 |
Primer for Private Wireless Access Points on MITnetPreliminary ConsiderationsWhile not explicitly banned on the MIT campus, IS&T recommends against using private access points (APs, also known as "base stations") for a number of technical, financial, and administrative considerations. This table lists areas to consider when choosing to deploy private access points and discusses the benefit of contracting with IS&T when compared to the responsibilities associated with a private installation.
802.11b Technology OverviewCustomers who have chosen to deploy privately-owned APs, should have a basic understanding of some details of the wireless LAN (local area network) technology in use at MIT. The wireless network infrastructure deployed by IS&T at MIT utilizes the IEEE 802.11b wireless LAN protocol. Connectivity is achieved by APs strategically positioned to cover target areas and network interface cards (NICs) in users’ computers. The NICs communicate through APs with the rest of the network; the APs act as receiving and transmitting stations connecting to the existing, wired network infrastructure, akin to how the base station of a cordless telephone operates to bridge the handset with the telephone network. The IEEE 802.11b is an internationally developed standard from the same organization that has set standards for Ethernet networking in common use throughout the campus. The standard ensures compatibility among compliant wireless devices from different vendors. 802.11b-compliant devices operate in the Industry, Scientific, and Medical (ISM) frequency band, an internationally recognized band for radio LANs, and operates near 2.4 GHz. As the name suggests, the frequency band was previously designated for a variety of industrial, scientific, and medical devices before the 802.11b protocol joined in. Some wireless consumer devices also operate in this band and can be a significant source of interference. For instance, certain cordless telephone units, such as those advertised to be 2.4 GHz and "longest range", operate at or near 2.4 GHz. The frequency band within which 802.11b operates also coincides with the frequency band at which microwave ovens operate - another possible source of interference. Provisions exist in 802.11b devices that can be turned on to combat some interference, often referred to as microwave robustness, Similarly, industry groups, such as the Wireless Ethernet Compatibility Alliance (WECA), conduct tests on 802.11b (and other wireless) devices to certify them for concurrent operation with other wireless products, such as Bluetooth, an emerging, shorter range wireless communication protocol. Most prominent of these certifications is the Wi-Fi certification, from WECA. Within the ISM band, there are 14 allocated channels. A channel is a smaller range of frequencies over which wireless transmissions and receptions between devices tuned to that channel take place. ISM channels are similar to channels used for a television broadcast or citizens band (CB) radio. In the United States, the regulating body, Federal Communication Commission (FCC), mandates the use of channels 1 through 11 for 802.11b communications. When tuned to use a specific channel, 802.11b devices utilize that channel primarily, though some less powerful transmission takes place in 4 channels immediately adjacent to the primary channel. So there are some issues of possible interference when configuring independently communicating groups of devices operating in the same area. 802.11b also accommodates two separate frequency technologies, referred to as Direct Sequence Spread Spectrum (DSSS) and Frequency Hopping Spread Spectrum (FHSS). Of these, DSSS is the newer and higher data rate standard, and is the one used by the MIT wireless network infrastructure. The "spread spectrum" in both technologies refers to a signal power modulation scheme that makes wireless communications less susceptible to electrical noise and interference. Since the 802.11b technology is wireless, multiple wireless networks, each with their own APs may sometimes overlap. A number of APs operating in concert as one wireless network are referred to as a Basic Service Set (BSS). In order to distinguish wireless networks from one another, APs can be configured to provide a network name unique to each BSS, also referred to as a Service Set Identifier (SSID). Choosing the same SSID allows users’ NICs to "join" and operate on the same wireless network. APs are also allowed to identify themselves with unique names known as station names or base station IDs. Typically, BSSs advertise their SSID and station IDs at periodic intervals. As a possible security measure, APs can be configured not to advertise their SSID or station IDs in what is referred to as a closed or network mode. 802.11b Wireless Networks and Networking Protocols802.11b, a wireless LAN protocol, handles the communications between wireless NICs and APs. On top of 802.11b, various higher-level network protocols, such as AppleTalk, NetBEUI, but most notably TCP/IP, the standard network protocol for the Internet, are used to communicate among computers. These same protocols run over other existing LAN protocols, such as Ethernet, which is deployed widely around campus. At the network protocol level, the distinction between 802.11b and Ethernet becomes minimal, apart from the fact that underneath, 802.11b is wireless and Ethernet is wired (cabled). In fact, all APs on campus ultimately connect to an Ethernet drop to "latch-in" with the rest of the campus network. This is one reason why the MIT wireless network is considered an extension of our network infrastructure. One limitation of 802.11b is the data rate it allows for communication. The 802.11b standard allows for up to 11 Mbps communications, whereas most locations around campus served with Ethernet are provided with up to 100 Mbps (with notable exceptions, at 10 Mbps) according to Ethernet standards. Further 802.11-associated standards are in development to increase the data rate, but none are in deployment at this time at MIT. IS&T assigns to each computer connecting to the MIT network a unique IP address, much like a phone number, that identifies it uniquely on the network, as part of the TCP/IP protocol requirements. Associated with each IP address, is a unique hostname, typically a customer-selected name, such as "foo.mit.edu" or "jackflorey.mit.edu", that is easier to remember than the numbers in an IP address. This is the case for all computers on the MIT network, regardless of whether they are connecting via Ethernet or wireless APs. The majority of wireless network infrastructure customers are users with portable computers who move from location to location across campus. IP addresses assigned by IS&T, however, are typically location-specific, requiring users to utilize a different IP address in every location and that is valid only in that location. This is provided for users (who can register for free) by another IS&T service that uses the Dynamic Host Configuration Protocol (DHCP). DHCP allows registered users’ computers to automatically receive another unique valid IP address at any MIT campus location where this service is provided. These dynamically assigned IP addresses are drawn from a pool for each location, especially reserved for roaming users. When users are at their "home" location (where they received their IS&T-assigned IP address), they simply are provided that IS&T-assigned address by DHCP. Common AP Types and IS&T Networking GuidelinesThere are a variety of wireless AP devices on the market, each offering different combinations of APs and features from other network devices. These devices behave differently with respect to how they affect services on the networks to which they are connected. They generally fall under three categories:
AP-only products or wireless bridges, like those deployed as part of the MIT wireless networking infrastructure, simply "bridge" the wireless LAN and the Ethernet network. They transfer information from the computers connected wirelessly to the Ethernet network, and vice versa. Devices with an AP and a built-in hub or switch do a bit more. A hub in these devices is a network device with multiple (for instance, Ethernet) ports on it; the hub transfers information from any port to all other ports, and vice versa. A switch is similar, except it transfers information from any port to specific other ports, and vice versa, based on the origin and the destination(s) of the communication. Either of these devices are typically used to create small, independent LANs in small offices and homes. Devices with an AP, a hub or switch, and a router or NAT built-in do even more. These devices are used to create small LANs, but additionally, they can "share" a single IP address and connection to a larger network, such as that of an ISP with a cable-modem or DSL service. They do this by assigning "dummy" IP addresses (reserved for that purpose, as part of the TCP/IP protocol) to the computers on the small "inside" network, and then routing and/or translating communication from these dummy addresses to destinations on the larger "outside" network, and vice versa. The latter two types of devices usually have a built-in DHCP server to distribute these "dummy" IP addresses. Usage Policies and Configuration Guidelines
Privacy, Security, and the MIT NetworkWireless LAN technologies in general, and specifically the 802.11b protocol, pose some security issues. Since the communication between wireless devices is, well, essentially wireless, it may be easier for an intruder to gain access to a wireless network and monitor transmissions. The situation is not so different from wired (cabled) LAN protocols, such as Ethernet, as at the higher network protocol layers, the communication between computers is performed in the same manner. It may appear to be more difficult to "tap in" to a wired network than a wireless network, and to a certain extent this may be true; however, for large scale networks like MIT's network and the Internet, there is no guarantee that anyone on either portion of the network is not malicious. The 802.11b protocol includes some measures designed to address the issue of access control and security. One of these is the option to conceal SSIDs, forming so-called closed or hidden networks. Another is Wired Equivalent Privacy (WEP) functionality that encrypts traffic between APs and users’ NICs at a relatively weak-level, using passwords. Some APs allow for filtering users’ computers based on a type of globally unique, built-in identifier, much like a serial number, in each NIC, known as a Medium Access Control (MAC) address. Closed or hidden networks use the "security through obscurity" approach, which is often not effective, in that an intruder can monitor all traffic in the frequency bands used by 802.11b, and from the traffic, be able to extract the SSID and station ID information. Further, they make troubleshooting unnecessarily complicated, should an interference or network-related issue arise. WEP encryption has been publicly proven to be weak against dedicated attacks, and proof-of-concept demonstrations have shown WEP-enabled networks can be broken into typically in a matter of days. Further, the current implementations of administrative tools on 802.11b-compliant devices do not scale effectively to allow the administration of WEP and other security measures on a large number of APs, such as there are at MIT. The MIT network is an open network without firewalls or blanket blocks (with minor exceptions to improve performance and protect against known exploits, from time to time). Thus, customers are responsible for maintaining their own systems’ security and keeping up-to-date with vendor updates, upgrades, and patches, while following their and IS&T guidelines and recommendations. Currently, IS&T recommends that customers refrain from using applications and protocols using unencrypted traffic whenever possible. Since the wireless network infrastructure is considered an extension of the MIT network, this applies to wireless configurations as well. This way, security can be guaranteed regardless of whether communication is wired or wireless. Finally, IS&T provides access to the MIT network through the DHCP service, by assigning IP addresses only to authorized users. The large number of MIT users makes it impractical to perform MAC address filtering at the AP level.
Service ExpectationsRegardless of whether the customer chooses to deploy his own APs or contracts with IS&T for the work, there are some important service aspects to be aware of. Wireless Networking Does Not Replace Wired Networking Performance depends on the quality of the AP Connections may get lost when moving between subnets |
