CHAPTER 5: Wireless Networking 176 Radio Frequency Behaviors The following radio frequency behaviors are important in your basic understanding of how wireless networks operate and interact with their environments. Gain and Loss Gain occurs when a signal has its strength increased, such as by passing through an amplifier. As you can see in the left-hand side of Figure 5.1, the lower wave represents the signal before passing through the amplifier and the higher wave represents the signal after passing through the amplifier. The difference in amplitudes between both signal strengths is the gain. Loss is the exact opposite of gain, and occurs when a signal has its strength decreased, either intentionally through the use of a device such as an attenuator, or unintentionally such as through resistance losses in a transmission cable. As you can see in the right-hand side of Figure 5.1, the higher wave represents the preloss signal strength and the lower wave repre- sents the wave signal strength after the loss has occurred. Reflection and Refraction Some RF behaviors are similar to those of light waves, such as in the case of reflection and refraction. As you can see in the left-hand side of Figure 5.2, reflection has occurred because our electromagnetic RF wave has impacted upon a surface that has a much larger cross-section than that of the wave itself. Many things cause reflection, such as doors, walls, floors, ceilings, buildings, and the curvature of the earth to name a few. Assuming that the surface being impacted is relatively flat and smooth, a large majority of the original signal will be reflected off at a different angle than the entry signal. FIGURE 5.1 Comparing Gain and Loss. Radio Frequency and Antenna Behaviors and Characteristics 177 Some signal will be lost due to absorption and scattering (discussed later in this chapter). Surfaces that are less smooth or flat will cause a larger percent- age of the original wave to be lost. The right-hand side of Figure 5.2 depicts the behavior known as refrac- tion. You’ve probably seen refraction for yourself if you’ve ever looked at a lake or pool of water. Refraction is a particular problem for long-range out- door point-to-point links due to changing atmospheric conditions, notably differing air densities due to changes in air temperature. When a wave is refracted, it passes through a medium and changes course with some of the original wave being reflected away from the original wave’s path. The longer an outdoor link is, the larger problem refraction could present. Absorption and Scattering As disruptive as reflection and refraction are, absorption and scattering can absolutely destroy an electromagnetic signal wave and prevent it from reach- ing its intended destination. At least with reflection and refraction, the sig- nal could still be received by the AP by chance. As you can see in the left-hand side of Figure 5.3, the RF signal has been completely absorbed because it has impacted an object that does not pass it on through any means (reflection or refraction). In this case, no signal is left and the data contained in it is lost. FIGURE 5.2 Comparing Reflection and Refraction. FIGURE 5.3 Comparing Absorption and Scattering. CHAPTER 5: Wireless Networking 178 The right-hand side of Figure 5.3 depicts the behavior known as scatter- ing. If you’ve ever played billiards, then you are undoubtedly familiar with this behavior. When an incoming electromagnetic wave hits a surface that is small compared to its wavelength, scattering will occur. This is the exact opposite of the effect of reflection. The resultant effect causes many lower magnitude waves to be sent off at various angles relative to the path of the original wave. Another practical example of scattering is the effect on satel- lite television during a heavy rain or snow storm; the incoming signal is degraded, and in some cases, completely destroyed, before arriving at the intended destination. Typical sources of scattering include trees, street signs, and atmospheric conditions. Antenna Characteristics Because antennas are a key element of any electromagnetic wave-based sys- tem, including wireless networks, you should also have a good understand- ing of some basic antenna concepts. We’ll examine the concepts of line of sight (LOS) and the Fresnel Zone in the next figure. An antenna, by its very design, is an amplification device. There need be no specific manipulation of the incoming signal to cause amplification to occur – this is a result of the shape of the antenna itself. When RF energy is tightly focused into a smaller beam, it becomes amplified. Different antenna types cause different shapes of output signals, and thus different amounts of amplification. LOS and Fresnel Zone Figure 5.4 illustrates another similarity that electromagnetic waves share with light waves – the visual LOS. With light waves, if a straight line exists, it’s implied that the LOS exists. Once you have LOS, the light waves will be able to travel from point to point. The same basic concept holds true with RF waves, with one exception; RF waves are also subject to a phenomenon known as the Fresnel Zone (pronounced “frah-nell”). When dealing with optics, visual LOS is enough to ensure good sig- nal transmission from point to point. With electromagnetic waves, this is not entirely true. Objects that extend into the Fresnel Zone, an elliptical region extending outward from the visual LOS, can cause signal loss through the methods we examine previously such as reflection, refraction, and scattering. FIGURE 5.4 LOS versus the Fresnel Zone. Fresnel Zone Line of Sight (LOS) Wireless Network Concepts 179 The actual mathematic processes needed to calculate the width of the Fresnel Zone at its widest point is not important to know here. The key thing to take away from this discussion is that blockage of 20 percent or more of the Fresnel Zone can begin to cause RF signal loss from source to destination. Many common objects that can be encountered in a point-to- point link can cause Fresnel Zone blockage, including buildings and trees. To overcome any blockage, you must either remove the object causing the blockage or raise one or both antennas in the link. WIRELESS NETWORK CONCEPTS This section covers some of the most popular wireless technologies used today for wireless networking. In the past 5 years, two wireless network technologies have seen considerable deployment: Wireless Application Protocol (WAP) networks and wireless local area network (WLAN) based on the Institute of Electrical and Electronic Engineers (IEEE) 802.11 speci- fication. These are not the only wireless networking technologies available, but are the most popular and must be understood to pass the wireless objectives on the Network certification exam. Overview of Wireless Communication in a Wireless Network Wireless networks, like their wired counterparts, rely on the manipula- tion of an electrical charge to enable communication between devices. Changes or oscillations in signal strength from zero to some maximum value (amplitude) and the rate of those oscillations (frequency) are used singularly or in combination with each other to encode and decode information. Two devices can communicate with each other when they understand the method(s) used to encode and decode information contained in the changes to the electrical properties of the communications medium being used. A network adapter can decode changes in the electric current it senses on a wire and convert them to meaningful information (bits) that can subse- quently be sent to higher levels for processing. Likewise, a network adapter can encode information (bits) by manipulating the properties of the electric current for transmission on the communications medium (in the case of wired networks, this would be the cable). Note A Fresnel Zone calculator is available at www.firstmilewireless.com/calc_fresnel.html. CHAPTER 5: Wireless Networking 180 Radio Frequency Communications The primary difference between wired and wireless networks is that wireless networks use a special type of electric current known as RF, which is created by applying alternating current (AC) to an antenna to produce an electro- magnetic field (EM). Devices for broadcasting and reception use the resulting RF field. In the case of wireless networks, the medium for communications is the EM field, the region of space that is influenced by electromagnetic radiation. Unlike audio waves, radio waves do not require a medium such as air or water to propagate. As with wired networks, amplitude decreases with distance, resulting in the degradation of signal strength and the ability to communicate. However, the EM field is also dispersed according to the properties of the transmitting antenna, and not tightly bound, as is the case with communication over a wire. Like the waves created by throwing a rock into a pool of water, radio waves are affected by the presence of obstructions and can be reflected, refracted, diffracted, or scattered, depending on the properties of the obstruction and its interaction with the radio waves. Reflected radio waves can be a source of interference on wireless networks. The interference created by bounced radio waves is called multipath interference. When radio waves are reflected, additional wave fronts are created. These different wave fronts may arrive at the receiver at different times and be in phase or out of phase with the main signal. When the peak of a wave is added to another wave (in phase), the wave is amplified. When the peak of a wave meets a trough (out of phase), the wave is effectively cancelled. Multipath interference can be the source of hard-to-troubleshoot prob- lems. In planning for a wireless network, administrators should consider the presence of common sources of multipath interference. These include metal doors, metal roofs, water, metal vertical blinds, and any other source that is highly reflective to radio waves. Antennas may help to compen- sate for the effects of multipath interference, but must be carefully chosen. Many wireless APs have two antennas for precisely this purpose. However, a single omnidirectional antenna may be of no use at all for this kind of interference. Another source of signal loss is the presence of obstacles. Although radio waves can travel through physical objects, they are degraded accord- ing to the properties of the object they travel through. For example, a window is fairly transparent to radio waves, but may reduce the effective range of a wireless network by between 50 and 70 percent, depending on the presence and nature of the coatings on the glass. A solid core wall can reduce the effective range of a wireless network by up to 90 percent or greater. Wireless Network Concepts 181 EM fields are also prone to interference and signal degradation by the presence of other EM fields. In particular, 802.11 wireless networks are prone to interference produced by cordless phones, microwave ovens, and a wide range of devices that use the same unlicensed Industrial, Scientific and Medical (ISM) or Unlicensed National Information Infrastructure (UNII) bands. To mitigate the effects of interference from these devices and other sources of electromagnetic interference, RF-based wireless networks employ spread spectrum technologies. Spread spectrum provides a way to “share” bandwidth with other devices that may be operating in the same frequency range. Rather than operating on a single, dedicated frequency such as is the case with radio and television broadcasts, wireless networks use a “spec- trum” of frequencies for communication. Spread Spectrum Technology Conceived of by Hedy Lamarr and George Antheil in 1940 as a method of securing military communications from jamming and for eavesdropping during World War II, spread spectrum defines methods for wireless devices to use to send a number of narrowband frequencies over a range of frequen- cies simultaneously for communication. The narrowband frequencies used between devices change according to a random-appearing, but defined pat- tern, allowing individual frequencies to contain parts of the transmission. Someone listening to a transmission using spread spectrum would hear only noise, unless his or her own device understood in advance what frequencies were used for the transmission and could synchronize with them. Two methods of synchronizing wireless devices are as follows: Frequency hopping spread spectrum Direct sequence spread spectrum Exam Warning Make sure that you pay close attention to the next couple of sections in this chapter, as they directly relate to the exam. Most of what you have learned to this point was background information to get you to the point where you can understand FHSS and DHSS. Make sure that you study the next sections carefully. Frequency hopping spread spectrum As the name implies, FHSS works by quickly moving from one fre- quency to another according to a pseudorandom pattern. The frequency range used by the frequency hop is relatively large (83.5 MHz), providing excellent protection from interference. The amount of time spent on any CHAPTER 5: Wireless Networking 182 given frequency is known as dwell time and the amount of time it takes to move from one frequency to another is known as hop time. FHSS devices begin their transmission on one frequency and move to other frequencies according to a predefined pseudorandom sequence and then repeat the sequence after reaching the final frequency in the pattern. Hop time is usually very short (200 to 300 µs) and not significant relative to the dwell time (100 to 200 µs). In general, the longer the dwell time, the greater the throughput and the more susceptible the transmission is to narrowband interference. The frequency hopping sequence creates a channel, allowing multiple channels to coexist in the same frequency range without interfering with each other. As many as 79 FCC-compliant FHSS devices using the 2.4 GHz ISM band can be co-located together. However, the expense of implementing such a large number of systems limits the practical number of co-located devices to well below this number. Wireless networks that use FHSS include HomeRF and Bluetooth, which both operate in the unlicensed 2.4 GHz ISM band. FHSS usually operates at lower rates of data transmission (usually 1.6 Mbps, but as high as 10 Mbps) than networks that use direct sequence spread spectrum (DSSS). Direct sequence spread spectrum DSSS works somewhat differently than FHSS. With DSSS, the data is divided and simultaneously transmitted on as many frequencies as possible within a particular frequency band (the channel). DSSS adds redundant bits of data known as chips to the data to represent binary 0s or 1s. The ratio of chips-to-data is known as the spreading ratio: the higher the ratio, the more immune to interference the signal becomes. If part of the transmis- sion is corrupted, the data can still be recovered from the remaining part of Note One megahertz represents 1 million cycles per second. The speed of microprocessors, called the clock speed, is measured in megahertz. For example, a microprocessor that runs at 200 MHz executes 200 million cycles per second. Each computer instruction requires a fixed number of cycles, so the clock speed determines how many instructions per second the microprocessor can execute. To a large degree, this controls how power- ful the microprocessor is. Another chief factor in determining a microprocessor’s power is its data width (that is, how many bits it can manipulate at one time). In addition to microprocessors, the speeds of buses and interfaces are also mea- sured in megahertz. Wireless Network Concepts 183 the chipping code. This method provides greater rates of transmission than FHSS, which uses a limited number of frequencies, but fewer channels in a given frequency range. Additionally, DSSS protects against data loss through the redundant, simultaneous transmission of data. However, because DSSS floods the channel it is using, it is also more vulnerable to interference from EM devices operating in the same range. In the 2.4 to 2.4835 GHz frequency range employed by 802.11b, DSSS transmissions can be broadcast in any one of fourteen 22 MHz-wide channels. The number of center-channel fre- quencies used by 802.11 DSSS devices depends on the physical location. For example, North America allows 11 channels operating in the 2.4 to 2.4835 GHz range, Europe allows 13, and Japan allows 1. Because each channel is 22 MHz wide, the channels may overlap each other. Of the 11 available channels in North America, only a maximum of three (1, 6, and 11) may be used concurrently without the use of overlapping frequencies. Wireless Network Architecture The seven-layer Open Systems Interconnect (OSI) networking model defines the framework for implementing network protocols. The OSI model is cov- ered in depth in Chapter 6. Wireless networks operate at the physical and data link layers of the OSI model. The physical layer is concerned with the physical connections between devices, such as how the medium and low bits (0s and 1s) are encoded and decoded. Both FHSS and DSSS are implemented at the physical layer. The data link layer is divided into two sublayers: the Media Access Control (MAC) and logical link control (LLC) layers. The MAC layer is responsible for such things are as follows: Framing data Error control Synchronization Collision detection and avoidance Note When comparing FHSS and DSSS technologies, it should be noted that FHSS networks are not inherently more secure than DSSS networks, contrary to popular belief. Even if the relatively few manufacturers of FHSS devices were not to publish the hopping sequence used by their devices, a sophisticated hacker armed with a spectrum analyzer and a computer could easily determine this information and eavesdrop on the communications. CHAPTER 5: Wireless Networking 184 The Ethernet 802.3 standard, which defines the Carrier Sense Multiple Access with Collision Detection (CSMA/CD) method for protecting against data loss as result of data collisions on the cable, is defined at this layer. CSMA/CD and CSMA/CA In contrast to Ethernet 802.3 networks, wireless networks defined by the 802.11 standard do not use CSMA/CD as a method to protect against data loss resulting from collisions. Instead, 802.11 networks use a method known as CSMA/CA. CSMA/CD works by detecting whether a collision has occurred on the network and then retransmitting the data in the event of such an occurrence. However, this method is not practical for wireless networks because it relies on the fact that every workstation can hear all the other workstations on a cable segment to determine if there is a collision. In wireless networks, usually only the AP can hear every workstation that is communicating with it (for example, workstations A and B may be able to communicate with the same AP, but may be too far apart from each other to hear their respective transmissions). Additionally, wireless networks do not use full-duplex communication, which is another way of protecting data against corruption and loss as a result of collisions. CSMA/CA solves the problem of potential collisions on the wireless net- work by taking a more active approach than CSMA/CD, which kicks in only after a collision has been detected. Using CSMA/CA, a wireless workstation first tries to detect if any other device is communicating on the network. If it senses it is clear to send, it initiates communication. The receiving device sends an acknowledgment (ACK) packet to the transmitting device indicat- ing successful reception. If the transmitting device does not receive an ACK, it assumes a collision has occurred and retransmits the data. However, it should be noted that many collisions can occur and that these collisions can be used to compromise the confidentiality of WEP encrypted data. Exam Warning 802.11 networks operate at Layer 1 (physical) and Layer 2 (MAC and LLC) of the OSI model. Note APs are also referred to as wireless access points. This is a more precise term that differ- entiates them from other network APs (such as dial-in remote APs), but in this chapter, we will use the acronym AP to avoid confusion with the WAP. Wireless Network Concepts 185 CSMA/CA is only one way in which wireless networks differ from wired networks in their implementation at the MAC layer. For example, the IEEE standard for 802.11 at the MAC layer defines additional functionality, such as virtual collision detection (VCD), roaming, power saving, asynchronous data transfer, and encryption. The fact that the WEP protocol is defined at the MAC layer is particularly noteworthy and has significant consequences for the security of wireless net- works. This means that data at the higher levels of the OSI model, particu- larly Transmission Control Protocol/Internet Protocol (TCP/IP) data, is also encrypted. Because much of the TCP/IP communications that occur between hosts contain a large amount of frequently repeating and well-known pat- terns, WEP may be vulnerable to known plaintext attacks, although it does include safeguards against this kind of attack. Wireless Network Protocols and Operation WLANs are covered by the IEEE 802.11 standards. The purpose of these standards is to provide a wireless equivalent to IEEE 802.3 Ethernet-based networks. The IEEE 802.3 standard defines a method for dealing with colli- sions (CSMA/CD), speeds of operation (10 Mbps, 100 Mbps, and faster), and cabling types (Category 5 twisted pair and fiber). The standard ensures the interoperability of various devices despite different speeds and cabling types. As with the 802.3 standard, the 802.11 standard defines methods for dealing with collision and speeds of operation. However, because of the dif- ferences in the media (air as opposed to wires), the devices being used, the potential mobility of users connected to the network, and the possible wire- less network topologies, the 802.11 standard differs significantly from the 802.3 standard. As mentioned earlier, 802.11 networks use CSMA/CA as the method to deal with potential collisions, instead of the CSMA/CD used by Ethernet networks, because not all stations on a wireless network can hear collisions that occur on a network. In addition to providing a solution to the problems created by collisions that occur on a wireless network, the 802.11 standard must deal with other issues specific to the nature of wireless devices and wireless communications in general. For example, wireless devices have to be able to locate other wireless devices, such as APs, and communicate with them. Wireless users are mobile and therefore should be able to move seamlessly from one wireless Exam Warning Make sure that you completely understand WEP and its vulnerabilities. WEP is discussed in more detail later in this chapter. . final frequency in the pattern. Hop time is usually very short (200 to 300 µs) and not significant relative to the dwell time (100 to 200 µs). In general, the longer the dwell time, the greater the. more immune to interference the signal becomes. If part of the transmis- sion is corrupted, the data can still be recovered from the remaining part of Note One megahertz represents 1 million cycles. the clock speed, is measured in megahertz. For example, a microprocessor that runs at 200 MHz executes 200 million cycles per second. Each computer instruction requires a fixed number of cycles,