Discussion on:

Evaluating the wireless networking options

evaluating the wireless network options does include the evalation of the security issues first.One cannot just go for the wireless options as available in the market as on date. The security & the scalabilty of the systems is what really matters first.

Brien,

You are forgetting the most important improvement of 802.11g! You mentioned that security the biggest problem with wireless networks, yet you neglect to talk about WPA (WiFi protected access) in 802.11g , which does security right. It implements stronger encryption that can't be sniffed like with WEP. It also includes enterprise-level authentication of wireless users AND authentication of access points. Once 802.11i (security, security, security) comes out, there will be even more improvements to WPA, which may then be called WPA2.

I won't tell you all the juicy details and instead let you research them on your own. But you should consider rewriting the paragraph on 802.11g to read, "So what are the advantages to using 802.11G? The primary advantage is SECURITY."

One more thing. You may want to mention that dual-band (2.4 GHz + 5 GHz) products are widely available (and without large price premiums!) which support both 802.11a, 802.11b, and 802.11g. Currently, there are issues with performance when a fast 54 Mbps node is transferring and a slow 11 Mbps starts talking. Usually this forces the higher speed product to adjust to much slower speeds. I expect this issue will be resolved soon with firmware updates.

Best of luck, and keep up the good work. I enjoy reading your articles.

Tristan

Tristan -
will G provide a more secure environment in a wired home (carrier: Earthlink) or it does not make a difference once the firewall is set on 802.11b

I am using a dual B/G Router with WPA connected to a DSL line. The Router has NAT, individual PCs use Software Firewalls. Security is the same, speed is the difference, 54Mbits vs. 11Mbits!

your reply postings are very useful as is this entire topic. Based on the info reviewed, I am going to get a G-compliant router for my home Earthlink Cable service.
Many thanks.

WPA upgrade applies (fortunately) to all members of the 802.11 family of protocols (currently A/B/G)and NOT ONLY to G! If your vendor does not provide a firmware/driver upgrade by now (Aug 18, 2003) PLEASE switch vendors!

Can't I run the about to be installed cable company's modem into my own D-Link or Linksys or Belkin G-compliant router and hook up my new wireless 802.11g laptop? In doing so, will I lose any security settings if Earthlink claims "no support" for my own hardware. What do I need to do to maintain the same high-level of security? Help.

Your DSL/Cable modem (and the ISP or Telco behind it) needs to know NOTHING about the configuration of your LAN!

If your LAN is nothing more but only just one SINGLE PC it must still have an RJ47 Ethernet connection to the modem. A local Router (wired or wireless) just connects to this very same RJ47 cable and muxes your local TCP/IP LAN traffic via the modem to the Internet!

I personally would NEVER use a BIG Name ISP, be it ATT or MSN! IMHO they simply do not seem to care much about SHO users. Their standard help line person AFIK is almost never network savvy. When I researched my WIFI LAN I tried to get a static IP address from MSN. They told me NO, they do not support that kind of 'feature'! ALL the local ISPS did! (-

Now with a static IP, both I and my friends (with valid passwords) are able to connect back to my own LAN based Web Servers (soon connections with client cerificates will also work).

I am very happy with my local ISP (VISI). They helped me while IP configuring my WIFI (Linksys) router and the Qwest provided Actiontech1520 DSL modem. Qwest was also very helpful when I had my 'only once' problem with the DSL environment. They were out within a few hours and tested, replaced my DSL modem. My local ISP also had equipment to test the DSL line from their office right back to my DSL modem! The phone people know all about telephone equipment, while the small/medium size ISPs are 'normally' computer people and understand IP networks, including routers.

I have only my Email with MSN. They are not network savvy! I have my Email with them because their browser based Email access brings nothing back to my PC and physically blocks virus infections. I also use a 'security' wrapper around my IE6 browser (called 'Secure IE') which stops 'any http worms', it also blocks POPUPs and any POPUP trasmitted virus infections.

For protecting my WIFI LAN I use Sygate's 'PRO' Firewall. Sygate also has a less capable but 'free' version for SHO users. Try it out!

It is amazing how much traffic there is between 'my' MS software and MS's Servers. These I stop now just out off pure spite! If MS ofically disclosed this 'back to mother' spy ware traffic then I would allow it. My firewall logs let me back track any IP traffic to its recipient and get the end-point's Email address. I sent an Email to MS and asked them about the reason for this spy ware like traffic but NO answer! This is the reason why I would never use a MS firewall (like the one in XP) or any other MS produced 'Secure Ware'. Who knows what kind of hidden 'security holes' are supported!?

My WIFI router also has a great built in firewall which protects my LAN from the 'wild' Internet. My Sygate Pro firewall protects my LAN from rouge access over the air wireless traffic while it still allows file sharing over my LAN.

When Linksys will eventually support WPA, for both their client cards and routers, then I finally can sleep in peace and not be scared 'of the next door' teenager hacker.

Currently Linksys supports WPA only on Windows XP. After the WIFI Association certifies the WRT54G router and there is still NO WAP support for my WPC54G cards then I am going to 'junk' them (reluctantly, because the dual 11Mb/54Mb support has been great) and switch to the latest Proxsym/Oronico cards, they already support WAP enabled dual 11b/54G PC card drivers for all Windows varieties.

WIFI certified equipment is guaranteed to support both 'standard' performance and all security aspects of the 802.11 protocol! IMHO, in the future, one manufacturer's WIFI certified equipment must inter operate with all aspect's of another's. If they do not then please publish it here and then we can always start a WIFI 'Class Action Suite' or just shame them into fixing the problem! -)
George

You need to investigate why the wireless net is in place. 802.11a is a nice protocol but if your supporting laptops, and older laptops your going to see power drain on the systems. "B" and "G" are better in this area.

Know yor customers and you'll know what solution to pick. This is the golden rule all technoilogy should live with, yet so few of us seem to do.

So the primary reason to switch to A is that hackers aren't focusing on it? Make sure you switch to Macs on the desktop, ride a bike to work, and move into a 1970's style underground house at the same time. I won't deny that security by obscurity does, at times, have it's place, but that place is never at the top of the list of reasons to adopt a technology. IMO, the strong (near unbreakable when combined with other security techniques like VPN) security of 802.11b, combined with it's bargain basement pricing and widerange acceptance, makes it the only choice for 95% of businesses today. G is a good option for those places that have to have greater speed (but think about it for a minute--how many wireless clients need greater than 11mb--people that need that kind of speed should have a wire), but only because it includes support for B.

The reasons to move to 802.11a are simply the abscence of noise in the environment and the number of independent channels. The 2.4 Ghz ISM band is crowded and noisy. This won't make any difference to you as a home user, but it can break a wireless ISP.

original article, very informative, thanks all.

Running three macs at home using appletalk, and one pc that switches mechanically (TRIOS) between driving one of two harddrives, the first of which was set up with windowsME (it totally went blank screen really after realplayer took over and turned the pc into a multimedia only broswer, then PCMcLan quit talking to macs, etc, etc.), and the second with linuxes (maybe five of them over about a year).

Ending up with SuSE 9.1 at the moment and it is much like my i-mac DVD with OS 10.3 (panther) except for, say, using aol at this time. I get i-mac aol notices from CPSR certificate mozilla reject notices which can be overridden.

I'm not worried about security, being non-profit nerd Berkeley 60's movement iconoclast.

So, black boxing security needs (A local ACLU card carying member) I notice that the linux hangs up upon power turn off when the external modem is set to the two red leds on the seven led sposter 33. modem, and the same, generally for the macs when the modem isn't rest.

It's instructive to view the differences between i-mac OS 10.3 and the SuSE 9.1 pc, the way the networking features are done.

Goal: Get our west coast Michigan township hybred wi-fi, leave no rural one behind, open local government to all, show world that democracy works when Jeffersonial ideal of an educated public is essential.

Will let you know when I figure this out.

Thjanks, from black boxer, retired bio-medical engineer, roger m

The article states that 802.11g range is less than 802.11b. I am currently using b and have null signal areas and occasional system drops or reduced bandwidth. I was hoping the increased bandwidth of g would compensate for reduced bandwidth periods. Is there any benefit to move to g if the issue is range?

RAM

The IEEE's final standard (released in May) lowers the data rates on 802.11G significantly from the 54Mb suggested in the article. In a mixed environment, 802.11g will give you only about 10Mb throughput, and a pure 802.11g will provide only about 20Mb. Of course, actual throughput on 802.11a is only around 24Mb.

Waterjar,

I know that SMC and other vendors have released firmware updates than improve the performance of 802.11g in mixed enviroments.

Go to www.smc.com and read the fine print about their "Nitro" technology and the advertised "Triple the speed!". This is due to improvements in mixed environments.

Tristan

I have installed several WiFi systems, including wireless ISP services. The author makes some good points but the WiFi choices should not be viewed as one or the other but rather as a range of choices that depend on the situation.

I use the 802.11A at 54MHz to beam between buildings using yagi or parabolic antennas. This has given me ranges up to 8 miles LOS.

Once the signal arrives, I use 802.11b or g in some buildings where the wired networks would be too expensive. In others, I patch into the phone system and distribute by DSL internal to the building.

I can wire a building for about $3,000 and service over 100 desks with 256K broadband. In a WISP delivbery, I give/sell PCI wireless cards along with external antennas that can be placed outside a window for added range.

In one such arrangement, I have covered a section of town called "Old Town" with one parabolic into an 802.11A AP. It then communicates to four other 802.11g APs that use external dipole antennas to each cover about 4 city blocks. The end result is a WISP service covering 17 city blocks that cannot otherwise receive DSL or cable connections.

the greatest benefit of WiFi is to deliver broadband internet access and networking services to areas that would not otherwise be cost-effective or even possible. At a total installed cost of over $4 per foot for the least expensive wired network, a business could invest 10's of thousands of dollars in wiring a building or several building that are geographically dispersed. A WiFi network can be installed for a fraction of that cost using existing phone wiring or low cost APs that can service several floors of a building.

It works if you mix and match.

Management Technology Consulting
"Using technology to resolve business problems"
www.mtccouncil.com

I'd like to know where you got that number. Also, how you can say a WiFi network can be installed for a fraction of that cost. Back up what you are stating please.

The cost, per foo,t of Cat-5 cable is the least expensive part of the equation when figuring total cost of installing a wired network. That's why most cabling contractors simply quote a flat rate per drop. All other per-port costs (cable termination, hubs, switches, patch bays, etc.) are fixed, and constitute the lion's share of the total per-port cost.

I'm just curious where the $4 a foot came from and what capability that figure would give someone. Is it 10mb? 100mb? gb? From my experience (18 yrs of sys/net admin) a typical figure is around $100 a drop for the patch panels, racks, cable, wall plates, termination and testing.

I have gotten emails requesting this response....

The context of the discussion was with respect to a network coverage of what I assumed to be more than a single office, i.e. a large office complex, an entire building or across multiple buildings. When you run CAT5 (or any network wiring) for the first time in a building, it can be VERY expensive.

Older buildings often have limited cableways between floors or rooms and running all the wiring in the overhead, adding drops and per terminal PCI cards (NICs), routers, hubs, etc. have a cumulative labor cost that far exceeds the cost of the materials - not to mention the on-going maintenace - how many times does someone move a computer without unplugging the NIC.

On top of this, you have issues with shared assets such as computers. Many networks do not have network based printers (they cost more) so they use printers attached to someone's computer BUT that only works when that computer is on.

I actually have experienced installations for much more than $4/foot but I didin't think they were typical.

That conservative figure rolls all the costs into one price that also relates the typical size.

For instance: A small network of a one-floor office might have a 500 foot network installation that would probably be about 20 drops. That's about 10-15 feet between drops and about 10 feet from the ceiling to the NIC for a total of 25 feet per node. Of course, hub placement can raise or lower this figure but you will find it often is much more.

A previous comment said their experience was $100 per drop. 500 ft X $4 = $2000. 20 Drops X $100 = $2000. My $4/ft estimate would be the same as his....

In actuality, even 20 nodes would probably average more than 25 feet per drop (average) with lines going back to the servers, hubs, etc.

I also question his $100/drop. If we are talking strickly parts, then yes, that is reasonable but if you add in the total cost of installation on a per drop basis, my experience is that it is much more. NICs = $25, CAT5 = $5 - $25, Labor to install each node = $50-150, Pro-rated portion of router, hubs and bridges $15 - $25. This puts the costs per node at around $95 - $225. Using my $4/ft and assuming 25 feet per node, that is $4 X 25 = $100/node - a low-ball estimate of what it might cost totally and in agreement with the $100/drop but if the labor runs higher, you get closer to $9/foot to install.

Now let's take a big network. A building of 4 floors with 30 drops per floor. By the previous estimate, that would be about 4 X 30 X $100 = $12,000. Using my measure, that would equal 3,000 feet. That is 4 floors X 30 nodes per floor X 25 feet per node = 3,000 feet. 3,000 ft X $4 = $12,000. But is 3,000 feet reasonsable?

That might be possible if there are no problems in the installation of any kind - such as having to drill between floors or if you do not have a convenient suspended ceiling and can centrally locate hubs. It also assumes an even distribution of nodes at 25 ft increments average, each routing around and thru walls, etc. etc. If you happen to get into an office with a triple-net lease and can install your own walls, etc. then you can do this cheaply but most cannot do that.

In my experience that just does not happen that often. More likely in the above example of 4 floors and 30 nodes per floor, you would be looking at closer to 4,000 or more feet and the costs would run closer to $20,000 if the building had never been wired before and might take 2-3 weeks to complete.

By contrast, a wireless network might come in two forms.

Using a rooftop yagi or parabolic ($300) and an 802.11a AP ($500) back to an ISP to trap an internet pipe of about 30-40 Mbps. Then patch into the phone system using an amplified DSL distribtion router ($1,500 for Cisco's 1760). Total cost so far = $2,300 plus about 10 hours of labor - perhaps a total of $3,000.

Typically, an ISP uses a 10-to-1 ratio of subscribers to active users. In other words, if you have 32MBps of bandwidth, you can provide 1 MBps of bandwidth to each of 320 users assuming that only 10% of them are actually actively downloading at that BW rate at any given moment.

In our 4 floor building with 120 nodes, we could give each 256K Bps simultaneously (with some left over) or, more likely, it would give
about 2.5 MBps to all 120 users, on average.

Since the phone wiring is already present, the only cost is the ADSL modems and/or hubs (about $20-30 each in bulk or $40-80 with multiple LAN ports) and the NICs for $25 each. Figure about $35/node. For 120 nodes, we get about $4,200. Total cost for 120 nodes across 4 floors of a building would be about $7,500 and would be accomplished in 3-4 days.

IF your phones are not DSL compatible (many are not), then you have to use WiFi direct to the node.

You still use the rooftop instllation but now you use a Cisco Aironet 1200 series that does the 802.11a job to bring in the internet pipe from the ISP AND it also has an 802.11b to rebroadcast to the building APs - cost $999.

In a smaller building or one of wood construction, you might even ba able to get by with just the one Cisco 1200 AP on the roof.

In our 4 floor building, the Cisco 1200 sends to two "b" APs at each end of the building. These three APs can all "see" each other. Each AP covers it's end of the building and most of the next floor down. Tuned and placed right you might be able to get by with just two more APs (4 total) by skipping a floor if you use good quality APs. This would also be controlled by how costly it is to run the CAT5 wiring to the APs' hubs on each floor or section of a floor. More APs = less CAT5 wiring.

If wiring to a hub is still to high, then you use APs direct to PCI WiFi cards with external antennas or use a USB WLAN device. Typically, these can run about $30 to $80 with antennas for a simple installation. If there is a lot of RF interference or the building has steel and concrete walls, you might have to use $95 to $125 devices.

Remeber, using a USB WLAN device also means that each computer can be setup without the cost and time to open and configure each case - a large savings in a big network.

Rooftop Cisco 1200 ($1000), 4 medium quality 802.11b APs ($480) and 120 WLAN connections (Microsoft USB MN510 $36 or Linksys WDT11 $41) for about $4,800. Total all wireless solution is about $6,280 in hardware and labor to install. Two people, three days $45/hr labor - $2160. Total cost of network installation = $8,440.

As you can see, a WLAN is going to undercut a CAT5 network almost every time and the $4/foot is probably a conservative but usable estimate for a wired network.

Thomas V. Watkins III
Director, Government Systems Division
Management Technology Consulting, Inc.
"You can't manage, what you can't measure"
Email: twatkins@mail.com
Web Site: www.MTCCouncil.com

Way t'Go Tom ! I love to shut down the naysayers like that! Great Info, Great Effort!!

The article recommends using 802.11A. hUH?