1 DAIR: Dense Array of Inexpensive Radios Managing Enterprise Wireless Networks Using Desktop Infrastructure Victor Bahl †, Jitendra Padhye †, Lenin Ravnindranath †, Manpreet Singh ‡, Alec Wolman †, Brian Zill † † Microsoft Research ‡ Cornell University

2 Observations Outfitting a desktop PC with wireless is becoming very inexpensive –Wireless USB dongles are cheap –PC motherboards are starting to appear with radios built-in Desktop PC’s with good wired connectivity are ubiquitous in enterprises $6.99!

3 Key Insight Combine to provide a dense deployment of wireless “sensors” We can use this platform to realize the full potential of wireless networks –Enterprise wireless management tools –Enable new services where wireless is a key component

4 The DAIR Platform Wireless management tools –Improve security –Reduce IT ops costs –Increase “quality of service” New applications and services –Location services –Seamless roaming –Alternative data distribution channel

5 Outline Motivation DAIR architecture Management apps (& Rogue networks) Related work

6 Enterprise WLAN Management Corporations spend a lot on WLAN infrastructure –Worldwide enterprise WLAN business expected to grow from $1.1 billion this year to $3.5 billion in 2009 –MS IT dept. – 72% of costs are people Security and reliability are major concerns –Wireless networks are becoming a target for hackers –Reliability: MS IT receives ~500 WLAN helpdesk requests per month No easy way to measure cost of reliability problems

7 Advantages of the DAIR Approach –High density Wireless propagation is highly variable in enterprise environments (many obstructions) Lots of channels to cover: 11 for b/g, 13 for a Improves fidelity of many management tasks Enables accurate location (useful as a diagnosis tool) –Stationary sensing Provides predictable coverage Also helps enable location services Allows meaningful historical analysis –Desktop resources Spare CPU, disk, and memory Good connectivity to wired network Wall power

8 Outline Motivation DAIR architecture Management apps (& Rogue networks) Related work

9 DAIR Architecture

10

11 Outline Motivation DAIR architecture Management apps (& Rogue networks) Related work

12 Wireless Management Apps Performance and Reliability Performance monitoring –Site planning: AP placement, frequency selection –AP Load balancing –Isolating performance problems Helping disconnected clients –RF Holes –Misconfiguration, certificates, etc… Reliability –Recovery from malfunctioning APs –Recovery from poor association policies

13 Wireless Management: Security Apps Detecting DoS attacks: –Spoofing Disassociation –Large NAV values –Jamming Detecting Rogue Wireless Networks

14 Rogue Wireless Networks Detecting rogue APs and rogue ad-hoc networks An uninformed or careless employee who doesn’t understand (or chooses not to think about) the security implications –An employee brings in an AP from home, and attaches it to the corporate network, creating a rogue AP –It is trivial to configure a desktop PC with a wireless interface to create a rogue ad-hoc network

15 Risks Attaching unauthorized AP to a corporate network –May allow unauthorized wireless clients to gain access A wireless client unknowingly connects to unauthorized AP on unauthorized network –May expose corporate information on that network Once rogue network is installed, physical proximity is no longer needed (esp. with directional antennas)…

16 A Simple Solution? Build a database of known: – SSIDs (network names) – BSSIDs (access point MAC addresses) Use DAIR infrastructure to scan – Whenever an unknown entity appears (either SSID or BSSID), raise an alarm This is the level at which most previous work solves this problem

17 False Alarms In many enterprise environments, one can hear other legitimate APs –E.g. shared office buildings Is the unknown wireless network connected to your corporate wired network?

18 Testing for Wired Connectivity Association test –Associate with suspect AP, contact wired node Mac address tests: –First-hop router test Wireless “DEST” = known router on wired network –ARP test Wireless “DEST” = known entity on local subnet DHCP signature test –For wireless routers: Identify device type through DHCP options Packet correlation test –Use timing and packet lengths to see traffic on both wired/wireless Replay test

19 First-Hop Router Test Land MonitorAir Monitor Subnet RouterDatabase Land Monitor discovers MAC addresses of all subnet routers, submits results to the database Client AirMonitor overhears a client communicating with an unknown access point Access Point ?

20 First-Hop Router Test Unencrypted HeaderEncrypted Payload ReceiverTransmitterDestination Access PointClientSubnet Router Frame (with encryption): MAC Addresses:

21 Outline Motivation DAIR architecture Management apps (& Rogue networks) Related work

22 Current Approaches & Related Research Many commercial offerings in this space Leverage existing access points (APs) –AirWave, ManageEngine, … –AP’s primary goal is to provide service to clients, limited time listening on other channels Specialized sensors –Aruba (MS IT choice), AirDefense, AirTight … –Expensive  limited density [Adya et al. Mobicom 04] – use assistance of mobile clients –Difficult to provide predictable coverage –Less proactive due to energy constraints Other wireless monitoring

23 Wrapping Up… –Status Built much of the “plumbing”: AirMonitors, Inferencing Service, Management Console (GUI) Built set of wireless security apps, ongoing evaluation Deployed ~22 AirMonitors on one floor of our building –Next 6 months: Performance & reliability apps Provide location services Larger scale deployment –Longer Term: going beyond management tools Seamless roaming Self-configuring complete replacement for existing wireless infrastructure

24 Backup Slides

25 Doesn’t IPsec/VPN just solve the rogue AP problem? It certainly helps, but… –Doesn’t address the bootstrapping problem –Doesn’t address the AP impersonation scenario –Not all corps use IPsec and/or VPNs to secure wireless –IPsec difficult to deploy in multi-vendor installations –Multiple levels of security

26 Association Test One Air Monitor attempts to associate with suspect AP –If this step succeeds, the Air Monitor makes a TCP connection to a well known entity on CorpNet (e.g. at Microsoft) –Test fails if AP is not “open” Mac Address filtering, WEP, WPA, 802.1x, etc…

27 Details of 1 st Hop Router Test With encryption and/or MAC filtering, the MAC addresses may still tell us something –MAC addresses are not encrypted –AP acts as an Ethernet bridge Suppose we can see an associated client using the suspect AP –If the client is communicating off the local subnet, then the destinaiton MAC on the air = the MAC address of the 1 st Hop router –ARP test handles the case where the wired communication endpoint is on the local subnet

28 Details of DHCP Signature Test Wireless router != Wireless AP –MAC addresses seen on the air will not match those on the wire A router needs to get a wired IP address DHCP requests are easy to observe –Sent to the IP broadcast address DHCP protocol has many options Can create device type signatures: –Typical DHCP request from Windows looks very different from a wireless router –Initial results look good: tested these techniques on 3 major brands of wireless routers: NetGear, D-Link, and ZyWall –At IETF, observed many types of end hosts (Windows, Apple, Linux)