Liquid Antenna - (Sea Water Antenna)

  

Liquid Antennas aren’t necessarily a  new concept. There have been a few “projects” in the works. Attached is a youtube video of another concept of a “Liquid Antenna with Sea Water”

The concept is revolutionary in a grand sense. Think of the unique and endless possibilities. There are the obvious questions like gain, pattern etc which wasn’t covered.  Enjoy!

Optimize CB21AG/PI21AG Roaming Behavior

  

I came across an oldie but goodie document. You can modify the driver behavior of the CB21 and PI21 AG cards.  

http://www.cisco.com/en/US/products/hw/wireless/ps4555/products_tech_note09186a008074fed9.shtml

Complete these steps in order to minimize delays when roaming from access point to access point when you use the CB21AG/PI21AG (802.11a/b/g wireless client adapter).

Note: These steps optimize roaming delays at the driver layer and are applicable to all authentication types. If 802.1x authentication is used, there might be additional optimizations possible, which are outside the scope of this document.

Note: Optimizing for faster roaming can potentially contribute to increased battery use and to reduced throughput.

1. Use ADU client software version 4.4 or later.

2. Set the BSS Aging Interval to 30, and set the Scan Valid Interval to 20.

   Complete these steps in order to set these two parameters via the Windows control panel:

   1. Go to Windows Explorer.

   2. Right-click My Network Places.

   3. Choose Properties from the drop-down list.

   4. Right-click Wireless Network Connection#, where # is the instance number of the Cisco CB21AG Wireless LAN adapter.

   5. Choose Properties from the drop-down list. The Wireless Network Connection Properties dialog box appears.

   6. Click Configure.

   7. Click the Advanced tab.

   8. Set the BSS Aging Interval to 30, and set the Scan Valid Interval to 20.

   These parameter values are the absolute lowest permitted values and should not be set any lower. The default values are 120 for BSS Aging Interval and 60 for Scan Valid Interval.

3. If your access point coverage permits it, configure the client profile in the ADU only to use the 5 GHz (802.11a) or 2.4 GHz (802.11b/g) band, not both. In order to configure the client profile, complete these steps:

   1. Launch the ADU client software.

   2. Click the Profile Management tab, highlight the profile of interest, and click Modify.

   3. Click the Advanced tab.

   4. Under Wireless Mode, uncheck the rates that you do not intend to use.

   5. If you do not use the ADU to manage the CB21AG, you must use registry settings in order to select the rates. Complete these steps:

      1. Choose Start > Run, and type regedit in order to launch the Registry Editor.

      2. Navigate to HKEY_LOCAL_MACHINE > System > CurrentControlSet > Control > Class > {4D36E972-E325-11CE-BFC1-08002bE10318}.

      3. Right-click the 4D36E972-E325-11CE-BFC1-08002bE10318 folder, and choose Find.

      4. Type NetBand in the search field in order to locate the NetBand variable. This is under an [instance] four-digit subkey that has a DriverDesc value of Cisco Aironet 802.11a/b/g Wireless Adapter.

         The NetBand REG_SZ variable is a bitmask of supported rates. By default this is 15. The values are:

         802.11a    0x01
         (not used) 0x02
         802.11b    0x04
         802.11g    0x08
         (not used) 0x10

         For example, in order to support only 11b and 11g rates, this is 0x04 + 0x08 = 0x0C = 12 decimal.

Why the Mythbusters won't do RFID

  

This is a great caption from Adam Savage about why they wont do an RFID show on the use and hacking of RFID. This video rippled through the web. 

iPAD Whiteboard HD Review

  

I'm an iPAD junky and these apps can nickel and dime you to death! LOL 

I use my iPad mainly for reading , some tunes and the cool apps. Recently, I<<<< CLICK ME >>>> wanted to find a
 good whiteboard app. So I surfed and found most were just “finger drawing”. I also had a need for a VGA output and one that can be easy to use and looked semi professional  (for a whiteboard drawing). In my search I came across Whiteboard HD. 

Whiteboard HD allows you VGA output, ease of e-mailing and is great for collaboration.  As a network engineer we like to draw with network ICONS. Well they don’t have “network” ICONS, YET. But you can use other shapes and label for identification.  I did email support and they said network ICONs are on the way.

<<<< CLICK ME >>>>The app took a little while to get use to. But after a week I am breezing through the screens.  With any new technology you need to embrace and have an open mind.  Whiteboard HD isn’t that bad and the best I’ve found so far for my needs. Its like under $8

Here are a few examples … 

If you used a better Whiteboard app please do share ! 

Take A Peek Inside Cisco's Wireless Gear ~ Literally !(UPDATE Cisco CLEAN Air)

  

I added Cisco Clean Air 3502i

 

 http://www.my80211.com/home/2010/5/15/take-a-peek-inside-ciscos-wireless-gear-literally.html

Wi-Fi Aerial Surveillance Platform (W.A.S.P)

  

WIFI Hacking from the sky... You have to love it !

(From www.rabbit-hole.com)

 

When two guys interested in computer security get bored, it's usually a recipe for trouble. (Wi-Fi Aerial Surveillance Platform). It's an autonomous Unmanned Aerial Vehicle (UAV) that we built in our garage with onboard war-driving gear, among other things. 

 

It didn't take long before we decided Wi-Fi networks weren't enough. So we added Bluetooth, Cellular, and imaging capabilities that we can easily add and remove based on our needs. It all plugs into an onboard USB hub, so the possibilities are infinite. 

 

Oh, and we're not Dutch. Mike (a.k.a. RedQueen) lives in Indiana. Rich (a.k.a. WhiteQueen) lives in Illinois. We're Midwest, corn-fed Americans. Not that there's anything wrong with being Dutch. 

 

Our goals were relatively simple. We wanted it to be cheap enough that we wouldn't go broke building it. Not wanting to scratchbuild every component, it needed to use as much off-the-shelf equipment as possible. It needed to fly long enough to be able to do something interesting. One person should be able to load it in and out of a station wagon without any special equipment. Finally, and most importantly, we wanted anyone to be able to follow in our footsteps without needing to be a PhD, electrical engineer, or aeronautical engineer. 

 

The airframe is a surplus U.S. Army target practice drone. A DIY Drones "ArduPilot" (based on the popular Arduino) controls the avionics. An onboard Via Epia Pico ITX PC with a Via C7 500 MHz CPU with 1 GB RAM, running the Backtrack 4 suite provides the "surveillance" capabilities.

It communicates with a ground station for real-time tracking, payload interaction, flight operations, and data download. An ArduStation in the base station receives the telemetry data. The base station runs on a 1 GHz Via Pico ITX PC with 1 GB of RAM. It allows us to establish a Secure Shell link via a PPP tunnel. Additionally, it can serve as a network router for connecting additional workstations to the payload system. The UAV also contains an Edge/3G connection, giving the aircraft onboard Internet connectivity. This connection allows the operator to control the payload from anywhere in the world -- including mobile devices. It also allows for processor-intensive applications, such as WPA attacks and password cracking, to be offloaded securely in real-time to a remote computing powerhouse utilizing CUDA technology, for mind-blowing performance. 

 

Altogether, WASP weighs approximately 13 pounds, with a length of 76 inches and a wingspan of 67 inches. Its flight time is approximately 30-45 minutes, with a maximum estimated altitude of around 22,000 feet. It flies a preprogrammed set of GPS coordinates, while collecting data, and returns to base. We can also interrupt the course, and cause the UAV to "loiter" around an interesting target, allowing us more time to investigate. 

http://www.rabbit-hole.org/

Cisco Visio Stencils

  

The last 2 weeks I responded to a number of forum post by others looking for the Cisco Stencils. So I thought I would add the link here as well

You will need Microsoft Visio Standard or Professional in order to see these stencils correctly. Be sure to download the add-ons to enjoy the full functionality of all the Cisco Visio Stencils listed below.

The documents listed for download on this page are .vss files within .zip files

http://www.cisco.com/en/US/products/hw/prod_cat_visios.html

Cisco WCS SQL Injection Vulnerability: CSCtf37019

  

Cisco released a WCS vulnerability last week

Cisco WCS devices running software 6.0.x are affected by this vulnerability.

Note: Cisco WCS software release 7.0 is not affected by this vulnerability. Cisco WCS version 7.0.164.0 (which is the first 7.0 version) already contains the fix for this vulnerability. Cisco WCS software releases prior to 6.0 are not affected by this vulnerability.

The version of WCS software installed on a particular device can be found via the Cisco WCS HTTP management interface. Choose Help > About the Software to obtain the software version.

Cisco WCS enables an administrator to configure and monitor one or more WLCs and associated access points.

A SQL injection vulnerability exists in Cisco WCS. Exploitation could allow an authenticated attacker to modify system configuration; create, modify and delete users; or modify the configuration of wireless devices managed by WCS.

This vulnerability is documented in Cisco bug ID CSCtf37019 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2010-2826.

Read more about this field notice: 

http://www.cisco.com/warp/public/707/cisco-sa-20100811-wcs.shtml

Cisco 6.0.199.0 - Reported Vocera Issues

  

Vocera is reporting connectivity issues on 6.0.199.0. They went as far as to release a Technical Advisory to customers. Its not clear what the issue is at the moment. 

The Vocera Advisory states:

Vocera is aware of an issue that customers are experiencing after moving to Cisco WLC version 6.0.199 that manifests itself in a substantial increase in difficulty with badge communications to the Vocera Application Server over the network. Badges will display "Searching For Server" or "Searching For AP."

Vocera is working closely with Cisco and its mutual customers on the problem.

Please consult with Vocera Technical Support and Cisco TAC before upgrading to 6.0.199.

Cisco 6.0.199.0 Controller Code Release - Potential MD / AW Release

  

Cisco released a new rev in the 6.0 track, 6.0.199.0. Note: this has potential to be MD / AW tagged. Although, I will wait and see what fall out there is based on the previous releases in the 6.0. track.

Look at the resolved caveats. There are some BIG problems resolved with this reelase. 

Note:6.0 is a MD train and 6.0.199.0 is a potential MD / AW release. 6.0.199.0 release will be marked with MD / AW Tag after few weeks of customer adaptation and completion of AW release certification

Table 5 Resolved Caveats 

ID Number	Caveat Title
CSCtf63030	Radio get stuck when it is in the RESET or DOWN state.
CSCta91358	HREAP is locking up due to a wedge input queue on the radio interface.
CSCtb02136	AP1252 with AP groups and HREAP do not broadcast SSIDs.
CSCth05209	An OEAP configuration option needs to be removed in an unsupported platform.
CSCth02673	Errors occur when you apply the WLAN template with security as the WEP.
CSCtg93517	The wrong error message appeared while the H-REAP access point was added to a different H-Group.
CSCsx62302	REAP VLAN support mapping on an access point is lost when you upgrade from 4.2.176 to 6.0.182.
CSCtg93928	A traceback occurred on the mesh access point.
CSCsy90434	The controller command line displays that diversity was enabled for the 1522a radio.
CSCtg94715	Lock Assert dtlARPTask has caused the Cisco 5500 Series Controller to crash.
CSCtg74904	The Cisco 1142 Access Point stopped transmitting and receiving on its radio.
CSCth11525	A WLAN gets disabled after you add a new SSID to an existing access point group.
CSCsy93463	Debug the output through Telnet and SSH sessions.
CSCsy99905	RLDP constantly finds wired threats only when manually used.
CSCth09687	The controller GUI has a problem when configuring new ACL rules.
CSCsz19203	The controller crashes at SSHpmMainTask.
CSCsz37520	Noise was not factored in Channel Util calculations for AP1140.
CSCsz38828	AMAC radio core dumps: the transmitter has stopped working.
CSCsz40659	Need to reboot the wireless controller after an upgrade.
CSCsz42048	An inconsistency has occurred in the neighbor RSSI measurements.
CSCsz84895	An association response has the wrong set of supported rates for the 11b device.
CSCta04008	The call station type on the controller does not state that it is applicable to non-802.1X devices only.
CSCta13941	An access point is rejecting the association request with the status code 13.
CSCta34765	The controller console displays that invalid behavior occurred when you entered the config mirror port command.
CSCta41584	The backup port was not active when the primary port was disabled on the controller.
CSCta49375	The Cisco 4404 Controller crashes when you restart the sig11 at nPCSL_timer.
CSCta58642	LAP1252-P seems to have violated the maximum power levels in the regulatory domain.
CSCta71448	Reduce the severity of the error msg: %APF-1-CHANGE_ORPHAN_PKT_IP.
CSCtb20125	CCMP displays errors when the radio configuration is changed.
CSCtb34971	When the Controller WISM loads third-party certificates for web authentication, HTTPS port 443 is disabled.
CSCtb39368	The webauth custom page fails with some file extensions.
CSCtb39612	The WGA two device solution displays the "Cannot find MSCB for NPU SCB on console" message.
CSCtb42260	Enabling broadcast forwarding versus multicast forwarding through the controller CLI.
CSCtb44059	The controller should send the DHCP packets to the proper DHCP server.
CSCtb45178	Insufficient memory or a traceback occurred on AP1130 and AP1232.
CSCtb63297	A file read error message was reported in message log.
CSCtb69778	The output of the show log ip-port hash command was not correct in Telnet or SSH sessions. Instead, the output displayed results in the console window.
CSCtb92872	The WiSM with no access points crashed and the controller is unresponsive and you have to reset the hardware module to bring it up.
CSCtc01748	The Controller 2106 kernal panic crashed and hung while running combination stress test.
CSCtc13337	Even after the clients are associated to the controller, the message log displays an error saying no ACLS was defined on the controller.
CSCtc13378	The Cisco 5508 Controller crashed on the apfProbeThread.
CSCtc22661	An MFP anomaly was detected on deauthenticated frames.
CSCtc23210	MC2UC: Fragmentation has caused fewer clients to connect.
CSCtc23277	Radio driver is consuming all of the WLAN pool buffers.
CSCtc23789	The AP 1140 and 1250 radios were down and the interface was stuck in the reset state.
CSCtc29509	A predownload of the image has stopped after completing 18 out of the 230 access points on the controller.
CSCtc41797	RLDP does not work for G-only APs.
CSCtc44480	The access points were still transmitting ad-hoc deauths even after auto-contain was disabled.
CSCtc50424	The Cisco 5500 controller crashes and an error message "cond pbuf->dataLen <= 2048 failed" appears in the crashlog.
CSCtc51076	The "config spanningtree port mode off" settings are not saved in the backup configuration file.
CSCtc57611	Delay in Music on Hold on 7925 with HREAP AP.
CSCtc67372	On the controller with some access points, the SSH/Telnet session hangs with sh run output with paging disabled.
CSCtc73503	The radios are showing a Tx power level of 0.
CSCtc73527	Low latency MAC is not supported on the 802.11n APs.
CSCtc90985	The DMA input queue is overrun by fast Ethernet bursts.
CSCtc95434	An FTP transfer does not work on Cisco 2100 Controllers.
CSCtc97144	The 1800-seconds session that occurs after the session timeout has been fixed when H_REAP is in the standalone mode.
CSCtc97595	Only one of many gratuitous ARP packets is forwarded to the client.
CSCtd04572	Video metrics fixes and enhancements.
CSCtd06186	Directed broadcast does not work when IGMP snooping is enabled.
CSCtd21859	WLAN CKIP PSK is deleted when the Apply button is applied.
CSCtd23497	1242 AP HREAP Mode crashes after%CAPWAP-5-CHANGED the state to Join.
CSCtd26168	Incorrect source MAC address in the ARP request when the controller is in lag mode.
CSCtd26794	5508 DP was crashing and fragmentation consumes all pbufs.
CSCtd28542	The controller was crashing on EmWeb due to an access point configuration change.
CSCtd28757	The LDAP user password length needs to be increased.
CSCtd30669	WLAN security settings and session timeouts are changed after restoration.
CSCtd59231	The master bit configuration was not saved in xml.
CSCtd60522	The configuration backup adds the wrong 802.11a channel list.
CSCtd72649	The Cisco 4400 Controller crashes at osapi_task.c:3660.
CSCtd74472	The Cisco 5500 Controller crashes with the OSAPI reaper task and throws a null tunnel pointer exception.
CSCtd75089	The controller needs to have the "devshellsysapiDumpMbufStatus" command to show mbuf usage.
CSCtd75094	The access point crashed while clearing the CAPWAP MGIDs for the new client.
CSCtd86901	The mobility anchor configuration for WLAN is lost while copying the configuration through auto installation.
CSCtd92105	The controller reloads and the DHCP task reaper is reset.
CSCtd97011	When the AMAC radio core dump is observed, the neighbor discovery frames are stuck.
CSCtd99288	The client authentication trapflag cannot be configured through the CLI.
CSCtd99659	An SNMP agent inserts null data during the mesh link test.
CSCte08090	A TFTP upload fails while trying to upload a packet capture to the Windows TFTP server.
CSCte19262	The client is deauthenticated after the key exchange and displays an error message "Unable to locate AP 00:00:00:00:00:00".
CSCte27052	An inconsistency in the AAA Override feature occurred.
CSCte36493	The controller GUI displays a guest LAN error when the ingress is set to None on the anchor WLAN controller.
CSCte43508	5508 DP CRASH: buffer leaks due to ARP storm.
CSCte51177	The SNMP TRAP port number is not reflected in the configuration file of the controller.
CSCte55458	The web authentication page takes a long time to display under a heavy load.
CSCte62815	The Cisco 5508 Controller is not passing OSPF multicast traffic.
CSCte74879	The controller 5508 agentSwitchInfoPowerSupply MIB was not working.
CSCte76854	Unable to enable a WLAN on the Cisco 5508 Controller.
CSCte78472	An invalid PHY rate is returned on an ADDTS response.
CSCte79131	Containment details for the ad-hoc rogue is incorrect in the controller GUI.
CSCte79305	Auto containment for wired rogue access points does not contain wired rogues.
CSCte81420	When the access point crash was in process, the message "Dot11 driver" dot11_rate_is_allowed appears.
CSCte89891	The radio stops transmitting beacons periodically.
CSCte90918	WiSM locks-up during the upgrade with a full load of access points and clients.
CSCte92365	The auto immune attacks fix does not cover the incorrectly formatted association request.
CSCte95626	The Cisco 5508 Controller was not forwarding 100% of packets for the Gigabit line burst.
CSCte96140	Ethernet bridging breaks when the Ethernet interface of AP 1242 is flapped.
CSCtf03121	An optical SFP misconnect causes the Cisco 5508 Controller to disable its ports.
CSCtf03958	The WLAN Load Balance and Band Select should display Global Disabled as apply.
CSCtf06314	The WCS access point current associate client list is not up to date.
CSCtf06931	The controller emWeb crashes while running the ewaFormSubmit_blacklistclient_list.
CSCtf08553	The system log is not sent to the server that is on the same subnet as the dynamic interface.
CSCtf23682	An access point cannot join with the multicast MAC address as the gateway (checkpoint).
CSCtf27580	The Ethernet interface input queue wedge is from the broadcast/uniGRE traffic.
CSCtf28217	An access point unexpectedly joins the controller in bridge mode instead of local mode or H-REAP.
CSCtf33859	The client state is run with no IP address.
CSCtf34858	The client cannot transmit the traffic if it reassociates to an access point within 20 seconds.
CSCtf36051	The CPU ACL is not filtering after a reload.
CSCtf50921	Acct-Input-Octets counters do not reset for every accounting stop.
CSCtf53521	Directed broadcast does not work when the IGMP snooping is enabled.
CSCtf71637	The username entry in the accounting stop did not match the accounting start.
CSCtf94670	emWeb task crashed at usmWebGetSfpType.
CSCtf94679	The used memory increases by 25-MB immediately after bootup.
CSCtg10321	The Cisco 5500 controller crashes when all ports are disabled.
CSCtg34627	The video queue constrain limit allows only 9 to 10 clients of the 5-Mb stream.
CSCtg55102	AssocFailPayload causes a payload error at the controller.
CSCtg98413	There is a discrepancy between the help on the CLI and the actual code.
CSCth00490	The Dyn-int template with secondary port of 7 is getting applied while applying a dynamic interface.
CSCth02608	RRM RF group Leader Election did not occur.
CSCte55219	AMC radio core dumps with reason "transmitter seems to have stopped" due to a large number of uplink frames in the inprog queue.
CSCtf69598	There is a memory leakage in the access point upon a CCKM failure.
CSCtg71658	Access point level resets to 0 while upgrading from 5.0 to 6.0.
CSCtf65636	The access points that are crashed from the data TLB misses exception.
CSCth16398	Downloadable logs should include primaries.
CSCtd43906	RAP, which is a mesh access point, does not recover after the radar was detected.
CSCtf84965	CCKM roam fails with OEAP.
CSCtg89404	Association response to client is sent with AID 0.

GEORGE STEFANICK - CWSP JOURNEY, (CHAPTER 5 – TSN POST#3)- 7/5/2010

  

George Stefanick - CWSP Journey, (Chapter 5 – TSN POST#3) - 7/5/2010

TSN stands for (Transition Security Network).  TSN supports both RSN and  pre-RSN legacy authentication and encryption on the same BSS.

Example – Think of WEP with WPA and/or WPA2 enabled on the same BSS. Pre-RSN +  RSN = TSN

Suppose your WLAN was secured with WEP and you wanted to upgrade to WPA2 . Instead of having to manage another WLAN and add additional wireless utilization (each WLAN you add you increase wireless utilization) you can modify the current WLAN to allow for WPA2 security.

Cisco often references TSN as a “migration” WLAN. I was emailed today about adding a config for a Cisco autonomous ap with TSN.

First lets look at a packet capture example:

Our SSID is: wep-wpa2

GROUP CIPHER WEP102 (WEP128)

RSNIE: You will notice the below capture the Group Cipher is Wep104 (WEP128). This is our indication WEP is enabled on this BSS. Since all stations share a single group encryption the lowest common denominator is used. In this case it is Wep104 (WEP128).

PAIRWISE CIPHER CODE 00-0F-AC-4

Some other areas of interest, the Pairwise Cipher code 00-0F-AC 4. This is our other indication AES-CCMP is being used.

NOTE:

OUI       Suite Type        Definition
00-0F-AC 0                    Use the group cipher suite (only valid for pairwise ciphers)
00-0F-AC 1                    WEP-40
00-0F-AC 2                    TKIP
00-0F-AC 3                    Reserved
00-0F-AC 4                    CCMP 

Auth Key Management Suite

Since we are in the frame, let me share what the AUTH KEY MANAGEMENT means. This is were the RSN authentication type lives. You will see 2 types, 00-0F-AC1 for 802.1X or 00-0F-AC2 fo PSK.  In our example we are using PSK.

Authentication and key management suites

OUI Suite type   Authentication                          Key management
00-0F-AC 1        802.1X or PMK caching              Key derivation from preshared master key
00-0F-AC 2        Pre-shared key                          Key derivation from pre-shared key

Cisco 1240 TSN Configuration

Configuration Notes:

SSID is wep-wpa2

WPA PSK: WPA2/AES

PSK: 1234567890

WEP KEY: Slot 3

WEP KEY: 128 / 12345678901234567890123456

Logon Cisco / Cisco

!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap
!
enable secret 5 $1$/d5u$WOD0P0tI3GSizQKugBNyj0
!
no aaa new-model
no ip domain lookup
!
!
dot11 syslog
!

! dot11: dot11 ssid wep-wpa2 is the SSID that your authentication    

! configuration will be applied

!

! Authentication OPEN: Auth OPEN allows open auth for WEP

! Authentication Key-Management: Key-Man WPA V2 optional allows WPA2 with ! the optional command meaning WPA and WEP can be used

! WPA-PSK: This is your key (note its encrypted)

 dot11 ssid wep-wpa2

   authentication open
   authentication key-management wpa version 2 optional
   wpa-psk ascii 7 135445415F59527D737D78
!
!
username Cisco password 7 02250D480809
!
bridge irb
!

! Dot11Radio0: This is your 802.11b/g radio where you encryption will live

! Encrypt: Key 3 is the slot, 128 bit is the length, next is your key and !then you are telling the ap that slot 3 is a transmit key

! Encrypt: Mode Cipher aes-ccm and wep128 is telling the radio what

! encryption modes to use. In this case use aes-ccmp AND WEP128

!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption key 3 size 128bit 7 904856427E9D21265549561E467E transmit-key
 encryption mode ciphers aes-ccm wep128
 !
 ssid wep-wpa2
 !
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 shutdown
 !
 encryption key 3 size 128bit 7 8F156E346C961F07447BA1D43824 transmit-key
 encryption mode wep mandatory
 dfs band 3 block
 channel dfs
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface FastEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 bridge-group 1
 no bridge-group 1 source-learning
 bridge-group 1 spanning-disabled
!
interface BVI1
 ip address 10.10.0.30 255.255.0.0
 no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 login local
!
end

George Stefanick - CWSP Journey, (Chapter 5 – RSN POST#2) - 7/4/2010

  

George Stefanick - CWSP Journey, (Chapter 5 – RSN  POST#2) - 7/4/2010

RSN stands for (Robust Security Network) which was defined in the 802.11i - 2004 standard. This was later rolled under the 802.11-2007 standard (clause 8).  The purpose of RSN is to provide stronger encryption and authentication methods.

RSNA stands for (Robust Security Network Association). RSNA requires (2) 802.11 stations to establish procedures to authenticate and associate with each other as well as create dynamic encryption keys through the 4-way handshake. *Note an access point is also a referenced as a station* The 802.11-2007 standard defines two classes of security methods pre-RSNA and RSNA.  RSNA security methods use either TKIP/RC4 or CCMP/AES.  This leads me to believe that WPA/TKIP is a RSNA as well. Although not under the RSNIE.

RSNIE stands for (Robust Security Network Information Element). RSNIE is the information element found in certain management frames. The purpose of this information element is to show station compatibilities. RSNIE can identify encryption capabilities and authentication type (802.1X/EAP) and (PSK)

NOTE: There are ONLY 4 types of 802.11 frames that contain the RSN Information Element (RSNIE). Remember (2) of these packets come from the (BSS) access point and (2) of them come from the station. The following FRAMES contain the RSNIE (RSN INFORMATION ELEMENT) when WPA2 / 802.11i is enabled on the BSS.

ACCESS POINT (BSS): BEACON and PROBE RESPONSE frames
CLIENT (Station) : ASSOCIATION RESPONSE and REASSOCIATION RESPONSE frames

Pre-RSN stands for (Pre-Robust Security Network).  A pre-RSN uses static or dynamic WEP keys. Anything WEP is considered Pre-RSN.  

TSN stands for (Transition Security Network).  TSN supports both RSN and  pre-RSN legacy authentication and encryption on the same BSS. Example – Think of WEP with  WPA and/or WPA2 enabled on the same BSS. Pre-RSN +  RSN = TSN

 Below is the RSNIE

RSNIE is enabled when you choose WPA2 (personal  (PSK) or enterprise(802.1X/EAP))

Example #1  WPA/TKIP  

Note WPA / TKIP is enabled on this BSS. The WPA information element is populated as you can see. Notice you won’t see an RSNIE.  

Example#2  WPA/AES 

Note WPA / AES is enabled on this BSS. The WPA information element is populated.  Notice you won’t see an RSNIE even though AES is enable. This is because RSN is WPA2 only.

Example#3  WPA2/TKIP 

WPA2 / TKIP is enabled on this BSS. The RSN information element is populated.  Note you don’t see the WPA information element, because WPA is not selected.

Example#4 – WPA2/AES 

Note WPA2 / AES is enabled on this BSS. The RSN information element is populated.  Note you don’t see the WPA information element, because WPA is not selected.

Example#5   TSN (Transition Security Network) WEP , WPA/WPA2 (TKIP/AES)

This is an example of a single BSS allowing pre-RSN (WEP) and RSN clients. This becomes beneficial when you want to migrate from WEP to a more secure wireless network such as WPA2.   

 

Safari Online: CCNP Wireless IAUWS Quick Reference Available

  

CCNP IAUWS by William G. Daniel is available on Safari Online!

You can own the entire book for only 3 tokens! Great cost savings... This is a great reference book and I highly recommend it if you are going for certifications or if you are deploying a WLC.

Chapter 1. Describing Regulatory Compliance

Identifying Wireless Vulnerabilities

Industry Standards and Associations

Regulatory Compliance

Segmenting Traffic

Configuring Administrative Security

Configuring the Cisco Secure ACS for RADIUS

Authenticating Management Users on TACACS+

Configuring the Cisco Secure ACS for TACACS+

Management via Wireless

Configuring Credentials for APs

Managing WLAN Controller and Cisco WCS Alarms

Configuring WCS Logging and Message Notification

Identifying Security Audit Tools

Cisco Spectrum Expert

WCS Security Reports

PCI DSS Compliance Report

Cisco Security MARS

Chapter 2. Secure Client Devices

Configuring EAP Authentication

Understanding the Impact of Security on Application and Client Roaming

Configuring Cisco Secure Services Client (SSC)

Troubleshooting Wireless Connectivity

Chapter 3. Design and Implement Guest Access Services

Understanding Guest Access Architecture

Firewall Rules and DHCP

Configuring Foreign and Anchor Controllers

Configuring Guest Access Accounts

Troubleshooting Guest Access

Chapter 4. Design and Integrate a Wireless Network with Cisco NAC Appliance Server

Introducing the Cisco NAC Appliance Server

Configuring the Controller for Cisco NAC Out-of-Band Operations

Chapter 5. Implement Secure Wireless Connectivity Services

Configuring Authentication for the WLAN Infrastructure

Configuring Management Frame Protection

Configuring Certificate Services

Implementing Access Control Lists

Implementing Identity-Based Networking

Troubleshooting Secure Wireless Connectivity

Troubleshooting Issues Using External Tools

Chapter 6. Internal and Integrated External Security Mitigations

Mitigating Wireless Vulnerabilities

Understanding the Cisco End-to-End Security Solutions

Integrating Cisco WCS with Wireless IPS

WLC: Carrier Busy Test

  

** UPDATE:  Carrier Busy is also enabled on a CAPWAP / LWAPP AP **

Back in the day when I couldn’t afford a spectrum or packet analyzer I would often use the next best free thing available. Its called the "carrier busy" test and it’s built into the Cisco Autonomous Access Point and can be used from a CAPWAP / LWAPP Access Point.

The carrier busy test will allow you to see what is going on in an environment from 50,000 feet, but that’s about where it ends. It doesn’t have details like a professional analyzer will provide. You could incorporate other commands like frame retries etc to help better interpret “carrier busy”.

Needless to say, it’s a fun command and if you don’t have the proper tools could help you in a pinch. If you do outdoor bridges, you may already use this command to assist on channel assignment.

What is "Carrier Busy"

On a Cisco autonomous access point you can run a command called 'carrier busy'. The AP will shutdown the respected radio interface and will scan all respected channels and report back with a percentage of channel activity. The channel activity collected includes activity from both 802.11 traffic and interference also sometimes called RFI (Radio Frequency Interference).

What this means, if there is 802.11 traffic and suppose there is interference it will compute a  (percentage) to this value. Things to note when you run the carrier busy test the radio will do a shut and all associated clients will lose connectivity between 5 - 8 seconds during the test. After the test the radio will no shut itself and return to production allowing clients to associate again.

I have not found any detailed documentation stating exactly how the access point computes these values. If you have any info please do share!

Autonomous Command for "Carrier Busy"

If your access point has both 802.11g <dot11Radio 0> and 802.11a <dot11Radio 1> radios you can run busy test on either the 2.4 GHz or the 5 GHz spectrums.

ap#dot11 <Radio Interface> carrier busy

ap#show dot11 carrier busy

802.11g = dot11Radio 0
802.11a = dot11Radio 1

ap#dot11 dot11Radio 0 carrier busy

WLC: CAPWAP / LWAPP Command for "Carrier Busy"

wlc-ap#debug dot11 <Radio Interface> carrier busy

802.11g = dot11Radio 0
802.11a = dot11Radio 1

wlc-ap#debug dot11 dot11Radio 0 carrier busy

Example # 1 - Carrier Busy (Normal)

This example is a neighboring access point on channel 11 only sending management frames

ap#dot11 dot11Radio 0 carrier busy

*Mar  2 09:07:33.173: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Mar  2 09:07:34.173: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down

Frequency  Carrier Busy %
---------  --------------
2412          0
2417          3
2422          0
2427          0
2432          0
2437          0
2442          0
2447          4
2452          5
2457          2
2462          5

*Mar  2 09:07:38.695: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar  2 09:07:39.695: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up

Example # 2 - Carrier Busy (Microwave)

 I introduced a microwave oven into the mix. You can see there is a significant increase in channel activity from 2447 - 2462. 

ap#dot11 dot11Radio 0 carrier busy

*Mar  2 09:05:52.664: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Mar  2 09:05:53.664: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down

Frequency  Carrier Busy %
---------  --------------
2412          1
2417          7
2422          5
2427          1
2432          11
2437          13
2442          10
2447          31
2452          36
2457          42
2462          45

*Mar  2 09:05:58.186: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar  2 09:05:59.186: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up

ap#

Example # 3 - Carrier Busy (ISO Download)

In this example I introduced 2 laptops and conducted an ISO download for the purpose of creating 802.11 traffic.

ap#dot11 dot11Radio 0 carrier busy

*Mar  2 09:07:33.173: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Mar  2 09:07:34.173: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down

Frequency  Carrier Busy %
---------  --------------
2412          0
2417          3
2422          0
2427          0
2432          0
2437          0
2442          3
2447          9
2452          19
2457          21
2462          23

*Mar  2 09:07:38.695: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar  2 09:07:39.695: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up

Conclusion

If you don’t have tools and you are in a pinch the carrier busy test may be a tool you might find helpful. Keep in mind, you will need to incorporate other commands to interpret the carrier busy results.

Safari Online: CCNP Wireless IUWMS Quick Reference available

  

Jerome Henry's CCNP IUWMS is available on Safari Online!

You can own the entire book for only 3 tokens! Great cost savings... This is a great reference book and I highly recommend it if you are going for certifications or if you are deploying a WLC.

Chapter 1. Implement Location-Based Services

Understanding Location-Tracking Techniques

Understanding the AP/Antenna Deployment Model for Location

Tracking RFID Tags

Tracking Wireless Clients

Tracking Rogues

Chapter 2. Implement Location Architecture

Understanding Mobility Service Engine and Location Appliance Architectures

Integrating the MSE or the Location Appliance to WCS

Configuring and Tuning the MSE or the Location Appliance

Integrating Third-Party Applications

Chapter 3. Implement Advanced Services and Manage with WCS and Navigator

Configuring Controller and AP Templates

Using Config Groups

Autoprovisioning

Supporting Autonomous APs

Scheduling Wireless Access

Configuring Administrative Tasks

Configuring Administrative Access

Configuring Reports

Using WCS Navigator

Chapter 4. Design WLAN Infrastructure for Mobility

Designing the Network for High Availability

Understanding and Using Best Practices

Understanding the Implications of Layer 2 and Layer 3 Roaming

Understand Single SSID Designs with Mobility

Chapter 5. Implement and Manage the Enterprise Mesh (Indoors)

Understanding Mesh and Its Benefits

Understanding Mesh Formation

Implementing Mesh

Configuring WCS: Mesh Focus

Chapter 6. Using Advanced Troubleshooting Tools

Troubleshooting AP Joining

Troubleshooting Clients

Location Troubleshooting

Special 6.0.196.159 WLC Build Available From TAC

  

Cisco has released a new Engineer Special for the 6.x WLC code; 6.0.196.159

You will have to request this code from Cisco TAC as you will not find this on CCO. Cisco TAC stated 6.x release is tagged as software advisory. They are not recommending this code and if you have it installed you should apply the latest Engineer Special release until the 6.x maintenance release is released. The 6.x maintenance release is expected end of July / early August.

If you have 6.x running today Cisco TAC has advised the following path:

1)      Down grade to 5.2.193.0 (ED)

2)      Upgrade to 7.0.98.0 (ED)

3)      Upgrade to 6.0.196.159 (ES) 

AS_4200_6_0_196_159 is a build from 6.0.196.0, and it is an engineering special that resolves the following additional caveats:

CSCta13941 - AP rejecting association request with status code 13

CSCtb02136 - AP with AP Groups and HREAP will not broadcast SSID

CSCtb20125 - CCMP errors on key rotation

CSCtc73503 - Radios are showing Tx power level 0

CSCtd28542 - WLC crash on emWeb due to AP config change

CSCtd97011 - Radio core dump: Neighbor Discovery frames stuck

CSCte19262 - Client Deauthenticated – “Unable to locate AP 00:00:00:00:00:00”

CSCte55219 - radio core dump due to large # of uplink frames in inprog queue

CSCte55458 - Web-Auth: Web page takes a long time to display under heavy load

CSCte62815 - 5508 not passing OSPF Multicast traffic

CSCte78472 - Invalid PHY rate returned on ADDTS response

CSCte81420 - Crash in process: "Dot11 driver "

CSCte89891 - AP doesn't transmit beacons

CSCte92365 - Auto Immune - AP side

CSCte93549 - The dot11a radio not able to pass traffic, tx queue getting filled.

CSCte96140 - Ethernet bridging breaks when the Ethernet interface of AP 1242 flapped

CSCtf23682 - 5508 - AP cannot join with Multicast MAC as gateway (checkpoint)

CSCtf34858 - Clients unable to pass broadcast traffic

CSCtf69598 - Memory leak in AP on CCKM Failure

CSCtc57611 - Delay in Music on Hold on 7925 with HREAP AP CSCtg45014 - CT5508 - CAPWAP Control traffic has incorrect DSCP marking.

CSCtg71658 - Ap power level reset to 0 when upgrading from 5.0 to 6.0.196.158

CSCtd43906 - J: RAP not transmitting after coming up; when shut due to radar

*ENGINEERING SPECIAL USE DISCLAIMER*

The Engineering Special fix supplied herewith is a Temporary Software Module which has undergone limited testing. This temporary software module is provided “AS-IS” without warranty under the terms of the END USER LICENSE FOR THIS PRODUCT. Please use this software at your own risk. The intention for this code fix is for you to use in your production environment until a released version is available.

Wifi client comparison to Apple’s antenna drama!

  

I want to take this opportunity to compare the obvious comparison of Apple’s antenna issue with the iPhone4 with a typical WiFi client analogy.

Apple released the iPhone 4 this week. There are early reports of antenna issues. Apparently the antenna design is flawed. Depending on how you hold the phone it could attenuate the signal. Steve Job’s  responded to emails , “just don’t hold it like that.” Way to go Jobs! This reminds me of the old analogy “A man goes to the doctor and says, Doc when I do this it really hurts. The Doc responds then don’t do that”.

Here is a classic example of a client issue. Customers reported issues almost immediately with cell reception with the new iPhone4. So what gives!? … They didn’t change the cell towers over night (access points)! Their phones changed (clients)!

If you read the reports they are using terms you as wireless engineer should be very familiar with, “attenuation, signal degradation, poor reception”. These are general terms we hear or use ourselves. Wireless is a 2-way communication. Often non wireless educated folks assume when there are issues it is the network and by this I mean the wireless access point or wireless infrastructure. They often don’t consider the wireless client.

I can think back to 2003’ish (or there around) when Intel released the Intel 2200b/g clients. This was around the time Cisco purchased Airespace. If you were in WiFi you surly remember this issue.

For those of you who weren’t, here is a quick recap. The Intel 2200 clients were flawed and were flawed for well over 2 months before Intel released a driver fix. The 2200 driver had big issues! When authenticated and in OFDM rates, Intel 2200 clients would not rate shift down to DSSS. As clients moved away from the access point the rate shifting stopped and the client would drop off the wireless. Of course back then customers always looked at the network. “Its got to be the AP”.  Especially the early adopters of the new Cisco/Airespace solution. Immediately people pointed blame at Cisco thinking there was an issue with the new controller solution they purchased from Airespace, which wasn’t the case.

Rumor has it Cisco did an assist with Intel with the replacement driver.

Fast forward to today…

WiFi engineers have more tools, training and hands on experience to quickly troubleshoot these issues. In fact, a good wireless engineer can determine if it’s a potential client issue with a quick wireless client capture and debug at the controller or AP. Manufactures of Wireless clients have also improved, especially Intel since they work closely with Cisco. You will find troubleshooting and diagnostics tools on the client side more today then ever before.

You have to remember wireless clients aren’t created equal. They all hear differently  (receive sensitivity) and have different transmit power levels and they all have their own operating behavior (when to roam, how they interpret signal strength, etc). Lets face it, some wireless clients are just crap.

Conclusion

If you are new to WiFi. Wireless clients have an equal part in the communication efforts and should be factored in when troubleshooting. In the case of the iPhone4 issue. The didn’t move the cell towers over night. The client changed!

Atheros sampling 450Mbps 802.11n Wi-Fi chipset

  

This is by John Cox from Network World. 

http://www.networkworld.com/news/2010/060210-atheros-wifi-chipset.html?page=1

Chip maker Atheros Wednesday released samples of its powerful new 802.11n Wi-Fi chipset, which tops out with a maximum data rate of 450Mbps for access points and routers, and a signal that's more consistent and resilient.

The 11n standard uses several innovations to boost data rate and throughput, and to maintain those higher levels consistently over longer distances compared to 802.11abg radios.

Like earlier Atheros 11n silicon, the new AR938x and AR9390 chipsets also have three antennas, part of a technology called multiple input multiple output (MIMO). With multiple antennas tuned to the same channel, the radio uses spectrum more efficiently, increasing overall performance. In addition, with multiple antennas on both ends of the send-receive chain, MIMO systems can recombine reflected signals to enhance them (otherwise these multipath reflections typically disrupt the signal).

Another part of the 11n innovation is using what are called multiple spatial streams, or distinct, separately encoded signals within a single spectral channel. Think of it as sending data in parallel: a lot more data in a given time or a given amount of data in much less time. The impact of multiple antennas and spatial streams is also affected by other optional techniques the vendor may implement. 

In the past, Atheros and most other Wi-Fi chip vendors have had at best a three-antenna configuration with two spatial streams, for a maximum data rate of 300Mbps. The new chips are Atheros' first to use three spatial streams, one for each antenna pair, boosting the rate to 400Mbps.

Atheros will offer the new 3x3 chipsets at a "similar price range" to the previous generation chipset, says Tony Hsu, senior director of product marketing for Atheros' networking business unit.

A couple of vendors are offering 4x4 MIMO radios. Quantenna Communications has such a product in trials with a dozen carriers, aiming at multi-media applications within a home. It's a development that emphatically makes sense, says Network World blogger Craig Mathias. 

The new products also include a range of 802.11n options, including transmit beam forming, which can be thought of as narrowing and focusing the radio signal to increase its range and decrease the impact of interference. Other techniques are Low Density Parity Check for much more efficient error-correction coding, and Maximum Likelihood equalization algorithms to demodulate the received signal with much greater accuracy than other methods.

Adding these techniques to a three-spatial stream chipset results in 50% greater range or up to 66% higher effective bandwidth, depending on the specific operating conditions, according to Atheros.

Apart from the raw increase in data rate and range, these kinds of advances also mean an improved radio environment for video and other streaming media. According to Atheros, its new 11n silicon can slow down the top data rate to reduce packet loss and latency, thus improving the quality of the video transmission. Other algorithms search for unused radio channels for the video stream. Atheros says the chipsets can support three simultaneous high-definition video streams.

The chipsets are available in sample quantities with full production due to ramp up in the third quarter.

Bugs: CSCtf34858 - Severity 1 - catastrophic (WLC Code Levels: 6.0.182.0, 6.0.188.0, 6.0.196.0)

  

Catastrophic isn't my words, but Cisco's.  Engineer's beware ...

Client can't transmit traffic if it reassociates to an AP within 20 sec

Symptom: Intermittently, when a client reassociates to an access point (within 20 seconds after having roamed away from that same AP), the AP will fail to forward any data received from that client, to the wired network. Other clients can associate to that same SSID on the same AP and work fine. If the SSID is configured to use encryption, then, at the time the problem is occurring, decrypt failures will be seen, when the following debugs are enabled on the affected radio: ap#no debug dot11 dot11radio0 print printf ap#debug dot11 dot11radio0 trace print clients keys Workaround: Resetting the AP radio, or rebooting the AP, can cause the problem temporarily to go away. This problem is not seen in 5.2.193.0 or earlier code, nor does it affect autonomous IOS APs. Base Code: 6.0.182.0, 6.0.188.0, 6.0.196.0 Special Build: Following options are available: 1.     Move to 7.0.98.0 Release posted on CCO. Please note, 7.0 is a new feature release. 2.     Contact TAC to get a 6.0 Special or Beta release with fixes for the bugs below.  3.     Wait for the CCO release of 6.0 MR3 (Maintenance Release), which is planned for July/August 2010  The code is designed for 2100 / 4400 / 5500 / WiSM / WLC3750 / WLCM This Software Advisory Notice is issued against all the above Wireless LAN Controller software versions due to the following bugs:

Cisco ACS Appliance / Solution Engine Not Responding to Pings??

  

I've always played with the Cisco ACS on Windows boxes, but I purchased a Cisco ACS Appliance / Solution Engine sometime ago. I didn't know at the time PING was disabled by default. Here is how enable ping response from the appliance / solution engine

The Cisco Secure ACS Solution Engine does not respond to pings like a normal, Windows−based Cisco

Secure ACS server.

 

The failure of the Cisco Secure ACS Solution Engine to respond to pings is the result of the rule set applied to the CSA installed on the appliance. In order to allow ping on your ACS Solution Engine, you need to disable the CSA.

This can be done via the System Configuration > Appliance Configuration menu.

 

 

There is an option to disable or enable the CSA. If you disable this agent, you can then ping the appliance