My80211 White Papers (Coming Soon!)
This area does not yet contain any content.
Social Links
Peek Inside Cisco's Gear

See inside Cisco's latest wireless gear!

2.4 GHz Channel Overlap

EXAMPLE 1  

EXAMPLE 2

EXAMPLE 3  

LWAPP QoS Packet Tagging

 

 

CWSP RELEASE DATE 2/08/2010
  • CWSP Certified Wireless Security Professional Official Study Guide: Exam PW0-204
    CWSP Certified Wireless Security Professional Official Study Guide: Exam PW0-204
    by David D. Coleman, David A. Westcott, Bryan E. Harkins, Shawn M. Jackman

    Shawn Jackman (Jack) CWNE#54 is a personal friend and has been a mentor to me for many years.  I've had the pleasure and opportunity to work with Jack for 4 years. Jack is a great teacher who takes complex 802.11 standards and breaks them down so almost anyone can understand the concept at hand. I'm excited for you brother. Great job and job well done! Put another notch in the belt!

Interference Types

BLUETOOTH
 

Microwave Oven
 

Cordless Phone

JAMMER!
 

IEEE 802.11a/g/n Reference Sheet

 

Sunday
Jun202010

Autonomous: Carrier Busy Test

  

Back in the day when I couldn’t afford a spectrum or packet analyzer I would often use the next best free thing available. Its called the "carrier busy" test and it’s built into the Cisco Autonomous Access Point.

The carrier busy test will allow you to see what is going on in an environment from 50,000 feet, but that’s about where it ends. It doesn’t have details like a professional analyzer will provide. You could incorporate other commands like frame retries etc to help better interpret “carrier busy”.

Needless to say, it’s a fun command and if you don’t have the proper tools could help you in a pinch. If you do outdoor bridges, you may already use this command to assist on channel assignment.

What is "Carrier Busy"

On a Cisco autonomous access point you can run a command called 'carrier busy'. The AP will shutdown the respected radio interface and will scan all respected channels and report back with a percentage of channel activity. The channel activity collected includes activity from both 802.11 traffic and interference also sometimes called RFI (Radio Frequency Interference).

What this means, if there is 802.11 traffic and suppose there is interference it will compute a  (percentage) to this value. Things to note when you run the carrier busy test the radio will do a shut and all associated clients will lose connectivity between 5 - 8 seconds during the test. After the test the radio will no shut itself and return to production allowing clients to associate again.

I have not found any detailed documentation stating exactly how the access point computes these values. If you have any info please do share!

Command for "Carrier Busy"

If your access point has both 802.11g <dot11Radio 0> and 802.11a <dot11Radio 1> radios you can run busy test on either the 2.4 GHz or the 5 GHz spectrums.

ap#dot11 <Radio Interface> carrier busy

ap#show dot11 carrier busy

802.11g = dot11Radio 0
802.11a = dot11Radio 1

ap#dot11 dot11Radio 0 carrier busy

 

Example # 1 - Carrier Busy (Normal)

This example is a neighboring access point on channel 11 only sending management frames

ap#dot11 dot11Radio 0 carrier busy

*Mar  2 09:07:33.173: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Mar  2 09:07:34.173: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down

Frequency  Carrier Busy %
---------  --------------
2412          0
2417          3
2422          0
2427          0
2432          0
2437          0
2442          0
2447          4
2452          5
2457          2
2462          5

*Mar  2 09:07:38.695: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar  2 09:07:39.695: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up

 

Example # 2 - Carrier Busy (Microwave)

 I introduced a microwave oven into the mix. You can see there is a significant increase in channel activity from 2447 - 2462. 

ap#dot11 dot11Radio 0 carrier busy

*Mar  2 09:05:52.664: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Mar  2 09:05:53.664: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down

Frequency  Carrier Busy %
---------  --------------
2412          1
2417          7
2422          5
2427          1
2432          11
2437          13
2442          10
2447          31
2452          36
2457          42
2462          45

*Mar  2 09:05:58.186: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar  2 09:05:59.186: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up

ap#

 

Example # 3 - Carrier Busy (ISO Download)

In this example I introduced 2 laptops and conducted an ISO download for the purpose of creating 802.11 traffic.

ap#dot11 dot11Radio 0 carrier busy

*Mar  2 09:07:33.173: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Mar  2 09:07:34.173: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down

Frequency  Carrier Busy %
---------  --------------
2412          0
2417          3
2422          0
2427          0
2432          0
2437          0
2442          3
2447          9
2452          19
2457          21
2462          23

*Mar  2 09:07:38.695: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar  2 09:07:39.695: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up

Conclusion

If you don’t have tools and you are in a pinch the carrier busy test may be a tool you might find helpful. Keep in mind, you will need to incorporate other commands to interpret the carrier busy results.

 

Friday
Apr092010

Autonomous: Enable / Disable Web Browser Interface

 

 

How to enable or disable the web interface on a Cisco access point (autonomous) 

 

The web browser command in the CLI is

"ip http server" for port 80 HTTP

"ip http secure-server" for port 443 HTTPS

ENABLE

ap(config)#ip http server 

ap(config)#ip http secure-server

   

DISABLE - You negate the command with "NO"

ap(config)#NO ip http server

ap(config)#NO ip http secure-server

 

 

 

Friday
Mar122010

Autonomous: Understanding Cisco AP ARP Caching [Disabled] [Enabled] and [Optional]

 

 

ARP Caching at the access point isn't something normally deployed in the field in my experience, but I wanted to cover it here.  I've done limited testing with this "nerd knob" function in the field. If you have this in production I would like to hear your feedback! 

ARP caching on an access point reduces the traffic on your wireless LAN by stopping ARP requests for client devices at the access point. The good is that you lessen the ARP traffic and lessen the use of the wireless medium. There is also a security benny. If you are familiar with aireplay-ng it works by capturing the ARP packet and replaying it back to the AP to generate traffic. By blocking the ARP at the AP you lessen the upstream ARPs to the wireless clients to be sniffed, but you still have down stream ARPs (wireless clients to LAN). 

ARP CACHE DISABLED:

ap(config)#no dot11 arp-cache <-- Negate dot11 arp-cache with "NO"

When ARP caching is disabled (its is by default), the access point forwards all ARP requests through the radio port to associated clients, and the client to which the ARP request is directed responds.
See FIG 1.

 

 

ARP CACHE ENABLED:

ap(config)#dot11 arp-cache <-- dot11 arp-cache ENABLED

When ARP caching is enabled, the access point responds to ARP requests for associated clients and does not forward requests to clients. When the access point receives an ARP request for an IP address not in the cache, the access point drops the request and does not forward it. Did your ears just perk up!? See Fig 2

 

 

 

ARP CACHE OPTIONAL: 

ap(config)#ap(config)#dot11 arp-cache optional <-- dot11 arp-cache OPTIONAL

When legacy and non-Cisco client devices are associated to an access point and not passing data, the access point might not know the client’s IP address. If this situation occurs frequently on your wireless LAN, you can enable optional ARP caching. When ARP caching is optional, the access point responds on behalf of clients with IP addresses known to the access point but forwards out its radio port any ARP requests addressed to unknown clients. When the access point learns the IP addresses for all associated clients, it drops ARP requests not directed to its associated clients.

 

 

 

Tuesday
Mar092010

Autonomous: Command History Buffer 

 

 

By default, the Cisco autonomous AP records ten command lines in its history buffer. 

Beginning in privileged EXEC mode, enter this command to change the number of command lines that the wireless device records during the current terminal session:
 
ap#terminal history size ?
  <0-256>  Size of history buffer
Negate 
ap#no terminal history 
 

Beginning in line configuration mode, enter this command to configure the number of command lines the access point records for all sessions on a particular line:

ap#config t
ap(config)#line vty 0 4
ap(config-line)#history size ?
 <0-256>  Size of history buffer

 

Negate 


ap#config t
ap(config)#line vty 0 4
ap(config-line)#no history

** NOTE ** If you select 100 for example, it will record 100 lines.


Below is the show history output:

ap#show history
  en
  show terminal
  show history
  terminal history
  terminal history 200
  configure terminal
  terminal history size 200
  configure t
  config t
  terminal history size
  show history

 

Monday
Mar082010

Autonomous: Configure a Cisco AP to provide DHCP Services

 

 

In real world deployments you wouldn't likely use a Cisco AP as the DHCP server. But, during deployments I've used it for temporary setups. Lets step through the setup process

In this senerio we will set up a class C 192.168.1.0 DHCP Scope with IP exclusions and add additional info like the gateway and DNS server information.

1. Lets start with the client exclusion. We will exclude the following ranges, so that the AP doesn't assign these specific addresses out: 

192.168.1.1 - 192.168.1.10
192.168.1.200 - 192.168.1.254 

ap#config t
ap(config)#ip dhcp excluded-address 192.168.1.1 192.168.1.10
ap(config)#ip dhcp excluded-address 192.168.1.200 192.168.1.254

 

2. Next, we will name the DHCP Scope (pool) and set the network:

ap(config)#ip dhcp pool WIRELESS
ap(dhcp-config)#network 192.168.1.0

3. Next, we will set the LEASE time for the addresses (3 days,4 hours, 20 min) , setup the gateway and DNS:

ap(dhcp-config)#lease 3 4 20
ap(dhcp-config)#default-router 192.168.1.1
ap(dhcp-config)#dns-server 192.168.1.250

4. Next, we connect a wired laptop to the switch on the VLAN and see the results: 
(Note this will also hand out Wireless DHCP as well)

Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix  . :

        Description . . . . . . . . . . . : Intel(R) 82567LM Gigabit Network Connection
        Physical Address. . . . . . . . . : 00-2A-A1-13-C2-33
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . : Yes
        IP Address. . . . . . . . . . . . . . : 192.168.1.11  <-- This is the first IP in our Scope
        Subnet Mask . . . . . . . . . . . : 255.255.255.0 <-- Our class C 
        Default Gateway . . . . . . . . . : 192.168.1.1   <-- This is the GW we set up
        DHCP Server . . . . . . . . . . . : 192.168.1.2      <-- This is the IP of our AP
        DNS Servers . . . . . . . . . . . : 192.168.1.250  <-- This is the DNS we set up 
        Lease Obtained. . . . . . . . . . : Saturday, March 06, 2010 5:48:12 PM <--- This is our lease time we set up
        Lease Expires . . . . . . . . . . : Tuesday, March 09, 2010 10:08:12 PM