WiFoo..The.Secrets.of.Wireless.Hacking [Electronic resources] نسخه متنی

Various WLAN Architectures

Quite a few WLANs introduced to the market have a central management device, which in many cases is dubbed a wireless switch. Before engaging in a discussion about wireless switches, first familiarize yourself with the definition of a network switch. One definition of a network switch is written as follows (http://wi-fiplanet.webopedia.com):

Short for port-switching hub, a special type of hub that forwards packets to the appropriate port based on the packet's address. Conventional hubs just rebroadcast every packet to every port. Because switching hubs forward each packet only to the required port, they provide much better performance.

In simple terms, "independent collision domain" identifies the key element that most network engineers perceive as a network switch. In the wired world, this means that only traffic destined for or leaving from a given station is on the local leg or wired segment of that station's network. To accomplish this in an 802.11 wireless network, you need to have every station on its own independent, nonoverlapping, noninterfering RF channel. If you were using a 2.4-GHz network, which has a total of three nonoverlapping channels, this means you can have up to three users. This does not make for a real scalable network!

In some definitions, the use of the term switched wireless may in fact be a true statement for 802.11. In either case, it has caused much confusion in the marketplace today, and many vendors have used the term switched wireless in such a way that it confuses many newcomers to the WLAN wireless world. WLAN technology is not a system that can be truly switched as defined and understood by most network engineers. WLAN devices operate in a shared medium, and the design of WLAN networks needs to reflect that fact.

This section covers five of the most popular wireless architectures and identifies some of their strengths and weaknesses (to the extent possible in this chapter). After you understand the differences, you should be able to make a decision on the architecture that best suits the needs of your network and applications.

The five primary architectures are as follows:

Distributed intelligence

Centralized intelligence

Core device architecture

Edge device architecture

Switched antenna systems

Two other architectures that are not commonly used today, but that are gaining popularity, are mesh networks and free-space optics networks.

By deciding on an architecture and defining technology requirements, as discussed earlier in Chapter 4, "WLAN Applications and Services," you should be ready to select the necessary devices, and possibly even the actual vendor and product models for your WLAN.

Distributed Intelligence

As has been the case because the inception of wireless, an AP has contained a fair amount of processing power and maintained most of the RF intelligence at the edge of the network. The AP then ties directly into the network, usually at a network switch, and is an independent AP, which means it is not reliant on any other server or controller on the network (other than Ethernet connectivity) to maintain 802.11 communications to the wireless clients.

The intelligent AP is often called a fat AP because it contains such components as a powerful processor and significant RAM and ROM. By containing these components, the AP can do more than just bridge Ethernet to 802.11 wireless.

Figure 5-1 illustrates a distributed intelligence system, where the AP is connected to a standard Ethernet switch and operates as a standalone device, without requiring a device on the network to provide overall operation of the AP.

Figure 5-1. Distributed Intelligence System

[View full size image]

One key feature of an intelligent AP is that it can be used as a port-based authenticator. When used as such, the AP actually blocks traffic inbound from the RF and destined for the Ethernet from passing beyond the Ethernet port, keeping it off of the wired network unless the traffic is authenticated. If a packet is received from the RF and is not from an authenticated station, it is redirected to the authenticated server only. In this manner, only secure, authenticated traffic is permitted on the wired network.

Local encryption and decryption is also another key advantage of intelligent APs. The AP is the point at which the RF traffic gets encrypted on the transmit side and decrypted on the receive side. Although some may not see this as an advantage, a high-performance AP will use hardware acceleration in the AP, performing the encryption with very little overhead to the throughput of the WLAN data traffic. By distributing this task to every AP, the probability of overburdening some processor that handles all RF traffic encryption from several to perhaps hundreds of APs is nonexistent.

Another often-overlooked feature of an intelligent AP is one of system resilience to failure. If one AP fails, only that one AP is affected, and all other devices continue to operate normally. It is not dependent on code running in some other device to operate.

In small installations, where you need perhaps only a very small number of APs, such as a small retail store or branch office, you have no need for an expensive controller or proprietary switch. You can manage the APs using their internal software and a simple web browser, or small management program that resides on one of the networked servers.

For optimum management, an intelligent AP approach, at least in large installations, usually requires a management server (for example, SNMP Manager) to provide adequate support, configuration, and management of the numerous APs. If the product is chosen so that its management requirements can be incorporated into the wired network management system already in use, however, integration of management is very easy and efficient.

The ultimate downside to an intelligent AP is that because of the extra components in the AP, it typically comes with a higher price tag. However, before deciding that price of the AP is the determining factor, make sure you put together a spreadsheet of overall costs, including management stations and controllers or proprietary switches. In many cases, the higher cost of the intelligent AP does not outweigh the high cost of other components needed in the following architectures.

Centralized Intelligence

In 1999, Proxim Corporation came out with the Harmony product line, consisting of a centralized controller and of access points that relied on the controller for proper operation. Enter wireless switched networks. In 2002, Symbol Technologies followed suit with a similar centralized WLAN system, which it called a switched wireless system. Known as the Mobius product line, this system uses a controller and associated "slimmed-down" APs. In contrast to an intelligent AP, most centralized intelligence systems remove most of the tasks and processing from the AP and place the processing of these tasks in a switch or master WLAN controller located in a central point of the wired network. These types of APs are often referred to as thin APs. The two types of centralized intelligence architectures are as follows:

A system that uses core devices (residing in the core of the network) for maintaining the intelligence

A system that uses edge devices (edge of the wired network, such as an Ethernet switch) for maintaining the intelligence of the WLAN

In the case of wireless switching, APs are simplified and perform only transceiver and, in some cases, air-monitoring functions. In some systems, these APs are connected to the WLAN switch directly or over a Layer 2/3 network, or to their controller (as in the core device systems). The APs become extended access ports on the WLAN switch, directing user traffic to the switch or controller for processing.

Security functions used in the WLAN switch systems, such as encryption, authentication, and access control, are adapted to follow users as they move. Most wireless switch systems provide extended Layer 2/3 switching, enabling mobile users to roam between APs, switches, VLANs, and subnets without losing connectivity.

WLAN switching also provides a different approach to the operational management of 802.11 networks. AP configurations are stored on the controller or WLAN switch rather than on the AP itself. With the ability to control individual AP power and channel settings, some WLAN switches can automatically detect failed APs and can instruct nearby APs to adjust their power and channel settings to compensate accordingly. When the failed AP is replaced by a working AP, the WLAN switch automatically notes the event and configures the new AP.

The more sophisticated WLAN switches constantly monitor the air space to observe network and user load. They may even dynamically adjust bandwidth, access control, QoS, and other parameters as mobile users roam throughout the enterprise.

Core Device Architecture

In a core device architecture, the intelligence resides anywhere on the network, usually inside the network operations center (NOC), or at the very least a remote computer or network room. Oddly, several of these systems use the term wireless switch to describe their centralized controller, even though it has no network switching capability at all (as defined in the beginning of this chapter) and provides only one ingress and one egress port on the device.

In these systems, an AP is usually stripped of both intelligence and many of the responsibilities associated with an edge device. It performs only the radio function and passes all traffic back to a centrally located controller (often referred to as the switch). This controller device is responsible for all packet-handling functions, including security, QoS classification and tagging, and packet filtering, for all associated APs.

The intended primary benefit of such a system is lower cost. By lowering equipment, deployment, and maintenance costs, the intended result is a lower total cost of ownership. Intelligence (and, therefore, cost) has been removed from the APs and has been moved into the network to the switch. However, the cost is really transferred to the switch as well. In the long run, there is minimal if any cost benefit over distributed intelligence systems.

Deployment of a core device may be accomplished in either of two ways. Figure 5-2 illustrates the deployment method suggested by most vendor literature. At the center of the Figure 5-2 is an Ethernet switch (for example, Cisco Catalyst WS-C3560-24PS) that serves dual purposes: to provide inline power to the APs (commonly the only power option, helping keep the hardware cost down) and to provide a point of aggregation for multiple APs. The controller in this scenario functions similarly to a one-armed router in that it is inline to all traffic to provide some higher-layer function (for example, security, QoS, filtering). In this case, all traffic would have to flow into and out of the switch on the same Ethernet interfaces.

Figure 5-2. Centralized, Core Intelligence System

[View full size image]

Figure 5-3 shows another deployment scenario with a centralized, core device architecture. In this diagram, the controller interfaces to a northbound switch that aggregates APs, and a southbound switch that provides access to the backbone. Each link is 100 Mbps, full duplex.

Figure 5-3. Alternative Centralized, Core Intelligence Architecture

Ethernet switch, which has connection directly to the backbone. To make the network secure, wireless traffic should be placed on a "dirty" segment, or demilitarized zone (DMZ), until it has been authenticated. The only way to accomplish this is to pass through the controller to a separate switch that then passes traffic to the backbone. Each link is 100 Mbps, full duplex.

Comparing Packet Flows of Distributed and Centralized Intelligence Systems

In fact, basic network speeds and feeds bores a hole in this architecture in more than one way. To illustrate, look at a simple packet flow through the network, from a wireless client to a wired client. Figure 5-4 shows a day in the life of a packet in a centralized intelligence core system environment. Keep in mind that the APs have been effectively "lobotomized," forcing each and every packet back to the controller for inspection.

Figure 5-4. Life of a Packet in a Centralized Core Intelligence System

[View full size image]

The following traffic flow (typical packet sequence) describes Figure 5-4:

A ping packet (ICMP Echo Request) is generated by the client workstation.

The packet contends for air space over the 802.11b wireless network and arrives at the AP.

The packet is bridged to the Ethernet LAN and directed toward the controller.

The Ethernet switch receives the packet.

The packet leaves the Ethernet switch on the controller's port.

The controller receives the packet.

The controller processes the packet (classifies, filters, tags, and so on).

The packet is directed toward the backbone network via the egress port.

The backbone switch receives the packet.

10.

The packet is sent to the IP address to which it was intended.

11.

The target PC receives the packet.

Now the packet must traverse back through the same steps in reverse order to the appropriate AP and client, for a total of 22 steps to move from one wireless client to another (even if these clients are on the same AP)!

A simple ping travels across 22 interfaces. If the source and destination IP devices are on different subnets, add a Layer 3 hop in the controller to that total.

Contrast the centralized intelligence system to a distributed intelligence system where the AP provides port-blocking authentication services, as well as local encryption.

Figure 5-5 shows the life of a packet in a fat AP.

Figure 5-5. Life of a Packet in a Distributed Intelligence System

[View full size image]

The following traffic flows describes Figure 5-5:

The packet contends for air space over the 802.11b wireless network and arrives at the AP.

The packet is received on the AP, the AP's internal CPU processes the packet (classifies, filters, tags), and then the packet is bridged to the Ethernet LAN.

The Ethernet switch sends the packet.

The Ethernet switch receives the packet.

The packet leaves the Ethernet switch toward the client PC.

The target PC receives the packet.

If the packet is destined for another wireless device (on a different AP), it simply travels from step 5 to the other AP and then to the client. If the traffic is between two clients on the same AP, it travels from the client to the AP and then to the next client. In both cases, a distributed intelligence WLAN network results in much less overall traffic than a centralized intelligence system.

The centralized controller solution hits nearly twice the number of interfaces per packet as the distributed solution. The implication for traffic is profound. Delays can occur in numerous areas, including the following:

RF port on the AP

Egress port on the AP

Ingress port on Ethernet switch

Egress port on Ethernet switch

Ingress port on controller

The controller itself

Egress port on controller

Ingress port on the second Ethernet switch

Egress port on the second Ethernet switch

Any given packet can be subject to propagation delay and processing delay, both of which effect the variation of delay, also known as jitter. The net effect is a slower, less-predictable network. This is particularly a concern with applications such as voice over IP (VoIP) that are very sensitive to jitter.

Edge Device Architecture

Starting in 2002, several new start-up companies such as Airespace and Aruba, as well as several established networking companies such as Extreme and Nortel, came out with their versions of switched wireless architecture. In these cases, the term switched wireless is a bit closer to what you know and understand as network switching. Here an Ethernet switch houses the intelligence for the APs.

By centralizing some of the wireless services and troubleshooting tools into a structured WLAN switching system, systems engineers can build, manage, and operate large-scale 802.11 infrastructures with improved performance and management capabilities. However, pulling in too much intelligence and processing into a central point can produce many of the same issues as a centralized core controller.

WLAN switching is based on bringing a system's approach to 802.11 wireless network infrastructures. Most of the WLAN switch systems today move intensive-processing functions such as encryption, authentication, and mobility management that are found in today's intelligent APs into a centralized WLAN switch; they do this while also adding important new wireless features, such as air monitoring and automated site surveys, that give network managers more visibility, security, and control. With WLAN switching, a multilayered approach is necessary for security protecting the air space, the network, and the user.

The use of actual Ethernet-type switches as the controller for APs is a better approach than a centralized controller, in that it actually improves security by having the switch become the port authenticator. In this manner, unauthenticated traffic will not pass beyond the switch port. However, this depends on whether the AP is connected directly to the switch providing the control for this particular AP. In most edge wireless switch systems, you can use one switch to control many APs, including those that are located at another switch (see Figure 5-6). In this case, you still have unauthenticated packets on the network.

Figure 5-6. Centralized Edge Intelligence System

[View full size image]

Another downside to edge switch device systems is the use of a proprietary switch. Most networks already have a network installed, and the wireless is an additional system, to be incorporated as part of the network. Requiring a separate, proprietary switch just for wireless can be a management challenge (and can increase the overall cost significantly).

The one key item that both core and edge device and centralized intelligence systems promote is ease of management. In most cases, however, the switches or controllers have a maximum number of APs that they can support and manage. In a large enterprise system, this requires that you add yet another component, a sort of manager of managers, required to manage these WLAN switches or controllers. In an ideal system, the same manager that is used to manage your wired routers and switches would be used to manage your wireless network.

Switched Antenna Systems

collision domains. Switched antenna systems use a phased array antenna and perform beam steering for the RF radiation. Beam steering refers to the capability to focus the RF energy in a narrow beam of energy and steer or change the beam's primary point of focus from one direction to another. Beam steering is not a new technology to RF in general; it has been used in the military for some time.

The two advantages to this architecture are range and ease of installation. Most WLAN models require hard wiring dozens of APs to cover the large areas where users are located. This wiring and installation can represent a large portion of the cost in many sites. Systems with large numbers of APs rely on what is known as a microcellular architecture, where a network of APs covering small areas (or microcells) are connected and the wireless client can move from one microcell to another, much like a cellular telephone system operates (see Figure 5-7). This type of microcellular system requires maintaining and managing a large number of APs on the network. Some view this as a strain on network management resources.

Figure 5-7. Microcellular Architecture

These issues have posed unique problems for the traditional design of the 802.11 solutions, and deploying dozens of APs raises the issues of installation, network management, security, and QoS. The switched antenna system is an attempt to improve these areas for WLANs.

Phased Array Antenna Technology

sinusoidal signals such as electromagnetic waves and the time delay that can be translated as a shift of the phase of the signal.

The characteristics of a phased array antenna allow the signal to be directional and less sensitive to radiating interference (the technical rationale for why it was used for radar). In the world of WLANs, using a phased array antenna system equates to less interference from other devices because of the narrow directional beams. This is particularly important because of the unlicensed and free spectrum in which it operates. The Vivato switch uses a phased array antenna (sometimes called panels because of their physical size and shape) as part of their AP. This antenna is composed of 128 array elements that work in unison to transmit the 802.11 signal. The beamed power is provided only in the locations where there are users; consequently, there is a significant reduction in possible interference. As a result of the narrow beam widths, users enjoy a considerable increase in antenna gain. This increase in gain provides a significant improvement in range. Therefore, the range of a phased antenna system can be measured in kilometers.

Although this all seems great, remember what your dad used to tell you, "If it seems too good to be true, it probably is." The same holds true here. When using a beam-steering technology such as this, utilizing very high-gain, narrow-radiation beams, RF-reflective surfaces can become a major hurdle. In most cases, if there is any type of metal or other RF-reflective surface in the first 20 to 50 feet or so of the antenna's radiation path, the beam steering becomes distorted, and the overall performance of that beam is dramatically reduced, usually to the point of a normal dipole antenna. This severely limits the use of the system in an indoor environment. This is also the reason a vendor that sells this type of device also sells a single, typical intelligent AP. This AP is used for "filling in holes" of RF coverage, caused by items such as bookshelves, storage cabinets, stairwells, elevators, and many other commonly found RF-reflective items in a building.

The second drawback has to do with capacity. If, in fact, the AP can support an entire floor of 250 people as a result of its increase coverage, what about bandwidth? The AP provides coverage using all three nonoverlapping channels. This means that when optimized, the maximum throughput of all three combined will be about 16 Mbps, and this will be shared among all 250 users! As discussed in later chapters, many industries, including enterprise, are looking at smaller-size cells, so the number of users per AP is lower and the bandwidth per user is higher. Using a switched antenna system eliminates this capability.

Because of the gain of the antennas in most phased array antenna systems, the use of this technology device is limited to regions that permit high gain. The devices actually communicate over one antenna beam to one device at a time; therefore, they fall into the point-to-point regulations under FCC rules. Because each user may have its own beam pattern, and because it operates on a point-to-point protocol, range is increased. As a result, broadcast and multicast packets must be converted to unicast packets and sent to every user individually. This reduces efficiency drastically in systems that have a fair amount of multicast packets.

Two of the biggest drawbacks to this technology are size and cost. A typically indoor AP has a list price of more than $8000 and requires wall space of 2 feet by 4 feet.

In outdoor systems, the switched antenna array may have more usefulness. It can provide distances of up to 1 kilometer for non-line-of-sight links, which can help with last-mile solutions for hard-to-reach areas. Campus green spaces are another area for which this system has been positioned, and it may have valid usage there, provided the following:

The number of users (and their required aggregate bandwidth) in the green space is within the capable bandwidth of the AP.

The strong signals do not interfere with the in-building wireless systems.

Phased Array Antenna Extends Range

Companies such as Vivato and Bandspeed have taken a new systems approach for the design and integration of WLAN. This type of system uses a unique phased array antenna panel that can significantly extend the range of transmissions. This powerful antenna is combined with a centralized intelligent controller (called a switch by Vivato) that mirrors a similar management model as an Ethernet switch, but takes into account the specialized aspects of the management of WLANS. The intent here is that the long-range capabilities of this device will solve the issues of installing dozens of APs for providing coverage to a large area.

Instead of emitting a 360-degree coverage pattern like most APs, the phased array antenna has a radiation pattern of 100 degrees and will associate with any client within this field of view (see Figure 5-8). It transmits on a particular beam only when a client is active, by sending a narrow beam of energy directly to the client. The powerful antenna is used to send and receive on a packet-by-packet basis, enabling seemingly multiple conversations at the same time. Notice the use of the word seemingly. In reality, it provides a platform that three users can communicate with at any one time (based in 802.11b or 802.11g having only three nonoverlapping channels). The Vivato AP uses several (as many as 13) radios in each AP to provide the three-channel coverage and to power the antenna array structure.

Figure 5-8. Phased Array Antenna Radiation Pattern

These phased array antennas are intended to be used both indoors and outdoors. Indoor panels are designed to be mounted flat on a wall or in a corner that can provide coverage for an entire floor in the 100-degree horizontal beam width with a range of up to 300 meters (see Figure 5-9). The idea here is that this eliminates the need to install and maintain multiple APs.

Figure 5-9. Phased Array Antenna Implementations

Because an outdoor switch is exposed to the elements of nature, it must be enclosed in a dust- and moisture-proof, temperature-controlled environment. This is accomplished by incorporating the device in a NEMA 4-rated enclosure to withstand severe weather conditions. The weather-proof enclosure is a complete package that can easily be mounted on the outside of a building or on a tower (see Figure 5-10).

Figure 5-10. Phased Array Products

[View full size image]

An outdoor wireless switch can provide coverage for an entire building from the outside. In some cases, the ranges of an AP using a phased array antenna in an outdoor environment can be much farther than with a standard AP implementation. For example, the range can be up to 4 kilometers (line of sight) for the Vivato Outdoor Switch AP, and it can penetrate into some buildings for 11-Mbps connections from up to 1 kilometer away.

Mesh Networking

peer-to-peer routing technology that leverages routing techniques originally developed for battlefield and other temporary communications systems. By pushing intelligence and decision making to the edge of the network, you can build highly mobile and scalable broadband networks at very low cost.

Some systems, such as the MeshNetworks system, support both infrastructure meshing and client meshing. Infrastructure meshing creates a scalable network, whereas client meshing enables clients to instantly form a broadband wireless network among themselves, with or without network infrastructure. Using the MeshNetworks multihopping routing technology, you can use every client device as a router/repeater, so every user on the system plays a part in network coverage and network throughput for other users. Figure 5-11 illustrates a mesh network topology and the RF traffic patterns.

Figure 5-11. Mesh Network Architecture

[View full size image]

One issue with a mesh network approach is security. The fact that every client can become a repeater for other devices means that other clients' traffic is traversing systems that may or may not be totally secure. Add to this the fact that some clients may be turned off or moved, and the overall stability and performance of such a network can be questionable. Typically, mesh networking is done for only temporary and unsecured systems.

Free-Space Optics (Laser)

Free-space optics (FSO) is a line-of-sight technology that uses lasers to provide optical bandwidth connections. Currently, FSO is capable of up to 2.5 Gbps of data, voice, and video communications through the air, allowing optical connectivity without requiring fiber-optic cable or securing spectrum licenses. FSO requires light, which can be focused by using either light emitting diodes (LEDs) or lasers (light amplification by stimulated emission of radiation). The use of lasers is a simple concept similar to optical transmissions using fiber-optic cables; the only difference is the medium. Light travels through air faster than it does through glass, so it is fair to classify FSO as optical communications at the speed of light.

FSO technology is relatively simple (see Figure 5-12). It is based on connectivity between FSO units, each consisting of an optical transceiver with a laser transmitter and a receiver to provide full-duplex (bidirectional) capability. Each FSO unit uses a high-power optical source (that is, laser), plus a lens that transmits light through the atmosphere to another lens receiving the information. The receiving lens connects to a high-sensitivity receiver via optical fiber. FSO is easily upgradeable, and its open interfaces support equipment from a variety of vendors, which helps service providers protect their investment in embedded telecommunications infrastructures.

Figure 5-12. FSO

FSO systems are usually used in point-to-point systems that are fixed mounted. They have a very narrow beam focus, and therefore need to be mounted to a sturdy fixture that has minimal movement (due to wind or other vibration problems). Although they can provide very high bandwidths, FSO systems are relatively short-range devices (1000 feet to a few miles).

Most FSO systems are installed with a backup RF system in the event that some environmental conditions, such as fog, heavy snow, or heavy storms, interfere with the light signal.