Text 3428, 123 rader
Skriven 2005-04-06 21:47:36 av Chris (1:379/45)
   Kommentar till text 3425 av Gary Britt (1:379/45)
Ärende: Re: Wireless Network Security Questions
===============================================
From: Chris <nospam@noemail>



Gary Britt wrote:
> "Chris" <nospam@noemail> wrote in message news:425455e3@w3.nls.net...
>
>>1.  I would not be too concerned about the encryption, especially if
>>there is not an apparent threat of people accessing your network because
>>of distance.  Having said that, anyone who is smart enough can build (or
>>buy) a small beam antenna (a Yagi, for example) and can point it at your
>>antenna with great success at longer distances.  It depends on how
>>fortified you want to make your castle in response to the perceived
>>threat.  Disabling the broadast of the SSID is just fine for this setting.
>>
>
>
> OK Thanks.  How good would a Yagi be at picking up my wireless access point
> through a couple of walls in the house.  Right now with the Hawking 6db gain
> omni directional my wife still only gets 70% signal strength about 50 ft
> away in the laundry/her computer/sewing room.  I've been thinking of eiter
> using a Dlink repeater that would provide line of sight between her and the
> main wireless access point or putting a client wireless access point with
> upgraded Hawking Antenna on her end.

A Yagi can be built with as much gain (sensitivity) and directionality as you
want it to have.  A crude concept would be a TV Antenna.  Those are technically
called "Log Periodic" (don't ask...complicated answer) but they are a form of a
Yagi beam antenna.  The primary characteristic of a Yagi is its
unidirectionality.  In your case, just make it simple and buy another Hawking
antenna or use the D-Link repeater (probably what I might go with, but it's
likely a preference issue more than anything).  It doesn't sound (from your
description) like there is much out there to worry about as far as proximity to
others.

>
>>2.  DEFINITELY turn off the broadcast of your SSID.  ENABLE WEP at it's
>>maximum possible strength, ENABLE MAC filtering.
>
>
> Why don't you think MAC filtering alone would be enough?  How much slow down
> does WEP encryption make on slower older computers?

Because, I can spoof a MAC VERY easily with my Dell-supplied wireless driver
(or just about any recent wireless driver).  If that avenue won't work, then
there are programs out there (mostly for *nix, I would venture to guess) that
can also spoof a mac.  For those who are REALLY paranoid, go google a
man-in-the-middle wireless attack.  I don't know what kind of performance
issues there are.  I ONLY use encryption on my home network.  At work, which is
a publicly-funded educational institution, we have non-encrypted connections,
which I do NOTHING secure on, unless I'm using SSL or SSH2.  I feel the
performance hit (whatever it may be) is worth it compared to my data being
sniffed or intercepted.

>
>
>>If you need even more
>>protection and you don't have internal, wire-based PC's that you need to
>>connect to, then make the wireless LAN a DMZ, if possible.
>
>
> This has definitely got me confused, why would this be a good idea?  Yes
> there are no wired computers to connect to.

Here is what Webopedia defines a DMZ as:

http://www.webopedia.com/TERM/D/DMZ.html
(pronounced as separate letters) Short for demilitarized zone, a computer or
small subnetwork that sits between a trusted internal network, such as a
corporate private LAN, and an untrusted external network, such as the public
Internet.

Typically, the DMZ contains devices accessible to Internet traffic, such as Web
(HTTP ) servers, FTP servers, SMTP (e-mail) servers and DNS servers.

The term comes from military use, meaning a buffer area between two enemies.

-----
I would see about making the wireless lan a DMZ if possible.  The reason is
that (IIRC) the DMZ users can do anything they want on the Internet, but they
cannot reach your private network.  Thus, if, after using the above security
measures, someone STILL uses your WAP to connect to the Internet, they can not
get to your wire-based machines.  Clear as mud? If I have the concept of a DMZ
wrong, someone please correct me.

>
>>The other
>>thing that I would really recommend in that situation (if you so desire)
>>is to turn off the Netgear's WAP when you are not going to use it.  This
>>will need to be done via a wire-based connection.  The newer netgear
>>routers have allowed this.
>
>
> Yes my netgear does allow turning off the radio signal.

I, just for fun, sniffed traffic today on my wireless LAN.  In 5 mins time, I
had about 15-30 packets.  Most of them were NetBIOS broadcasts by my stupid
print server.  It ANNOUNCEs itself every 30 seconds.  Boy, it's chatty!

>
>>A note about SSID broadcasting:  If your WAP is on, I can find out your
>>SSID without trying very hard, whether or not you have SSID broadcasting
>>on or off.  This is because with a sniffer, such as Ethereal, I can
>>listen to the traffic over the wireless and see all the SSIDs within
>>range because every packet has the SSID in it.  If it didn't, how would
>>the equipment know what wireless network it was for?
>
>
> Good point.  Does this sniffing apply to mac addresses as well?

Yes.

>
> Thanks,
>
> Gary

Your Welcome,

/Chris

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)