AirMagnet PRG-Laptop 7.0 Reference guide

  • Hello! I am an AI chatbot trained to assist you with the AirMagnet PRG-Laptop 7.0 Reference guide. I’ve already reviewed the document and can help you find the information you need or explain it in simple terms. Just ask your questions, and providing more details will help me assist you more effectively!
AirMagnet
®
Laptop
Wireless LAN Policy Reference Guide
Laptop Wireless LAN Policy Reference Guide.book Page 1 Thursday, January 25, 2007 5:36 PM
© 2002-2007 AirMagnet, Inc. All rights reserved.
AirMagnet Laptop Wireless LAN Policy Reference Guide.
This Reference Guide is furnished under license and may be used or
copied only in accordance with the terms specified in the license. The
content of this document is for information only and should not be
construed as a commitment on the part of AirMagnet, Inc.
No part of this document may be reproduced, transmitted, stored in a
retrievable system, or translated into any language in any form or by any
means without the prior written consent of AirMagnet, Inc. Further,
AirMagnet, Inc. reserves the right to modify the content of this
document without notice.
AIRMAGNET, INC. SHALL NOT BE HELD LIABLE FOR ERRORS OR
OMISSIONS CONTAINED HEREIN; NOR FOR INCIDENTAL OR
CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OF THIS
CONETENT.
This product includes software developed by the University of
California, Lawrence Berkeley Laboratory and its contributors. This
product includes software derived from the RSA Data Security, Inc.
MD5 Message-Digest Algorithm. Copyright 1990-1992 RSA Data
Security, Inc. All rights reserved.
AirMagnet
®
and AirWISE® are registered trademarks, and the
AirMagnet logo is a trademark, of AirMagnet, Inc. All the other product
names mentioned herein may be trademarks or registered trademarks of
their respective companies.
AirMagnet, Inc.
1325 Chesapeake Terrace
Sunnyvale, CA 94089
USA
Compiled in the United States of America, January 25, 2007.
Part Number: PRG-Laptop 7.0
Laptop Wireless LAN Policy Reference Guide.book Page 2 Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Table of Contents i
Table of Contents
Part One: Security IDS/IPS ....................................................1
Chapter 1: Configuration Vulnerabilities ...................................3
Ad-hoc Station Detected....................................................................................... 3
AP Broadcasting SSID ......................................................................................... 4
AP Configuration Changed................................................................................... 5
AP Operating in Bridged Mode Detected............................................................. 8
AP Using Default Configuration........................................................................ 10
Device Vulnerable to Hotspot Attack Tools....................................................... 11
Potential Pre-802.11n device detected................................................................ 15
Exposed Wireless Station Detected.................................................................... 17
LEAP Vulnerability Detected............................................................................. 19
Chapter 2: IDS—Denial of Service Attack................................23
DoS Attack Against AP...................................................................................... 23
DoS Attack: Association Flood............................................................ 24
DoS Attack: Association Table Overflow............................................ 26
DoS Attack: Authentication Flood....................................................... 26
DoS Attack: EAPOL-Start Attack........................................................ 28
DoS Attack: PS Poll Flood Attack....................................................... 29
DoS Attack: Unauthenticated Association........................................... 30
DoS Attack Against Infrastructure ..................................................................... 32
DoS Attack: CTS Flood ....................................................................... 32
DoS Attack: Queensland University of Technology Exploit............... 34
DoS Attack: RF Jamming Attack......................................................... 36
DoS Attack: Virtual Carrier Attack...................................................... 38
DoS Attack Against Client Station..................................................................... 40
Laptop Wireless LAN Policy Reference Guide.book Page i Thursday, January 25, 2007 5:36 PM
ii Table of Contents
AirMagnet Laptop Wireless LAN Policy Reference Guide
DoS Attack: Authentication-Failure Attack......................................... 41
DoS Attack: De-Authentication Broadcast.......................................... 43
DoS Attack: De-Authentication Flood................................................. 44
DoS Attack: Disassociation Broadcast................................................. 46
DoS Attack: Disassociation Flood ....................................................... 47
DoS Attack: EAPOL-Logoff Attack.................................................... 49
DoS Attack: FATA-Jack Tool Detected .............................................. 50
DoS Attack: Premature EAP-Failure Attack........................................ 52
DoS Attack: Premature EAP-Success Attack ...................................... 54
Chapter 3: IDS—Security Penetration......................................57
Airsnarf Attack Detected.................................................................................... 57
Fast WEP Crack (ARP Replay) Detected........................................................... 60
Device Probing for APs ..................................................................................... 61
Dictionary Attack on EAP Methods................................................................... 64
EAP Attack Against 802.1x Authentication Type.............................................. 65
Fake APs Detected.............................................................................................. 66
Fake DHCP Server Detected.............................................................................. 67
Hotspotter Tool Detected.................................................................................... 68
Illegal 802.11 Packets Detected.......................................................................... 71
Man-in-the-Middle Attack Detected................................................................... 72
Monitored Device Detected................................................................................ 74
NetStumbler Detected ........................................................................................ 75
Potential ASLEAP Attack Detected................................................................... 76
Potential Honey Pot AP Detected....................................................................... 78
Publicly Secure Packet Forwarding (PSPF) Violation....................................... 80
Soft AP or Host AP Detected ............................................................................. 81
Spoofed MAC Address Detected........................................................................ 82
Suspicious After-Hour Traffic Detected............................................................. 83
Unauthorized Association Detected ................................................................... 84
Wellenreiter Detected......................................................................................... 87
Chapter 4: Rogue AP and Station..............................................89
Rogue AP............................................................................................................ 90
Laptop Wireless LAN Policy Reference Guide.book Page ii Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Table of Contents iii
Rogue AP by Channel.......................................................................... 91
Rogue AP by IEEE ID (OUI)............................................................... 92
Rogue AP by MAC Address (ACL) .................................................... 93
Rogue AP by SSID............................................................................... 94
Rogue AP by Wireless Media Type..................................................... 95
Rogue AP Traced on Enterprise Wired Network................................. 96
Rogue Station ..................................................................................................... 97
Rogue Station by Channel.................................................................... 97
Rogue Station by IEEE ID (OUI) ........................................................ 98
Rogue Station by MAC Address (ACL).............................................. 99
Rogue Station by SSID ...................................................................... 100
Rogue Station by Wireless Media Type............................................. 101
Chapter 5: Authentication and Encryption.............................103
Other Encryption and Authentication Methods................................................ 104
Device Unprotected by Other Encryption.......................................... 104
Device Unprotected by Fortress Encryption...................................... 105
Static WEP Encryption..................................................................................... 106
AP with Encryption Disabled............................................................. 107
Client with Encryption Disabled........................................................ 107
Crackable WEP IV Key Used............................................................ 108
Device Using Open Authentication.................................................... 109
Device Using Shared Key Authentication ......................................... 109
WEP IV Key Reused.......................................................................... 111
VPN .................................................................................................................. 111
Device Unprotected by VPN.............................................................. 112
WPA and 802.11i.............................................................................................. 113
802.11x Rekey Timeout Too Long.................................................... 114
802.1x Unencrypted Broadcast or Multicast...................................... 114
Device Unprotected by IEEE 802.11i/AES ....................................... 116
Device Unprotected by 802.11x......................................................... 120
Device Unproetected by EAP-FAST ................................................. 122
Device Unprotected by PEAP............................................................ 123
Device Unprotected by TKIP............................................................. 124
WPA or 802.11i Pre-Shared Key Used.............................................. 126
Laptop Wireless LAN Policy Reference Guide.book Page iii Thursday, January 25, 2007 5:36 PM
iv Table of Contents
AirMagnet Laptop Wireless LAN Policy Reference Guide
Part Two: Performance Violation .....................................129
Chapter 6: Channel or Device Overload .................................131
AP Association Capacity Full........................................................................... 132
AP Overloaded by Stations............................................................................... 132
AP Overloaded by Utilization .......................................................................... 133
Excessive Bandwidth Usage............................................................................. 133
Excessive Multicast/Broadcast......................................................................... 134
Chapter 7: Deployment and Operation Error........................137
Configuration Error .......................................................................................... 138
Ad-hoc Node Using AP’s SSID......................................................... 139
Conflicting AP Configuration............................................................ 140
Higher Speed Not Supported.............................................................. 141
Missing Performance Options............................................................ 142
Simultaneous PCF and DCF Operation ............................................. 143
Unassociated Station Detected........................................................... 144
Device Down or Malfunction........................................................................... 144
AP System or Firmware Reset........................................................... 145
AP with Flawed Power-Save Implementation................................... 145
IEEE 802.11g Issues......................................................................................... 146
802.11g AP Beacons Wrong Protection............................................. 148
802.11g AP with Short Slot Time...................................................... 148
802.11g Device Using Non-Standard Data Rate................................ 149
802.11g Pre-Standard Device............................................................. 149
802.11g Protection Mechanism Not Implemented............................. 150
802.11g Protection Mechanism Overhead......................................... 150
Device Thrashing Between 802.11g and 802.11b.............................. 151
Chapter 8: IEEE 802.11e & VoWLAN Issues.........................153
AP Overloaded by Voice Traffic...................................................................... 155
Voice Quality Degradation Caused by Interfering APs ................................... 157
Channel Overloaded by Voice Traffic.............................................................. 159
Laptop Wireless LAN Policy Reference Guide.book Page iv Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Table of Contents v
Excessive Roaming Detected on Wireless Phones........................................... 163
Power Save DTIM Not Optimized for Voice Traffic....................................... 167
VoWLAN Multicast Traffic Detected.............................................................. 167
Chapter 9: Problematic Traffic Pattern..................................169
Excessive Fragmentation Degrading Performance .......................................... 170
Excessive Frame Retries................................................................................... 171
Excessive Low Speed Transmission................................................................. 172
Excessive Missed AP Beacons......................................................................... 174
Excessive Packet Errors.................................................................................... 175
Excessive Roaming or Reassociation............................................................... 177
High Management Traffic Overhead................................................................ 179
Streaming Traffic from Wireless Device.......................................................... 181
Chapter 10: RF Management...................................................179
Channel with High Noise Level ....................................................................... 180
Channel with Overloaded APs.......................................................................... 181
Hidden Station Detected................................................................................... 183
Insufficient RF Coverage.................................................................................. 185
Interfering APs Detected .................................................................................. 187
Non-802.11 Interfering Source Detected.......................................................... 188
RF Regulatory Rule Violation.......................................................................... 192
Laptop Wireless LAN Policy Reference Guide.book Page v Thursday, January 25, 2007 5:36 PM
vi Table of Contents
AirMagnet Laptop Wireless LAN Policy Reference Guide
Laptop Wireless LAN Policy Reference Guide.book Page vi Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Part One: Security IDS/IPS 1
Part One: Security IDS/IPS
The addition of WLANs in the corporate environment introduces a
whole new class of threats for network security. RF signals that
penetrate walls and extend beyond intended boundaries can expose
the network to unauthorized users. Rogue Access Points installed by
employees for their personal use usually do not adhere to the
corporate security policy. A single Rogue AP can put the entire
corporate network at risk of outside penetration and attack, and there
are many other possible wireless security risks and intrusions such as
mis-configured AP, unconfigured AP, and Denial-of-Service attacks.
Figure 1-1: Wireless Security Approaches
The AirMagnet product is designed to help manage against security
threats by validating proper security configurations and detecting
possible intrusions. With the comprehensive suite of security
monitoring technologies, AirMagnet alerts the user on more than 100
different threat conditions in the following categories:
• User authentication and traffic encryption
• Rogue and ad-hoc mode devices.
• Configuration vulnerabilities
• Intrusion detection on security penetration
• Intrusion detection on DoS attacks
Laptop Wireless LAN Policy Reference Guide.book Page 1 Thursday, January 25, 2007 5:36 PM
2 Part One: Security IDS/IPS
AirMagnet Laptop Wireless LAN Policy Reference Guide
To maximize the power of AirMagnet Mobile, security alarms can be
customized to best match your security deployment policy. For
example, if your WLAN deployment includes Access Points made by
a specific vendor, the product can be customized to generate the
rogue AP alarm when an AP made by another vendor is detected by
AirMagnet Mobile.
Laptop Wireless LAN Policy Reference Guide.book Page 2 Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Chapter 1: Configuration Vulnerabilities 3
Chapter 1:Configuration Vulnerabilities
Implementing a strong deployment policy is fundamental to
constructing a secure WLAN. However, enforcing the policy requires
constant monitoring to catch violations caused by mis-configuration
or equipment vendor implementation errors. With more and more
laptops coming packaged with built-in Wi-Fi capabilities, the
complexity of WLAN configuration extends beyond the Access
Points and to the stations. WLAN device configuration management
products can make the configuration process easier, but the need for
validation persists especially in laptops with built-in but unused and
unconfigured Wi-Fi. Besides checking policy validations, AirMagnet
also provides suggestions for best configuration practices in case a
suboptimal configuration choice is detected. For example,
AirMagnet Mobile generates a warning alarm when it detects an AP
broadcasting its SSID. The AirMagnet Mobile alarm description in
this case will recommend that the wireless administrator turn off the
SSID broadcast as a good security practice.
Ad-hoc Station Detected
A Wireless client station operating in ad-hoc mode (peer-to-peer
networking) is usually not protected by the same rigorous security
rules as enterprise-deployed APs in the infrastructure mode.
Figure 1-1: Ad-hoc Networking (Peer-to-Peer Stations) Bypasses
Enterprise Security Infrastructure
Peer-to-peer networking is usually not supported by the enterprise
WLAN, and thus lacks the necessary security measures such as
802.1x user authentication and the dynamic key encryption. As a
result, ad-hoc mode stations risk exposing data in the air through
weak (if any) encryption. In addition, weak authentication may
allow unauthorized devices to associate. If the ad-hoc mode client
station is also connected to the wired network, the entire enterprise
wired network is at risk. An Ad-hoc mode client station should be
investigated as a rogue AP because of the high risk imposed.
Laptop Wireless LAN Policy Reference Guide.book Page 3 Thursday, January 25, 2007 5:36 PM
4 Chapter 1: Configuration Vulnerabilities
AirMagnet Laptop Wireless LAN Policy Reference Guide
AirMagnet Mobile detects ad-hoc mode usage and triggers alarms.
To get a list of all ad-hoc mode stations, you can use the
Infrastructure view. See the sample screen shot below:
Figure 1-2: Infrastructure page identifies all Ad-hoc mode stations for
security sweep
Once this alarm is triggered, you can locate the ad-hoc device using
the Find tool and remove it from the enterprise network.
AP Broadcasting SSID
WLAN SSIDs are typically announced in the broadcast beacon
frames sent by Access Points. It is meant for client stations to easily
identify available WLANs and the APs providing the service. War-
drivers equipped with tools such as Netstumbler sometimes scan for
the SSIDs sent by Access Points to discover potential targets. If the
WLAN SSID is uncovered, your network may be susceptible to two
specific threats:
• Intruders can set the SSID on their client to attempt to join
that WLAN. According to most war-driving web sites, many
Access Points implemented these days are operating without
any security. Even though knowing the SSID name does not
necessarily mean that rogue clients will be able to join the
network, it is necessary to carry out other forms of security
attacks (such as Denial-of-service).
• Your WLAN and APs with GPS information on your
geographical location may be collected in a global database
and published on the Internet.
Laptop Wireless LAN Policy Reference Guide.book Page 4 Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Chapter 1: Configuration Vulnerabilities 5
AirMagnet Mobile detects an AP broadcasting its SSID and triggers
alarms (it is also able to discover SSIDs that are not broadcast). In the
Start page, APs are listed with their SSIDs in red to indicate a non-
broadcast SSID. See sample AirMagnet screenshots below:
Figure 1-3: The START screen showing non-broadcaster SSID in red
Most AP vendors support the configuration for SSID broadcast. A
Cisco Aironet AP can be configured from the Internet browser (see
sample below).
Figure 1-4: Disabling SSID broadcast for Cisco Aironet Access Point
AP Configuration Changed
Most of the current day wireless 802.11b LAN equipment use Direct
Sequence Spread Spectrum (DSSS) technology to send and receive
data. In DSSS, the data signal is combined with the chipping code,
which will divide the signal depending on the spreading ratio.
802.11a/g devices use the Orthogonal Frequency Division
Multiplexing (OFDM) modulation technology to help achieve higher
data rates. In this technology the high speed signal is divided into
separate sub-carrier signals.
According to the 802.11 standard, the user sets the channel for the
Access point and the wireless client adjusts its frequency to the same
channel and then begins the association phase.
Laptop Wireless LAN Policy Reference Guide.book Page 5 Thursday, January 25, 2007 5:36 PM
6 Chapter 1: Configuration Vulnerabilities
AirMagnet Laptop Wireless LAN Policy Reference Guide
The IEEE 802.11 standard mandates the use of 802.11b/g devices in
the 2.4 GHz ISM (Industrial, Scientific and Medical) band only while
the 802.11a devices operate in the 5Ghz UNII (Unlicensed National
Information Infrastructure) band. 802.11a devices cannot interoperate
with 802.11b/g devices as they operate in different frequency bands.
Table 1-1: Channel Assignment for 802.11b Devices
Channel Frequency
Regulatory Domains
Americas
(-A)
Japan
(-J)
Singapore
(-S)
Taiwan
(-T)
34 5170 — x — —
36 5180 x — x —
38 5190 — x — —
40 5200 x — x —
42 5210 — x — —
44 5220 x — x —
46 5230 — x — —
48 5340 x — x —
52 5260 x — — x
56 5280 x — — x
60 5300 x — — x
64 5320 x — — x
149 5740 — — — —
153 5765 — — — —
157 5785 — — — —
161 5805 — — — —
Laptop Wireless LAN Policy Reference Guide.book Page 6 Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Chapter 1: Configuration Vulnerabilities 7
Mexico is included in the Americas domain but channels 1 through 8
are for indoor use only while channels 9 through 11 can be used indoors
and outdoors. France is included in the EMEA regulatory domain, but
only channels 10 through 13 can be used in France.
For 802.11b/g, a total of 14 channels are defined by the IEEE standard
in the ISM band with each channel occupying 22 MHz. Adjacent
channels overlaps with each other in RF frequency usage (see
illustration below).
Figure 1-5: 802.11b/g Channel Allocation and Frequency Overlaps
Wireless devices operating in adjacent channels (channel numbers
less than 5 apart) have their RF frequencies overlapped and will
interfere with one another. Ideally, APs should be 5 channels apart to
avoid such problem. This means that channel 1, 6 and 11 are the three
non-overlapping channels in the frequency spectrum. See sample
channel allocation and AP deployment below.
Figure 1-6: Allocating Adjacent APs to Non-overlapping Channels
Laptop Wireless LAN Policy Reference Guide.book Page 7 Thursday, January 25, 2007 5:36 PM
8 Chapter 1: Configuration Vulnerabilities
AirMagnet Laptop Wireless LAN Policy Reference Guide
After the initial site survey, in which channels for different APs were
considered, it becomes very important that no changes be made in
channel allocation. Any changes could lead to potential interference
between APs and increased noise level in the frequency spectrum.
Such a change could render the pre and post site survey useless.
Sudden changes in the channel allocation for the APs could also
indicate that an unauthorized person has gained access to the APs
and has made those changes.
AirMagnet Mobile also alerts the user for any sudden changes in the
SSID of the access point. This may indicate that an intruder has
control over the access point and has modified the SSID
configuration. This can cause all valid clients to get disconnected
from the AP as they now are not talking on the same network. Please
connect to the AP whose configuration has changed and assign a
stronger password for the access point login and change the SSID
back to the original one to continue providing service to the clients.
AP Operating in Bridged Mode Detected
Access Points are the most commonly used infrastructure products
for WLAN networks. An AP will act as a centralized hub through
which different wireless devices can connect to the wired distribution
network. There are access points that are available that can operate in
both the access point mode as well as the bridged mode. Most of
them can operate in either mode at a time, though there are a few
vendor devices that support both modes simultaneously. In bridged
mode, the wireless bridge can be used to connect two wired LAN
segments together. This can be in the point-to-point or point-to-
multipoint configuration.
Laptop Wireless LAN Policy Reference Guide.book Page 8 Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Chapter 1: Configuration Vulnerabilities 9
An attacker or a rogue insider could install such a wireless bridge
inside the corporate network that would invariably extend the
corporate network to any location outside the corporate premises.
Detection of such wireless bridge devices indicates that something is
wrong and the security of the corporate network could be
compromised.
Figure 1-7: Rogue Bridged AP/wireless bridge conneted to a corporate
network
Laptop Wireless LAN Policy Reference Guide.book Page 9 Thursday, January 25, 2007 5:36 PM
10 Chapter 1: Configuration Vulnerabilities
AirMagnet Laptop Wireless LAN Policy Reference Guide
AirMagnet Mobile will alert the administrator when it detects a
wireless bridge. Once a Rogue AP running in the bridged mode is
identified and reported by AirMagnet
Mobile, the WLAN
administrator may use the FIND tool to locate the rogue device.
Figure 1-8: Locating a device with AirMagnet Mobile’s FIND tool
AP Using Default Configuration
Access Points shipped by wireless equipment vendors usually come
with a set of default configuration parameters. Until these
configuration parameters are set based on your corporate security
policy, new Access Points should not be connected to the corporate
wired network. Depending on the manufacturer, unconfigured APs
have a default administrator password, SSIDs, channels,
Laptop Wireless LAN Policy Reference Guide.book Page 10 Thursday, January 25, 2007 5:36 PM
AirMagnet Laptop Wireless LAN Policy Reference Guide
Chapter 1: Configuration Vulnerabilities 11
authentication/encryption settings, SNMP read/write community
strings, etc. Such default values are public knowledge available in
user manuals and installation guides on the vendor web site and may
be used by wireless hackers to compromise WLAN security.
Figure 1-9: Sample default SSIDs for APs from different wireless
equipment vendors
AirMagnet Mobile scans the WLAN for unconfigured APs by
matching factory default settings against an internal database of well
known default configurations such as SSID. When a match is found,
AirMagnet
Mobile alerts the WLAN administrator of the
unconfigured AP. The administrator should change the default
settings of the AP to avoid easy hacking of the AP.
Device Vulnerable to Hotspot Attack Tools
A hotspot is any location where Wi-Fi network access is made
available for the general public. One often finds hotspots in airports,
hotels, coffee shops, and other places where business people tend to
congregate. It is probably one of the most important network access
services for business travelers these days. All the customer requires is
a wireless-enabled laptop or handheld. Then the user can connect to
the legitimate access point and get the service. Most Hotspots do not
require the user to have any advanced authentication mechanisms to
connect to the access point, instead simply popping up a web page
for the user to login. So, the criterion for entry is dependent only on
whether the subscriber has paid the subscription fees or not. In a
Default SSID Vendor / Products
tsunami Cisco Aironet
Compaq Compaq WL-100/200/300/400
WLAN D-Link DL-713
WLAN SMC SMC2652W/SMC2526W
comcomcom 3Com AirConnect
Intel Intel Pro/Wireless 2011
Symbol Symbol Technologies AP
AirPort Network Apple Airport
Mello ZCOMMax XWL 450
Roamabout Default
Network Name
Lucent, Cabletron, or Enterasys AP
Bridge SMC SMC2682
MAC address SOHOware NetBlaster
Laptop Wireless LAN Policy Reference Guide.book Page 11 Thursday, January 25, 2007 5:36 PM
12 Chapter 1: Configuration Vulnerabilities
AirMagnet Laptop Wireless LAN Policy Reference Guide
wireless hotspot environment, one can say that one should not trust
anyone else. Due to the concern of security these days, some WLAN
Hotspot vendors are using 802.1x or higher authentication
mechanisms to validate the identity of the user.
Figure 1-10: Basic components of a WLAN Hotspot network
The 4 components of a basic Hotspot network are:
• Hotspot Subscribers: These are valid users with a wireless
enabled laptop or handheld and valid login for accessing the
Hotspot network.
• WLAN Access Points: These can be SOHO gateways or
enterprise level access points depending upon the Hotspot
implementation.
• Hotspot Controllers: This box deals with user authentication,
gathering billing information, tracking usage time, filtering
functions, etc. This can be an independent machine, or can be
incorporated in the access point itself.
• Authentication Server: This server contains the login
credentials for the subscribers. The Hotspot controller will, in
most cases, verify the credential for the subscriber with the
authentication server after it is received.
Laptop Wireless LAN Policy Reference Guide.book Page 12 Thursday, January 25, 2007 5:36 PM
/