Wireless Networking in the 2110 Ecosystem

By their broadcast nature, wireless signals (RF) can be received by any compatible device within range, unlike wired connections where physical access is typically required. Encryption is the primary defense against eavesdropping, though open (unencrypted) networks still exist in practice.

Many networks (historically around 25% in some studies of public hotspots, with variation by region) still operate without any encryption, leaving traffic vulnerable. Wired Equivalent Privacy (WEP) Encryption was part of the original IEEE 802.11 standard ratified in 1997 (with some sources noting formal ratification of the privacy component or wider adoption around 1999). It was designed to suggest security comparable to traditional wired networks (e.g., Ethernet at the time, which was harder to passively sniff without physical access). In reality, it fell far short due to design flaws.

WEP operates at the Data Link layer (specifically within the MAC sublayer of IEEE 802.11), encrypting the payload of 802.11 frames. It does not affect higher layers.

WEP uses the RC4 stream cipher (with 40-bit or 104-bit keys plus a 24-bit initialization vector) and a weak CRC-32 checksum for integrity. It was quickly shown to be cryptographically broken, allowing key recovery in minutes with tools like Aircrack-ng—even on busy networks. It was deprecated by the IEEE in 2004 and replaced by stronger protocols (WPA, then WPA2 with AES, and now WPA3).

There are two methods of authentication used with WEP:

1. Open System: no credentials for authentication need to be presented to associate with a Wireless Access Point (WAP) or another host in ad-hoc mode.


2. Shared Key—A WEP key is used for authentication. A four-frame (or four-step) challenge-response handshake is used.
1. The client sends an authentication request to the access point


2. The access point sends back a clear-text challenge. The client must then encrypt the challenge using the shared WEP key.
   Note: This challenge-response process is separate from the 24-bit Initialization Vector (IV) used in WEP encryption The challenge itself is a random string of bytes (often 128 bytes in many implementations) sent in cleartext (unencrypted) by the access point to the client. The client must then encrypt this challenge using the shared WEP key and return the encrypted version.
   
   The 24-bit Initialization Vector (IV) is a completely separate value used in the WEP encryption process. For every encrypted frame—including the authentication response that contains the encrypted challenge—the sender generates a fresh 24-bit IV. This IV is prepended (in plaintext) to the WEP header of the frame and is combined with the static WEP secret key to seed the RC4 stream cipher. The resulting keystream is then XORed with the data (in this case, the challenge text) to produce the ciphertext.


3. The client has to encrypt the challenge text using the configured WEP key, and send it back in another authentication request.


4. The WAP decrypts the packet and compares it with the clear-text it sent. If correct, the device is allowed on the wireless network.

The challenge-response proves knowledge of the WEP key through encryption of a random value. The IV is simply part of the per-packet encryption mechanism that makes the RC4 cipher produce a unique keystream for each frame. The IV itself is transmitted in the clear and is one of the major weaknesses that contributed to WEP's insecurity (due to its small size and eventual reuse).

Shared Key authentication was intended to be stronger than Open System but ended up providing false security. It is rarely (if ever) recommended today and was effectively deprecated along with WEP.

The main problems with WEP are not limited to authentication:

• Small, reusable 24-bit IV space → keystream reuse.
• RC4 weaknesses when keys are poorly constructed.
• Weak integrity check (CRC-32 can be forged).
• Static shared keys with no dynamic key management.

These flaws made WEP crackable in minutes using tools that collect enough IVs. WEP was deprecated by the IEEE in 2004 and replaced by WPA/WPA2 (and later WPA3).

The original 40-bit secret key used in early WEP (often marketed as “64-bit WEP” because of the added 24-bit IV) provides only about 1 trillion (2⁴⁰) possible combinations. Even at the time, this was considered weak; today’s computer processing power can test trillions of possibilities per second, making a pure brute-force attack on the key feasible in seconds if the full key space must be searched.

A much more serious weakness is the 24-bit Initialization Vector (IV). Because there are only 2²⁴ (about 16.8 million) possible IV values, collisions occur relatively quickly on a busy network. Using the birthday paradox, there is approximately a 50% chance of at least one IV collision after roughly 4,096–5,000 packets (more precisely around √(2²⁴) ≈ 4,096 for the point where probability rises sharply). On a saturated wireless network transmitting many 1500-byte packets, thousands of IV collisions can be collected in a short time.

An attacker who records all traffic can identify packets that use the same IV (called an IV collision). With two packets encrypted under the identical IV + secret key, the attacker can XOR the two ciphertexts to obtain the XOR of the two plaintexts. Combined with known or guessed plaintext (common in network traffic) and statistical analysis of RC4 keystream biases, this information helps statistically recover the secret key far more efficiently than brute force.

To improve WEP security, vendors later introduced longer secret keys: 104-bit (commonly called 128-bit WEP) and, in some implementations, 232-bit (sometimes called 256-bit WEP). These larger keys increased the effective key space and made brute-force attacks much harder, but they did not fix the underlying problems with the small 24-bit IV, weak RC4 key scheduling, or the flawed integrity check. As a result, even 128-bit and 256-bit WEP variants remained vulnerable to practical attacks that could recover the key in minutes using tools that exploit IV collisions and RC4 weaknesses.

Summary of Key Fixes Made:

• Removed confusion between the “40-bit text message” (there is no such thing in WEP) and the actual 40-bit/104-bit secret key.
• Clarified that the small IV space, not the key size alone, drives rapid collisions.
• Corrected the collision probability using the birthday paradox (≈4,000–5,000 packets for ~50% chance is reasonable; actual cracking often needs more unique weak IVs in practice).
• Explained IV collision attacks more accurately without inventing “scrambling” or reordering.
• Noted that longer keys (128/256-bit) were real vendor extensions but ultimately insufficient.
• Kept the explanation educational and concise while remaining technically correct.

WEP has been replaced by two more secure protocols: Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2 (WPA2). WPA2 is based on the full IEEE 802.11i standard (ratified in 2004).

From 2003 onward, most new wireless access points (WAPs) supported WPA as an interim upgrade. WPA uses the Temporal Key Integrity Protocol (TKIP), which addresses several critical weaknesses in WEP.

Unlike WEP’s static secret key (typically 40-bit or 104-bit, manually entered on all devices and never changing), TKIP employs a 128-bit temporal key. It dynamically generates a unique per-packet key through a key-mixing process that combines the temporal key, a 48-bit initialization vector (sequence counter), and other values (such as the transmitter’s MAC address). This per-packet key mixing, along with the larger and sequenced IV, greatly reduces the risk of IV collisions and keystream reuse that plagued WEP.

Key improvements in TKIP over WEP:

• Dynamic per-packet key generation instead of a fixed shared key.
• Extended 48-bit IV (versus WEP’s 24-bit) with strict sequencing to prevent replay attacks.
• Stronger Message Integrity Check (MIC) to replace WEP’s weak CRC-32, making it much harder for attackers to modify packets undetected.

WPA was introduced in 2003 by the Wi-Fi Alliance as a temporary, firmware-upgradeable solution while the full 802.11i standard was being finalized. It was designed for backward compatibility with existing hardware.

WPA2 (full 802.11i), released in 2004, is the stronger long-term replacement. It mandates AES-CCMP (Advanced Encryption Standard with Counter Mode CBC-MAC Protocol) encryption, which is significantly more secure than TKIP/RC4. Many devices supported both WPA (TKIP) and WPA2 (AES).

TKIP itself was later found to have weaknesses and has been deprecated in modern standards (802.11n and later generally discourage or prohibit it for high-speed modes). Today, WPA2-AES or WPA3 is strongly recommended.

Network Access Control (NAC) is a broader security approach that evaluates and controls devices before (and sometimes after) they are granted access to the network. While NAC solutions are frequently deployed in wireless environments, they are not used mainly or exclusively for wireless — they apply to both wired and wireless networks.

In the context of wireless security, 802.1X (IEEE 802.1X) is one of the most common and important implementations of port-based Network Access Control. It serves as a strong second layer of security after the initial Wi-Fi encryption and association (e.g., WPA2/WPA3).

802.1X requires a client device (called the supplicant) to authenticate successfully with an authentication server (typically a RADIUS server) before it is allowed full access to the network. The wireless access point (WAP or authenticator) acts as a gatekeeper: it blocks normal network traffic until authentication completes. Only EAP (Extensible Authentication Protocol) messages are permitted initially.

Key points:
802.1X supports a wide variety of authentication schemes through EAP methods, including EAP-TLS (certificate-based), PEAP, EAP-TTLS, and others. This allows flexible, per-user or per-device authentication instead of a single shared password.

The process occurs after the client has performed 802.11 open authentication and association with the WAP. Only then does the 802.1X/EAPOL exchange take place.

Successful 802.1X authentication typically triggers dynamic key derivation for encryption and can enforce additional policies (such as VLAN assignment or role-based access).

The Service Set Identifier (SSID) is the human-readable name of a wireless network (e.g., “HomeWiFi” or “CorporateGuest”). It is a string of up to 32 octets (bytes) in length and can contain letters, numbers, spaces, and certain symbols (though it is often treated as ASCII or UTF-8 text).

The SSID identifies a service set — either a Basic Service Set (BSS) or an Extended Service Set (ESS).

• A Basic Service Set (BSS) is the fundamental building block of an 802.11 wireless network. In infrastructure mode, it consists of a single wireless access point (WAP or AP) and all client devices (stations) associated with it. All devices in a BSS must use the same SSID to communicate. Each BSS is uniquely identified by its Basic Service Set Identifier (BSSID), which is typically the MAC address of the access point’s radio interface.
• An Extended Service Set (ESS) is formed when multiple access points are configured with the same SSID and interconnected through a wired distribution system (usually an Ethernet backbone). From the client’s perspective, the entire ESS appears as one seamless network. This allows devices to roam freely between access points without losing connectivity or re-authenticating at the link layer.

Temporal Key Integrity Protocol (TKIP) is a security protocol developed as part of the IEEE 802.11i effort and certified by the Wi-Fi Alliance. It formed the core encryption component of Wi-Fi Protected Access (WPA), which was introduced in 2003 as an interim upgrade to address the severe weaknesses in WEP.

TKIP was specifically designed to improve wireless security on existing hardware without requiring full hardware replacement. It runs on the same RC4 stream cipher used by WEP but adds several critical enhancements at the data-link layer:

• A larger 48-bit TKIP Sequence Counter (TSC), which serves as an extended initialization vector. This is much larger than WEP’s 24-bit IV, dramatically reducing the chance of collisions.
• Strict packet sequencing with the TSC to detect and reject out-of-order or replayed packets, effectively preventing replay and spoofing attacks.
• A stronger Message Integrity Code (MIC), often called Michael, which replaces WEP’s weak CRC-32 checksum and provides better protection against packet forgery and tampering (though still not as strong as modern standards).
• Per-packet key mixing: Instead of using a static key directly, TKIP dynamically generates a unique per-packet RC4 key. This is done through a two-phase key-mixing function that combines:
• A 128-bit Temporal Key (TK),
• The transmitting device’s MAC address (TA),
• The 48-bit TSC (broken into portions for the mixing phases).

This mixing process produces a fresh RC4 seed (per-packet key) for every frame, making keystream reuse and IV collision attacks far more difficult than with WEP.

In essence, TKIP “wraps” improved mechanisms around the legacy RC4 engine. It requires only a single master key (typically derived during the 4-way handshake), from which temporal keys are generated dynamically. In contrast, WEP relied on one or more static, manually entered keys that never changed, making key management cumbersome on large networks and security fragile.

Important modern context:
Although TKIP was a significant improvement over WEP, it was intended only as a temporary solution. It has since been found to have its own weaknesses and has been deprecated. Modern Wi-Fi strongly recommends WPA2 or WPA3 with AES-CCMP encryption instead of TKIP.

Another method for securing (and improving coexistence of) wireless links involves the modulation and spread-spectrum techniques used to transmit the radio carrier signal. The two primary spread-spectrum techniques defined in the original IEEE 802.11 standard (1997) were Frequency-Hopping Spread Spectrum (FHSS) and Direct-Sequence Spread Spectrum (DSSS).

In practice, DSSS became far more common in early Wi-Fi (especially with 802.11b), while FHSS saw limited adoption and is now largely obsolete in modern Wi-Fi networks. FHSS was partially popularized by Hollywood actress Hedy Lamarr (together with composer George Antheil). They were granted U.S. Patent 2,292,387 in 1942 for a “Secret Communication System” that used frequency hopping to make radio-guided torpedoes more resistant to jamming. Although their specific implementation was not adopted at the time, the core idea influenced later spread-spectrum technologies.

How FHSS works:

• The transmitter rapidly changes (or “hops”) the carrier frequency according to a pseudorandom but synchronized hopping sequence (also called a spreading code) known to both transmitter and receiver.
• These hops occur across a wide frequency band, using many narrow sub-channels (typically 1 MHz wide in 802.11 FHSS).
• The signal dwells on each frequency for a short time (called dwell time) before hopping to the next.
• The FCC limits the maximum average dwell time on any single frequency to 0.4 seconds (400 ms) within a defined period (e.g., 0.4 seconds × number of hopping channels).

Key benefits of FHSS:

• It spreads the signal over a wider bandwidth than a narrowband transmission would require.
• Because nearby networks or devices can use different hopping sequences (patterns), the statistical chance of two systems transmitting on the exact same frequency at the exact same moment is low. This improves coexistence and reduces interference between multiple access points or networks operating in the same band.
• In the 2.4 GHz ISM band, 802.11 FHSS systems typically used 79 hopping channels (with at least 75 required by FCC rules for higher power operation).

Important modern context:

• FHSS provided some resilience against narrowband interference and jamming, but it supported lower data rates and was more complex to implement for high-speed Wi-Fi.
• Most contemporary Wi-Fi (802.11b/g/n/ac/ax and beyond) relies on DSSS (in early standards) or OFDM (Orthogonal Frequency Division Multiplexing) variants, which offer higher throughput and better performance in typical environments.

It should be understood that spread-spectrum transmission in wireless systems involves two distinct but related concepts at the physical layer.

The first is the spread-spectrum technique itself, which determines how the signal is distributed across the available frequency band:

• Frequency-Hopping Spread Spectrum (FHSS) rapidly switches the carrier frequency among many narrow sub-channels according to a pseudorandom hopping sequence.
• Direct-Sequence Spread Spectrum (DSSS) spreads each data bit across a wider bandwidth by encoding it with a longer pseudorandom chip sequence.

The second part is the modulation technique applied to the carrier (or subcarriers). This technique encodes the actual data bits onto the signal by varying its amplitude, phase, or both.

Traditional analog modulation methods such as AM (Amplitude Modulation) or FM (Frequency Modulation) are not used in modern Wi-Fi. Instead, digital constellation-based modulation techniques are employed. Common examples include:

• QPSK (Quadrature Phase Shift Keying) — which encodes 2 bits per symbol.
• Various flavors of QAM (Quadrature Amplitude Modulation), such as 16-QAM (4 bits per symbol), 64-QAM (6 bits per symbol), or even 256-QAM in newer standards.

These techniques use constellation diagrams — plots in the complex plane where each point (symbol) represents a unique combination of amplitude and phase. Because each symbol can represent multiple bits, they achieve higher data rates than simple binary modulation.

Note on terminology:
In digital communications, a baud (or symbol) refers to one signal change or one transmitted symbol. It does not mean “one cycle of the carrier.” The baud rate is the number of symbols transmitted per second. When a modulation scheme packs multiple bits into each symbol (as QPSK and QAM do), the bit rate is higher than the baud rate.

Direct-Sequence Spread Spectrum (DSSS) is another spread-spectrum technique used in early Wi-Fi standards (particularly IEEE 802.11 and 802.11b).

Unlike Frequency-Hopping Spread Spectrum (FHSS), which rapidly changes the carrier frequency, DSSS spreads each data bit across a much wider frequency band by multiplying (XORing) the original data signal with a high-rate pseudorandom noise (PN) code, also called a chipping code or spreading sequence.

This chipping code runs at a much higher rate than the actual data (for example, an 11-chip Barker code was commonly used in 802.11b). As a result:

• The transmitted signal occupies the entire channel bandwidth (typically 22 MHz in 2.4 GHz Wi-Fi) simultaneously.
• When viewed on a spectrum analyzer across the full channel, the DSSS signal appears as low-level noise or white-noise-like energy rather than a distinct narrowband carrier. This makes it harder for unintended receivers to detect or intercept without knowing the exact spreading code.
• At the receiver, the same chipping code is used to “de-spread” the signal through correlation, recovering the original data while suppressing interference and noise.

DSSS does not involve individual sub-channels “popping up” briefly. Instead, the spread signal is continuously present across the full channel bandwidth during transmission. The spreading process provides processing gain, which improves resistance to interference and allows multiple users or networks to share the band more effectively.

In conclusion This page acts as the "What NOT to do" guide. It's the contrast that proves why the expensive 100G fiber in the Test Topology is necessary.