Archives for August 2019

A Company Of One

August 18, 2019 By Rowell Leave a Comment

In 2017, I decided to incorporate a business. Focused on wireless professional services, I had been receiving enough work to make it a structured entity.

That’s when the business was registered online though, INCfile.com, as a single member LLC.

*Visiting an early client of mine in San Francisco.*

Why an LLC? My business really started in San Diego in the year 2015. As a sole proprietor I was doing more blogging than consulting.

When I moved to San Jose, CA there was an opportunity to start fresh with a focus on enterprise wireless.

The LLC allowed me to create a separate entity and provided a protection for my personal assets.

My business was started as a side hustle and continues to be one.

Since 2017, I’ve taught myself how to run a small business of one. I’ve never gone to business school. This is going to be a fun journey for me.

I intentionally want to keep the business small. And by small, I mean just me. I have no desire to grow and have many employees. Very much the opposite of how other businesses think in Silicon Valley. And that’s where I’ll start to differentiate myself.

*My LLC-1 document. Stamped May 9, 2017. Official LLC!*

In this category, bschool, I have decided to document my experiences in running a small business of one.

Identifying OWE Transition Mode with Wireshark

August 8, 2019 By Rowell 2 Comments

Share on twitter
Share on Twitter
Share on linkedin
Share on LinkedIn
Share on facebook
Share on FB
Share on email
Email

Opportunistic Wireless Encryption (OWE) will hopefully start entering the market to help secure open wireless networks. We’re getting a glimpse of it through Aruba Networks and Cisco.

With the C9800-CL and C9115 AP, I was able to get basic configuration done to enable OWE Transition Mode.

OWE Transition Mode is meant to provide a sort of backwards compatibility. A transition to OWE networks.

The way OWE Transition Mode works is by utilizing two SSIDs. One is an open SSID. No security parameters at all. The second SSID is hidden, has Protected Management Frames (PMF) required and has OWE enabled under WPA parameters.

Why do you need two SSIDs for OWE Transition Mode? Because there will be devices that do not support OWE yet. In this case, the non-OWE compatible device associates with the open SSID. If an OWE-compatible device associates to the open SSID, it will be told to associate to the OWE hidden SSID.

How do we spot this within the frames?

With a frame capture, we’re looking for Beacon frames to indicate if the WLAN supports OWE.

You can use a filter to find all Beacon frames:

wlan.fc.type_subtype == 8

A WLAN support OWE Transition Mode will simply be an open SSID containing no RSN Information Element. What you should be able to find is a Wi-Fi Alliance: OWE Transition Mode Information Element.

There are a few details to go over here. For one, you see that it is a vendor specific tag that says OWE Transition Mode.

More importantly, there is a BSSID and SSID listed. If you look near the top of the image above, we’re looking at a Beacon frame for SSID McFurly-OWETM.

Within the OWE Transition Mode information element, the actual OWE SSID is identified. In this case it is McFurly-OWE. That is the hidden ssid. That piece is how we transition an OWE-compatible device to the OWE only SSID.

The Beacon of OWE

Next, we look within the Beacon frame of the hidden SSID. To secure this open SSID it will be configured with WPA parameters using AES and Opportunistic Wireless Encryption (OWE). It will also contain the OWE information element as well.

The image above is the Beacon of the hidden SSID supporting OWE. Notice the SSID parameter is.. hidden. We’ll get into how we know this is the Beacon frame we’re looking for.

We see there is an RSN information element with an AES cipher and an AKM of Opportunistic Wireless Encryption (OWE). Well, there you go. That’s clearly the SSID we’re looking for.

Looking further below, there is an OWE Transition Mode information element. The difference with this entry is the BSSID and SSID. It is referencing the open SSID.

And again, an OWE compatible device will be told to associate to this hidden SSID, named McFurly-OWE. A non-OWE compatible device will simply associate to the open SSID, McFurly-OWETM.

YOUR TURN
What do you think about using Opportunistic Wireless Encryption to protect open SSIDs?

Identifying 802.11ax Support with Wireshark

August 2, 2019 By Rowell 3 Comments

We’re beginning to see vendors come out with their latest and greatest access points touting 802.11ax (Wi-Fi 6) support.

At the Cisco JustTheTech event, I was given a Cisco C9115 to try out for the purposes of testing Wi-Fi 6. At the time, the controller code didn’t have these features enabled.

How can a vendor come out with a Wi-Fi 6 AP but not have those features ready to go? The hardware is capable but in software, it had to be turned on.

In this blog post, we’ll look at how to identify 802.11ax support using Wireshark.

Do you find this content useful? If so, consider buying me a coffee! ☕

802.11ax – High Efficiency

At the time of this blog post, 802.11ax is still in draft form and the Wi-Fi Alliance had branded it as Wi-Fi 6. The developers at Wireshark added support to view the information elements and fields for 802.11ax.

You do not need an 802.11ax capable device to view some of these information elements. Using a frame capture tool such as Airtool or the Ekahau Sidekick, we can collect this information and view it within Wireshark.

I’m using Wireshark version 2.9.0.

If you’re interested in learning more about 802.11ax, please check out my podcast series with François Vergès.

Cisco C9800-CL 802.11ax Configuration

It’s important to note in the configuration, 802.11ax must be enabled. Using the C9800-CL, the option is enabled under High Throughput and under the WLAN configuration.

Configuration -> Radio Configurations -> High Throughput

Additionally, 802.11ax features must be enabled on the WLAN.

802.11ax features on the WLAN configuration

A Beacon of 802.11ax

The most notable place to see 802.11ax support is in the Beacon frame. After viewing the HT and VHT information elements will be an 802.11ax High Efficiency (HE) information element which holds many more details about the support of 802.11ax.

You’ll notice HE Capabilities and HE Operation below in the screenshot.

802.11ax High Efficiency Information Elements

Expanding the HE Capabilities information element, we can see all the details supported on the Cisco C9115. There’s a lot to unpack here and in the following screenshots but I will not dive into those details here.

The HE Operation information element contains more fields, including BSS Color.

What about spatial stream support? You can verify that within the Beacon frame as well by looking at the Supported HE-MCS and NSS Set field.

What’s In the Association Response

I noticed there were more details under the Association Response from the AP. In the Beacon we did not see TWT supported. But in the Association Response we are able to see TWT Requester Support as Supported.

802.11ax Association Response Frame – HE Capabilities

Should You Buy 802.11ax Today?

No. It’s too early to say how 802.11ax will perform with new hardware. There aren’t many 802.11ax capable clients. In my lab I used a Samsung S10 and an Lenovo with an Intel AX200. A lot more real world testing needs to be done to validate the operation of 802.11ax in today’s mixed environments.