Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil...
Transcript of Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil...
![Page 1: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/1.jpg)
What’sontheWireless?
DavidMalone
14November2005
1
![Page 2: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/2.jpg)
Plan
1.Some802.11basics.
2.Alittleaboutwardriving.
3.AlittleaboutwirelessinTCD.
2
![Page 3: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/3.jpg)
Ethernet(802.3)
•RobertMetcalfeatXerox,mid70s.
•3Mbpsto100Gbps.
•Nowmainlyswitched.
•CSMA/CD:Politedinnerpartymodel.
•Cablelengthlimitations.
3
![Page 4: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/4.jpg)
WiFi(802.11)
•ThinkoldsharedEthernetwithoutacable.
•Keydifference:onceyouspeakcan’thearothers.
•Needacknowledgments(ACKscheme,notNAK).
•Doesback-offaftereverypacket.
4
![Page 5: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/5.jpg)
nτ(1−τ)n−1
0
0.2
0.4
0.6
0.8
1
0 0.2 0.4 0.6 0.8 1
total throughput
transmission probability
1 user 4 users 10 users
100 users
BianchiMarkovModle.
5
![Page 6: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/6.jpg)
Commonvariants
802.11bMostcommonvariant.2.4GHz,11Mbps,100m.
802.11gMostcommonvariant.2.4GHz,54Mbps,100m.
802.11aFastvariantindifferentband5GHz,54Mbps,
50m.
802.1xEAPbasedauthentication.
e:QoS,g:faster2.4GHz,h:modstoa,i:security,n:
Fasteragain.
6
![Page 7: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/7.jpg)
802.11Concepts
ChannelFrequencyforcommunication(1–14).
BSSIDGroupofcommunicatingindividuals(MAC).
SSIDNetworkname(20chars).
modeInfrastructure/ad-hoc(IBSS).
BeaconUsedtoadvertiseanaccesspoint.
AssociationConnectingtoanaccesspoint.
7
![Page 8: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/8.jpg)
Otherinteresting
differences
Originalsecuritymechanism:WEP.
•Encryptsthebodyofframes.
•40(104)bitkeys.
•Defaultorper-station.
•Nokeymanagement.
8
![Page 9: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/9.jpg)
WEPProblems
Hasbeenshowntobe(badly)flawed.
•Keyisusuallyconstant.
•Firstbyteis0xAA.
•InitialVectorisobservable.
•SomeIVsprovideinformationaboutkey.
•LEAP,PEAP,WPA,WPA2,...
9
![Page 10: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/10.jpg)
Wardriving
•Lookingforwirelessnetworks.
•Namedafterwardialing.
•Probablylegal,thoughunauthorizedaccessisillegal.
•Cf.Portscanning.
10
![Page 11: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/11.jpg)
WirelessCards
OldChipsLucentHermes,IntersilPRISM,Aironet.
NewChipsAtheros,Centrino,TexasInstruments,
Broadcom.
SniffingSomechipsetsmoreflexiblethanothers.
HostAPUsefulforbuildingownnetworks.
AntennaDependsonpackaging,canaddomni,sector,
yagi,...
WEP/WPAKeysizeandsupportedprotocols.
11
![Page 12: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/12.jpg)
Software
•Needgooddriversupportby/forusualsuspects.
•Nowcommontonotprovidedrivers:
Ndiswrapper/ProjectEvil.
•Sniffingfornetworks:kismet,bsdairtools,
NetStumbler,MacStumbler,...
•Sniffingforpackets:tcpdump,AirSnort,
bsdairtools,...
•Networksurveying.
12
![Page 13: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/13.jpg)
•DryrunaroundTCD.
•Expandtoaroundtown.
•IndustrialEstates.
•Results.
13
![Page 14: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/14.jpg)
InterestingFinds
•IFSCandfriends.
•Bignetworkinthedocks.
•Publicserviceuse?
•Industrialestate.
•Communitynetworks.
•Nocommercialhotspotsin2002,lotsnow.
14
![Page 15: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/15.jpg)
BeforeAfter
15
![Page 16: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/16.jpg)
WarCycling
•FoundMacStumbler.
•antenna++,faradycage--;
•Tookabitofgettingright.
•Routetowork&Clontarf.
16
![Page 17: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/17.jpg)
17
![Page 18: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/18.jpg)
TalkingtoPeople
•Legaladvice.
•Helpwithmapping.
•‘Guysinacar...’
•Feedback.
18
![Page 19: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/19.jpg)
ConferenceSniffing
•FreeBSD4.7,
•Orinococard,
•dsniff,
•notjustwirelessproblem.
19
![Page 20: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/20.jpg)
RunningWireless
Networks
•Havetorunsomething.
•Dirtywireless.
•LEAP/PEAP/WPA/....
•Authenticatetogateway/IPsec.
•Captiveportal(IPoverDNS).
20
![Page 21: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/21.jpg)
InTCD
•4Wirelessops.
•CS,ISS,Maths,Researchers.
•Only3channelstogoaround!
•ISS:145APsin50locations,3services.
•Registered200→750→1500?
•Infirstmonth:488.
•CoverageinGoldsmithtoimprove.
21
![Page 22: Wireless? the on What’sdwmalone/p/ducss05.pdfWireless Cards Old Chips Lucen t Hermes, In tersil PRISM, Aironet. New Chips A theros, Cen trino, T exas Instrumen ts, Broadcom. Sni](https://reader033.fdocuments.us/reader033/viewer/2022041617/5e3c5ab2ba8ea9111a214d16/html5/thumbnails/22.jpg)
Future
•Citycrawlingwithwireless.
•802.11n,MIMO,using802.11e.
•WiMax,802.16,connectivityeverywhere.
•NextGenMobile1Gbps,100Mbps.
22