Wireless Network Communication

A WLAN uses radio frequency at the physical layer and MAC sublayer. Devices connect through an AP or wireless router, not a switch, and are often battery powered. Because RF reaches outside the facility, there are privacy issues that a wired LAN does not have.

WLANs use CSMA/CA instead of CSMA/CD, and a different frame format with extra header fields.

An 802.11 frame carries these fields:

Frame Control

Type, version, power management and security.

Address1

The receiving device or AP.

Address2

The transmitting device or AP.

Address3

Often the destination, for example the default gateway.

Sequence Control

Sequencing and fragments.

Address4

Only used in ad hoc mode.

Payload and FCS

The data, and the frame check sequence for error control.

A wireless client can't hear while sending, so it can't detect collisions. CSMA/CA avoids them instead:

1. 1.Listen for an idle carrier.
2. 2.Send RTS and wait for CTS.
3. 3.If no CTS arrives, wait a random time and restart.
4. 4.Every transmission is acknowledged.

A client and an AP go through three stages: discover, authenticate, associate.

To associate, both sides must agree on:

SSID

The network name; maps to a VLAN in larger networks.

Password

Used to authenticate to the AP.

Network mode

802.11a/b/g/n/ac/ad, or Mixed.

Security mode

WEP, WPA or WPA2; always use the highest supported.

Channel

Auto-scanned, or set manually if there is interference.

Discovery is either passive, where the AP broadcasts beacon frames with the SSID, standards and security, or active, where the client sends a probe request, with or without a known SSID. In short: passive means the AP shouts, active means the client asks.

In small networks a wireless router is a router, a switch and an AP in one box. A WLC (wireless LAN controller) centralises control and management. With a WLC the APs become lightweight APs (LWAPs): they only forward data, and SSIDs and authentication are defined once on the controller.

There are four WLAN threats, each with a matching counter:

A wireless DoS has three sources: improperly configured devices (accidental or deliberate), malicious interference with the communication, and accidental interference from microwaves, cordless phones and baby monitors. The 2.4 GHz band suffers far more than 5 GHz.

With a rogue AP an attacker can capture MACs and packets, reach resources and launch a MiTM. A personal hotspot on an authorised host counts as a rogue AP too. Prevent it with rogue AP policies on the WLC and by monitoring the radio spectrum for unauthorised APs.

An evil twin is a rogue AP that uses the legitimate SSID with a stronger signal. It thrives where open authentication is normal, such as airports and cafes. Clients near it associate with the stronger signal, and the traffic is captured and then forwarded to the real AP. The attacker steals passwords and personal information.

Two measures deter casual users but neither stops a real intruder:

• —SSID cloaking disables the SSID beacon, so the name must be entered manually.
• —MAC filtering permits or denies by hardware address.

SSIDs are easily discovered even when not broadcast, and MAC addresses can be spoofed. The real answer is authentication and encryption.

Open system is for free access where security doesn't matter; the client secures itself, for example with a VPN. Shared key covers WEP, WPA, WPA2 and WPA3, and needs a password that is pre-shared between both parties.

WPA2 Personal uses a pre-shared key, suits home and small office use, and needs no auth server. WPA2 Enterprise has the device authenticate to RADIUS; users then authenticate with 802.1X, which uses EAP.

To configure enterprise authentication, the AP needs three things:

• —The IP address of the RADIUS server.
• —The UDP ports: 1812 for authentication and 1813 for accounting (also 1645 and 1646).
• —A shared key, which authenticates the AP to the server.

The shared key is never configured on the client. 802.1X and EAP handle the user.

WPA3 has four features:

WPA3-Personal

Uses SAE; the PSK is never exposed in the handshake.

WPA3-Enterprise

802.1X/EAP plus a 192-bit suite, CNSA.

Open Networks

Unauthenticated but encrypted with OWE.

IoT Onboarding

DPP replaces vulnerable WPS, using a QR code.