Electronics notes/802.11 (WiFi)
| ⌛ This hasn't been updated for a while, so could be outdated (particularly if it's about something that evolves constantly, such as software or research). |
| 📃 These are primarily notes, intended to be a collection of useful fragments, that will probably never be complete in any sense. |
Relatively common-and-central concepts
a, b, g, n, ac; 4, 5, 6, 7
Wi-Fi is IEEE 802.11-based. Chronologically:
- legacy IEEE 802.11, at 2.4GHz, marketed as 2MBit/s (discontinued)
- IEEE 802.11a (seemed aimed at corporate use, I've never seen this in use)
- often at 5GHz
- marketed as 54MBit/s
- (there is also a US variant in 3.7GHz, works up to 5km / 3 miles)
- IEEE 802.11b
- 2.4GHz band
- marketed as 11MBit/s, typical throughput more like ~4.5MBit/s (0.5MByte/s)
- IEEE 802.11g
- 2.4GHz band
- marketed as 54MBit/s, typical throughput more like ~20MBit/s (~2.5MByte/s)
- In a way, g is the best of a and b (11a and 11b are alternatives; a is shorter-range, higher-speed, and was targeted at business use)
- Around this era there were more non-standard methods to support higher speed - e.g. Atheros's Super G[1] (108Mbps), Broadcom's 125HSM[2], Conexant's Nitro[3] (140Mbps). Note this only works when access point and clients use exactly the same technology, and may only work under ideal conditions (low interference, devices close together).
- IEEE 802.11n ("WiFi 4", because apparently we start numbering at 4, retro-numbering g as 3, a as 2, b as 1)
- initially 2.4GHz-only and various clients did only that. Dual-radio also adding 5GHz became common later, as more client devices support it.
- decent indoor speed up to 30m / 90feet (verify) and connection up to ~70 meters (verify), but these are optimistic figures.
- Working at the same frequencies they are just as susceptible to walls - focused more on higher speed and a little more range, with fancier MIMO and some other tricks)
- Varied devices might only support the slower of the speeds belonging to the standard, ~150MBit/s, and in the real world maybe don't count on getting more than ~50-80MBit (7-10MByte/s). Faster speeds (in theory up to 600MBit/s) not supported by all clients or APs, and would use a lot of the 2.4GHz spectrum to do so, so that is unlikely to ever happen.
- 5GHz variant a little less range than 2.4GHz, but a dual-radio AP has more frequency to give out, so more devices that don't have to share bandwidth
- will only do >54 Mbps when using WPA2/AES (or no encryption(verify)), not when using WEP or using TKIP. Can be relevant.
- IEEE 802.11ac ("WiFi 5"), since roughly 2013
- 5GHz only, but 11ac APs and clients are likely to support and fall back to separate 11n in the 2.4GHz band (verify)
- 80 MHz channels, supporting ~500MBps per client
- so practical speed in non-ideals conditions might be 200Mbit/s (25MByte/s)
- IEEE 802.11ax ("WiFi 6"), since roughly 2021
- 2.4 and 5 GHz (and a later 6E at 6GHz)
- so practical speed in non-ideal conditions is maybe 400MBit(verify)
- IEEE 802.11be ("WiFi 7"), since roughly 2024
- 2.4, 5, and 6 GHz
- IEEE 802.11bn ("WiFi 8")
- 2.4, 5, and 6 GHz
- in development
For any of these, assume decent speeds work up to speed up to 10m / 30feet,
- more outdoor / line of sight
- less if there are walls inbetween
- recent versions are
- a little better at direction
- and a little worst at alls
Channels
Channels are a central frequency, and an effective band around it.
WiFi in the 2.4GHz ISM band (b/g/n/ax/be/bn) is an band within 2.401 though 2.495, but ends a little lower in almost all places on earth, so call it maybe 70, 80MHz of total usable air.
There are roughly a dozen channels, with channel centers are 5MHz apart.
At typical transmission strengths, a channel is easily ~22MHz wide in the air (falls off to negligible power at the edge of that).
Which means that at full power (which is common), each channel overlaps with the next four channels in both directions.
And you only really have three actually distinct channels.
It degrades gracefully, meaning you get service even in very busy areas (though not good speed or latency). It also means that if you're planning fast wifi for your home, you can only run about three full-power channels without interference - assuming you have no neighbours.
APs regularly choose 1, 6, and 11 (because that fits in the US, and is regularly seen elsewhere) and 14 in the regions where it is usable.
If you have control to plan all adjacent APs, you can split the area(/volume) to be covered as a three/four color mapping problem[4] so that the closest AP on the same channel is further away.
Back in the real world with noisy neigbours, you probably just try to find a relatively silent channel.
Also it's a reason we added more at 5GHz and later 6GHz - more air to work with.
Wifi in 5GHz (a/h/n/ac/ax/be/bn) refers to use of roughly 5.1 to 5.9GHz, but with various footnotes.
It's split into a few different bands, each with its own rules. This is roughly why you may see channel ranges like:
- channels 36 through 48 (5.15 ~ 5.25 GHz) (better range)
- channels 52 though 68 (5.25 ~ 5.35 GHz)
- channels 96 through 140 (5.47 ~ 5.71 GHz) (a few regions don't have these or higher)
- channels 149 through 177 (5.74 ~ 5.9 GHz) (the highest channels are restricted in many regions)
WiFi in 6GHz (ax/be/bn) is another channel numbering between 5.93 and 7.13 GHz.
Practically you can see this as
- 5.9 to 6.4GHz (available in most regions)
- 6.4 to 7.1GHz (mostly not usable outside the US and canada)
See also:
- http://en.wikipedia.org/wiki/IEEE_802.11
- http://www.moonblinkwifi.com/2point4freq.cfm
- http://en.wikipedia.org/wiki/List_of_WLAN_channels
Nodes and groups of them:
A service set is a set of devices that share a service set identifier (SSID)[5].
That SSID is the human-readable name, the names you click in your wifi settings, the thing that people consider as the network we are on.
A Basic Service Set (BSS) refers to a single use of the same radio frequency, modulation scheme, security settings.
A BSSID is a 48-bit address identifying a BSS, that the AP advertizes and the clients connect to. You normally don't see that.
An Extended Service Set (ESS) is a setup wherein you have one name (SSID) backed by multiple BSSes.
Say, if you want more coverage, you would often put in multiple APs, have them mention the same name (SSID), will each be different BSSes with their own BSSIDs, but make up one ESS.
Note that this is both because multiple radios must not share the same identiier (BSSID)(verify), but also it's useful because this allows each BSS to, for example, use a different channel, and so that different clients might be using entirely non-overlapping frequencies while on the same-named wifi (SSID).
An 'ESSID' isn't technically a WiFi concept(verify), but people sometimes use it, e.g. to mean 'this SSID is actually doing ESS stuff'.
BSS and ESS are about infrastructure mode, which is the most common.
There is also the Independent Basic Service Set (IBBS), which are identifiers in ad-hoc networks.
In consumer APs it used to be common to serve one BSSID, in which case the BSSID was often just the radio's hardware MAC.
But they don't have to be. For example, if you serve a home and a guest network, they will be distinct SSIDs, identifying distinct BSSes, so need distinct BSSIDs.
'WiFi meshing'
In recent years, manufacturers have started saying 'wifi meshing'.
This does not refer to mesh networks at all (nor ad hoc networks) , and just seems to mean that you can get the same-named wifi out of multiple access points.
More critically, it means that, decades later, they finally got bothered to make ESS setups reasonably easy to set up for people who don't know what that means.
...but to be fair, the roaming features being more standard also helps.
(which is even more confusing once you do actually need and use a wireless backhaul)
Other letters
There are a bunch of amendmends over time, standardized in other letters, some of which are commonly supported but not advertised to customers because even if they help, they're not as known as the speed ones.
Consider:
- d - country roaming extensions
- e - QoS, packet bursting
- i - WPA2 (roughly. the WPA names were historically confusing)
- k - attempts better traffic distribution (basically, not only choosing an AP based on signal strength)
- r - fast roaming
...and some of which specific-purpose, like:
- af, ah - in TV bands, non-licensed bands (slowish, but useful for specific purposes, like wireless mics, maybe IoT)
- ad, ay (WiGig) (note: at much higher frequencies than the similar-speed ax. Expect wigig to only work within a room)
See also:
On signal strength, noise, quality and such
Signal Strength often refers to RSSI (Received Signal Strength Indication), which is a measure of signal energy (note: not of quality - quality is much harder to estimate).
RSSI is a general RF concept, measured in dBm (so an absolute value).
However, in 802.11 standards it is not tied to a real measure, and not necessarily reported in dBm. (Probably more commonly you get some proportional number no particular unit,
so different vendors (even different drivers) may report different RSSIs in exactly the same situations.)
This value is continuously calculated because it is used internally, for example to check whether a channel is currently clear to send on (This is also one reason RSSI may be truncated above a certain good-enough value, and another reason that it shouldn't be taken as a physical measure), and e.g. whether switching to another AP might be worth it.
So WiFi RSSI can only be taken as a relative measure of signal strength, comparable only to other such measures from the same card.
Signal to noise ratio is a fairly well known term, but its use in WiFi is somewhat different; Wifi's SNR also regularly refers to the strength of a signal above the noise floor. The noise floor refers to RF energy that isn't part of the 802.11 transmission, which can often be estimated, or assumed to be on the order of -100dBm (that value apparently an implication of some of the realities of WiFi, such as the 20Mhz channel width that 11b and 11g have), though depending on where you are it might be higher, say -92dBm(verify)
An example of such above-noise-floor calculations: Say you have a noise floor of -94dBm (about 4*10-13 Watt) and a RSSI of -65dBm (about 3*10-10 Watt), then you could say you have a SNR / signal quality of 29.
While it is neither the only or the best way of calculating signal quality, Signal quality often refers to this. Arguments against this use include that signal quality should be a measure of how the actual signal is getting through, not how strongly it seems to be received. However, it is a convenient estimation (partly because of the ease of reporting RSSI - the hardware is continuously doing it anyway).
Apparently:
- ~10dB above noise floor (around -90dBm) will get you a weak and slow signal
- ~20dB above noise floor (around -80dBm) starts being decent
- ~40dB above noise floor (around -60dBm) or better tends to be necessary for full speed operation (54Mbit in g, up to 300 in n)
These figures rely on both relatively ideal hardware and an interference-free environment.
Other factors (including receive sensitivity) may mean that in practice, the figure may easily be 10 or 20dB worse.
.
Receive(r) sensitivity (...glossing over some details...) indicates the weakest signal that a particular device can discern and actually use (...assuming it's above the noise floor).
Receive sensitivity is a property of the hardware design, varies with technology used (a/b/g/n). It is also worse for higher speeds because more power is needed. This is part of why a weak signal means you may get a slower connection.
It seems that you can expect fancier hardware has a receive sensitivity of around -96dBm, while particularly cheap hardware may be -70dBm (verify).
Remember that (roughly) 3dB is a factor two power difference and 10dB a factor ten. This means that difference is prety huge; -96dBm may support hundreds of meters and -70dBm may mean a few meters (assuming ~35mW transmissions, which many laptops won't go above).
In theory, sensitivity can be useful for the amount of APs you need to cover an area, and is useful to know in mesh networking -- but for most clients and most consumer devices (specifically the client-to-AP communication) this is not often something you have much of a choice over, so it doesn't pay to be too optimistic.
See also lists like:
On speed, range, and interference
Speed
In moderate conditions, you can be fairly happy if you often get speeds in the range of
- 1 to 5MByte/s on 11g
- 3 to 8MByte/s (24..64Mbit) on 11n
- 5 to 15MByte/s (40..130Mbit) on 11ac
Advertised throughputs are stupid
tl;dr:
- for distance-and-wall-and-neighbour reasons, and the will of marketers to use the maximum possible number,
- you can you can practically expect real throughput to max out at half the advertised speed
- That improved a little with 11ac,
- though how much better is arguably even more of an 'it depends' than before.
The figure on the box is for
- lab conditions,
- minimal distance,
- a lack of neighbors,
- a lack of walls, and
- may be the collective possible speed for all supported clients, which may be fundamentally impossible to give to a single client.
In reality:
- You have more than a meter of distance.
- this shouldn't matter a lot. Yes, inverse square applies, but the first so-many meters are in a very comfortable range, so this can be overstate.
- (Yes, putting an AP on your desk helps a lot -- but then why not just plug in the wire? I promise you the bandwidth and latency and latency jitter are better)
- You have walls. Walls dampen signal.
- For drywall or lime brick maybe 6dB per wall on 2.4GHz, 12dB on 5GHz (verify).
- On serious concrete, well, more than you care for
- After two walls you will probably never see the high end of the speeds.
- You share that medium, so you share that speed with all clients.
- So divide the speed the air can do, by the amount of people using it constantly.
- on the upside, most things are intermittent so sharing works well. On the downside, things like video streaming are a constant load.
- In dense housing, you probably have neighbours. If you have one or two, then you can be on unique bits of the medium (see notes on channels), but even clever APs are only moderately good at setting things up that way.
- more than two and you will be sharing the medium, and the speed divides right along.
- Mixed-speed networks have slightly lower overall throughput
- There's mixed-speed networks (e.g. b + g + n, because they're all in the same 2.4GHz band, though b is rare now and g less and less common).
- That implies that when b or g devices appear, the communication goes at different speeds at different times;
- It won't force everything to talk to the slowest speed on the network, an apparently common-enough misconception.
- (...but the slower clients take up more timeslots to send the same amount of bytes, so when the slower clients have a lot to say it can seem that way).
- (note that anything that moves a small amount of data tends to have negligible effect)
11ac is 5GHZ-only so does not have to share with b, g, or n at all.
But at the same time, 5GHz has higher losses through walls. The better ability to focus energy in one direction (MIMO) helps a bunch -- but seen another way, at best it helps one wall more, and then acts like 11n did.
Also keep in mind that this directionality only helps if the client is equally good at directing its response.
So there's an argument that if you want good 11ac, get more APs to cover the area -- and bang for buck, simpler 11ac APs so you can have more of them for the same overall cost, and e.g. spread them around the rooms you're usually in)..
If you are a better nerd than me, you can in theory get 11ac to carry 1Gbps or even 4Gbps or 7Gbps, but actually most devices don't even support that.
Some laptops are designed to try for 400Mbps or so, most tablets and particularly phones aren't even designed to try for half of that.
(Technically this relates mostly to the the QAM and MIMO variants. Practically it relates to expected use cases as well. Phone designers know you're not going to concurrently stream eight 4K streams on a single phone).
There's also some creative advertising going on (always a marketer hobby around wifi, why stop now?),
just arguably got more creative around 11n and 11ac.
For example, your AP may indeed have 1.3Gbit to spend, but never gives more than a few hundred mbps to any one client.
Often by specific design, even.
As 11ac APs tend to be dual radio (providing 11n on 2.4GHz), the box label might add the 2.4GHz and 5GHz speeds together.
Not because any one device gets to ever use that, but because marketing likes higher numbers.
Ultra turbo large antenna APs, aggressively angled plastic, and 1024-QAM and 4x4 (or even 8x8) MIMO are, in a word, stupid. Because even if the AP can do this, it doesn't matter when
- stronger sending and more directional sending only really helps (speed-at-a-)range when both side do it, and many clients can't
- most clients do at most 64-QAM and 2×2 MIMO
In fact, if you like covering your area with more AP and for your clients to roam,
then less transmit power might encourage hopping to a better AP earlier.
Latency
Latency is roughly the wallclock time in which packets make it through.
tl;dr
- at best ~1ms average while no one uses wifi much
- assume ~10ms when saving power
- assume over 100ms (and varying a lot) when congested by a lot of people
- no matter the baseline, the occasional packet can take longer
When the medium is (not) idle
Wifi may well hover around 1ms when everything around you is idle.
When the medium is fully used (heavy downloading) and/or sees interference, then you can expect at least a small percentage of packets to take longer.
There will be spikes to order of 100ms 'even when the average is still a few ms.
If used/shared/interfered intensively all the time, then you can expect something like 150ms to be the average.
With power saving
Wifi power lowers the background use of having WiFi on, and is great, and done fairly cleverly, and is part of the WiFi protocol itself.
Yet you should assume that this may easily make the minimum ~10ms.
It may also be fairly consistently be that when idle, which is not noticeable for a lot of uses, so actually very reasonable for a client to choose if it makes your battery last significantly longer.
Consider using a cable when you easily can
Keep in mind that when people collectively manage to saturate the wifi medium (the channel's effective speed), there is basically nothing to stop latency from growing high.
It is a shared medium and you have no control over who uses it.
That LAN cable, not being a shared medium, doesn't have that issue at all.
Until a lot of people concentrate to saturate a switch (which are gBit these days), or more likely, the broadband you share.
(also note that laptops aren't clever enough to immediately switch all they can to the cable you just plugged in. So this is mostly useful for fixed workspaces)
On range and interference
For an analogy, think of a party with a lot of chatty people.
- You're all using the same air to talk on.
- More people will always mean it's harder to talk
- politeness, conventions, and agreements can help - but only if everyone cares
- Standing closer and facing someone will help. Speaking a level that is no louder than necessary will help.
- Also means your group is less disruptive of the other groups
- Standing closer and facing someone will help. Speaking a level that is no louder than necessary will help.
- Louder only helps that one guy with the loud voice, but if we all talk louder it's the same mess again. Also it's bad for our vocal cords.
Most of that has direct analogues in wifi terms:
- You're all using the same medium. Things on the same channel will share speed
- in the 2.4GHz band you get approx 3 fully separated channels (not 13 - the channels overlap); just one or two at 11n speeds.
- seeing 30 APs from all your neighbours means your wifi won't be as great
- (if you can plan your channel use with your neighbours, that helps - but is rarely worth the trouble. Businesses, universities and such can and often do plan this better)
- the fairness of the use of shared channels are actually quite good (and the politeness mostly enforced)
- if both talkers are closeby, chances are that less gets lost in noise
- implying that often, the simplest way to get better wifi speed is to wire in another AP (on a different channel)
- both talkers being directional helps range
- ...but since in home use, one side is always an AP, it's easier to place that AP in the center of a group of users.
- those manly large antennas don't really help, for the same reason (but this is a different discussion)
- There are stories like people having a cantenna pair between their apartment and laptop on the beach ~100m away. It's very specific but it works :)
- You may have seen "transmit power" on your AP's settings
- Increasing this will not increase range, unless you can also increase the clients's.
- there is usually a hard limit on laptops/tablets/phones. If there isn't...
- it easily leads to signal overdrive, meaning communication may be no better, or worse
- beyond some limit it's bad for the amp
- If you change only the , you will often find no difference. Or negative - some devices will switch/roam to you when they can't actually reach you.
For range, the client is usually the limiting factor, and there is usually nothing you can do about it. There is significant variation in laptop / phone, hard to know/measure, and harder to change. Even if you can tweak transmit power, that often means shortening battery life. This is another arguments towards "wire in another AP closeby" (or even a repeater).
Each wall will decrease signal quality - usually three walls away it's useless, and two walls away you'll already have interesting dead spots.
Clever AP placement helps, but again, having more APs to be clever with is better.
Note that there is no such thing as a 3dBi omnidirectional antenna. That statement violates the laws of physics.
Per definition, the dBi of an omnidirectional can never be above 0, and will always be a little below due to losses.
That doesn't mean these are a scam, and it doesn't mean they are not useful. It means they are only sort of omnidirectional - the shape of their effectiveness in 3D is basically like an apple stuck on it. The higher the (not-)dBi number, the flatter the apple. Point this antenna directly at the computer and signal drops. But stick the antenna to the sky and the rooms on the same floor get better-than-isotropic reception. Beyond 3dBi the shape gets weird, which is more confusing than it is useful.
The flat apple shape is useful, yes. But only so much, because for this to mean more range, mobile devices have to do the same thing. They can a little (e.g. laptop screens usually point up when in use), but not a lot.
On interference
802.11 devices work together fairly well, in terms of sharing speed on the same channel.
But use of the same air goes down fast
variants with more air help a bunch
Adjacent channels actually overlap
Channels refer to fixed center frequencies.
At full power, transmission on a 2.4GHz channel covers five channels's centers.
In theory, they could transmit at tiny power and we could have a lot of non-overlapping short-range channels.
Theory is actually more complex, but it's sort of irrelevant because in practice, nobody ever did that.
If you can control all your APs, it makes sense to set APs on channels far enough apart - usually channels 1, 6, and 11 - and plan a map to have the same channel never be directly adjacent, then you can significantly reduce interference.
And when you do that, lowering transmit power can also help.
However, in practice this planned economy only works if you control most APs and have a kind of benevolent dictator to doing this. In practice, that only works in some large managed buildings, where someone knows what they are doing and are not overruled by others.
At home, the best you can do is try to find a relatively quiet channel.
Seeing APs on a channel doesn't mean that much without seeing how busy it is. But channel use varies throughout the day. Other interference may be even less predictable.
Informed trial and error and speed testing may be the best solution, as a self-organizing system works better than not thinking at all :)
Actual use, and/or seeing APs?
The easiest degradation comes mostly from the amount of radios transmitting, and the amount of frequency they can use.
More people on the same channel will quickly start dividing the total bandwidth.
There is a background amount of work each AP adds. This adds up much more slowly than devices, but if you're seeing 200+ APs, then they alone starting to add noticeable traffic even before' devices get involved.
But more usually, the problem that that many APs suggest that there will be order of a thousand devices.
This affects 2.4GHz most, which is why even a simple update to a flavor with 5GHz radio can help.
Even if they weren't faster, doing so more than doubles the amount of non-overlapping channels.
They are also somewhat shorter range, which ends up helping.
Non-WiFi devices interfere with WiFi
2.4GHz WiFi uses the 2.4GHz license-free. That band was reserved pretty much so that RF communication wouldn't use it, and certain devices could be used without interfering with anything important.
The band being license-free, however, means that various communication devices use this, including:
- Bluetooth (uses the same band). (Bluetooth's rapid channel hopping should mean fairly graceful degradation of speed on both BT and WiFi, but only up to a point)
- Wireless headsets
- Microwaves (relatively leaky ones, anyway - in general they shouldn't matter much)
- Some cordless phones
- Some fancy motion detectors (2.4GHz radar)
- Some (analog) AV transmitters
Note that interference varies with distance. For example, many bluetooth devices by design don't react more than ~10 meters.
WiFi makes itself worse in part from the fact it has more range.
WiFi frame notes
Security
Encryption (and authentication)
Broadly, the on-the-air encryption options are:
- None (no access control, unencrypted traffic)
- WEP (Wired Equivalent Privacy)
- WPA and WPA2 (Wi-Fi Protected Access), both referring to parts of 802.11i
- WPA2 is more secure than WPA is more secure than WEP (is more secure than nothing)
- WPA3
"How secure are the basic options"
WEP
- offline brute force based on enough data packets
- meaning it has been considered deprecated for ages
WPA
- offline brute force based on snooping handshake
WPA2
- offline brute force based on snooping handshake
- KRACK - patchable, but older devices might not be
WPA3
Any of them are due to Evil Twin, though healthy skepticism reduces
How about more acronyms?
- WEP - is mostly a cipher algorithm (while WPA and WPA2 allow a choice)
- WPA
- sort of an interim semi-standard while 802.11i was written. Effectively a subset of the full 802.11i standard.
- cipher: TKIP or sometimes AES/CCMP
- WPA2
- mostly in line with RSNA/802.11i. The term RSNA is sometimes used where it is more accurate and/or less confusing.
- cipher: TKIP or AES/CCMP
- WPA3
- AES - in general, a cipher with various modes. In this context usually refers to AES-CCMP, a.k.a. just CCMP
- some of those acronym variants were used as near-synonyms in the context of WiFi, [7], though this is less sensible now with WPA3
- CCMP - cipher based on AES (mandatory part of WPA2, though a few WPA had it too).
- PSK - Pre-Shared Key
- Mostly the concept of using a secret that is shared by everyone on the network, and basing the encryption on that (note that communication sends keys derived from the PSK, not the PSK itself)
- ...as opposed to personal authentication, and/or private keys, is possible (but not common) within EAP
- In some situations you'll see PSK referring to TKIP+PSK (WPA) and PSK2 referring to AES+PSK (WPA2), though this seems to be non-standard shorthand terms (verify)
- TKIP - a cipher algorithm (used in WPA and WPA2, no longer in WPA3) [8]
- RSNA - a method/setup (handshake, key exchange, cipher choice).
- Mostly synonymous with what was first 802.11i, now part of 802.11. Pragmatically perhaps most comparable to WPA2.
- EAP - Extensible Authentication Protocol - an authentication framework.
- authentication: relates only to how the network accepts you, not directly to the encryption used
- framework: has various options, allows some extension
- Terms like "Enterprise WPA/WPA" often refer to logging in with personal credentials
(Personal (arguably not a great name) usually to pre-shared keys (see PSK below) where everyone uses the same) - When EAP is configured, an AP probably only allows EAP traffic from a client until the client has used EAP to authenticate (usually via some login server)
- There are quite a few specific EAP implementation/methods, including
- PEAP (Protected EAP)
- TLS
- TTLS (Tunneled TLS)
- LEAP - seems a hardware feature in some pricier wifi cards, though it seems flawed in that it allows for offline dictionary attacks. See e.g. [9]. It seems it will protect against wardrivers with cheap (non-LEAP) cards.
- 802.11i - 802.11i-2004 was a security amendment at the time, that has since been incorporated into 802.11-2007.
- A security suite, a good chunk of which is used in WPA, and all in and WPA2(verify).
- Deprecates WEP.
- including CCMP (a.k.a. AES-CCMP),
- 802.11x - doesn't exist. You're thinking 802.1X, which isn't part of 802.11
- 802.1X - encapsulates EAP [10]
Further notes:
- "TKIP+AES" seems to just be a "allow both AES and TKIP, to avoid denying clients that can't do AES". (verify)
- "WPA2+WPA" is much the same story (verify)
- You could say the basic ciphers used are WEP, TKIP, and AES/CCMP
See also:
- http://en.wikipedia.org/wiki/Wireless_security
- http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy
- http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access
- http://en.wikipedia.org/wiki/IEEE_802.11i
- http://en.wikipedia.org/wiki/IEEE_802.1X
TODO: read:
- http://www.networkworld.com/research/2002/0506whatisit.html
- http://www.wi-fiplanet.com/tutorials/article.php/1041171
- http://hostap.epitest.fi/wpa_supplicant/
WPS, WCN, and such
WPS (Wi-Fi Protected Setup, originally Wi-Fi Simple Config) should make it easier (avoid config screens) to set up wireless security.
- Often makes it easier to point a specific device and AP at each other.
WCN (Windows Connect Now) is similar to WPS, but specific to Windows (and defines fewer options for binding(verify)).
There are other systems building on these, with other names(verify).
See also:
- http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup
- http://en.wikipedia.org/wiki/Windows_Rally#Windows_Connect_Now
- http://www.microsoft.com/windowsxp/using/networking/getstarted/windowsconnectnow.mspx
Software
App lists:
- http://wiki.personaltelco.net/index.cgi/WirelessSniffer
- http://www.sheerboredom.net/modules.php?name=News&file=article&sid=79 (utility list)
Discovery
Linux:
- Kismet
- netdiscover
Windows:
- inSSIDer [11]
- Xirrus Wi-Fi inspector [12]
- Netstumbler [13] (apparently not as smart at discovery as * kismet, but is easier to get running] (Not under Win7/Vista)
- Kiswin (limited in terms of drivers, though (verify))
- Javvin?
Dump
- Kismet
- aircrack
- airsnort
Windows:
- winairsnort
weplay? The brute forcer way probably doesn't dump the lower-level wireless packets(verify).
Attack/Decypher
Linux:
- Aircrack, the name of a package that has a dumper (airodump) and cracker(aircrack)
- Aircrack-ng [14] (WEP cryptanalyitically, TKIP-PSK WPA dictionary)
- Airsnort [15] (brute force?)
- weplab (brute force but also analytic?(verify))
- coWPAtty (TKIP-PSK WPA, brute force, see e.g. [16])
Windows:
De-authentication
Linux:
- Void11
- wlan_jack
- essid_jack
To read: http://www.wirelessdefence.org/Contents/Aircrack_aireplay.htm
Anti-hacking
- FakeAP throws around a lot of AP beacons, which should confuse sniffing a little - but also freely roaming clients.
On tracking and revealing information
Because WiFi was conceived more as a residential thing, before mobile phones, there are some privacy details that might be less than ideal.
Some are overstated, some are a indeed a little privacy-leaky.
For context
Probes and privacy
Levels of revealing information
While not connected
Clients on the same AP
Can someone detect the presence of your phone even when they're connected to their AP?
Can you see where phones are?
Can they know who you are?
Trading privacy for features
Relief
MAC randomisation
Attacks
For context: connection behaviour
Karma attack
Beacon spamming / beacon swarm
Evil twin attack
Listening to authentication
Deassociation attack
More concepts and notes
Client isolation
tl;dr: roughly, client isolation is an AP setting that means WiFi clients on the same WiFi network cannot communicate directly to each other.
In the olden days, 'local area network' meant everyone on it could talk to each other,
and that often also carried into WiFi, when it just bridged the same network into wireless.
These days, WiFi is frequently set up as 'I only care to connect you to the internet', which in public wifi and business environments is probably actually a good idea. Which means some security people figured that there is no reasons that clients should talk to each other anymore.
Roaming, range extenders, repeaters
A range extender, a.k.a. wireless repeater, is a device which can act as a relay between the real AP and the eventual client.
Upside:
- more coverage with no extra wiring
Downside:
- uses same channel to receive and send, effectively reducing the speed
- so you wouldn't want support many clients this way
- and is pretty horrible when done on multiple APs
Wireless access point versus wireless router
tl;dr: people abuse terms, most devices are most things now.
A wireless AP is in principle just a bridge, a device which translates between media, specifically a layer-2 device that translates between Ethernet (802.3) and WiFi (802.11).
A wireless AP need not have an IP or web interface, though many do.
A wireless router additionally does layer-3 things,
such as filtering, separating networks, providing IPs via DHCP, doing NAT, being a gateway, and such.
In practice, 'Access Point' is used to refer to any device that gives you WiFi, whether it is a basic bridge or complex router.
Blurring of the lines is helped by the fact that many Wifi-ey devices can do routery things, and (at least in theory) be configured to be just a bridge.
Access Points's default behaviour is simply the most conventional wish: to connect wireless clients such as laptops to whatever is on the wire stuck into the back of the AP -- typically a LAN with internet access.
APs regularly also:
- have a distinction between a WAN port ('internet side') and a LAN port ('inside')
- This is useful when it runs a DHCP server for wired clients. Exposing that to the larger network (WAN port) means there are probably now multiple DHCP servers, which can be a big headache of "sometimes it works" reports.
- add their own DHCP
- This isn't always necessary, since your modem will also run a DHCP server, and usually the only problem you can run into is running out of addresses on the subnet. (which an AP can solve by itself using one address on the modem's subnet, creating a new subnet for its clients, and doing the necessary routing).
- This can be annoying when it is configured to make a new subnet to do so, in that devices on the modem's subnet and the AP's subnet probably won't be able to discover each other. It also means roaming may not work well.
Wireless bridge
The term wireless bridge can refer to a few different things.
'Bridge' in general networking parlance refers to doing something at layer 2 (link layer), typically to connecting two segments at that layer, which is transparent to layer 3 stuff such as IP (which is the technical meaning of 'wireless AP' mentioned above, but as was implied, that's not a useful term in practice).
This meaning can also apply to wireless, and it's one way to set up basic roaming in your house: You set up the APs's names and security (to be identical), but disable DHCP and any layer 3 stuff.
Everything thinks it's on the same network because the AP does nothing more than transport packets between wire and air (...for attached clients).
However, it's not typically called bridging in AP configs, because of the following:
Bridge in a wireless context often means connecting two LAN segments together using a wireless link (Note: using a wire is typically better for speed and latency, so there is probably a good reason you're not using a wire).
Instead of the most typical AP behaviour (see previous section), many APs could be made to be client to another access point. If they can, then...
- they can choose to act only' as a client -- often to allow it to be a "I want a few wired devices to act to an AP further along"
- they can choose to be both client and as an AP -- which makes them a repeater (...with the optional added bonus of also serving on the LAN ports)
This opens up a few new ways of interconnection.
Some specific cases that are bridges in some way or other:
- The basic case is the description of an AP in the technical sense, that of link-level translation between wire and air.
- This sounds like a trivial case not worth mentioning, but it's useful to consider when when you set up roaming, since you often want only one device to handle all the gateway+DHCP+other such things, and all further APs to act purely as bridges (...with the same name and security details so clients know how to roam).
- Connecting two otherwise unconnected networks with a wireless connection
- Note that both may be fully functional, and separately internet-connected networks already (if so, it may be useful to filter some things from crossing the bridge)
- can be set up as...
- one box purely acting as an AP to the other, the other only connecting to that AP, or
- both APs may serve clients at their respective site, and (generally) one AP is a client to the other (verify)
- adding a small wired segment, but connecting to internet via WiFi because wires are more bothersome to add than a WiFi connection
- DD-WRT calls this a "client bridge" [20] (it's only a client)
- ...a similar setup in which the client box also acts as an AP itself -- effectively extending the range a little.
- DD-WRT calls this a "repeater bridge" [21]
- Note that this is basically a range extender / wireless repeater that happens to also have things connected via cable
Card modes
The usual mode is managed, particularly in windows.
Most cards also allow ad-hoc, and a various drivers allow monitor (though this is rarer in windows) and some can act as an access point. The differences lie almost purely in restrictions in the drivers.
Drivers also do things like require you to set a SSID, then filter out anything not with the SSID, or allow you to look at the packets encapsulated by wifi and not the wifi packets itself (wifi mostly being a drop-in replacement for Ethernet). (This is similar to but not the same as 'promiscuous mode,' a networking term that tends to refer to the IP stack. Your network card usually only hands data it sees to the OS when it is intended for you (by Ethernet address); with promiscuous you get everything passing through.)
Cards that have monitor mode will also allow you to look at the wifi packets themselves, and may or may not allow injection of packets.
Anyway, the modes:
- Managed (client to an AP): knows one or more APs by MAC address (or some nicer name that software/OS superimposes) and uses it / can roam between them
- Note: APs by default send out beacons to let potential clients know about them.
- Ad-Hoc, a.k.a IBBS, peer to peer: Like a set of computers wired only ot each other, an AP-less cell of friends. That's not to say there can't be a gateway on it, mind.
- Access point (AP): Tends to be a single network gateway for a group of clients, e.g. an internet proxy for your home broadband.
- Monitor: Does not participate, just receives everything on the a channel/frequency. This is one way of seeing what APs are around, and it also used for network sniffing.
Repeaters exist, which have:
- Repeater: used to extend the range of a network by retransmission
- Secondary: Backup for repeater(verify)
- prism54 (prism devices, also those usb-based)
- B and G
- Related: islsm (newmac/softmac)
- Related: hostap
- wlan-ng
- B-only (so max 11MBit)
- Pretty good list of adapters and drivers: http://linux-wless.passys.nl/
- NDISwrapper
- Allows windows drivers
- ..but only very basic operation (no monitor mode, no promiscuous mode, no WPA out of the box)
Antennas
- Aliminum foil: [22]
To read
- http://www.wildpackets.com/support/compendium/manual_appendices/nxA1_AP
- http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/network-wireless.html
-->
Traffic indication map
(Delivery) Traffic Indication Map/Message is a way of letting specific sleeping WiFi clients know there is data for them, so that they do not have to use power transmitting until they know that's useful.
Implementation-wise, this is typically added to some or all AP beacons, which APs send regularly anyway.
...and specifically a bitmask of already-associated stations that those stations will know refers to them. (only part of that bitmap will typically be sent, because there is usually only data for a small set of stations)
Some APs will have a setting like the DTIM period - a setting that lets you send this TIM (Traffic Indicaton Map) only every nth beacon.
This lets an AP delay waking up the station. This is client power saving configurable on the AP side, so only really useful in systems where you control all of that, less so in general purpose wifi, and where the increased latency is acceptable.
https://en.wikipedia.org/wiki/Traffic_indication_map#Delivery_traffic_indication_message
Captive portals
A captive portal refers to cases where
- a WiFi access point will let you associate,
- but fora time will intercept HTTP requests
- to initially only present a specific page, instead of the real webpage you asked for, usually so that it an ask you
- ask you to authenticate, and/or
- accept a Terms of Service, and/or
- ask for payment
- ...before you are granted regular internet access
The way this works is intercepting HTTP (not HTTPS - that can't work).
Now that browsers do HTTPS by default, browsers more actively do a background check whether a captive portal applies, so that they can give you a popup saying something along the lines of "this network is asking you to sign in, go here to do so."
Most mobile devices will check for captive portals by, after connecting to an AP, attempting to fetch a known HTTP URL,
and seeing whether they get back what they expect, or not.
Depending on what it gets back, it can e.g. decide
- if it gets back a HTTP response as it expected: you have internet access, fine
- if it gets back an unexpected HTTP response: assume there is a captive portal
- if it doesn't get a response at all: you have no internet access
Mobile
- android would do a plaintext HTTP request to something like http://connectivitycheck.gstatic.com/generate_204 (apparently a lot of different hosts were used over time[23])
- Getting a HTTP response, with any status other than a 204 (No Content), is considered a captive portal
- (it seems android also uses captive.apple.com - as a double check or just unified?(verify))
- Apple uses
OSes started doing very similar checks later.
- e.g. www.msftncsi.com [24]
Browsers may as well, particularly those on mobile devices.
- Firefox's seems to be http://detectportal.firefox.com/success.txt
...apparently many specific URLs were used over time.
...and apparently others[25]
Captive portals are implemented by one (or more) of:
- respond to all DNS requests with their own web server
- intercept all HTTP requests (while leaving DNS alone)
- in newer implementations, be communicated via DHCP (see RFC 7710)
- what is done with the rest of traffic may vary
- this hasn't replaced the previous methods yet
Yes, the first two are basically Man-in-the-Middle attacks, but used for good rather than evil.
In the first two cases, sending a redirect to a logon page
- or that page itself
Notes:
- It seems that e.g. phones may decide a captive portal is done if it links/redirects to a different domain. (verify)
- (would be an extra reason a HTTPS captive portal is hard?)
- The first two methods make HTTP an issue, because whether HTTPS is blocked or intercepted, it's likely to lead to timeouts and/or security warnings
How do devices detect the captive portal part is done?
https://captivebehavior.wballiance.com/
---
I've used captive portals for some DIY, whre you may want a phone to just go to your DIY device instead of using WiFi for internet access, this is rather simpler to implement than a portal that does switch to providing internet access (If it can do a soft AP and a DNS server answering the same IP to every request, that's basically enough).