How do I get the school across the street to stop flooding me off my own wireless network?

Page 2 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

Old Hippie

Diamond Member
Oct 8, 2005
6,361
1
0
Originally posted by: RebateMonger
Originally posted by: Old Hippie
Is this a threat to that system, or a countermeasure against something?
It's intended to "drown" an unauthorized wireless access point inside a company's network. In this case, it's interfering with other people's networks outside their building.

Ah Ha, I see says the Old Blind Hippie.

Thanks RM!
 

chucky2

Lifer
Dec 9, 1999
10,016
36
86
Originally posted by: spidey07
Originally posted by: chucky2
If all else fails, you could get a 802.11n router that broadcasts on 5GHz...then again, you'd need wireless NIC's that broadcast on 5GHz as well...but, if you have that capability, then you could go that route.

I say talk to the school folks...it's entirely possible they don't know as much as you and will work with you to resolve the problem as long as you remain civil.

If they dismiss you, sigh and say 'I was afraid you'd say that, now I've got to get the FCC involved...do you know if I list you as the aggravating party, the principle, or would that be the board president? All 3?'

They may take the hint then that you're not going away....

Chuck

*chuckle*
The school is using a professionally installed system doing what it is supposed to do. Also they are probably already using the 5Ghz band so no guarantee there. 75-100 feet is nothing for open air wifi.

Since OP specifies 30 minutes, that's a magic timer for cisco's solution. It's when RF management kicks in and all the radios change.

I dismiss you easily as I am well within FCC regulations on total energy output.

I realize it may be professionally installed, but that doesn't mean the people who maintain it are uber-professionals (such as yourself) themselves. I used to work in IT in Education, believe me, I know schools have a whole gamut of experienced people - some with uber skillz, and some with no skillz at all.

I cannot imagine the FCC's best practice is to allow entities to broadcast significantly outside their needed coverage are if conditions don't warrant it, especially when it's needlessly F'ing over other people and those people are complaining. If that's accepted, he could do the same thing and the networks can just fight it out as cmetz described? That sounds like the exact opposite reason the FCC was in part chartered for...

OP: Go grab a 5GHz 802.11n router from Worst Buy, open the packaging nicely, and just see if the school really is using the 5GHz band. If they're not, and you can switch over, your problem is easily solved (even though it'll cost you some money).

Chuck
 

nightowl

Golden Member
Oct 12, 2000
1,935
0
0
Originally posted by: spidey07
Originally posted by: chucky2
If all else fails, you could get a 802.11n router that broadcasts on 5GHz...then again, you'd need wireless NIC's that broadcast on 5GHz as well...but, if you have that capability, then you could go that route.

I say talk to the school folks...it's entirely possible they don't know as much as you and will work with you to resolve the problem as long as you remain civil.

If they dismiss you, sigh and say 'I was afraid you'd say that, now I've got to get the FCC involved...do you know if I list you as the aggravating party, the principle, or would that be the board president? All 3?'

They may take the hint then that you're not going away....

Chuck

*chuckle*
The school is using a professionally installed system doing what it is supposed to do. Also they are probably already using the 5Ghz band so no guarantee there. 75-100 feet is nothing for open air wifi.

Since OP specifies 30 minutes, that's a magic timer for cisco's solution. It's when RF management kicks in and all the radios change.

I dismiss you easily as I am well within FCC regulations on total energy output.

Nope, the timer by default is 10 minuted on Cisco controllers for Auto RF (just checked mine). Also, as I stated before the Cisco controllers DO NOT automatically contain "rogue" access points. That is because it cannot tell if it is an AP that is connected to the network or not.
 

ScottMac

Moderator<br>Networking<br>Elite member
Mar 19, 2001
5,471
2
0
Directional antennas would definitely help for both sides.

OP: Have you gone over there and told them they are interfering? It's usually not in the school's interest to piss off the neighbors, and for the few I've dealt with (as customers), if you let them know they are interfering. there's a pretty good chance they will have the installers back to make some adjustments.

If they flip you off, then start escalating, including letting them know that you will send some editorial letters to the local newspaper, and (if you have a station that does this) the local consumer advocate.

You're the one that knows what your pain threshold is ... which is more bother? just getting up & running, or going through the steps to get someone else to change their system?

Chances are you'll end up paying for it one way or the other ... either through taxes or directly out of your wallet.

Decide, then act.

Good Luck
Scott
 

Twr1

Junior Member
May 2, 2006
22
0
0
Simple one.
Set up your MAC filter to accept only your devices. Or
Configure encryption to keep other devices from connecting.

If you still have problems and get no response from contacting the school. Make it their problem.

Set up a spare router in your window facing the school. Disconnect it from the Internet and set ?AP Isolation? to enabled (DD-WRT) It may go by a different name depending on the brand of Router. This will stop any device from connecting to anything through the AP. Set up your main router on a different channel and enjoy.

Set timer on how long it takes the school to configure their client devices to not roam.
 

Joemonkey

Diamond Member
Mar 3, 2001
8,859
2
0
Originally posted by: Twr1
Simple one.
Set up your MAC filter to accept only your devices. Or
Configure encryption to keep other devices from connecting.

If you still have problems and get no response from contacting the school. Make it their problem.

I've done all this. What some people don't seem to realize is that the school's WAPs are actually attacking the CLIENTs, they don't attack my WAP. They spoof the SSID and MAC (even if broadcast is turned off) of my WAP, then send DoS from there to keep my clients from connecting. Here is an excel doc that shows what happens, it is acutally much less than 30 minutes

Text
 

cmetz

Platinum Member
Nov 13, 2001
2,296
0
0
Old Hippie, the concept here is that a land owner (the school) is trying to restrict ISM band 802.11 access points on their land to only be their authorized and approved access points. They're doing this using a countermeasure that intentionally interferes with any access points that aren't authorized.

The flaws in this approach are:

1. Radio waves don't magically stop at the boundaries of your land. Signals from other folks outside your land enter your land, and signals from inside your land exit your land.
2. The land owner does not own the ISM frequency band, they are an unlicensed user of the public's airspace.
3. They're protecting the wrong thing anyway.

(1) is the genesis of the FCC and the Communications Act of 1934. A constitutionally-minded oberver might ask why a radio dispute between OP and the school across the street is even a federal legal issue - it's because RF energy waves travel an infinite distance (though with vanishingly small power). It's this realization that radio waves don't care one bit about the boundaries of your land that requires a different approach to resource allocation and sharing for radio to maximize the public good of radio technology.

(2) ahh yes. This point is the part where I see people get confused all the time. *ALL* frequencies are owned by the public. That's the way the law works. Some frequency bands are licensed to an exclusive user (the government, a corporation, etc.) - when you hear about multi-billion dollar spectrum auctions, that's what's being sold, an exclusive license. Because it's a license, the FCC can still set some terms through their regulatory process. Some frequency bands are licensed to a use, and may or may not require station licenses. For example, FM radio bands are allocated to that service, and stations that want to transmit above a certain exempted power threshold have to go through a pretty serious licensing process. And some frequency bands are licensed for "unlicensed" use, subject to various ground rules and device approval. For example, the 2.4GHz ISM band, which was once thought to be useless, is set up for unlicensed use within a set of regulations. One of those regulations is the nearly universal FCC regulation that devices must not intentionally interfere with other users of the same tier.

Many business and even government types are used to *owning* things, which means that they can legally control access to them. As a business owner, you're used to the idea that you own (or have an exclusive lease to) your building, and you can lock the doors, or require a badge for access, and, most importantly, if somebody is on your premesis without permission, you can have your security people escort them away or call the police to do the same. It's your property, it's your boundaries, and it's necessary that you preserve the security of your business. They're so used to owning things that they have trouble dealing with things they might use and depend on, but don't and can't own. And often they deal with it by just applying the ownership model they're used to, even if it doesn't apply.

You don't own the ISM band. Neither does the school system. As neither of you have any ownership/property rights to the band, you also have no right to exclude others from use of it. We are all guests as 802.11 users on the ISM band. The public owns the band, users are guests. No guest has any right to prevent any other guest from using the resource.

This, of course, does not stop confused folks from trying. If you let them routinely treat the ISM band as a resource that they own, then by default, they do. Ever heard the phrase "possession is 9/10 of the law"?

(3) So why is an enterprise concerned with a rogue AP anyway? If your network is designed such that anybody can walk up, plug in a Linksys AP, and bridge the public airwaves to your network, your network security sucks. Unfortunately, that's exactly the problem that a lot of large enterprises have. They have no internal security, and they think that the solution is to have really aggressive border protections. Since the 802.11 public airwaves are a border, obviously, they must aggressively protect it. This approach is what security folks call "crunchy outside, chewy inside." Once the next wireless technology comes along that their currently installed defenses can't see, they're wide open. If a user enters the premesis with a laptop, they're wide open. And so on. This kind of approach to network security is just totally doomed to failure, yet it's the overwhelmingly common approach still in 2008. Rather than fix the problem the right way, most large enterprises are still investing heavily in border defenses like active 802.11 rogue AP detection techniques. If, instead, a rogue AP can be physically plugged into your network but won't be able to get anywhere due to your internal security measures, you don't need such a thing.




802.11 exists because there was an unlicensed band available to all that it could work in. It wasn't large enterprises and government that really made 802.11 popular, it was small tech companies and hobbyists that were the early adopters (yes, the gear was Lucent and Proxim). If the ISM bands cease to be a public resource and become a resource that is controlled by the biggest bully on the block, then it will also lose the level of technical innovation and growth that we've seen so far. Early pre-802.11 WaveLAN sucked compared to what we have today. But try to explain public good and technical innovation to most large enterprises and you get blank stares - they're too focused on THEIR NEEDS to look at the big picture.
 

Twr1

Junior Member
May 2, 2006
22
0
0
Originally posted by: Joemonkey

I've done all this. What some people don't seem to realize is that the school's WAPs are actually attacking the CLIENTs, they don't attack my WAP. They spoof the SSID and MAC (even if broadcast is turned off) of my WAP, then send DoS from there to keep my clients from connecting. Here is an excel doc that shows what happens, it is acutally much less than 30 minutes

Text

Are you sure SSID Octopus is from the school? It doesn't match their naming convention.

 

Joemonkey

Diamond Member
Mar 3, 2001
8,859
2
0
Originally posted by: Twr1
Originally posted by: Joemonkey

I've done all this. What some people don't seem to realize is that the school's WAPs are actually attacking the CLIENTs, they don't attack my WAP. They spoof the SSID and MAC (even if broadcast is turned off) of my WAP, then send DoS from there to keep my clients from connecting. Here is an excel doc that shows what happens, it is acutally much less than 30 minutes

Text

Are you sure SSID Octopus is from the school? It doesn't match their naming convention.

My SSID is Octopus. You can see one of their WAPs change it's SSID (or add it) to Octopus to kick off my clients. That is the whole point of the Excel file, it shows you step by step when they do it, and that the MAC address of their WAP changes to Octopus.

In any event, I never got a call back from the technology office and even called them back and left a message. So over the weekend I'm left with no useable wireless service yet again. My router is draft N, so I could go purchase a couple of USB 802.11N adapters and use them, as well as buy an ethernet adapter for my Wii, but why should I shell out ~$150 when I don't have to?
 

chucky2

Lifer
Dec 9, 1999
10,016
36
86
There's Draft N for 2.4 band, an Draft N for 5GHz band. Can you tell if the school is using 2.4, 5GHz, or both?

If they're not using 5GHz band, then maybe you can strike a deal where they split the cost with you, rather than start d1cking around with their network they're not going to want to change.

If they don't get back to you in a couple of days, it sounds like you're going to have to show up at the school rather than wait for them to call you back...sux, but that's the way the game is often played...

Chuck
 

Joemonkey

Diamond Member
Mar 3, 2001
8,859
2
0
They actually had a carnival for their kids today, so I went over there with my niece that attends the school and talked to the principal, who obviously had no idea what I was talking about. However, she did confirm that no one at the school has anything to do with the set up so calling the technology office is the right way to go. So, instead of showing up at the school I'd have to show up at the technology office. The principal is also friends with my sister and after explaining the situation she said if the technology office isn't willing to help to call her directly and she'll talk to them.

I don't know if they are using N at all, as my airmagnet card is only a/b/g and I have no draft N cards. I guess I could bite the bullet and go out and buy a USB draft N adapter from walmart or office depot (only stores close by) and see what happens, but even if I buy one for each laptop I'd still have to get the ethernet adapter for my Wii.
 

RebateMonger

Elite Member
Dec 24, 2005
11,586
0
0
A Google search also reveals that one brand (Airgo) of the early draft-N equipment would wipe out any 802.11 b/g networks that were in range, "legally". This Airgo chipset was used in the Netgear RangeMax 240.

Blogs.ZDNet.com

" (2006) While Airgo?s third generation product achieves record breaking throughput, it annihilates any legacy 802.11 b/g product in the vicinity and effectively shuts them down. The other products from Broadcom and Marvel weren?t quite as devastating to the neighbors, but the damage is still severe. What?s crazy is that these products are FCC legal and are being sold on store shelves today. This is a serious problem in the city where town homes and condominiums are right next to each other and it?s even a problem for businesses which primarily uses 802.11 b/g. While these products are aimed at the home market, they?re also sometimes used in a small office environment and these radio jamming characteristics are intermittent (when data is being sent) and difficult to track down. "
 

JackBurton

Lifer
Jul 18, 2000
15,993
14
81
They want to play that game? If they want to jam your AP, have them try to jam 53,000 APs. This may overwhelm their security system by having it chase down so many APs. You also maybe able to hide within all these ghost APs.
 

Twr1

Junior Member
May 2, 2006
22
0
0
I have to agree to the Fake AP.

The School?s MAC address reference to the vendor Enterasys. It seems likely someone may be cloning the Enterasys MAC and then doing an attack. The timing of the change to a different SSID could tell you if it?s automated or manual. If it is manual, it may not be originating at the School.
A directional antenna and a laptop could be useful here.
 
May 16, 2000
13,522
0
0
I'd say be upfront and nice to them, and see if they'll work a solution with you. If not, talk to some shady types and find a way to cost the school millions of dollars (fry equipment, legal hassles, etc). When big guys push little guys around, the big guys should be destroyed. Always.

People are more important than groups/organizations/corporations. Always. Fuck em.
 

Old Hippie

Diamond Member
Oct 8, 2005
6,361
1
0
Originally posted by: cmetz
Old Hippie, the concept here is that a land owner (the school) is trying to restrict ISM band 802.11 access points on their land to only be their authorized and approved access points. They're doing this using a countermeasure that intentionally interferes with any access points that aren't authorized. .........

But try to explain public good and technical innovation to most large enterprises and you get blank stares - they're too focused on THEIR NEEDS to look at the big picture.

Nice cmetz! Would have taken me an hour to type that.

I'm voting for JB's jam trick. :thumbsup:

 

Joemonkey

Diamond Member
Mar 3, 2001
8,859
2
0
Received a call from the technology office today requesting I email my wireless MAC addresses to them, which I did. Now it's up to them to see what happens. Here is a portion of the email I sent:

"Good morning. I did some research about your Enterasys WAPs and found this information:

?RoamAbout simplifies roll-outs with enhanced automation tools, and comprehensively secures the wireless infrastructure with leading-edge encryption, authentication, rogue access point detection and WLAN intrusion defense.?

So, if you turned off the bolded portion we shouldn?t have an issue. In fact, this issue just started about a week and a half ago so I don?t think the rogue access point detection was turned on until recently. Also, adding my MAC addresses to your ignore list should take care of things, but wouldn?t that mean every time I had a visitor or bought a new wireless device I would have to report that MAC address to you as well? Same thing if I change my SSID?

I have attached an Excel document with some notes and screenshots I took while running Airmagnet software. It shows specifically your danville_domain WAP with MAC address 00:11:88:87:0D:90 performing a DoS attack on my wireless devices after spoofing my MAC address and changing to the channel my SSID is on. Give me a call if you need more information or need to discuss options. Thanks."



 

Joemonkey

Diamond Member
Mar 3, 2001
8,859
2
0
Response from school system:

About the same time you started having problems we performed a firmware and software update to our wireless infrastructure. What I didn?t see at the time was that some options were changed regarding the handling of RF countermeasures. Our control software still showed it was disabled, but on the security switch level it changed over to ?attack? anything detected.

I went ahead and placed the MAC of your AP in the ignore category. Searching through the logs I couldn?t find a mention of any of your other MAC addresses. The only mention I found of your AP?s MAC was it being detected as an ad-hoc client, but before I found the other problem the security switch was performing a disconnect attack.

So sorry for the inconvenience, it was never our intention to disable any network outside of our buildings. Unfortunately the change in settings wasn?t mentioned in the release notes we had and when I checked it the first time after you contacted us everything looked like it was normal and shouldn?t have been impacting you or anyone else.

Let either me or Jacob know if you have any further problems.

My response:

So will you be turning this off completely or will I have to inform you of any changes I make to my WAP settings, such as buying a new router or changing my SSID? What will happen if others in the neighborhood attempt to install a wireless network? Thanks again.
 

Joemonkey

Diamond Member
Mar 3, 2001
8,859
2
0
OK hopefully the final update:

From the school system

Yes the setting was meant to be off in the first place. But a configuration error had it switched on for everything not part of our network. It should be saved and turned off now so you shouldn?t have to do anything else.
 

JackMDS

Elite Member
Super Moderator
Oct 25, 1999
29,484
391
126
Happy Ending and a proof that ?Yahoo, Hurrah, and attack? is Not always the best choice.

:thumbsup:
 

bruceb

Diamond Member
Aug 20, 2004
8,874
111
106
Let's hope it stays fixed.
Update us in about 1-3 weeks
and let us know if all is still ok
 
sale-70-410-exam    | Exam-200-125-pdf    | we-sale-70-410-exam    | hot-sale-70-410-exam    | Latest-exam-700-603-Dumps    | Dumps-98-363-exams-date    | Certs-200-125-date    | Dumps-300-075-exams-date    | hot-sale-book-C8010-726-book    | Hot-Sale-200-310-Exam    | Exam-Description-200-310-dumps?    | hot-sale-book-200-125-book    | Latest-Updated-300-209-Exam    | Dumps-210-260-exams-date    | Download-200-125-Exam-PDF    | Exam-Description-300-101-dumps    | Certs-300-101-date    | Hot-Sale-300-075-Exam    | Latest-exam-200-125-Dumps    | Exam-Description-200-125-dumps    | Latest-Updated-300-075-Exam    | hot-sale-book-210-260-book    | Dumps-200-901-exams-date    | Certs-200-901-date    | Latest-exam-1Z0-062-Dumps    | Hot-Sale-1Z0-062-Exam    | Certs-CSSLP-date    | 100%-Pass-70-383-Exams    | Latest-JN0-360-real-exam-questions    | 100%-Pass-4A0-100-Real-Exam-Questions    | Dumps-300-135-exams-date    | Passed-200-105-Tech-Exams    | Latest-Updated-200-310-Exam    | Download-300-070-Exam-PDF    | Hot-Sale-JN0-360-Exam    | 100%-Pass-JN0-360-Exams    | 100%-Pass-JN0-360-Real-Exam-Questions    | Dumps-JN0-360-exams-date    | Exam-Description-1Z0-876-dumps    | Latest-exam-1Z0-876-Dumps    | Dumps-HPE0-Y53-exams-date    | 2017-Latest-HPE0-Y53-Exam    | 100%-Pass-HPE0-Y53-Real-Exam-Questions    | Pass-4A0-100-Exam    | Latest-4A0-100-Questions    | Dumps-98-365-exams-date    | 2017-Latest-98-365-Exam    | 100%-Pass-VCS-254-Exams    | 2017-Latest-VCS-273-Exam    | Dumps-200-355-exams-date    | 2017-Latest-300-320-Exam    | Pass-300-101-Exam    | 100%-Pass-300-115-Exams    |
http://www.portvapes.co.uk/    | http://www.portvapes.co.uk/    |