WAP's and other devices that may be owned by tenants! Should we just avoid the default channel and hope for the best?!?
Interference between the two WAPs is not really what you have to worry about. Put them on different channels on opposite ends of the chunk of 802.11b spectrum and its done.
The real issue is interference from other devices. I hope no one has a 2.4GHz phone.. or a microwave.. or X11.. or one of the other dozens of devices on the (unregulated) 2.4GHz band. It can knock your 11Mbit down to 1.
Using your sig line to advertise for friends is lame.
I've heard of people being able to spoof mac addresses. I think you may need to watch out for that.
Also education of the tennets will be needed. You don't want them to come running to you because the hotmail server went down.
=================
Unix is very user friendly, it's just picky about who its friends are.
mac addresses are fairly easy to spoof (at least in OpenBSD), and any two-bit prism based sniffer can tell the mac addresses of other nodes on the network. It would probably be better to go with a different scheme, such as login/passphrase authentication, rather than MAC address. I know UC berkeley is using some sort of program like that check out Calnet
to build a Beowulf cluster?
Beer - it's not just for breakfast anymore!
Dear Slashdot:
What is the most effective way to kill trolls? PLZ K THX
You wouldn't hire anyone who didn't know _exactly_ what they were doing? I'm sure you knew exactly what you were doing on the first day of every job you've ever had. Have you never done anything new and had to learn how to do it before?
--Forest C. Adcock--
once you are done with the physical layout you should consider a vpn-type solution along with WEP and an ACL to prevent passer-by's from hacking the tenant's machines...
What other things might I need to worry about?"
Hmmm, maybe the fact that it's pretty easy to spoof a MAC address?
- 802.11 manages devices in a friendly way, and is designed specifically to play nice with lots of other 802.11 devices in the area. In fact, infrastructure networks assume it WILL work that way. Put your entire complex on one SSID and one channel - each WAP will form a BSS, and devices should seamlessly roam between them.
- Other peoples' devices shouldn't interfere with yours unless there is a LOT of devices. If they do, too bad for them, they can choose a new channel. Or you can choose a new channel. But it shouldn't be a problem unless there's a ton of networks.
- I would suggest leaving your network entirely open (no WEP, etc.) then putting a router at the edge which authenticates MAC/IP addresses, provides DHCP, and only routes those who enter a password of some sort. This leaves the internal network open to hackers unfortunately, but WEP management for an apartment will be hell, and the alternate solutions all tend to be non-standardized.
I am an assistant network engineer at a large midwestern university. Currently, like you we're in the process of figuring out how to deploy wireless access points. Our campus's Engineering Computer Network let us borrow a mobile testing appratus that has a WAP and an Antenna on it (looks like a camera tripod). We take it to different parts of our residence halls and, with a laptop, we take SNR readings from different parts of the surrounding rooms and record our measurements on the building blueprints. We figure we need about 6 WAP's to sufficiently cover the lounge areas of the older dormitories (with their steel and concrete infrastructure), but for your sake 2 WAP's should sufficiently cover a medium-sized apartment building and more. We also plan to cover several large outdoor areas, a library, and our Union right off the bat. The equipment we are using is Enterasys Roamabouts ($1000 a pop), [link] and they are highly configurable and have a ton of management features. We figure each WAP will get connected to a switch port on the Cisco Catalysts in our buildings. So far, we haven't done much in terms of the deployment because it is a long process, where the Physical Facilities department has to do the actual installation of the equipment, data jacks, etc. I assume in your case you can better coordinate this without all the red tape. We figure that by the time these are all installed and our userbase is well-informed of the network, we will have a great system that will scale to thousands of students and staff in the future.l
http://www.purdue.edu/ITaP/projects/wireless.shtm
- Interference between WAP's
If you have WAP's on different sides of buildings they most likely won't interfere with each other. Just keep the WAPs with the same channel as far apart as possible. If you can get your hands on some a few to test with it would be worth while to mock up a few layouts and wander around with a laptop to measure single strength and interference.
- Management of 'hitchhikers'
In addition you could run WEP, it is breakable but its another layer or security. Sorta like the car theif will go for the car without the club.
- Interference from WAP's and other devices that may be owned by tenants!
Here could be your big problem. As someone else mentioned there are lots of 2.4Ghz devices. Most would only cause a local disturbence, but if I decided to set up a WAP in my apartment you have no grounds to stop me from doing so. Some WAPs are smart enough to work nicely together though so it might not be as big a deal as microwaves and cordless phones.
There's _always_ a better way. And slashdot is one of the best places to learn about it.
If I was given a choice between a professional who never asks for help and another one who is smart enough to tap in the potential of Slashdot guess who'd get the project!
Just make it free (included in rent) and let everyone have internet... great for our communist society!
U.C. Berkeley has been working on implementing a wireless network around campus. You can read up on the project here. It mentions some of the technical issues they face like 2.4GHz cordless phones and even interference from old microwave ovens.
You have 3 channels with 802.11b, and you can pretend you have 4 if you have a little bit of overlap. Arrange things in a honeycomb. Also investigate the nocatauth portal. A small bit of googling will turn our lots of resources, you don't need to code this all yourself - lots of people are doing it.
SSL Certificate
Check out software available through Karlnet. They made the firmware for most 802.11 devices out there and have software that would allow control over who has access and who doesn't, bandwidth throttling, etc. Some of the stuff only works with specific APs and their own Turbocell drivers but it all looks pretty nifty.
Before you full implement it, do some testing and see what works best. I don't think it matters wether you do DHCP or Static IP, just filter by MAC address and you should eliminate anyone who is not a subscriber from getting access. However, I am intersted in the project, and maybe for better help from others, you could give more details. Good luck...
My first moderted "troll". And no, it wasn't a troll. I just think you should be enough of a professional where you don't have to ask how to do your job on a web site. Learn how to do it, then become a professional. Would you want a doctor posting questions like "how do I calcualte someones blood presure?"?
"Allez Cusine!"
If you are worried about data sniffing, IPSec / WEP is your answer. If however, as I assume, you are worried about "free rides" on your bandwidth, I'd suggest PPPoE. That way no one gets on the network unless they have an account. Seeing how it is a relatively small number pf tenants I assume (less than 500 or so) it should be simple to keep a list of names / logins so as to provide a tenant with two logins should he get a second PC. This method saves you the hassle of managing a bunch of fixed IPs and MAC addresses with everyone on the network.
I hope this helps. Our wireless guys pulled this off in 130 buildings over a several square kilometer area. Good Luck!
PS. Cracks about Redneck Rocky Top and such ilk should be modded -1!
Comparing it to Windows will be a moot point, since El Dorado is going to have a 40% larger code base than XP.
At what point did he say he was a professional?
Isn't one of the best ways to learn asking questions?
Now if he said he was hired as a contractor for a big company, I would think diffrent, but here's a guy trying to do something that's new to him.
Everybody must be watching celebrity boxing II (truly what television was invented for!)
hi!
Back at my alma mater, one of the students (who thought he was clever) founded an ISP that provided 802.11b wireless access to apartments on campus. Inevitably, the WEP key he used was compromised, and student account passwords were sniffed and abused. Now, common sense would dictate that he shouldn't be responsible for what a criminal does with his network; but common sense does not reign supreme in the ivory tower of academia. What happened next was shocking: the student was disciplined, expelled, and sued for damages by the state college. Although he certainly could have won his case in front of a jury, he settled because he could not afford $15k to hire a good trial lawyer. Right now he has no degree, can't get into a good school, and is pumping gas for a living.
So, if you are considering rolling out a notoriously insecure network architecture (such as 802.11[ab]), consider the fact that you may be personally liable for anything bad that a crook does with your network. Be afraid.
df
Its not really spoofing as such. Anyone can change their MAC identification to anything they want with most cards. in linux you do it through ifconfig and in WindNT/2K/XP you can do it in the network control panel. This is another reason I would go with PPPoE or a VPN.
are you just the fix-it guy that has computer knowledge, or a private contractor?
if you are expected to stay in house and manage the thing once it is up, get ready for a lot of sleepless nights and angry users.
it is probably MUCH more cost effective for the complex to just pay for the DSL in all the buildings and keep them hooked up forever. ~$60 a month including a phone line and you have no hassles what-so-ever. then pass the cost onto the tennant
your month cost per tennant will probably be $20-30/month in hardware depreciation and bandwidth usage. plus you would have a HUGE (you didn't give building or unit numbers so i'll guess) setup fee of $10,000+ assuming you get a couple T1s and all the wireless hardware.
as a tenant i won't pay you more than $50 a month (standard DSL cost) so you have to figure out if you can provide all this service and not spend $20 a month per user of your time. i don't think you can.
MARIJUANA, SHROOMS, X: ONLINE?! - E
WEP is easily broken. There are several tools that make war driver's life really easy.
I would set up the wireless network ouside a firewall, and then probably hook up a couple of machines with FreeSWAN or poptop (linux vpn servers) that will connect to the access points.
See this paper for a good discussion on wireless security.
There's several ways to go about this.
- Buy CheckPoint FireWall-1 in addition to your access points. There are SOHO versions of FW1 on dedicated hardware (e.g. Nokia IP71) that retail for less than $1000 and can accomodate up to 50 users. Use its Session Authentication agent to arbitrate access to anything other than DHCP and don't bother with enabling WEP. Unfortunately, the agent seems to be only available for Windows 9X/ME/NT/2K/XP.
- Buy Cisco access points and Cisco ACS software and enable LEAP. While non-standard, you are probably forcing them to buy a wireless card anyway, and Cisco's client devices aren't all that expensive. The Aironet device is supported in Windows and Windows CE, Linux, and MacOS 9.x and 10.x. My employer uses LEAP and it works great.
- Hack your own. Set up Linux and Squid and Apache and transparent forwarding to redirect unauthenticated web traffic to a HTTPS login form. Have the form automatically add the necessary firewall rules to allow them out, and have a cron job remove them after a delay. Upside: A five banana problem once you've mirrored enough of CPAN to write the Perl scripts. Downside: Easily spoofed/hacked with a copy of AirSnort, Kismet, and Ettercap.
WEP key management sucks so hard that relying on it is stupid. I'd probably go the LEAP route just because it is so damn easy on both the client side and on the server side, even though I hate Cisco. The build-it-yourself solution would be a complete kludge and would be totally unsupportable except by the author, i.e. lots of work. The CheckPoint firewall is in between the Cisco (easy) and do-it-yourself (really hard) in terms of difficulty.Anyway, I'm rambling now, so hopefully this helps and makes sense. If you have questions, post 'em here.
I'm proud of my Northern Tibetian Heritage
Wireless network that spanned several different buildings, and required a few different AP's. Toughy, but not impossible. First, set each AP on its own channel. Second, enable MAC Address security for each Card on the network. Then instead of using DHCP to give out IPs you should assing each computer an IP and Subnet mask. Turn off DHCP server on the AP to try and stop any hitchhikers. The next thing you should do is enable WEP on the AP and the cards. Use the highest possible key. This should keep most of the standard users out of the network and force them to pay. As far as hardware, I suggest Linksys cards as they allow for the "any" SSID to be used allow each resident to use the best AP. Also, for desktops use USB so that you dont have to open up the computers. That could be a BIG liability for you and your employer. Only use PCI cards if they sign a letter releasing you from all liability. You can do this on 802.11b for the cost reasons. If you need further help with this project email me. If this works out please let me know.
LowneWulf states:
To which MarkKomus replies: LowneWulf states: Which is rebutted by MarkKomus: I need to know who has more money or a bigger house so I can know who to believe!The University of Florida is using some kind of authentication scheme. Basically, everything is automatic. Any attempt to access a valid network address takes me to the login page, where I can login using my UF gatorlink account info.
After that, everything just works. I don't know how secure the authentication stuff is. The configuration is dhcp, so real easy.
WAP stands for Wireless Application Protocol. I think the acronym that you should use is AP, which would stand for Access Point, in this case. The wireless is assumed.
It may be cheaper to just run cat5 through the buildings. Definetly more secure.
I spent 4 years as a wiring contractor and know its not dirt cheap, but depending on how many takers you have for your bandwith, paying a hundred bucks or so per wireless nic isn't cheap either.
I'm not sure how many units you have in the apartment, but if it was mine, I'd have the place wired with at least a solid RG-6 coax and an ethernet cable to each apartment.
Changing your MAC or using unsolicited ARP broadcasts to take over another IP address are exactly what IP spoofing is all about. It's more than just setting a new MAC through ifconfig or Device Manager, too. Usually, you're doing some kind of ARP poison routing to do man-in-the-middle attacks or sniffing.
So it really is spoofing, as such.
I'm proud of my Northern Tibetian Heritage
I goto umass and we just setup a campus wide wireless network here, that is a good system because it isn't based on easily spoofable MAC addresses. What we do is to use not WEP key, but we assign unroutable IP addresses to network cards via DHCP. Then we have a VPN concentrator that has an address in that unroutable space and in routable space. To get out to the internet you need to authenticate youself via the VPN server>
I don't know if it's been mentioned, but I would use IPSEC if I were you,
simply because 802.11a/b sniffing is trivial now and mac address spoofing is
even easier. Also, I would probably recommend against going with an
established commercial wap product, as they all almost definately aren't going
to have the flexibility you need in the future and are probably way too
expensive. I would roll a couple of OpenBSD boxes with wireless cards, that
way you have an all in one solution with lots of nifty stuff like traffic
shaping per mac, monthly bandwidth accounting capablities via pf, syslog, and
tons of other stuff that commercial vendors just don't offer. And I do mean,
don't offer, regardless of price. This page
offers a good howto regarding ipsec on openbsd and this page
give a pretty good read on replacing wep with ipsec on openbsd as well. Good
luck.
SealBeater
-- Its survival of the fittest...and we got the fucking guns!!!
http://www.netgear.com/product_view.asp?xrp=9&yrp= 21&zrp=79
NoCatAuth is a project that attempts to address the security concerns of running subscription based wireless services. AFAIK though, it's designed so that you must build linux boxes to act as access points, it would take some hacking to get it to work with existing access points (most of which can be administered through snmp).
You probably do not want to use 802.11b wireless networking in an apartment complex, considering that a cordless phone can interfere with the signal and destroy all connections within. It happens all the time at my house.
If someone is determined enough, they can get on your WLAN. MAC addresses can be spoofed, WEP keys can be sniffed. All you can do is authenticate and log.
I recently spoke to some keen fellows from Baylor University that have created an OpenBSD-based firewall/logging/authentication system that takes the poster's info page one step further. Everyone authenticates via an SSL-encrypted web site in order to join the network. DHCP leases are handed out in conjunction with a login session, so you can track who does what. Logging in also opens up your firewall to allow the newly-leased IP address through.
We set up a small wireless network (5 hosts) at our apartment building to share internet. One of our biggest concerns was interference from other devices. On our limited budget we didn't have the luxury of buying signal testing equipment and AP's to see if 802.11b would be reliable in our building. So in the end, we went with HomeRF 2.0 equipment made by Proxim which has a better range and is much better at avoiding interference than 802.11b and transmits at a similar 10Mbps.
We bought the USB adaptors (for around $80) from Provantage for less than any USB 802.11b adaptors we could find at the time.
There are some limitations with HomeRF, (I don't think roaming between AP's is supported and only drivers for Windows and Mac are provided) but in our situation it was just what we needed and it's worked flawlessly. We've had no network downtime due to interference.
The whole point about using wireless LANs is to enable environments where you either need to support roaming/migrant users or you have little/no control over the local infrastructure.
Neither is the case here.
You also need to remember that the 11MB/s provided by WiFi is shared between all users. If you have 50 "dwelling units" and two WiFi access points, you'll be offering a service with less maximum bandwidth than bottom-of-the-range xDSL... and you'll be charging for $100 WiFi NICs instead of $10 PCI ethernet NICs (which many PCs now have as standard anyway)... and for a service subject to atmospheric outages (ever use a WiFi network during a thunderstorm) as well as interference from a multitude of other devices like microwaves, cordless headphones and DECT telephones...
I'd recommend taking a bit of up-front hit and running CAT5 to each apartment. Put a switch on each floor (unmanaged 16-port switches are less than $80), and run each floor-switch to a central switch, and from there to the T1 router, squid server and whatever other infrastructure you've going to value-add into the equation.
This is what business-class hotels now do - just provide an ethernet RJ-45 jack and a DHCP server... all a guest has to do is plug in, configure for DHCP, and reboot.
If nothing else, support costs for a wired network are trivial... but for a WiFi? How do you explain to a user that they can't get their mail because the guy in apartment 2B is listening to a CD?
This sig left unintentionally blank.
For you, so that you may 'learn as you go' as well.
Have you considered going with a wired solution instead of a wireless one?
I assume that the units already have cable TV. If they do, you should be able to run a cat-5 cable beside the cable coax and replace the wall plates with one that includes both a coax port and cat-5 port. You then run the cables to a centralized 10base2 switch for each building, and thence to a central switch for the complex. You shouldn't skimp on these - get hubs with real VLANs. Commodity switches still leak information between the ports.
This will initially be more expensive than tossing up some WAPs, but it will probably save you a lot of headaches down the road because you don't need to worry about people running AirSnort, or interference from common household electronics, or any other crap like that. If people really want wireless access, let them set up their own WAP, but make sure they know their access will be cut off if it's abused.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
This is the next, already grown too far, plague of the internet, n00baphobia.
Why is it when people sit down to a new game and get online to see if it's worth multiplaying, they're treated like 2 bit carny workers not worthy to lick dung off the monkey trainer's broom?
Why is it when someone posts a valid question or asks for help at
Some people really need to grow up. Would you treat your own children this way? Oh wait, women (sorry ladies, most of us
Do your friends treat you this way when you ask them to help you move? Then again, with an attitude like that, you most likely have no friends.
I could go on and on and on about n00baphobia, but I don't want to seem like I'm ranting. Just give the guy some slack and if you don't really have anything useful or entertaining to say, bugger off.
Groove---Misanthrope to the Stars
Groove - Misanthrope to the stars
Just for the record, while you usually think as 802.11 as being relatively limited in range, its really not. For instance, a Primestar dish can be used as a directional antenna and get a supossed 10 mile range. I've also heard of a Pringles can being used similiarly. (Those were the first hits on google, there are many more resources.) My point is that its not just "war drivers" you need to be concerned about, but the guy two blocks away but with line of sight too. For about $10, you can build a directional antenna, and the rest is just a matter of time.
CitrusTV (http://www.citrustv.net): the Nation's Oldest & Largest Entirely Student-Run Television Station
I setup a small AP in my apartment, only used by me, so far ;)
I used an old 486 laptop running Linux 2.4.18 (RedHat base) with an Orinoco Silver card, using 40-bit WEP (which to a cracker, is slightly inconvenient at best) and IPTABLES, MAC filtering with IPSEC 3DES and 1024-bit keys.
Be sure to use some kind of encryption better than WEP (like Checkpoint VPN, IPSEC, etc.) otherwise, it's only a matter of time before your users' account info is stolen.
Also consider the kinds of antennas used on the AP. I actually bought the 3 dB loop antenna (size of a 10" plastic ruler) but I don't even need it within my own apartment (100' radius). I use both 2.4GHz phone and microwave with no major problems in my access. Mind you, I'm not using the link for heavy-use or Internet/media streaming. Here are some links to sites that helped me:
Good luck with it, please post a link to your HOWTO when you get it running!
Suncoast Linux - Sarasota, FL
http://www.linksys.com/products/product.asp?grid=3 2&prid=416
PLEBR10 - ethernet via powerline
Are the apartments all on the same side of the transformer?
Does the aprartment own the power lines in the complex?
Better solution IMO no new wires, 12meg of
data vs like 3-4 for 11.b stuff AND
you can move it from outlet to outlet....
No broadcasting via airwaves so people won't even think about checking the powerline for internet
(for awhile).
If the distance between the buildings is too great, or they are seperated by a transformer,
I would think about doing a cat 5 or fiber run
between the buidings. If not, the put
a couple 11.a points up to interconnect.
Service guarantees Citizenship! Questions Guarantee GITMO.... Amerika Uber Alles!
lol
How about keeping it simple.
Increase everybody's rent $20 per month, and let them know that wireless broadband is included "at no extra charge". Build a list of compatible devices, charge a few bucks for installation assistance, and be done with it.
I don't know what it costs over there, but I suspect you can get a lot of cable laid for the price of the wireless access points. On the other hand, being able to drag a laptop outside while enjoying a coffee under a tree sounds rather pleasant. Perhaps there is a main central area that would benefit from wireless, while the rest could be cabled on request.
None of this addresses security concerns, but plenty of others have opinions there.
And how is he supposed to learn?
--Forest C. Adcock--
Although I have tried to not rise to this opportunity of pointing out your stupidity, I have decided I will....
W ireless
A ccess
P oint
Fool!
I have a suplementary question - rather than buying one WAP per region (floor, wing, etc.), is it possible to reduce the number of WAPs by plugging multiple antennae into one WAP, perhaps with something as simple as a Y connector ?
This way someone rigging up a large or complex structure, but with relatively few stations, could have an antenna in each region, and string
coax back to the WAP.
I know this will cause nasty phase-shift and multipath problems, due to the same station being received by both antennae, but 801.11 must already contend with this, as reflection from metal surfaces will cause it, even for the single-WAP-single-station case.
I'm just curious to see if someone has already tried something like this and failed, or if there's a good theoretical reason why it's a dumb thing to do.
THanks
FIn
## W.Finlay McWalter ## http://www.mcwalter.org ##
There is some good documentation out there, that cover a lot of the issues you will run in to. My favorite is Designing Airport Networks from Apple [PDF], it goes on the assumption WEP works, but other than that it covers things such as how to get multiple devices to play nice and some network topologies.
Good Luck.
Or the season final of Enterprise.
cluge
"Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
Currently I am in the situation where I am trying to talk an office out of spending $6000 from one contractor on a wireless network. Their office is small and has absolutely no need for a wireless network (yet alone at the $6000 price tag). The lady in charge of this decission has no idea what she is talking about and has been brainwashed by her "personal technician" (who has qutie the cush job - $500/mo consultant wether he does something or not).
But the point of my post is this: just because you can go wireless does not mean you always SHOULD - there are times when a wired network makes a hell of a lot more sense.
The ultimate network admin tool needs HELP!
>Would you want a doctor posting questions like "how do I calcualte someones blood presure?"?
He didn't say that. I learned how to do that in Grade 9 Phys. Ed.
It is quite obvious he far surpasses a high-school knowledge of computing, and it appears he has as much knowledge as your average computer technician (if not more), so there's no reason why he doesn't have the necessary knowledge to have a handle on the situation.
Also, you should know, very, very, very few businesses know how to attack a new problem (and every single client is a new problem unless you only do a single thing) right away.
Your job as a general computer solutions consultant isn't to go there knowing how to do it and telling the client that it will be done that way. Your job is to talk with the client and come up with a reasonable solution. A good client (and a good job) will leave you with enough flexibility that "anything goes" as long as it works reliably, and at a reasonable cost.
And, with that flexibility comes the fact that you can't know everything, and consulting other people who may or may not know more about the topic (such as slashdot) is a very good idea.
In short, you were modded a troll because if you followed your advice you would never land a job unless you and the client think exactly alike (once in a blue moon).
And, BTW, he was asked by the client to do this job. He didn't ask them. When someone offers you money and you think you can do the job (and it seems he thinks he can) you don't say no (unless someone's life is at stake. I doubt that in this case).
The whole "professional" thing is a chicken and egg problem that shouldn't require any explaining.
The professional thing to do, anyways, in all circumstances (except where lives are at stake, which doesn't count in this case), is to leave the client happy. If you can do that, you've beat out a lot of accredited professionals I know by miles.
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
- WEP (Wired
Equivalent Protocol)
- Open Systems
Authentication
- Shared Key
Authentication
- Access Control
Lists (MAC Address Lists)
- Closed Network Access Control (LUCENTS Proprietary Access
Control)
The important thing to note here is that EVERY one of these mechanisms can be worked around.- WEP has known
vulnerabilities allowing someone to decrypt information in real-time after
capturing about a days worth of traffic.
- Open Systems
Authenticationhas
"shown that the authentication management
frames are sent in the clear even when WEP is enabled."
- Shared Key Authenitication has shown that it is rudimentary to capture
the Initialization Vector since it is sent in the clear as part of a WEP
frame.
- Standard Access Control Lists are easily circumvented by an attacker
sniffing the network for a valid MAC and thus reprogramming their network card
to an appropriate value to gain access to the network.
- The proprietary Closed Network Access Control list that LUCENT (and
others)touts as "a system that will not send the network identification
(SSID) as a broadcast, thereby mandating that someone KNOW the SSID before
they can associate to the network," is inherently flawed
since:
"Several management messages contain the network name, or SSID, and these messages are broadcast in the clear by access points and clients. The actual message containing the SSID depends on the vendor of the access point. The end result, however, is that an attacker can easily sniff the network name, determining the shared secret and gaining access to the "protected" network. This flaw exists even with WEP enabled because the management messages are broadcast in the clear." When setting up a wireless 802.11b network, you MUST consider it to be publicly accessible. Anyone who is motivated can gain access to your physical network. They need not be within 300 meters, and through the use of a Yagi antenna or some other directional device could gain access from miles away. If setting up a wireless network despite the vulnerabilities please follow the following suggestions:- The most effective strategy would be
to put your wireless access points into aIPSEC enabled DMZ, and have your wireless
users tunnel into your network using a VPN. If your corporation doesn't
already have a VPN infrastructure in place, it's going to cost you some money
to implement. Even if you do have a VPN in place, and all of your clients
already have the VPN software, there's going to be an extra effort associated
with setting up a VLAN for your DMZ. But this solution adds a layer of
encryption and authentication that could make a wireless network suitable for
sensitive data.
- Consider using an additional level of authentication, such as RADIUS, before you permit an association with
your access points. While it's not part of the 802.11b standard, a number of
companies are optionally including some provision for RADIUS authentication.
Orinoco access points, for example, can enforce RADIUS authentication of MAC
addresses to an external RADIUS server. Intermec access points include a
built-in RADIUS server for up to 128 MAC addresses.( EAP (Extensible Authentication Protocol) is used to
allow wireless clients to authenticate to RADIUS servers using a single
sign-on. )
- At an absolute minimum, even with it's
vulnerabilities, you should enable WEP. Whether you implement 64-bit or
128-bit doesn't really matter too much, as it's not the encryption scheme
that's determining how long it takes to crack it, but the number of possible
Initialization Vectors. WEP is only a low barrier to entry, but it will keep
out many of the casual hackers because there are so many other wireless
networks that are wide open and easier targets.
REFERENCESUniversity of Maryland Study: http://www.cs.umd.edu/~waa/wireless.pdf
Fluhrer, Mantin and Shamir Study: http://www.eyetap.org/~rguerra/toronto2001/rc4_ksa proc.pdf
AT&T Labs and Rice University Study: http://www.cs.rice.edu/~astubble/wep/wep_attack.ht ml
Most phone lines have 4-6 cables in them, and 2 are only used (in AUST at least) instead of using wireless, or costly wiring up of cat5, why couldnt you just tap into the existing phone cables splice off the unused wires and provide access back to a central gateway.
That's what we do up here in BGates great neo-stalinist NW ... since electricity comes with the rent, I heat my apartment with 4-K6s. We burn energy like it's kilowatts so Ca weenies freeze ta death in their ice-cold redwood hot-tubs. BWAaahahahahahaha
"Let's get physical and let me link my data to you."
You may consider deploying BOTH 802.11b and 802.11a. There are devices that support both, such as the Cisco 1200, but no wireless cards for 802.11a yet (due August/September 2002). There are also devices that work with your existing Access Point, such as Symbol's Mobius 5224, which sits over an existing Symbol 802.11b access point, uses the same network cable (provides a second network port for the 802.11b AP) and even provides power for the old AP.
If you go with 802.11a for any reason though, be warned, the cell sizes are MUCH smaller. The slowest 802.11a speed of 5 Mbit/s gives you coverage to about the same distance as 802.11b does at 5.5 Mbit/s. At least with 802.11b you can go slower in areas where the coverage is marginal.
Antennas can make a big difference to your coverage pattern, and should not be underestimated. Using semi-directional antennas is also a good way to avoid or reduce outside coverage on a building, which makes it that little bit harder for carpark hackers to get in. If you have a lot of metal around, look at using diversity (2 antennas seperated by a small distance - each antennas signals are compared and the best signal is used), which will improve coverage and reduce dropouts.
You will also want to consider the number and type of client radio's connecting to your 802.11b network. While 2 AP's might provide coverage, you may find the density of users brings everything to a crawl. Decent AP/Client card combo's will load balance across multiple AP's if the signal strength is there. Some AP's (particularly Cisco's) have a real problem delivering speed to more than 2 clients from a single AP at the same time, as they don't load balance (internally) properly. You will find 2 clients will get almost all the bandwidth, and the rest will get a tiny amount (eg: 4-10Kbit/sec). This is totally unacceptable for high user densities.
As for security, there are a number of authentication systems out there that seem reasonable, such as EAP/TLS, and Kerberos based implementations, all implemented in the AP. Authenticating using DHCP and MAC addresses is not worth it, as you can fake MAC addresses easily, and you can always use a fixed IP. That said, if the AP has MAC level Access Lists, USE THEM where possible, with other security methods. Just makes it that little bit harder.
EAP/TLS is the newcomer on the market, and usually relies on a Radius server for it's back end authentication. This is OK, as long as your users don't roam about at all. If they roam from one AP to the next, you will get delays of ~300ms as the AP re-authenicates itself with the Radius server. This might be OK if your users don't move around much, but is totally unacceptable if they are mobile in any way. All the Kerberos authentication systems I have seen distribute details to all the AP's at authentication time, so that roaming is about 50ms or less.
With encryption, if you have WEP, enable it. Once again, like with MAC level ACL's, it's just one more thing for them to get through. Many AP's now support Dynamic WEP, or TKIP (Temporal Key Integrity Protocol). There are also some devices that support AES based encryption methods, and I wouldn't be surprised to see TKIP implemented with AES instead of WEP out there as well.
Of course, you could also use a VPN solution like IPSec. I'd also recommend to use large keysizes, simply because you can. If you do use a VPN, STILL use WEP/TKIP/AES and ACL's, as it'll make it just that little bit harder to try and get into.
Remember, the object is deter them from trying to break into your network. If they try long enough, they'd probably still eventually break in. But if they can break into another system in 1/100th of the time, then unless they have a major grudge or very specific reason, they'll go that way.
Good luck!
My father is a big Radio Shack Remote lighting finatic. (X10) Every Light is hooked up with a remote switch. All his laps have the plugin appliance system. Even his Cristmas lights are X10 enabled.
Well I needed to toss a cablle modem to me LAN which BTW was Wireless. And the only spot I had was down in the basement. Infact exactly 4 inches (yes I just mesured) away from the X10 modual controling the christmass lights.
My laptop is now on the third floor on the other side of the house. Almost the furthest point without going outside. Well on avarage I get about an 80% signal strength considering the amount of plaster and copper pipes between me and the basement. (For some reason tonight I have a 60% strength).
So, that being the case I'll go check the x-mass lights
. . .
Yup it worked... I'll place my bet that the interferance if any is not that big a deal!!!
> SELECT * FROM brain_cells WHERE synaptic_rate > 0
0 row returned
Yeah - most moderators don't seem to know the difference between "offtopic" and "troll".
I don't think it would be that difficult to design but more difficult to maintain.
A number of security issues are involved.
Wireless is amoung the easiest access points to break into.
Who is going to support the users on the network?
Who is going to maintain the network if it has problems?
Who is responsible for replacing the cards the users buy?
My advice:
Let people get their own ISP cable/dsl or phone-line connection. Let either them or their ISP deal with the related problems. No montly fee would be worth all the headaches or potiential legal problems that would result. This is especially true if the apartment manager has little or no networking experience.
You should be able to get a good price for Pringles since you have a reason to buy bulk...
PPPOE!
First AND second post and both with content. That has to be some sort of slashdot record.
Nerd: Derogatory term typically directed at anybody with a lower Slashdot ID than you.
I always get flamed when I post stuff like this but... Throughout college and for the next few years of my life I am going to live in an apartment complex and I really don't understand why newer apartment complexes aren't taking into consideration high speed internet access.
Run some Cat5 through the walls and build a telephone/wiring closet into each building.
Then raise the rent about $10 a month which will absorb the cost of a T-1 and a part-time techie. 25 buildings x 12 tenants x $10 = $3000. $1500 for the T-1 connection and $1500 to keep the techie happy.
Wireless would be great, but I'll agree with the person who posted up above and say there is way too much junk out there interfering with the 2.4 GHz spectrum.
Flame away....
I am not a wireless expert by any means, so my words of advice will be from a risks perspective.
1. Avoid, at all costs, trying to bring everything up at once. Try bringing up a few users at a time. Roll it out slowly.
2. Manufacturers want to sell equipment. Try to find one that has engineers willing to work with you in designing the network. While manufacturers don't do that for sales of one and two items to Harry Homeowner, they might be a bit more responsive to an apartment development.
3. Limit your liability. You need to get a written contract with the apartment complex. It needs to spell out that you you are not responsible if the network fails to provide adequate bandwidth, security, or reliability.
4. Item three not withstanding, make certain that you can provide adequate bandwidth for the entire unit. Recognize that there will be people who download porn, MP3s, and CD images 24x7.
5. Make sure that the management puts together a rock-solid acceptable use policy. There will almost certainly be residents who will spam and who will set up web pages to sell their miracle herbal viagra. You don't want the entire network to be taken down by the uplink ISP before you even finish deployment.
6. On a similar note, make sure that the management has a realistic plan for providing the bandwidth. If they are intent on putting 500 units on a single T1 or a cable modem, the project is doomed to failure from the start.
7. If the project looks hopeless because the customer is clueless, get payment in advance.
8. Do not purchase ANY hardware with your own funds. Make the customer pay. Don't shell out several grand with the hope that you will be reimbursed.
9. If you make any design decisions based on information provided by the customer, make sure to document that in "as-per-our-conversation-of" e-mails and/or memos.
Good luck.
802.1x authentication. 802.1x is a port based authentication method that can be backed up to a radius server, or any other type of authentication device. It is based on EAP, and allows an encryption algorithm to be specified to be used in conjunction with a client app, and the server. When manufacturers start sending APs with 802.1x support in the next month or so, this will be the preferred solution for wireless security. Oh yeah, Windows XP already has built in support for 802.1x too. This will be the next round of wireless security, at least until TKIP is deployed.
I use an old ThinkPad as my access point. It runs Linux. I assume that most of your clients are going to be running Windows. Anyone else should be clever enough to emulate PPTP.
:)
I first chose a random WEP key. I don't consider this secure at all.
I have my ThinkPad play DHCP server (so anyone with the WEP key can get a DHCP addr), and firewall everything other than DHCP and PPTP from the wireless interface. I then use slirp with PoPToP to provide stateless 128-bit MPPE, and assign each windows box a unique password (this is where the security comes from). All real traffic is encrypted; all the user has to do is "dial-in". Of course, everything is NAT'ed; hope that's what you wanted anyways
Obviously this works with 2 APs and one computer behind them.
Your abount to walk into support nightmare. Ever heard the term you touch it you own it. Never ever give your time away for free, period. Your free installation with become in a matter of days "you touched my computer and now the printer does not work". I am by no means telling you not to move forward with the idea, this has been pushed around a good bit by many people I know. I have even helped build out a full push for a new development. Pulls, switches, and the t's. All pre-wired, DHCP, and the price was included in the rent as a "plus" to moving into the new place. I wish you the best of luck, but figure out how to make your time worth it because once they get it for free and you have touched "their" system your going to get pointed at for all kinds of things.
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
Just let me know where that's at..I'd be glad to come on over and help you out.
It worked for NASA. WEP is worse than useless, it slows you down with (arguaby) no benefit (read the whitepaper or download airsnort). Use application/transport layer security when you really need it, like at login time.
Just remember the bigger signal gets the attention of wireless devices on the machines, if someone puts up a access point with a stronger, perhaps applified signal, gets some tools like air snort, webstumbler, and wepcrack, he could own your network, route all the traffic through his access point, and sniff anything going through.
im assuming that this apartment complex has rg6 coax for cable television??, and a central location so that the cable provider can administer it??
go for cable modems, place 48 port switch and a cable modem hub, run a DCHP server to make it easy and provide user/password access rights to the internet connection.
You can make a 10mb LAN to provide access AND the posibility of local file sharing.
Well, anyone suggesting how to lay out radios or frequencies from what you're provided as info can't know that much.
;/ (well, I would, but I'm a vindictive bastard)
" The buildings are arranged such that 2 AP per building should cover all the tenants "
Well.. ok... so the buildings are one foot wide? To be sure that all the tenants can get signal, you'd probably want to actually do a site survey and detail the results if you're looking for decent feedback.
Interference between AP:
It is impossible to tell from the information you've given whether you'll have an issue. It's MOST LIKELY that if you just have two AP, you'll be ok. (one on channel 1, one on 11, happy!)
Management of hitchhikers:
Why not a FreeNet? But anyway, get AP that allow you to accept only based on MAC. That'll take care of 99% of the hitchhikers. The other 1% know what they're doing and you probably shouldn't waste your time worrying - they'll just blast your AP with random 2.4 if you cut them off.
Interference from outside sources:
You can get royally hosed on interference if you're just using off the shelf stuff. You can get hosed by cordless phones, microwave ovens (pop pop pop - the internet is down due to popcorn!), wireless television adapters (check radio shack - they exist at 2.4GHz), and other AP.
Sure, you can do it, but it'll be RF vulnerable, security vulnerable and might not have the range you think it'll have (but I can't tell cause you didn't even provide the most basic size of complex info).
If you called me on the phone and asked me for a quote on this, I could not give you that quote before I came out there. I could guesstimate if you told me the size of the complex, but with what I've got now, I couldn't even guesstimate.
Good luck.
-- There is no sig line, only Zuul.
I refuse to live in an apartment because the last one decided that it would become a commune and divide everyone's water bills up by, what else, square footage of rented space. One person living in a large apartment paid as much as four Mexicans sharing an economy. When your bosses get the brilliant idea of making this a *requirement*, and everyone's still sharing 11Mb of bandwidth, expect to get sued several times over.
"I assumed blithely that there were no elves out there in the darkness"
Couldn't have said it better myself! :)
Most complexes built in the past 10 years are like Faraday cages. Metal lined insulation, full length mirrors, refridgerators, filing cabinets, etc. KILL 2.4 signal. *MANY* people have tried delivering service to the MDU market using poorly planned wireless systems and have failed miserably. We use 2.4 systems to deliver service to the property in a PtP setup. We then deliver 10Mb ethernet via ethersplit to the tenant units using existing POTS lines. A 10base-T jack in every unit with our label coming back to a linux box running ipchains to enable/disable service based on MAC addressing. It works and costs less than a properly designed wireless deployment.
thanks,
tom
This external antenna design sounds interesting. Could you reply to this with more info on how that was done? (Or if you'd rather not share it with the world my email is sd-at-itwerx-dot-net).
Thanks!
Set up a reverse firewall to start. Take a standard firewall and flip it around. So you have 100 people on the outside of it. Then use a VPN to tunnel through it. That will keep the hijackers off your case.
/.ers happy choose a VPN solution that runs with linux :)
Also if you want, make it so that everyone who does not sign in gets dumped to a default page on the internal network that says "You need to sign in to the VPN before being able to access the internet" then also put in a link to download and reinstall the software (that is if you don't mind the hijackers knowing what you are using, otherwise use a directory on the webserver that only you know about, so you can easiliy reinstall it)
Set up your DHCP to assign the DNS entries to the DNS on the other side of the firewall.
However if you want to make the
802.11b nics do not "remember" the last channel that someone transmitted on...so if there are many nics or ap's, the nic's have to process all of the data they see and filter what is meant for them and what is not, so packet loss will actually occur. This is a problem that we have at the employer I work for. We have many access points and nic's, and they just crawl when there is a lot of activity, and packet loss does occur. I know that there are people researching this, but it would require either changes in the standard, or changes in the hardware that might not lead to compliance with the standard...
This may be similar to what he is talking about...
Hello Cliff: While I have never posted on Slashdot I felt compelled to register and reply. PLEASE READ THIS CAREFULLY Allow me to explain that I am a network consultant and have learned the hard way on wireless--very hard and many sleepless nights. My first WLAN installation reminds me of where I think you may be right now, but I had done six months of research and had had endless hours of conversations with engineers from several manufacturers. Before we get to the problems I had, lets start with what you have missed overall: a site survey. NEVER even agree to take on a task like a WLAN unless you have done an extensive site survey. First, you will need blueprints if possible or will need to take fairly exact measurements of each apartment, know materials used in construction etc. You'll also need to have floor plans and more. That said, you should then know the maximum number of users and throw all the specs the manufacturer gave you out the window as regards range, distance and AP's required. And, I am assuming you will have over 20 users. In two different buildings? Don't go with consumer grade stuff like SMC for the AP's. SMC is the best of it but still lacks signal strength in many installs. Go with Cisco for AP's and routers, and ONLY Orinoco Gold cards for laptops and equivalent for desktops. You'll also need a portable spectrum analyzer and know how to intrepret the data it provides. Not sure if they can be rented but I paid $3,000 for mine and it was a deal. You'll need to set up the AP's and then go to every location and check SNR etc.--and record all the data. There's a mountain of paperwork on a project like this, just for the site survey alone. After that's done you will still need to go to each apartment with a mid-range laptop and again record signal strength etc. There will be dead spots, and God only knows where a tenant will put their PC. Now, you will have to roam about again with the spectrum analyzer AND a laptop to look for both multipath interference and to check for other 802.211b nets in the area. And did I mention if you are in a congested urban area or near a university or hospital you will also need to contact the admins at those institutions and hope they will cooperate and give you a map of their devices, antennae and locations? They generally will but may not even know where it all is if it's a large institution--and that can be yet another nightmare to solve. And, forget about promised scalability. Most AP's will really only handle 10 users or so, especially the consumer grade gear. At least unless things have changed drastically since November of 2001, my last nightmare install. You also have another problem: lack of a homogeneous hardware environment. On the Nigthmare Project 2001 (as I call it now) I had some PC's that never worked right if at all on the WLAN (30 users in one university residence, off-campus.) I spent an average of 8 hrs a day on the phone with high-level engineers from Cisco and SMC. Both companies were good but had to admit at times they had no idea why some problems happened. And I had their home and cell phone numbers. I know. Was dealing with a mix of Macs, Linux boxen and Windows PC's running anything from 98 to XP. And some were old Gateways, others new Dells. Gateways were the worst. Forget about the idea that your big worry will be with other 2.4 Ghz devices. Microwaves and phones have seldom been a problem for me on a project unless within 6 ft of the AP or wireless NIC. One stark exception is Panasonic phones, but this is a known issue fopr professionals. I am NOT anti-wireless but do think you should know that the obstacles you face are severe. I do this for a living and can say that I would not take on a project like this unless I had a very tight contract (you do have a lawyer, right.) CAT 5 and other options are cheaper and more reliable--and I haven't even touched on servers or security issues. Wireless is NOT cheaper, is more difficult to roll out and is a real headache--especially in historical buildings and those "impossible to wire" locations. I still do a lot of it but only for corporate installs where I have an open floor plan and decent line of sight. I also refuse to do an install now unless I know the company has skilled admins and will allow me indemnification. Do what you like but don't go into this believing all you have read from manufacturers or home users. Hope you don't have to learn as painfuly as I did. OK to email me at wavelanexperts@yahoo.com and I will be happy to chat on the phone or get you my real email. Good Luck!
YIkes! First post. What happened to my paragraphing? Surely was there when I wrote it all. Apologies. Guess that's what I get for using an XP box I'm testing for a client.
Don't be stupid. Take the time and HARD wire in some access points to each apartment. It's sounds hard but it's not. In addition it's way cheaper than you think. Wireless is too insecure now. You will be comprimised within a couple of days. Trust me. I don't care what vendors say about their security. I have done a lot of research on wireless. Like another person said, "...be very afraid" of lawsuits. You WILL be COMPRIMISED.
Drop the wireless and go for "roll your own" DSL.0 0_DSLA M_1_to_72_Ports_48VDC_Ready_SNMP__Bridges___Router s/display_~larger_image
http://www.epinions.com/Paradyne_Hotwire_88
There's one right there. For about 4 large and some change you get a 48 port DSLAM.
If you want to raise some fundage, post a notice that you are going to implement this and say that the first N people to sign up get 6 months free if they pay 50$ now and are willing to wait a month or two.
Check the public access point by colubris.
s s/ CN3000/
They claim it is worlds first access point with authentication
Worth a look
Then its only users with stuipid passwords you have to worry about & not MAC spoofers.
http://www.colubris.com/en/products/public_acce
I am in the process of developing a city-wide wireless network. Here are some of the thing I am doing in my lab to prepare for rollout.
1. PPPoE
Yes its anoying to users, and I'm not to fond of it myself, but it is a hell of alot better than any other auth method, IMHO, and it allows me to do some cool stuff with radius.
2. Amps are your friend
Most interference can be weeded out just by drownding it out. Pick a channel, and stay with it, when and if you have problems with interference amp it. Other devices that don't need as much as a spectrum in the 2.4 range, such as phones will just look for another clearer channel. At the ITECH i beamed in a signal into the convension center from a nearby hotel and ran an IP phone over it, I found out the morning of the show that lots of other people were using wireless inside the building, i just ran up to the roof of the hotel and stuck on an amp, and bamo 11Mbs, nailed.
3. Channel Selection
Most devices i've played with will either defaul to channel 1 or 6, put your signal on a high number like 9 to avoid killing your clients internal wireless network.
4. Saturation
The one concern I had is saturation, with only 11Mbs on 802.11b several power users could suck up alot of that. I would expect that more technical clients will realize that they are on an ethernet segment together and start setting up shared folders for their buddy 2 doors down so he can get all of his mp3s/porn. with enough users it could turn into a problem. I am remiding this by creating a backbone of 802.11a and then distriuting it with 802.11b
just my $.02
This is a must read article to configure a wireless PCMCIA to act like an access point on Linux.
Spanish
French
It's not free if you have to put the rent up to pay for the equipment.
Free trials and rentals are a great way to get new users but someone at some stage has to pay for the equipment. Even a government grant is indirectly paid for through taxes.
If someone bought a point out of their own cash and provided free access then that would be cheaper but you still need to buy a WAN card.
Daniel
Forgive my ignorance, but wwc?
CitrusTV (http://www.citrustv.net): the Nation's Oldest & Largest Entirely Student-Run Television Station
It is, according to some people...
2. Amps are your friend
Yes - they are your friend - but only if they're legal. Just because 802.11 and other 2ghz devices are unlicensed doesn't mean you can be lax on the technical and legal requirements.
In the US, FCC regs require that Part 15 devices (most of the wireless devices out there) be certified as systems. This means you can only add an amp if it's certified to work with the system (both the wireless bridge AND antenna) you're amping. Many of the common vendors don't have such certified amps, so you're stuck. (I've most commonly found certified amps for Orinoco and higher end products like alvarion - but rarely seen certified ones for SMC, Cisco or the likes).
Don't forget your power calculations as well - depending on your band, your AMP can only boost power _to_ a specific level (30 db or 1 watt total on part 15 2ghz devices). If you have a bigger antenna, then you may have to reduce your amp power (e.g in many cases, it's against the law/regs to amp an 802.11 device with those grid dish antennas).
Also - amping things to drown out interference is akin to shouting louder on a bus to talk "over" a conversation between you and the receiver. Sure, it works, but then you become the interference. You might even convince someone else to shout louder than you. While it's true Part 15 devices must accept any interference, amping up your connection to drown out others could be against the regs (as general rules state no purposeful interference is permitted...there are cases to support this position). If you amp to "drown out interference", it could be construed as purposeful inteference itself (especially if your amping result's in drowning out licensed devices in the same band - remember THEY have the priority (part 18)).
Amps are best used to support "weak" connections - not to handle interference. Believe it or not, most 2ghz devices (even the phones) can be made to play nice. With a little careful planning and design, proper knowledge, and coordination, most, if not all interference problems can be handled _without_ amping.
Anonymous Coward Here....
SF will die in North America.
Ok, I'm back ... no longer an anonymous coward. Here's a public answer to the private emails I've received so far:
Here's the recipe from NASA:
OpenBSD 2.9
ISC's DHCPD 3.0
Apache/OpenSSL
PHP 4.x
Some network-based authentication (we use RADIUS)
I wrote a note to Boscia (the author of the white paper) and she directed me towards server/mdb.c in the DHCP source code -- whenever the DHCP lease changes state from active to free or abandoned, call the "remove firewall rule" function.
slank's post is a little misleading. We allow ANYONE to grab a lease from DHCP. The trick is, you don't let them route outside the wireless subnet until they've presented login credentials to your HTTPS web script. Then, via DHCP's logs and the web script, you now have: username, MAC address, IP address, computer name. Throw all that with a timestamp into a log and you have accountability.
Best of luck! Jeff underscore Wilson at baylor dot edu
Regards,
Jeff Wilson
Baylor University
Waco, TX
An apartment with a 100 foot radius? Enough of the wireless stuff, I want to know how he heats the place.
Is there a cheap way to determine if a wireless network would be feasible in a given environment (ie/ measure possible interference)?
Robots are everywhere, and they eat old people's medicine for fuel.
You know, what I find funny is that you are
blaming your lack of HTML skills and a complete
lack of understanding as to how slashdot posts
are formatted to an "XP box" problem. Given
these simple skills, or lack thereof, your entire
post is of questionable quality.
Since I've actually done this before, I've got some other things you need to look at.
1. Proper coverage. There's lots of nasty things in apartment buildings that block signals, or attenuate it to the point where the connections get really lossy. You'll have to blanket the hell out of the area to get reliable connectivity, and then you'll run in to crosstalk problems.
2. Using a wireless solution will also mean an increase in latency. This will give people problems when playing online games.
3. Quality of equipment. I'm sure you've thought about this already, but while Linksys and most of the other wireless vendors are great for peer-to-peer wireless, they're going to suck for the kind of solution you want. I'd suggest Cisco or Lucent.
4. Expect problems. We attempted several wireless-to-desktop solutions, and none of them worked very well. We ended up scrapping them in favor of either wireless backbone, or trenching cable. It's also a real pain in the ass to do reliable wireless to a large area over public band, since there's so many things that operate in there and there's so many restrictions on how high you can boost the power on your signal.
As you mentioned, interference is a major problem. You'll run in to all sorts of stuff that'll kill the signal.
If what you want is good, fast service, you've got a couple of options. Personally, I'd scrap the wireless-to-desktop idea entirely, and run a dsl-over-telco solution, and stick the dslam for the DSL in the telco room. This will prevent people from stealing service, since you can have direct control over what ports are active. This is only really viable if you have a central demarc for all the phone lines on the property. An option if you don't have a central demark is to either run your own home runs to create a demarc (trenching cable is cheap, in most cases cheaper than the wireless solution would cost). You can then patch the wires that you had run on to the existing lines in each building, and get the service going that way. Another option is to mount mini-dslams at each building at the phone terminals (I know Tut Systems, for one, makes these), and run either an ethernet or wireless backbone to a central point where you have the uplink circuit.
I've been called a "Fucking Dick" by better people than you.
I helped found an ISP based on 802.11. Been there done that.
As stated above - put your access points on opposite ends of the spectrum. Use WAP. Stops the casual observer (and this isn't a military installation after all). Any financial interaction your tennants have should be done with the protection of SSL or some other scheme anyway - that's their problem.
For access control DHCP/MAC again stops the casual moron with a power book. For net access setup a proxy sever and require login/password authentication to get out. Squid handles this nicely. You can then also do things like porn filters and such based on login. (if you want to go down that road)
As far as interference goes we have run multiple different 2.4gHz networks and wireless phones in the same room - 802.11 works every time. If the signal is already running at 1mb and you have strong "near field" interference (cordless phone right next to the AP) you will drop a significant portion of packets.
Oh, and just bite the bullet and use Lucent/Orinoco cards and access points. We've tried em all. Lucent rules the roost.
"Smile, listen, agree, and then do whatever the fuck you wanted to do anyway." ~Robert Downey Jr.
Please pay no attention to the other AC ass who replied earlier. To answer your question, the default /. posting format is HTML, which means that you ought to mark paragraphs with <P> ... </P>, although you can get away with simply separating them with <P> markers. And don't fail to take advantage of the preview button.
Welcome to slashdot, and thanks for the informative first post.
Go with a company that has dual radio capability in one UAP so that you don't have to run Cat5 cable. Also, if I was a tenant, seamless roaming would be a requirement.
www.intermec.com
Look at their 210x series; especially the 2100 for outdoors.
10 MD
Okie Dokie.
Um, what the hell are you talking about?
PLEASE READ THIS CAREFULLY Allow me to explain that I am a network consultant and have learned the hard way on wireless--very hard and many sleepless nights.
snip
OK to email me at wavelanexperts@yahoo.com
I understand that you may have a yahoo email address for privacy reasons, but the fact that it is related to your "professional" area of expertise is a bit suspect. Do you often give out anonymous wireless networking advice?
I don't necessarily disagree with everything you say.
Many have mentioned the problem of interference around 2.4GHz from cordless phones, microwaves, etc. As I see it, the best solution to this (and with future capacity in mind) is to go with 802.11a instead of 802.11b. It operates at around 5GHz and has much higher bandwidth (~60 Mbps). The only drawback right now is that it costs more and only one company I know of sells them yet (D-Link).
Hello:
You are correct about the yahoo address being used for privacy reasons. I'm not sure why you think the address is a bit suspect, unless you imagine that I might be seeking to sell products or services--which I am not. I feel that solicitation of goods or services on a site like /. is reprehensible.
I live and work in a Metro area of 500,000 residents and have all the work I need locally.Any projects I take on outside of my local area are due to referrals from one of several wireless vendors.Now, you ask if I often give out anonymous WLAN advice. I do so when I have time, but felt especially compelled to reply to the original poster. What I got from the subtext of his post is that he might be young, have some experience in networking but obviously none to little in wireless. Without the site survey and a good contract drawn up by a lawyer he would be headed for certain disaster.
Even more important to me was the fact that the type of install he proposes it perhaps the most difficult of any to implement. Just thinking about the problems one faces on that sort of rollout makes me want to grab a beer.
Lastly, I am an open source advocate. That said, I feel obligated to help others when I can if the issues are within my area of expertise and do not result in any conflicts with clients or vendors. Many others in the community have been giving of their time and skills, so I like to do my part when I can. I hope this alleviates any concerns you may have.
Kindest Regards,
Doc
True AP mode with Orinoco cards under Linux? Can't be done as far as I know. You must be in ad-hoc mode. FYI actual AP mode with an Orinoco can be done in Windows with the Lucent driver and some undocumented registry settings - for details look here
The only cards that will do actual Access Point mode under Linux are based on Prism2. The HostAP driver provides full AP mode including offloading WEP to the CPU (128 bit WEP on a 40 bit card!), MAC filtering, and lots of other fun stuff. Works beautifully. Check it out here
First off, there are only three effective channels with 802.11b. 1,5, and 11. All the other channels overlap these three. You should avoid overlapping the same channel in the same area, as it will cause interference. As for security, just inform the users that the connection will be relatively fast (assuming you are not just buying a dsl line for the whole complex, in which case, I as a user would buy my own damn dsl line and wireless AP), but not secure.
WEP is bullshit, how secure is something when you have to give the keys to everyone. Not very... Tell the users that they should ensure that their email accounts are using some kind of secure password authentication scheme. As for people reading my mail, i don't care that much. I use PGP when I do.
To keep freeloaders off the network, mac address filtering is the way to go. Also the lucent/avaya aps support 802.1x and radius. Get yourself a Cisco 3550 L3 switch to connect your aps up, I believe that you can set up mac address filters on it. If someone complains about not being able to get on the network, check out the mac address tables to see which ports that mac address has been seen on and track down the perp.
IMHO
I found this interesting pice of text on NASA's homepage. You should especialy follow the link in the bottom of the text (this one)
go to www.turbowave.com, these antennas (slh10 and 12) use circular polarity at 2.4ghz. No need to peek through windows, just put one on each building and each person has one pointing at it.
I've seen these little beauties providing wireless
with one antenna pointed down into a 3 story building. And you don't have to hike a mile or two for line of sight. The circular polarization goes through (especially at close range) buildings and vegetation.
i dont think anyones agreements with there isp allows for the reselling of dsl service any thoughts
Yes, that's right, I'm using Ad-Hoc. Sorry for any confusion. I meant that I'm using the old laptop as a wireless interface to my roaming laptop.
Suncoast Linux - Sarasota, FL