Re: Wireless Network in Public Places Options

From: Jeff Liebermann (jeffl_at_comix.santa-cruz.ca.us)
Date: 02/11/05 

Date: Fri, 11 Feb 2005 10:08:50 -0800

On Thu, 10 Feb 2005 17:49:22 -0600, Smowk <SmowkOne@Yahoo.com> wrote:

>Jeff Liebermann <jeffl@comix.santa-cruz.ca.us> wrote in
>news:eq2n01drgkhb3el6draacn7usklfifk33u@4ax.com:
>
>> Well, the way this is done is to disable the dynamic bridging table
>> feature of the switch, and implement a static bridging table. Each
>> wireless MAC address goes to a specific ethernet port, which only
>> allows traffic to one other ethernet port, which conveniently happens
>> to be that of the router.

>yea, but we would have to register all of the mac addresses of the guests who
>use the hotels wifi and set it up manually for each new user (around 20 or so
>per day peak season).
>right?
>other than that, i agree with phil...VERY GOOD EXPLANATION
>smowk

Nope. Here's where I get on thin ice as I'm not sure how existing
implementations do such things. I'm also not too good on the protocol
thing. Therefore, I'll guess(tm) how I would implement such a scheme.

The bridging algorithm needs a bit of tweaking. For example, the
bridge would still automatically sniff for 802.3 ethernet packets
source MAC addresses. However, instead of allowing multiple MAC
addresses per port and multiple MAC addresses per destination, it
would have a fixed destination MAC address pointing at the router
port. Any other MAC destination addresses or other source addresses
would simply be ignored. The switch (multi-port bridge) would still
be able to connect new wireless MAC addresses to the router port after
a disconnect, but destination MAC addresses other than the router
would be ignored.

Packets with no destination addresses such as broadcasts and DHCP
requests would also need to be handled. Broadcasts have a source, but
no destination MAC address. So, the switch sends them to every port.
Not good. So, the broadcast mechanism has to restricted to pass
broadcasts only to the port in the bridging table. Broadcasts from
the router port go to every port and wireless connection.

As I vaguely recall, that's the way some ancient access point firmware
worked. I do recall the constant complaints in the mailing lists that
some access points would not allow communications between wireless
clients, or between wireless clients and wired LAN ports. For WISP
(wireless ISP), hot spot, and neighborhood LAN service, it's the
desired mode of operation.

Again, this cannot be done at the IP level by tweaking the routing
table even if every client were trustworthy. There would be nothing
to prevent a client from turning your access point into their private
game network, which never sees the router or goes to the internet.
Also, without any control, everyone would also get everyone else's
broadcasts. Therefore, it has to be one at with a bridge/switch at
the MAC level. 

-- 
Jeff Liebermann    jeffl@comix.santa-cruz.ca.us
150 Felker St #D   http://www.LearnByDestroying.com
Santa Cruz CA 95060    AE6KS  831-336-2558

Relevant Pages

  • Re: Wireless Network in Public Places Options
    ... > source MAC addresses. ... > addresses per port and multiple MAC addresses per destination, ... > would have a fixed destination MAC address pointing at the router ... > Packets with no destination addresses such as broadcasts and DHCP ...
    (microsoft.public.win2000.networking)
  • Re: Scan for "outsider" Pcs on network
    ... can use is the MAC address. ... switch ports by MAC address does not secure one's Ethernet network. ... switch port set up to only accept their mac address. ... OpenBSD Box (SOB) set up as a bridge.He drops it inline with the ...
    (Focus-IDS)
  • Re: Its War!
    ... they know which port is doing what. ... Once they have that MAC address, ... security seriously, they have tied your MAC address to you. ... log into the router for Internet, the mere fact that you can get ...
    (microsoft.public.windowsxp.general)
  • Re: port-security and IP Phones
    ... In fact the MAC address was still known on that port ... switchport port-security aging type inactivity ...
    (comp.dcom.sys.cisco)
  • Re: Mass storage device support in WM5
    ... This would mean that I could use it on my mac as ... I'd been using a usb1 port with a hub. ... If I turn off the Axim, ... I do NOT have Active sync installed on this machine. ...
    (microsoft.public.pocketpc)