Saturday, January 9, 2010

Confusing me is easy

TimeCapsule.jpg


Sometimes I am amazed at how confused I can get over WLAN configurations. What seems so straightforward and plain to me when I am advising someone else will appear convoluted and unknowable when it is my own configuration.

Take for example my own humble home network. Over the years it has evolved from a single Apple Airport (Graphite) Base station and a laptop back in 1999 which I still own to my rather complex hodgepodge of multiple networks I have today.

Apple AirPort Logo


Today I have 3 networks which I have re-architected many times based on my own changing needs. One for media (music and in the future, Apple TV), one for testing and one for primary wireless access.
Apple Airport Express


The network used only for music (AirTunes is Apple's name for it) consists of one Apple AirPort (Snow) Base Station on my Ethernet LAN and several AirPort Express wireless repeaters scattered liberally throughout my home attached to stereos and speakers here and there. The purpose of these are, as I already mentioned, is to provide me with ubiquitous and simultaneous music. They are all on channel 1 (2.412 gHz) so as to avoid the old Sharp Carousel microwave oven which would normally destroy my listening enjoyment when it is running if the network would use channels 5 to 13 (2.432 - 2.472 gHz). Happily this network has an option set that will not permit Clients (STAs) to attach to it and in fact does not appear on my AirMagnet WiFi analyzer except as actual 802.11 packets. The APs themselves are invisible to network scanners like Netstumbler and others unless you actually do packet analysis. Lastly it is encrypted with WPA2-PSK and is configured for 802.11g only with a 5.5Mb/s muticast rate so the music will play without skips or misses as it streams from my music server.
.
3CF61E2B-81F6-4D0D-8D45-E8B8EE894AFF.jpg


The testing network changes constantly and has AirMagnet Sensors and the Meraki nodes on it. You may have seen some of my previous posts about Meraki's cloud based wireless solutions. Very cool indeed
C2513B20-A57C-4D8C-A613-BD6ECF336857.jpg


Now onto the primary network and here is where I got confused. You see, originally this was an 802.11b/g network using that old AirPort (Snow) Base Station. However, as a WLAN engineer I felt it important to have an 02.11n network in place but was worried about interference. This would be both co-channel and adjacent channel interference from other wifi devices as well as non-wifi interference from cordless phones, Bluetooth and my dreaded microwave oven. So I purchase the Airport Extreme Base Station N.This device supported both 802.11a/b/g and Draft N standards, it had Gigabit Ethernet and a port to connect a USB hard drive for NAS. However, I was extremely disappointed to learn that this device would only work on either 5gHz or 2.4gHz not both simultaneously. I wanted both at the same time. C'est la vie. I put the AP in place and started to have issues with the configuration right away. You see, I wanted to use the older Express devices as wirelessly connected repeaters as I had the the other AP but after 2 weeks of trying I could never get them to work so I figured that Apple must want me to upgrade them to the newer N model, however I was reluctant as there was nothing wrong with the ones I had. I chose to live with it the way it was.

Luckily for me Apple introduced a Simultaneous Dual Band version within a few weeks of my purchase and I was able to exchange mine for the newer model. This turned out to cause a new problem when I noticed that it was dropping client occasionally and had to be rebooted once or twice a week. I was perturbed and figured the problem was me or my configuration. I twiddled the settings a few times and changed the firmware but had limited success resolving my issues. I did notice that the Ethernet connectors were always loose no matter how firmly I inserted them but could not positively determine if this was the issue. Also, I suspected my aging ZyXEL DSL router to be a culprit but again could not reproduce the problem to my satisfaction. I just could not believe that it was an Apple product control issue. My internal standard for Apple's Quality control was very high after years and years of experience with their products. Finally, after awhile (2-3 moths) I grew tired of trying to fix it and gave up and just informed my family to reboot the Internet Router and the Airport if they couldn't access the Internet. To quote Julia Child, "This always works."

After a few months and independent from these issues, we decided to invest in a backup solution that was more comprehensive that the piece meal attempts at backup we were doing today. The consensus was to go with Apple's TimeCapsule as I had heard from others on how well it performed. For all intents and purposes it was identical to my current AP but with internal Hard Drive and Power supply so I was a bit trepidatious but gave it the green light. We purchased the product. Configured it in about 15 minutes and replaced the Simultaneous Dual-Band AirPort Extreme N Base Station and low and behold, all my problems went away! I was amazed and decided that 8 hours was not long enough for testing. 2 weeks later it is still going strong. I had found the weak link, or had I?

I repurposed the Slightly older AirPort to my boudoir/office and never had a problem again with either connections. To this day I am at a loss to explain it. Some combination caused the problem, once separated however, the problem disappeared.

You see, sometimes I get confused.



Labels: , , , , , ,

Thursday, April 23, 2009

Maturation of the WiFi Market

blanket.gif

I think we are reaching a stage where people are actually starting to depend on their wifi networks the way they do their wired ones. They expect blanket coverage everywhere. Network Admins are starting to actually trust these networks now as well.


How did I reach this conclusion? Well, I was told this by a very large healthcare organization. This company has over 60 thousand employees and hundreds of locations. I was teaching a class in WLAN management when a couple of router guys chuckled in the back of the room. You see, to them wifi was a part time gig. They managed the core. I would have said something however, I never had to. Another attendee, a real leader in the group, took over and said, "You wired guys want to chuckle but let me tell you, moving forward, wireless networking will be the primary access method for all new connections and applications."


I was stunned as this was a pretty hefty statement to make in front of a vendor (me).


And this is not the only place I heard this. I was recently at the headquarters for a major media company. I mean really major. The WLAN Admin Exec. said almost the exact same thing.


Are we reaching a milestone? I think so. I think mobile devices are pushing this forward. It was all fine and good that companies provide wifi for big ol' laptops but when people have an iPhone in their pocket and are surfing the web non-stop round the clock... Well, let's just say, people can get pretty demanding for something they never had before but are getting used to using everyday.


To illustrate my point, please watch this comedian from the Conan O'Brien show. His name is Louis CK and he is spot on. If you are impatient, tune to 1:55 for the particularly poignant part.






Labels: , , , , ,

Monday, February 9, 2009

How to find a WiFi antenna?

Finding the right Wifi Antenna is a pain in the connector. When I meet with WLAN managers the most often asked question about antennas is, "Where can I get one that is camoflaged or hidden in some way?" Most antenna sales or manufacturers websites are really bad. Either these websites haven't been changed since 1997 or the are broken or just plain unusable.

I get a lot of requests for sources of antennas. Not high gain, site to site antennas. Not parabolic or Backfire. Not a 4 foot long ultra-high gain omni.

All the requests I get are for one simple thing. A disguised antenna. This could be an antenna that looks like a smoke detector, an alarm light, a speaker grill or anything except a wifi antenna. In almost every case the antenna must do 2.4GHz and 5GHz. More recently it also must do 802.11n.

How hard is it. I am pretty good at Google but I have a real hard time finding one. Everytime I look I get pages that look like this:

Now why is that? I searched for "camouflaged WLAN antenna" and I get the above. When what I want is this:
Anyway, here a short list of websites I have fouond for wifi antennas. If you have a better resource, especially for camoflaged antennas, please post a comment.



Labels: , , , ,

Saturday, April 12, 2008

Cease and Desist!

My ISP (Speakeasy) sent me a nice letter recently informing me the Eurpopean Union's copyright infringement division was displeased with me. The said that based on these allegations, I would be in violation of the Speakeasy Acceptable Use Policy. "How can that be?", thought I. I buy my music on iTunes, I do not partake in bittorrent, limewire or any other version of the now dead Napster (old school version not the new subscription based system) music/file-trading system Hell, I pay for stuff!. I have encoded all my purchased CD's and boxed them away but I keep them to myself. In fact I am a true supporter of "legitimate" digital music use via iTunes or any other service that, in some way, supports the artisits that create the music I love. This includes freely distributed music a la Radiohead.

So why was the European Union comin after me? Speakeasy's Tech Support and Security groups were very helpful in pointing out to me that they could track streams of file sharing originating at my IP address. So I thought deeply about this (for 2 seconds) and arrived at the most logical conclusion. My neighbors were connecting to me via Free The Net, the Meraki based San Francisco free wifi network and uploading/downloading music to their hearts content. I have 2 repeaters on my roof and 4 others in houses nearby providing firewalled access to the Internet. This made me sad. I was very pleased to provide an un-asked for service to my neighbors who may not have - or may not be able to afford - Internet access. I wrote to Meraki explaining my dilemma and asked of there was someway to restrict my neighbors from conducting file trading on my network.
People in my hood are sharing music over my wireless network and
abusing my speakeasy acceptable use policy. Speakeasy.net has warned
me that any continued abuse will result in disconnection of my
service. Therefore I must inform you that unless you can lock it
down so only port 80 is being used I will have to disconnect the
Meraki repeaters and access points from my network.

I am very sorry. This seems like a real shame. I was very eager to
participate in "Free the Net" but now I am a bit saddened that folks
are abusing it.

Please get back to me and let me know if there is anything you can do
on your end.


They replied back with...

Hey Bruce,

grr. that's really irritating. but actually what's surprising is that
we haven't had to address this issue so far. as far as blocking
everything but port 80: I don't think any of us would be happy with a web-only Internet connection, so that doesn't seem like a good answer. to me it seems the real solution here would be to figure out who the culprit is and block them.

I looked on your gateway and didn't see anyone transferring an
inordinate amount of traffic. do you happen to have any idea who it is? do you know if it is bittorrent they are using? maybe they are using a different gateway at least part of the time (probably mine, hehe).

next week I guess we can figure out how to set up the right counters on your gateway so that we can figure out who it is (any insight or additional info you can provide would obviously be super helpful). hopefully Speakeasy can wait that long. if you need to unplug, we understand, but leaving your repeater plugged into power would at least soften the blow.

ugh,
So far they have found no way to track or stop the activity and I love my Speakeasy service. So I have no choice. Until such a time as I can trust my neighbors not to conduct activity that the European Union deems as illegal or until Meraki finds a way to filter this traffic out, I must disconnect my network from "Free the Net". I still have repeaters on my roof but they are no longer connected to my network, file traders now siphon off some other guys pipe or tube or truck that backs up and unloads Internet.
Comments and suggestions, as always, are very welcome.

Labels: , , , , , , , ,

Thursday, November 1, 2007

WiFi Enabled Bag!

OK, Admission. The previously lauded WiFi enabled Shirt SUCKED! It had this big plasticky velcro'y patch on the front. I just couldn't wear it. I thought it would be more integrated. So...

My wife the genius (BTW, she is a geek, too. She really wanted me to order her one. So I did). She takes one look at her shirt and says, " I am not going to wear this but I have an idea."



She tears the shirt apart and buys herself a new bag/backpack/purse. She cuts a hole in the front of the bag for the cable. Sews the felt backing used to secure the velcro to the front of the bag. Puts the battery pack and cable into an internal pocket and away we go. WiFi enabled bag!!!


This is way more cool than the lame shirt. Now she carries this to work proudly, letting all around her know if they can surf via WiFi or not.

Labels: , , ,

Friday, October 5, 2007

WiFi enabled shirt?!!!

As if some geeky clothing designer and an Uber-RF-Nerd had a dorky lovechild, ThinkGeek has launched the first WiFi enabled SHIRT!!!



I am not kidding. this a a wearable WiFi detector that illustrates the strength of the WiFi signal with glowing bars and antenna and the words, "802.11" underneath.



I cannot wait to wear this to the next, "I can't get a date with nobody/Star Trek/D&D/comic book/video game/networking convention"



Look, Drool and count the days till it is released.




Labels: , , , , ,

Monday, July 30, 2007

The Myth of the Self-Monitoring WLAN

Recently, as you all probably know by now, Duke University had a WLAN meltdown. The CIO, Tracy Futhey (Comment here) and the assistant IT director, Kevin Miller (Comment here) have put to rest the notion that the Apple iPhone caused it. Cisco has issued an advisory to the effect and Apple assisted in the effort.



I am not going to go into the details of what happened or why. Suffice it to say that mobile handhelds of all types, not just iPhones, send a lot of ARP traffic and the Cisco infrastructure was not ready for it. The quote at Network World explains that, "The advisory finally makes it clear that the iPhone simply triggered the ARP storms that were made possible by the controller vulnerabilities. Any other wireless client device, moving from one subnet to another apparently could have done the same thing."



What I will point out, however, is the problem we in the Wi-Fi community have today with the following simple delusion, "Your WLAN infrastructure as a cohesive, integrated, single-vendor solution is all anybody needs. It is self monitoring and self healing." I talk to a lot of people about which WLAN solution they are going to purchase and implement and I am always surprised by how many believe that the AP and controller vendor has all the answers. Don't get me wrong, I am a huge fan of this type of solution. Central management is critical for even medium sized organizations of 50 or more APs, much less larger ones that may a few hundred or even thousands. Manually changing the configuration of each AP is not a viable solution in these cases. The Admin needs assistance. And the story sounds so great, "Implement our solution and it will fix itself when it breaks and protect itself when security policies are breached." Who wouldn't want that?



But the truth is a little more complicated. As we have seen from previous posts, sometimes the solution doesn't behave the way your business practices need. Similarly, sometimes there are security problems within the infrastructure itself. So what to do?



This will sound like an advertisement for the company I work for and I apologize ahead of time but there is a very good reason I continue to work there. Mainly, I believe in the message.



When the Duke network went down and the Assistant IT director looked at his WLAN infrastructure dashboard, what did he see? I have not spoken with him directly but my guess would be it said, "hey man, it ain't me. Everything looks good from my end" So what did he do? he pulled out a sniffer and got to work. With packet traces in hand and assistance from Cisco and Apple he solved the problem. Did the infrastructure fix itself? Did it correctly identify the problem and solution? No. A patch is now needed to keep this from happening again.



One should not blame the infrastructure for not getting this right at the outset nor should one blame Mr. Miller. He was correctly reading what the controllers were telling him. But it shows how important it is to have a separate, 3rd party solution also available to get down to the bits and bytes or even spectrum analysis (if the problem should be something other than 802.11 protocol madness.)



There are a few great WLAN security vendors out there and they make 3rd party, best of breed solutions for monitoring the security of your WLAN (one of which recently got snatched up pennies on the dollar and will probably be rolled into another integrated, self-healing, self-monitoring role; against my better judgment.) There are an even smaller number who both monitor your security and your connectivity and performance and give you great troubleshooting tools built-in (insert shameless plug here). These should be your trusted advisor's when things go wrong. I am in no way suggesting that they would have identified the problem and cause and given a solution at Duke either (although I think they at least would have shown alerts for denial of service and strange traffic behavior.) What I am suggesting is that with them in place you now have a set of tools to assist in solving the problem. Remote packet and/or spectrum analysis. Alarm thresholds that can be set by the admin and will continue surveillance. Reports. System-to-system notifications. Graphs of speed and traffic type. Lists of who is connected to what and how. All the things you would need to get to the bottom of any problem in that invisible Luminiferous Ether.




Labels: , , , , , , , ,

Friday, July 27, 2007

Cisco Ripples - DCA and RRM - Help is on the way

Since I first published " The Ripple Effect" back in February I have heard from many folks who have validated the effect but to my chagrin, I have had no solution to offer. Well thankfully there are smarter people than me out there and solutions have started to appear.



I was alerted to the fact that Medical Connectivity consulting recently put Cisco in their sights and quoted my blog with regard to Dynamic Channel Assignment and RRM causing issues. The Web, being the great time waster that it is, lead me on a journey. As I read the article I clicked here and there and next thing I knew I was looking at a forum at Cisco that was talking about this exact phenomena.



One of the forum posters had some great suggestions to eliminate this problem in the future. Bruce Johnson at Partners Healthcare offered this solution,



"We saw the majority of DCA events were triggered by Interference from Rogue APs. After we disabled Foreign AP Avoidance the number of channel changes dropped by an entire order of magnitude (1000s to 100s). We disabled Cisco AP Load Avoidance and this reduced the number of DCAs within an order of magnitude (100s less).



DTPC will power-up APs to max levels to provide a 3-neighbor -65 RSSI coverage "grid" and 7921s will power up to follow suit (up to their max Tx Power). Other clients with higher Tx power may send the APs to max power causing a mismatch with IP phones.



You can decrease the tx-power-threshold so the "grid" won't be as hot (default is -65, change to -71 or -74):



config advanced 802.11a tx-power-control-thresh <-50 to -80>
config advanced 802.11b tx-power-control-thresh <-50 to -80>



and reduce the coverage hole detection threshold (reduce Min SNR level in RRM Thresholds) to suppress the power-up activity."

Bruce seemed on track with this fix. the problem is that it isn't a fix. It shuts off the RRM and DCA so that the WLAN would remain stable. So where is the benefit of a controller based system?



He does note that a fix is forthcoming from Cisco, "They are revamping the behavior of RRM in the WLC 4.1 Maintenance release." Which is later confirmed by a Cisco employee, Saurabh Bhasin a TME,



"With the 4.1 Maintenance Release(MR) due out on cisco.com shorly, many improvements based on such feedback have been brought into RRM's algorithms ? improvements aimed at allowing administrators to fine-tune their RRM-run WLANs where desired. These enhancements will allow for greater control over both the channel and power output selection algorithms, so administrators may assist RRM in being either more or less aggressive in such decisions, depending on application and network needs. Additionally, enhancements have been made to the management and reporting of all RRM information and configuration alterations to allow for better tracking of RF environmental fluctuations and to assist in keeping track of RRM activity. Further technical detail on the inner workings of these enhancements will be available very soon in an update to the above-mentioned RRM Whitepaper."
The paper he references is found here http://www.cisco.com/warp/public/114/rrm.html and explains a lot of what we are all seeing. (here is the PDF version)



So here is to hope that WLC 4.1 Maint. Rels. fixes it. As an aside, Bruce Johnson is skeptical,


"Its all well and good to make things work for Intel and the CCX/CCKM compliant crew, but if you have any of the other brands of WLAN NICs (like those made by medical device manufacturers, who won't subscribe to fast roaming features until they're adopted by the IEEE) you are best keeping RRM disabled until it delivers on its promise as stated in the following 802.11TGv Objectives draft:

Service and Function Objectives

Solutions shall define mechanisms to provide the service listed below.

[Req2000] TGv shall support Dynamic Channel Selection, to allow STAs to avoid interference. Solution shall be able to change the operating channel (and/or band) for the entire BSS during live system operation and be done seamlessly with no intermittent loss of connectivity from the perspective of an associated STA. Solution shall not define algorithm for channel selection."

Labels: , , , , ,

Thursday, May 3, 2007

Meraki - Staunton, VA

Another great grass roots wifi project is being lead by a group of folks out in Staunton Virginia. With 19 nodes up as of today, the 3rd of May, it looks like it is doing well.



Again, I must say, citizens and grass roots efforts beat out commercial or governmental efforst all the time. Less bloat, less waste. These efforts are similar to the way we as world citizens take it upon ourselves to act responsibly on the road, or by taking the effort to recycle our bottles and cans. It is also parallel to the user created content wave sweeping the Internet. Not only do we want to get news and opinion our own way we want to get services our way too. And just like we don't mind spending some of our time to create that content we do not mind spending some our time and bandwidth to add wifi services.



Drop in on Staunton VA and take a look at http://www.stauntonwifi.org/ and let them know what a great job they are doing!


Labels: , , , ,

Friday, April 20, 2007

My Meraki Mesh Node - Update

Meraki is a pretty cool company. I don't say that just because I am some bleeding heart liberal (even though I am) and they have a rather humanistic desire to get inexpensive Internet connectivity out to "the next billion people". Nor do I say it because they like to be polite network citizens and not go for the capitalistic jugular. But also because they have their head in the right spot and treat people decently and still make money doing it. nice. Liberals want to get rich too!



Not long after getting the free (as in "beer") Meraki node set up I purchased two new minis. I purchased these to learn about how they work and for fun and to "hack-on". I mean, heck, they were pretty inexpensive. Soon after I put these nodes up using the same SSID as Meraki's project so they would associate to it and I gave them to my neighbors. At this point Meraki contacted me. I guess they were monitoring the "Free the Net" WLAN and they sent the following note...



Hi Bruce,



We noticed that you ordered a couple of Meraki Minis and have set up your own network with the name "Free the Net". We are very psyched that you're so motivated and excited to help out with the project, and we'd love to help out. :) For starters, you definitely don't need to spend your own money, we'd be delighted to provide Minis for any of your neighbors who you can get involved. We would also really love to have the repeaters in the "Free the Net" project be in our existing network in Dashboard, so that they'll all show up on our one network map and we can see the aggregated usage numbers and all of that in one place. I totally understand that as a WiFi guy you'd probably like to play around with Dashboard some yourself -- could we offer to send you a couple more Minis to play with, and let us add your neighbors' repeaters to our existing network?



Thanks a bunch, and again, we appreciate your help with the project!



What great folks! A few days later 2 more nodes showed up and now I have two to "Play" with and two that will soon be migrated to the "Free The Net" project. I have all four up now on a new SSID and when I attach my laptop to them I get a nifty splash page from Meraki. This is of course because my new mesh of 4 (lets call them "Unchained") automatically saw another Meraki node ("Free The Net") and linked to it. as an aside, I think, if I plug one of my "Unchained" nodes into my Internet connection they will dis-associate from "Free The Net"




Now here is the real surprise, After you click the, "Take me to where I was going" link you get a new bar at the top of your browser window that scrolls advertising for local businesses. Now, I have no idea if these businesses are paying for this. I assume they are, but who knows. But think of the revenue opportunities.


The bar is very discrete. Thin and lean. the rotating text ads are very low key and I didn't even notice it for quite a few days. Also there is a request for input in a box if you click the "?" icon.


Lastly, there is a "search local" box that allows you to search for businesses and other stuff in your local area based on your Latitude and Longitude (actually, the Lat Long of the node you are associated with). Very hip.


The Result then takes you to a Google Local page. Nice.


All in all, when you add this idea and the strategy to get a percentage of money that Meraki makes off of your monetizing you own mesh hotspot, the large orders of nodes going to other cities and countries desiring a quick and easy way to get their citizens connected to the Internet and the fact that Google buys Meraki nodes to extend their mesh into peoples homes and businesses, Meraki is poised to pay off that Sequoia investment in nothing flat.


Labels: , , , ,

Friday, March 30, 2007

Meraki - Dallas freenet


Entrepenuership in action. If you want to see how another mesh deployment is going, cruise on over to http://www.dfwfreenet.org/ and see how they are doing. they have a great wiki and a node map up and running. So far they only appear to have 5 nodes up and running but I could see this going big. Support them by laying out a measeley $49 bucks for your own node and go to town!

Labels: , , ,

Meraki Node - Management Details

The Meraki mesh node I got has been up for a week now and here are my thoughts. Well, first of all, It is pretty neat. 'nuff said. I had some questions that I posed to Ben Chambers of Meraki and here are the answers.



The first thing I wanted to know was why it beacons every 500ms instead of 100ms. Twice per second did not seem very much and considerably off the norm. Ben stated that, "As far as the beacon interval goes, the reason is basically that if you have a fairly high number of repeaters (say, 20) within range of each other, 10 beacons per second per node gets pretty excessive." This makes total sense to me.



The next question was whether there was a way to configure the node or at least monitor it. I was told that because it was a free node belonging to the Meraki "Free the Net" project I would not be able to configure it but I would be able to monitor it in a variety of ways:



1. I can see if it is up by associating with it and browsing to http://my.meraki.net/ where I would see a splash page. Click on each image to see a larger version of the image.
2. I can Select the "Advanced" link in the upper left and get a page that lets me run a throughput test to the internet.

3. I can select another link on the advanced page that allows me to set a static IP and some other functions.

4. I can also get to a page that is just for my repeater at http://sf.meraki.net/myrepeater/00:18:0a:01:10:b3 which looks like this:

5. I can also get more data from a more public view of the Meraki network from this URL http://sf.meraki.net/overview which shows me connected to another mesh node way over in Potrero Hill, at least a mile away.


6. I was also pointed to a site where there is XML data for Google earth. http://sf.meraki.net/earth . You must save the source as a KMZ file on you hard drive and open in Google Earth.

After which, it now looks like this in Google Earth. Notice the mesh links (I made them yellow, the better to see them with.)

Which now allows me to go down to sea level and see the line of site to the other link

Pretty impressive. My next step would be to get some Meraki Minis and connect them to the mesh and see how they work out. More fun for next time :-) Talk to you then.





Labels: , , , ,

Monday, March 26, 2007

My Own Mesh Node - Meraki comes through!

Here is the view from my roof of downtown San Francisco. Looks like a good place for a Mesh Node!


Last Thursday, Ben Chambers and Jessica showed up on my doorstep from Meraki Networks with APs in hand. I was psyched! We were about to hook up an outdoor node to the Meraki San Francisco trial.

They brought over a Meraki outdoor AP, a toolbox and a lot of cable and got right to work. We went up on the roof to check it out and find a spot to put it. Then we went indoors and talked about how/where to bring the cable in. The unit is powered by a proprietary POE (Power over Ethernet) injector which I plugged and hooked up to my switch.


Ben went back up onto the roof and connect the AP to a plumbing vent pipe. It came with what appears to be a 12dbi antenna (I will check and get back with the details).


It got link and pulled a DHCP address from my home router and started broadcasting the SSID FreeTheNet and we were done.














We chatted awhile and then they left. The were super nice and obviously loved their jobs. Later the unit started upgrading itself and is now running a newer OS than what it originally had. I checked that evening and found I was up on the website at http://sf.meraki.net/ but unfortunately none of my neighbors had a Meraki node close enough to attach to mine. I am going to drop in on Ritual Coffee later this week and get them to join the network as well as some of my neighbors.



Labels: , , ,

Saturday, February 3, 2007

The Ripple Effect - Problems with Cisco’s Radio Resource Management (RMM)

Introduction:

In its Unified Wireless Network architecture, Cisco has developed patent pending technology for dealing with interference detection and avoidance, dynamic channel assignment, dynamic power adjustment, coverage-hole detection and correction, rogue detection and client load balancing. This system is known as RRM or Radio Resource management. The stated goal of which is to avoid problems in the fixed ISM band of 802.11b/g where only 11 channels are available to U.S. WLANs. This system, though sound in theory, has problems when applied to large WLANs in urban areas or locales that have heavily deployed WLANs such as Metro WiFi, skyscrapers, hospitals, universities and businesses near residential neighborhoods.

Background on Channel Overlap:

Anyone who has configured their own home access point (AP) knows they are allowed to choose a channel for the AP to transmit on. Since APs use Dynamic Spread Spectrum technology they actually utilize 5 channels per AP.

If an admin were to configure APs to use all channels in the 802.11b/g spectrum, a serious decrease in available bandwidth would occur and users would experience sever throughput loss. Thus an admin is restricted to only configure his/her APs to 3 non-overlapping channels; 1, 6 and 11. In some cases an admin may opt, out of necessity, to go for a slight overlap and configure a 4 channel plan consisting of channels 1, 4, 7 and 11.

WLAN planning and Site Surveying:

Administrators need to then plan out their deployment so that each AP avoids overlapping its coverage with another AP on the same channel. APs must have their power adjusted to compensate for walls and coverage gaps that may ensue when a building is not a standard rectangular shape or when neighbors move in and configure their AP on a channel used by the organization the admin works for. This adjustment in power may increase or decrease the size of the cell of each AP and the additional adjustments to all the other APs will now be needed. Lastly, the admin must plan for areas where usage may change very dynamically such as in conference rooms and auditoriums. As one can see, this is really an art and a whole industry has evolved around designing wireless networks. Usually a Site Survey is needed to map out the existing neighbor APs as well as to plan where to place and map the new APs. Surveys are also recommended from time to time to adjust to changes that may happen around the organization as well as within it.

Cisco's Solution:

The Cisco Unified Wireless Network (UWN) architecture hopes to avoid this problem by sensing the types of problems that occur in WLANs and automatically compensating. Problems such as:


  • A neighbor moving in next door or upstairs and implementing APs that overlap yours
  • Coverage gaps that occurs when walls, cubicles and other furniture are moved, added or removed
  • Loss in throughput when people, who are 78% water, move around in a company and group together in conference rooms or other areas (water attenuates or "blocks" radio waves)

Cisco has a brief description on their website at HERE and a much more in depth description HERE

On that second page Cisco describes how this works under the section entitled, "Radio Resource Monitoring"

Management of an RF network requires strong visibility into the factors affecting the air space. Cisco lightweight access points are specially designed to not only offer service, but to also monitor all channels at the same time. This is a result of the extensive development work Cisco has performed on the 802.11 MAC layer as part of its split MAC architecture.

In addition to offering service, Cisco lightweight access points can simultaneously scan all valid 802.11a/b/g channels for the country of operation, as well as for channels valid in other geographies. This provides the highest level of protection-the system will discover rogue access points that might be imported from other countries, or a hacker that knows how to change the country of operation such that the rogue would be out of band and not detected by most WLAN intrusion detection systems (IDSs).

The Cisco lightweight access point goes "off-channel" for a period not greater than 60 ms to listen to these channels. Packets collected during this time are sent to the Cisco Wireless LAN Controller, where they are analyzed to detect rogue access points (whether service set identifiers [SSIDs] are broadcast or not), rogue clients, ad-hoc clients, and interfering access points.

By default, each access point spends only 0.2 percent of its time off-channel. This is statistically distributed across all access points so that adjacent access points are not scanning at the same time, which could adversely affect WLAN performance. This enables administrators to build a picture of what is happening in their WLANs from the perspective of every access point, and increases network visibility beyond what an overlay network can provide, eliminating the "hidden node" problem that can result when air monitors are deployed for every three to five access points.

I will not debate the issues around part time scanning in this article; many others have addressed that already. But I will address the next issue which is how Cisco responds once it has discovered any of the aforementioned problems.

When a station has something to say, it announces it to the media. An access point will allow the station to send its data if the medium is open. If not, the station will be told to wait to transmit until other stations using that medium are finished with it. This prevents two clients from transmitting on the same channel at the same time, which would result in corrupted frames.

With CSMA/CA, two access points on the same channel (in the same vicinity) will get half the capacity of two access points on different channels. This becomes an issue, for example, when someone reading e-mail in a café affects the performance of the access point in a neighboring business. Even though these are completely separate networks, someone sending traffic to the café on Channel 1 can cause data corruption in an enterprise using the same channel. Cisco wireless LAN controllers address this problem and other co-channel interference issues by dynamically allocating access point channel assignments to avoid conflict. Since the Cisco lightweight solution has enterprisewide visibility with its RRM tools, channels are "reused" to avoid wasting scarce RF resources. In other words, Channel 1 will be allocated to a different access point far from the café. This is much more effective than not using Channel 1 altogether, which is what other WLAN systems often do.

Figure 2. Dynamic Channel Assignment

Later in the same document it describes a similar situation as Interference.

"Interference" is defined as any 802.11 traffic that is not part of the Cisco WLAN system, including a rogue access point, a Bluetooth device, or a neighboring WLAN. Cisco lightweight access points are constantly scanning all channels looking for major sources of interference (Figure 3).

If the amount of 802.11 interference a predefined threshold (the default is 10 percent), a trap is sent to the Cisco Wireless Control System (WCS).The Cisco Wireless LAN Controller will attempt to rearrange channel assignments to increase system performance in the presence of the interference.

Figure 3. Dynamic Channel Assignment Reacting to Interference

Again I will refrain from diving too deep on interference sources as Cisco does not even have a way to detect much less respond to such non-803.11 interferers as Cordless phones, baby monitors, wireless cameras, DECT phones and headsets etc.

The Problem:

When you have a large number of APs implemented and you are covering a large area, the Cisco system will adjust to compensate for rogues, neighbors and interferers almost continuously. As you add more and more interferers in and around the WLAN, more and more adjustments must be made to compensate for these. As the compensations take place they run into adjustments coming the other direction from the other side of the building and you get a huge ripple effect that will in some cases cancel out adjustments and in others build up over adjustments. The WLAN starts to behave like a wave phase experiment.

Example:

Let us say that we are in a hospital in San Francisco where the average number of APs per block is around a hundred. The hospital has 20 APs per floor and 10 floors in the main building. That's 200 APs, which is quite a large number. This hospital, since it is in an urban setting has many neighbors, many of whom also have APs.

In a typical situation a neighbor to the hospital puts an AP on Channel 1. The Cisco architecture senses this and adjusts to compensate, moving APs from adjacent channels to ones farther away. At or around the same time but on the other side of the hospital, another neighbor appears but this time the AP is on Channel 11. A similar situation occurs there. At some point the two waves of adjustments meet or cross in the middle. This is made possible because the split MAC architecture of the Cisco UWN has many decisions made in its WLAN controllers. These controllers are distributed and can act semi-independently. By the time the wave reaches the other side of the hospital, the system realizes it is again being interefered and readjusts.






This wave or ripple action, because it moves across floors and up stories may go on forever. As more neighbors or interferers come on line more waves are sent out. The larger the implementation the worse the problem gets. The effect is readily visible and measurable to anyone with a WLAN analyzer. They will see MAC addresses hopping from one channel to the next on a second by second basis. They will also be changing output power continuously so the signal will be rising and falling.

Effects of the "Ripple"

The net effect of this phenomenon is a serious decrease in throughput and a large increase in latency. If you use your WLAN for applications that need low latency or high throughput such as VOIP over a WLAN (known as VoWLAN or VoFi) or you have low power handhelds such as the kind used for barcode scanning, this network is unusable. The VoFi traffic will be filled with jitter and conversations will be choppy at best. The handhelds will never be able to sleep or go to low power as they will always be probing for changes to the environment. If the system had been statically mapped to specific channels that do not change, the WLAN would have had problems, for certain, but these problems would be affecting just the few APs that face the neighbors. Now that all the APs are reconfiguring continuously, the whole WLAN is affected all the time.

WLAN STAs that are associated and attempting to pass data will continuously be probing for new channels and APs to associate with. The amount of roaming will go up dramatically. Roaming takes a few seconds to complete so the problem will be very serious for the end user.

Cisco even mentions this problem in one of their release notes for the CB21AG card found here: HERE

CSCse49324-CB21AG retransmission mechanism has problems with RRM in LWAPP network

A CB21AG client that is operating in an LWAPP infrastructure loses connection for small periods of time. When the AP is performing radio resource management (RRM), the AP goes off channel. During these periods, the AP cannot hear and answer ACK and RTS frames from the client. The client card initiates a scan for another AP, and network traffic for the client is affected.

Workaround: Increase the HwTxRetries value from 4 to 14 (registry entry) so that the client card continues to retry for the 20 to 30 milliseconds that the AP is off channel.

SpectraLink and other VoWLAN vendors specifically warn their customers not to deploy their Cisco UWN architecture with RRM enabled. When a WLAN needs to support voice, the requirements for stability increase dramatically.

Conclusion:

The idea behind automatically adjusting and configuring networks is a good one. Maybe sometime in the near future Cisco will program their controllers to avoid this type of effect but in the meantime, unless you have a pretty small network or are located far from interference sources and neighbors, admins are urged to complete a thorough site survey and statically map all their APs to a channel and resurvey from time to time.

Labels: , , , , , , , ,