Introduction to wireless network troubleshooting and security strategies

Wireless LANs based on the IEEE 802.11 standard, also known as Wi-Fi networks, have evolved from traditional warehouse environments to mainstream networks. As a result, troubleshooting and securing wireless networks has become as important to network technicians or engineers as wired networks.

Handheld, wired and wireless integrated analyzers are particularly useful. With such a device, technicians can troubleshoot both wireless and wired networks, quickly locating the cause of a problem as a wireless or wired problem, or ruling it out as a network problem. This can maximize work efficiency for users who are increasingly using mobile applications.

Wireless Network Environment

Wi-Fi is configured in several modes, including peer-to-peer mode, bridge mode, switching mode, and mesh mode. Good tools can analyze devices, RF channels, and protocol types in different modes of networks, while quickly locating faults. For example, using one device, four different modes of networks can be tested by device classification and connection interface.

Network Structure

Ad-hoc networks consist of client devices that are in a workgroup and can communicate directly through wireless network cards. Ad-hoc networks can bring security issues. Unauthorized users may automatically communicate with legitimate users, which may lead to the acquisition of sensitive data and the access to wired networks through wireless networks.

The wireless infrastructure consists of wireless access points (APs), which can be connected to wired networks or wireless switches. APs provide RF signals to clients. They can also be configured in point-to-point mode to bridge wireless networks between different buildings, such as two buildings separated by a parking lot.

Another basic network is a mesh structure, which is also composed of APs. APs can communicate with each other through wireless routing protocols. A mesh structure can communicate with a wired network through an AP connected to a wired network. A mesh structure can reduce wiring projects, reduce the wiring cost of interconnecting each AP, and improve scalability and flexibility.

Channel scanning in multiple modes

Wireless network cards and APs generally use the 802.11 standard group. 802.11b and 802.11g work in the 2.4GHz frequency band, and 802.11a works in the 5GHz frequency band. These standards are used in enterprise-level network environments. For business networks, they expect to have the most interference-free channels to avoid RF signal interference and optimize the performance of WLAN.

Even if an enterprise only uses one 802.11 standard WLAN, it is recommended to use a tester that supports three standards 802.11b, a, and g, because it can scan all channels. Otherwise, your enterprise will have security risks from ad-hoc mode or malicious APs. Analyzers

that support multiple modes can scan all 802.11 frequency bands, including all channels in the 2.4GHz and 5GHz frequency bands, and display them in graphical form. From these charts, you can see whether the configuration is reasonable, what the SNR signal-to-noise ratio is, how much bandwidth can be used, and other related issues. If a certain AP has prominent traffic, it may be because many clients are using this AP to access the Internet; on the other hand, it may be that a special application or protocol is occupying a large amount of bandwidth. Technicians can carry wireless analyzers to search for "those sending the most traffic" and quickly determine whether there are MP3 downloads, BT downloads and other applications, which may need to be banned in the wireless network. Usually, Weixin Instruments employees are not allowed to download BT during work hours.

Figure 1. Troubleshooting a hybrid Wi-Fi environment to ensure security

RF signal failure

Unlike wired networks, the performance of wireless networks is affected by the location and environment of APs and clients. Because the clients connected to APs are mobile, it is a challenge to properly deploy APs. In addition, when the AP is overloaded or when a client roams to a place where the RF signal is weak, it may cause a blind spot in the wireless network.

Some remote dead-end locations will also have blind spots because APs are not installed. These blind spots will affect some applications, such as VOIP applications based on wireless networks; sometimes, despite good signal surveys, changes in the physical environment will also affect signal changes, making it impossible for clients to communicate with APs. For example, the movement of furniture, the movement of metal filing cabinets, the installation of microwave ovens or other wireless appliances, etc. [page]

Eliminate guesswork about the network

Usually the main difficulty is that users lack experience in using wireless networks, and even do not understand wired networks. A report shows that last year 22% of user failures were integrated into network products, cables and connectors, and 69% of failures were attributed to servers and applications.

Regardless, network administrators need to determine what causes network failures, and in many cases, application support personnel need to know clearly whether there is a problem with the network.

Troubleshooting steps

When users encounter Wi-Fi wireless network connection problems, they usually seek help from internal IT support personnel. Explanations over the phone may not be enough, and someone needs to be sent to the site.

If the user has a login problem, the network administrator needs to locate the fault location. Using a handheld meter, you can test both wired and wireless networks, which can find the root cause of the problem most quickly.

If the technician can successfully log in to the wireless network from the client location using the tester, the problem may be in the configuration or permissions of the client device. If the tester cannot connect to the server, the problem may be in the physical layer of the wireless or wired network. In addition, insufficient bandwidth, request queue timeouts, conflict interference, etc. may also be the root cause of the problem.

The network administrator uses a wireless tester to scan the wireless network environment from the fault location to measure signal strength and AP performance. The tester can use passive scanning, which does not require logging into the AP. In passive mode, the tester's wireless network card only receives signals and does not send data. If the RF quality meets the requirements, the administrator can log in to the wireless network in client mode for testing, such as login test, PING and throughput test.

Usually, the administrator must verify whether the client configuration is consistent with the security mode of the business. (For example, EAP). If the security mode is inconsistent, it will affect the login.

A good handheld instrument should have wired/wireless comprehensive analysis functions, which can monitor and troubleshoot whether each step of logging in to the network is successful and locate the failed link. If the server refuses the user to log in, the problem may be related to the authentication server itself, or to the user's security configuration, or both. Strengthening the supervision of EAP can reduce such failures.

Support security testing

As mentioned earlier, the wireless network is dynamic, and the environment will change after deployment. Sometimes it is human error, and sometimes some unauthorized devices are brought in by increasing the coverage of wireless network access. Many times, because the wireless network provides access services in three-dimensional space, unauthorized APs may connect in. In addition, this result may also be caused by design errors.

Find APs and Ad-Hoc networks

Not all companies have deployed security detection equipment (such as IDS) to find malicious devices or APs. In most cases, the work of finding rogue APs is done through mobile testing. In the handheld tester, the deployed APs can be set as "authorized", which can effectively and quickly determine which APs or ad-hoc networks are authorized.

Figure 2: Wireless network scanning

Network Audit

From a security perspective, it is predicted that in 2006, 70% of malicious attacks will be caused by security holes caused by misconfiguration of APs or clients. Wireless testing tools can help enterprises regularly review the configuration of APs and clients to see if these configurations comply with corporate security policies.

Research institutions recommend that enterprises regularly check device configurations to ensure strict compliance with internal corporate security policies. If the enterprise chooses a WPA network, PEAP is an effective authorization method, and administrators need to confirm that all APs are configured as PEAP.

It is necessary to conduct periodic on-site surveys of wireless networks. Network administrators can use handheld tools to analyze RF signal quality and check if performance has decreased. They can also see user usage trends, where users are concentrated, and whether the number of APs needs to be increased.