802.11 Wireless Networks: The Definitive Guide, 2nd Edition

Preface

People move. Networks don’t.

More than anything else, these two statements can explain the explosion of wireless LAN hardware. In just a few years, wireless LANs have grown from a high-priced, alpha-geek curiosity to mainstream technology.

By removing the network port from the equation, wireless networks separate user connectivity from a direct physical location at the end of a cord. To abstract the user location from the network, however, requires a great deal of protocol engineering. For users to have location-independent services, the network must become much more aware of their location.

This book has been written on more airplanes, in more airports, and on more trains than I care to count. Much of the research involved in distilling evolving network technology into a book depends on Internet access. It is safe to say that without ubiquitous network access, the arrival of this book would have been much delayed.

The advantages of wireless networks has made them a fast-growing multibillion dollar equipment market. Wireless LANs are now a fixture on the networking landscape, which means you need to learn to deal with them.

Prometheus Untethered: The Possibilities of Wireless LANs

Wireless networks offer several advantages over fixed (or “wired”) networks:

Mobility

Users move, but data is usually stored centrally, enabling users to access data while they are in motion can lead to large productivity gains. Networks are built because they offer valuable services to users. In the past, network designers have focused on working with network ports because that is what typically maps to a user. With wireless, there are no ports, and the network can be designed around user identity.

Ease and speed of deployment

Many areas are difficult to wire for traditional wired LANs. Older buildings are often a problem; running cable through the walls of an older stone building to which the blueprints have been lost can be a challenge. In many places, historic preservation laws make it difficult to carry out new LAN installations in older buildings. Even in modern facilities, contracting for cable installation can be expensive and time-consuming.

Flexibility

No cables means no recabling. Wireless networks allow users to quickly form amorphous, small group networks for a meeting, and wireless networking makes moving between cubicles and offices a snap. Expansion with wireless networks is easy because the network medium is already everywhere. There are no cables to pull, connect, or trip over. Flexibility is the big selling point for the “hot spot” market, composed mainly of hotels, airports, train stations (and even trains themselves!), libraries, and cafes.

Cost

In some cases, costs can be reduced by using wireless technology. As an example, 802.11® equipment can be used to create a wireless bridge between two buildings. Setting up a wireless bridge requires some initial capital cost in terms of outdoor equipment, access points, and wireless interfaces. After the initial capital expenditure, however, an 802.11-based, line-of-sight network will have only a negligible recurring monthly operating cost. Over time, point-to-point wireless links are far cheaper than leasing capacity from the telephone company.

Until the completion of the 802.11 standard in 1997, however, users wanting to take advantage of these attributes were forced to adopt single-vendor solutions with all of the risk that entailed. Once 802.11 started the ball rolling, speeds quickly increased from 2 Mbps to 11 Mbps to 54 Mbps. Standardized wireless interfaces and antennas have made it much easier to build wireless networks. Several service providers have jumped at the idea, and enthusiastic bands of volunteers in most major cities have started to build public wireless networks based on 802.11.

802.11 has become something of a universally assumed connectivity method as well. Rather than wiring public access ports up with Ethernet, a collection of access points can provide connectivity to guests. In the years since 802.11 was standardized, so-called “hot spots” have gone from an exotic curiosity in venues that do not move, to technology that is providing connectivity even while in transit. By coupling 802.11 access with a satellite uplink, it is possible to provide Internet access even while moving quickly. Several commuter rail systems provide mobile hot-spots, and Boeing’s Connexion service can do the same for an airplane, even at a cruising speed of 550 miles per hour.

Audience

This book is intended for readers who need to learn more about the technical aspects of wireless LANs, from operations to deployment to monitoring:

• Network architects contemplating rolling out 802.11 equipment onto networks or building networks based on 802.11

• Network administrators responsible for building and maintaining 802.11 networks

• Security professionals concerned about the exposure from deployment of 802.11 equipment and interested in measures to reduce the security headaches

The book assumes that you have a solid background in computer networks. You should have a basic understanding of IEEE 802 networks (particularly Ethernet), the OSI reference model, and the TCP/IP protocols, in addition to any other protocols on your network. Wireless LANs are not totally new ground for most network administrators, but there will be new concepts, particularly involving radio transmissions.

Overture for Book in Black and White, Opus 2

Part of the difficulty in writing a book on a technology that is evolving quickly is that you are never quite sure what to include. The years between the first and second edition were filled with many developments in security, and updating the security-related information was one of the major parts of this revision. This book has two main purposes: it is meant to teach the reader about the 802.11 standard itself, and it offers practical advice on building wireless LANs with 802.11 equipment. These two purposes are meant to be independent of each other so you can easily find what interests you. To help you decide what to read first and to give you a better idea of the layout, the following are brief summaries of all the chapters.

Chapter 1, Introduction to Wireless Networking, lists ways in which wireless networks are different from traditional wired networks and discusses the challenges faced when adapting to fuzzy boundaries and unreliable media. Wireless LANs are perhaps the most interesting illustration of Christian Huitema’s assertion that the Internet has no center, just an ever-expanding edge. With wireless LAN technology becoming commonplace, that edge is now blurring.

Chapter 2, Overview of 802.11 Networks, describes the overall architecture of 802.11 wireless LANs. 802.11 is somewhat like Ethernet but with a number of new network components and a lot of new acronyms. This chapter introduces you to the network components that you’ll work with. Broadly speaking, these components are stations (mobile devices with wireless cards), access points (glorified bridges between the stations and the distribution system), and the distribution system itself (the wired backbone network). Stations are grouped logically into Basic Service Sets (BSSs). When no access point is present, the network is a loose, ad-hoc confederation called an independent BSS (IBSS). Access points allow more structure by connecting disparate physical BSSs into a further logical grouping called an Extended Service Set (ESS).

Chapter 3, 802.11 MAC Fundamentals, describes the Media Access Control (MAC) layer of the 802.11 standard in detail. 802.11, like all IEEE 802 networks, splits the MAC-layer functionality from the physical medium access. Several physical layers exist for 802.11, but the MAC is the same across all of them. The main mode for accessing the network medium is a traditional contention-based access method, though it employs collision avoidance (CSMA/CA) rather than collision detection (CSMA/CD). The chapter also discusses data encapsulation in 802.11 frames and helps network administrators understand the frame sequences used to transfer data.

Chapter 4, 802.11 Framing in Detail, builds on the end of Chapter 3 by describing the various frame types and where they are used. This chapter is intended more as a reference than actual reading material. It describes the three major frame classes. Data frames are the workhorse of 802.11. Control frames serve supervisory purposes. Management frames assist in performing the extended operations of the 802.11 MAC. Beacons announce the existence of an 802.11 network, assist in the association process, and are used for authenticating stations.

Chapter 5, Wired Equivalent Privacy (WEP), describes the Wired Equivalent Privacy protocol. In spite of its flaws, WEP is the basis for much of the following work in wireless LAN security. This chapter discusses what WEP is, how it works, and why you can’t rely on it for any meaningful privacy or security.

Chapter 6, User Authentication with 802.1X, describes the 802.1X authentication framework. In conjunction with the Extensible Authentication Protocol, 802.1X provides strong authentication solutions and improved encryption on Wireless LANs.

Chapter 7, 802.11i: Robust Security Networks, TKIP, and CCMP, describes the 802.11i standard for wireless LAN security. In recognition of the fundamental flaws of WEP, two new link-layer encryption protocols were designed, complete with new mechanisms to derive and distribute keys.

Chapter 8, Management Operations, describes the management operations on 802.11 networks. To find networks to join, stations scan for active networks announced by access points or the IBSS creator. Before sending data, stations must associate with an access point. This chapter also discusses the power-management features incorporated into the MAC that allow battery-powered stations to sleep and pick up buffered traffic at periodic intervals.

Chapter 9, Contention-Free Service with the PCF, describes the point coordination function. The PCF is not widely implemented, so this chapter can be skipped for most purposes. The PCF is the basis for contention-free access to the wireless medium. Contention-free access is like a centrally controlled, token-based medium, where access points provide the “token” function.

Chapter 10, Physical Layer Overview, describes the general architecture of the physical layer (PHY) in the 802.11 model. The PHY itself is broken down into two “sublayers.” The Physical Layer Convergence Procedure (PLCP) adds a preamble to form the complete frame and its own header, while the Physical Medium Dependent (PMD) sublayer includes modulation details. The most common PHYs use radio frequency (RF) as the wireless medium, so the chapter closes with a short discussion on RF systems and technology that can be applied to any PHY discussed in the book.

Chapter 11, The Frequency-Hopping (FH) PHY, describes the oldest physical layer with 802.11. Products based on the FH PHY are no longer widely sold, but a great deal of early 802.11 equipment was based on them. Organizations with a long history of involvement with 802.11 technology may need to be familiar with this PHY.

Chapter 12, The Direct Sequence PHYs: DSSS and HR/DSSS (802.11b), describes two physical layers based on direct sequence spread spectrum technology. The initial 802.11 standard included a layer which offered speeds of 1 Mbps and 2 Mbps. While interesting, it was not until 802.11b added 5.5 Mbps and 11 Mbps data rates that the technology really took off. This chapter describes the two closely-related PHYs as a single package.

Chapter 13, 802.11a and 802.11j: 5-GHz OFDM PHY, describes the 5-GHz PHY standardized with 802.11a, which operates at 54 Mbps. This physical layer uses another modulation technique known as orthogonal frequency division multiplexing (OFDM). Slight modifications were required to use this PHY in Japan, which were made by the 802.11j standard.

Chapter 14, 802.11g: The Extended-Rate PHY (ERP), describes a PHY which uses OFDM technology, but in the 2.4 GHz frequency band shared by 802.11b. It has largely supplanted 802.11b, and is a common option for built-in connectivity with new notebook computers. The PHY itself is almost identical to the 802.11a PHY. The differences are in allowing for backwards compatibility with older equipment sharing the same frequency band.

Chapter 15, A Peek Ahead at 802.11n: MIMO-OFDM, describes the PHY currently in development. 802.11n uses a PHY based on multiple-input/multiple-output (MIMO) technology for much higher speed. At the time this book went to press, two proposed standards were dueling in the committee. This chapter describes both.

Chapter 16, 802.11 Hardware, begins the transition from theoretical matters based on the standards to how the standards are implemented. 802.11 is a relatively loose standard, and allows a large number of implementation choices. Cards may differ in their specified performance, or in the manner in which certain protocols are implemented. Many of these variations are based on how they are built.

Chapter 17, Using 802.11 on Windows, describes the basic driver installation procedure in Windows, and how to configure security settings.

Chapter 18, 802.11 on the Macintosh, describes how to use the AirPort card on MacOS X to connect to 802.11 networks. It focuses on Mac OS X 10.3, which was the first software version to include 802.1X support.

Chapter 19, Using 802.11 on Linux, discusses how to install 802.11 support on a Linux system. After discussing how to add PC Card support to the operating system, it shows how to use the wireless extensions API. It discusses two common drivers, one for the older Orinoco 802.11b card, and the MADwifi driver for newer cards based on chipsets from Atheros Communications. Finally, it shows how to configure 802.1X security using xsupplicant.

Chapter 20, Using 802.11 Access Points, describes the equipment used on the infrastructure end of 802.11 networks. Commercial access point products have varying features. This chapter describes the common features of access points, offers buying advice, and presents two practical configuration examples.

Chapter 21, Logical Wireless Network Architecture, marks the third transition in the book, from the implementation of 802.11 on the scale of an individual device, to how to build 802.11 networks on a larger scale. There are several major styles that can be used to build the network, each with its advantages and disadvantages. This chapter sorts through the common types of network topologies and offers advice on selecting one.

Chapter 22, Security Architecture, should be read in tandem with the previous chapter. Maintaining network security while offering network access on an open medium is a major challenge. Security choices and architecture choices are mutually influential. This chapter addresses the major choices to be made in designing a network: what type of authentication will be used and how it integrates with existing user databases, how to encrypt traffic to keep it safe, and how to deal with unauthorized access point deployment.

Chapter 23, Site Planning and Project Management, is the final component of the book for network administrators. Designing a large-scale wireless network is difficult because there is great user demand for access. Ensuring that the network has sufficient capacity to satisfy user demands in all the locations where it will be used requires some planning. Choosing locations for access points depends a great deal on the radio environment, and has traditionally been one of the most time-consuming tasks in building a network.

Chapter 24, 802.11 Network Analysis, teaches administrators how to recognize what’s going on with their wireless LANs. Network analyzers have proven their worth time and time again on wired networks. Wireless network analyzers are just as valuable a tool for 802.11 networks. This chapter discusses how to use wireless network analyzers and what certain symptoms may indicate. It also describes how to build an analyzer using Ethereal, and what to look for to troubleshoot common problems.

Chapter 25, 802.11 Performance Tuning, describes how network administrators can increase throughput. It begins by describing how to calculate overall throughput for payload data, and common ways of increasing performance. In rare cases, it may make sense to change commonly exposed 802.11 parameters.

Chapter 26, Conclusions and Predictions, summarizes current standards work in the 802.11 working group. After summarizing the work in progress, I get to prognosticate and hope that I don’t have to revise this too extensively in future editions.

Major Changes from the First Edition

The three years between 2002 and 2005 saw a great deal of change in wireless LANs. The standards themselves continued to evolve to provide greater security and interoperability. Following the typical technology path of “faster, better, and cheaper,” the data rate of most 802.11 interfaces has shot from 2 or 11 Mbps with 802.11b to 54 Mbps with 802.11a and 802.11g. Increased speed with backwards compatibility has proved to be a commercially successful formula for 802.11g, even if it has limitations when used for large-scale networks. The coming standardization of 802.11n is set to boost speeds even farther. New developments in PHY technology are anxiously awaited by users, as shown by the popular releases of pre-standard technology. Two entirely new chapters are devoted to 802.11g and 802.11n. European adoption of 802.11a was contingent on the development of spectrum management in 802.11h, which resulted in extensive revisions to the management chapter.

When the first edition was released in 2002, the perception of insecurity dominated discussions of the technology. WEP was clearly insufficient, but there was no good alternative. Most network administrators were making do with remote access systems turned inward, rather than their natural outward orientation. The development of 802.11i was done a great deal to simplify network security. Security is now built in to the specification, rather than something which must be added on after getting the network right. Security improvements permeate the book, from new chapters showing how the new protocols work, to showing how they can be used on the client side, to how to sort through different options when building a network. Sorting through security options is much more complex now than it was three years ago, and made it necessary to expand a section of the deployment discussion in the first edition into its own chapter.

Three years ago, most access points were expensive devices that did not work well in large numbers. Network deployment was often an exercise in working around the limitations of the devices of the time. Three years later, vastly more capable devices allow much more flexible deployment models. Rather than just a “one size fits all” deployment model, there are now multiple options to sort through. Security protocols have improved enough that discussions of deploying technology are based on what it can do for the organization, not on fear and how to keep it controlled. As a result, the original chapter on network deployment has grown into three, each tackling a major part of the deployment process.

Conventions Used in This Book

Italic

Indicates pathnames, filenames, class names, and directories; new terms where they are defined; and Internet addresses, such as domain names and URLs.

Bold

Used for GUI components.

Constant width

Used for command lines and options that should be typed verbatim on the screens, as well as all code listings.

Constant width italic

Shows general placeholders that indicate that an item should be replaced by some actual value in your own program

Constant width bold

Shows text that is typed in code examples by the user.

Tip

This icon signifies a tip, suggestion, or general note.

Caution

This icon indicates a warning or caution.

Using Code Examples

This book is here to help you get your job done. In general, if this book includes code examples, you may use the code in your programs and documentation. You do not need to contact us for permission unless you’re reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from this book does not require permission. Selling or distributing a CD-ROM of examples from O’Reilly books does require permission. Answering a question by citing this book and quoting example code does not require permission. Incorporating a significant amount of example code from this book into your product’s documentation does require permission.

We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN. For example: “802.11 Wireless Networks: The Definitive Guide, Second Edition by Matthew S. Gast (O’Reilly). Copyright 2005 Matthew S. Gast, 978-0-596-10052-0.”

If you feel your use of code examples falls outside fair use or the permission given above, feel free to contact us at [e-mail].

Safari® Books Online

Note

Safari Books Online (www.safaribooksonline.com) is an on-demand digital library that delivers expert content in both book and video form from the world’s leading authors in technology and business.

Technology professionals, software developers, web designers, and business and creative professionals use Safari Books Online as their primary resource for research, problem solving, learning, and certification training.

Safari Books Online offers a range of product mixes and pricing programs for organizations, government agencies, and individuals. Subscribers have access to thousands of books, training videos, and prepublication manuscripts in one fully searchable database from publishers like O’Reilly Media, Prentice Hall Professional, Addison-Wesley Professional, Microsoft Press, Sams, Que, Peachpit Press, Focal Press, Cisco Press, John Wiley & Sons, Syngress, Morgan Kaufmann, IBM Redbooks, Packt, Adobe Press, FT Press, Apress, Manning, New Riders, McGraw-Hill, Jones & Bartlett, Course Technology, and dozens more. For more information about Safari Books Online, please visit us online.

How to Contact Us

Please address comments and questions concerning this book to the publisher:

O’Reilly Media, Inc.

1005 Gravenstein Highway North

Sebastopol, CA 95472

800-998-9938 (in the United States or Canada)

707-829-0515 (international or local)

707-829-0104 (fax)

We have a web page for this book, where we list errata, examples, and any additional information. You can access this page at http://www.oreilly.com/catalog/802dot112/.

To comment or ask technical questions about this book, send email to [e-mail].

For more information about our books, courses, conferences, and news, see our website at http://www.oreilly.com.

Find us on Facebook: http://facebook.com/oreilly

Follow us on Twitter: http://twitter.com/oreillymedia

Watch us on YouTube: http://www.youtube.com/oreillymedia

Acknowledgments

As much as I would like to believe that you are reading this book for its entertainment value, I know better. Technical books are valued because they get the details right, and convey them in an easier fashion than the unadorned technical specification. Behind every technical book, there is a review team that saw the first draft and helped to improve it. My review team caught numerous mistakes and made the book significantly better. Dr. Malik Audeh of Tropos Networks is, for lack of a better term, my radio conscience. I am no radio expert—what I know about radio, I learned because of my interest in 802.11. Malik knew radio technology before 802.11, and I have been privileged to share in his insight. Gerry Creager of Texas A&M offered insight into the FCC rules and regulations for unlicensed devices, which was valuable because wireless LANs have been upending the rules in recent years. When Glenn Fleishman agreed to write the foreword, I had no idea that he would offer so much help in placing 802.11 within its larger context. Many of the details he suggested were references to articles that had run in the past years on his own Wi-Fi Networking News site. As a writer himself, Glenn also pointed out several locations where better examples would make my points much clearer. Finally, Terry Simons of the Open1X project has worked extensively with 802.11 on Linux, and with nearly every 802.1X supplicant on the major operating systems. Terry also is one of the architects of the wireless authentication system at the University of Utah. His expertise can be felt throughout the early part of the book on security specifications, as well as in the practical matter of using supplicants and building an authentication system.

I am also indebted to many others who help keep me abreast of current developments in 802.11, and share their knowledge with me. Since 2002, I have been privileged to participate in the Interop Labs initiatives related to wireless security and 802.1X. The real world is far too messy for the classroom. Every year, I learn more about the state of the art by volunteering than I ever could by taking a prepared class. Through the Interop Labs, I met Chris Hessing, the development lead for xsupplicant. Chris has always generously explained how all the keying bits move around in 802.11, which is no small feat! Sudheer Matta, a colleague of mine, always has time to explain what is happening in the standards world, and how the minute details of the MAC work.

The large supporting cast at O’Reilly was tremendously helpful in a wide variety of ways. Ellie Volckhausen designed a stunning cover that has adorned my cubicle as well as most of the personal electronics devices I own since 2001, when I began writing the first edition. (It even looks good as the wallpaper on my mobile telephone!) Jessamyn Read took a huge mass of raw sketches and converted every last one into something that is worth looking at, and did so on a grueling schedule. I do not know how many hours Colleen Gorman, the production editor, put into this book to get it finished, but I hope her family and her cat, Phineas, forgive me. And, as always, I am thankful for the wisdom of Mike Loukides, the editor. Mike kept this project moving forward in the innumerable ways I have been accustomed to from our past collaborations, and his background as a ham radio operator proved especially useful when I started writing about the dark and forbidding world of antennas and RF transmission. (Among many, many other items, you have him to thank for the footnote on the gain of the Aricebo radio telescope!)

As with so much in life, the devil of writing is in the details. Getting it right means rewriting, and then probably rewriting some more. I did not attempt a large writing project until college, when I took Brad Bateman’s U.S. Financial System class. Although I certainly learned about the flow of money through the economy and the tools that the Federal Reserve uses in formulating policy, what I most value in retrospect was the highly structured process of writing a lengthy paper throughout the semester. In addition to simply producing a large document, Dr. Bateman stressed the revision process, a skill that I had to use repeatedly in the preparation of this book and its second edition. It would be a mistake, however, for me to simply credit Dr. Bateman as an outstanding writing teacher or an economist gifted with the ability to explain complex subjects to his students. Dr. Bateman is not shackled by his narrow academic expertise. During the preparation of the second edition of this book, I attended a lecture of his about the social history of my alma mater. In a captivating hour, he traced the history of the institution and its intersection with wider social movements, which explained its present-day culture in far more depth than I ever appreciated while a student. Not all professors teach to prepare students for graduate school, and not all professors confine their teaching to the classroom. I am a far better writer, economist, and citizen for his influence.

When writing a book, it is easy to acknowledge the tangible contributions of others. Behind every author, though, there is a supportive cast of relatives and friends. As always, my wife Ali continued to indulge my writing habit with extremely good humor, especially considering the number of weekends that were sacrificed to this book. Many of my friends informally supported this project with a great deal of encouragement and support; my thanks must go to (in alphabetical order) Annie, Aramazd, Brian, Dameon, Kevin, and Nick.

—Matthew Gast

San Francisco, California

February 2005