MAC filtering has often been a point of contention in posts about wifi security. Whilst I commend the author on pointing out that MAC addresses can be changed it is not the case that a valid MAC address needs to be known in order to subvert the so called “security” that MAC filtering offers. You can in fact simply clone an existing mac, if the station owner happens to be operating at the time this will cause a MAC conflict. Different hardware and software of the stations handle this in different ways and very few will actualy do anything at all. Sadly these days software and firmware is rushed out the door to meet target deadlines and is rarely tested properly. It is not realy feasible to block the MAC as there is no real way to determine if you are blocking the genuine device of the spoofed one. Company’s do not want support calls so will simply go with the option that will generate the least ammount of support calls. At best MAC filtering is only of use to prevent an unwanted station accidentally connecting!

The best advice I found in this post is to employ the highest level of packet encryption the devices support and it was refreshing to see CCMP described correctly for a change.

The last piece of advice I can offer as indeed the author did is to employ the most random complex key that you can. The only issue this can sometimes raise is that not all software and firmware will support the full 63 characters laid down in the standards. In my experience I have found 60 characters has best security whilst avoiding any bugs thay may bite!

I would also recommend using a group key update interval of a non standard value such as 26 or 47 minutes for example though if you are employing CCMP with a good lengthy PSK and most certainty not using the factory SSID then this is a little overkill and within the realm of the foil hat brigade!

In conclusion this is one of the better articles I have come across with a good deal of thought and effort put into it. A refreshing change from the usual “turn on mac filtering and use your dogs name as your PSK” posts that sadly still wander arround the internet.

A big thumbs up from me for the author. 🙂

Stuartbe.

]]> http://blog.superuser.com/2011/06/09/better-know-your-wireless-router/#comment-725626 Wed, 25 Sep 2013 09:40:50 +0000 http://blog.superuser.com/?p=3367#comment-725626 Can anyone help me with wifi connect between an hp printer and a verizon DSL-2750B modem? The device is trying to connect but looks like it is getting blocked somewhere.

]]> http://blog.superuser.com/2011/06/09/better-know-your-wireless-router/#comment-556827 Tue, 30 Jul 2013 13:46:50 +0000 http://blog.superuser.com/?p=3367#comment-556827 I am using 2 laptops when i connect them to wifi they all get connected but only one gets an internet. usually the first laptop connected gets the internet. any thoughts about it?

]]> http://blog.superuser.com/2011/06/09/better-know-your-wireless-router/#comment-717 Fri, 16 Dec 2011 17:41:20 +0000 http://blog.superuser.com/?p=3367#comment-717 I am using local telecom company’s wifi router (MTNL). It works fine with my laptop. However, with my LG optimus one p500 mobile phone, internet works fine initially when I start it in mobile. After few time (around 10 minutes), mobile is connected with wifi but internet not works in the phone. At the same time internet works on my laptop, that means wifi router is connected with internet but not works on mobile.

I googled and found some configuration needs to be changed to works well with different devices. I found few settings in my router which are as follows. Please help me fix this issue.

Beacon Interval: 100 ms(range: 20~1000)

RTS/CTS Threshold: 2347 bytes(range: 1500~2347)

Fragmentation Threshold: 2346 bytes(range: 256~2346, even numbers only)

DTIM: 1 (range: 1~255)

Wireless Mode: 802.11b+g+n

Station Number: 16 (range: 0~16)

Channel Bandwidth: 20/40 Mhz

Guard Interval: AUTO

MCS: AUTO

]]> http://blog.superuser.com/2011/06/09/better-know-your-wireless-router/#comment-274 Sat, 18 Jun 2011 16:21:28 +0000 http://blog.superuser.com/?p=3367#comment-274 There is a an additional concern with “simultaneous” dual band routers. Some cannot seamlessly switch on-the-fly between g and n support. So, if you’re trying to run n on the 2.4 GHz spectrum but add a g device to the network (something that is rather typical, e.g. a wireless printer, or a family member or guest with a laptop that is a couple of years old), the router switches to g-only mode, essentially forcing all of the connections to g instead of operating each connection in the best mode the corresponding client supports.

Such a limitation reflects a limitation of the hardware and/or firmware in the specific device and not of the technical standards themselves.

I learned this only by reading carefully, thereby avoiding purchasing a device that claimed simultaneous dual band support but had this limitation.

]]> http://blog.superuser.com/2011/06/09/better-know-your-wireless-router/#comment-272 Thu, 09 Jun 2011 16:14:41 +0000 http://blog.superuser.com/?p=3367#comment-272 Great Post, but the real question is why are wireless connections so buggy. I get to reboot my computer and router all the time to get things working again. Given the choice I’ll always user Wired.

]]> http://blog.superuser.com/2011/06/09/better-know-your-wireless-router/#comment-271 Thu, 09 Jun 2011 13:55:40 +0000 http://blog.superuser.com/?p=3367#comment-271 Your information about the ‘a’ variant is wrong: the theoretical speed is 54Mbps, with a typical throughput of 20Mbps. That’s notably faster than ‘b’, though not as good as ‘g’ or ‘n’. It does run on a different spectrum, though, so for good speeds, you do need to be a bit closer to the device.

]]>