Category: Wireless Networking

Articles

Wi-Fi now to standardise the operation of distributed Wi-Fi setups like the NETGEAR Orbi with the EasyMesh standard

A new Wi-Fi standard could let different mesh routers work together | The Verge

Mesh Wifi gear from different companies could soon work together | Engadget

Wi-Fi Alliance’s Wi-Fi EasyMesh certification aims to standardize mesh networks | PC World

From the horse’s mouth

Wi-Fi Alliance

Press Release

EasyMesh Product Page

My Comments

Increasingly, home and small-business Wi-Fi users are showing interest in distributed-WiFi network systems that implement simplified configuration and hands-off optimisation. They consist of multiple access-point devices and use a Wi-Fi path or, in the case of a few systems, an optional wired-network path to provide a backhaul to the router that links to your Internet service.

People are showing interest in these setups as a simplified way to assure Wi-Fi wireless-network coverage across a large or multi-storey / split-level building or a building that uses materials and construction techniques that play havoc with Wi-Fi network coverage. As well, they don’t want to deal with devices that are difficult to set up or to have to remember which SSID to use for best coverage in a particular area.

To the same extent, those of us who have separate buildings on our properties like a cabin or converted garage may want to be sure we can gain reliable access to the Internet and network resources from these buildings. Some of the distributed Wi-Fi systems like the Netgear Orbi can support wired backbones which can work with a HomePlug powerline link or Ethernet cable strung between the buildings and this could bring seamless Wi-Fi network operation to these buildings.

But the current problem with these systems is that you have to create the system with equipment from the same vendor or, in some cases, implementing a particular chipset. This makes it hard for customers to mix and match equipment to create a distributed-WiFi system that answers their needs exactly.

There is also the risk that if a manufacturer abandons their distributed-WiFi product line and one of the units fails, customers can’t replace the faulty unit with a new one from a different vendor – they would have to scrap the whole system. The same situation also applies if a customer wants to use a unit that offers specific functionality such as a router with higher security, a modem router or a weatherproof access point.

Enter the Wi-Fi Alliance who have established a certifiable standard with a trademark for these kind of systems. This standard, known as the EasyMesh standard and is part of their device-certification scheme, is based on the IEEE 1905.1 protocol for small-network configuration allows for “mix and match” operation of a distributed-WiFi system.

A network based on the Wi-Fi EasyMesh standard can implement a backhaul based on a Wi-Fi wireless and/or a wired (Ethernet, HomePlug powerline, MoCA TV-aerial / cable-TV coax, etc) medium. As well, the devices can support a dedicated Wi-Fi backhaul segment with dedicated radio transceivers or use the same Wi-Fi segment used to serve client computing devices.

There are two classes of device that exist across an EasyMesh Wi-Fi network – a Controller and an Agent device. The Controller co-ordinates what is happening with the network and typically it can be part of the Wi-Fi router that is the network-Internet “edge” of your home network. But it can be software running in another computer or an access point. You can have only one of these in operation on the one EasyMesh network.

The Agent device is the access point that your client devices such as your laptop, tablet or smartphone link to your home network through. These will connect to each other and to the Controller using the Wi-Fi, Ethernet or similar backbone.

A simplified setup and device-onboarding process takes place in an EasyMesh network, with the device-onboarding process typically being facilitated through methods like NFC or push-button setup. The onboarding procedure will also be about learning the capabilities that the new device offers such as what bands it operates on and whether they can be used simultaneously or what Wi-Fi standard is being supported by that device. Of course, initial network configuration may be about determining the ESSID (Wi-Fi network name) and, perhaps, a user-chosen passphrase for your network.

Let’s not forget that the EasyMesh network implements continual self-tuning for each Agent AP node. This means that if you add or remove extra Agent APs or move them around, they adjust their operating frequency and signal strength themselves. It also applies whenever neighbours set up or modify their Wi-Fi-based home networks.

The Controller device then monitors the network for best performance and will have the network steer client devices towards access points that offer the best bandwidth. As well, the Agent access points report their measurements to the Controller device and each other to provide the self-tuning self-healing network.

The Wi-Fi Alliance stated that there is the possibility of implementing Wi-Fi Certified EasyMesh at a software or firmware level without any particular requirements as far as the hardware is concerned. This could appeal to vendors to implement EasyMesh in to existing devices as part of, say, a firmware update which is a practice that AVM have done to enable some of their Fritz series of home-network equipment for distributed-Wi-Fi operation.

But what do I see the Wi-Fi Certified EasyMesh technology lead to?

There will be the ability to supply distributed-WiFi equipment that offers better value to the home or small-business user. This includes the ability for manufacturers to supply equipment that targets particular niches such as VPN-endpoint Wi-Fi routers for business or weatherproof access points for installation outdoors. Manufacturers could even consider the idea of integrating “mesh AP” functionality in to client devices so these devices could effectively boost Wi-Fi coverage in to an area.

The technology will benefit ISPs, telcos and cable-TV operators who supply Wi-Fi routers, typically modem routers, to their customers as part of providing Internet service. Here, it could become feasible to provide a modem router with EasyMesh capability to their customer and allow these customers to purchase the EasyMesh-compliant access points that suits their needs through the ISP’s storefront or a third-party retailer.

There is also room for the vendors to continually improve on their products in many different ways without needing to worry about risks associated with designing for a proprietary setup. Here, the algorithms associated with network-performance management can be tweaked in a manner so as to carry that improvement across an existing EasyMesh setup.

At the moment, the Wi-Fi EasyMesh solution will primarily be targeted at simple small networks but there will be a call to evolve this standard to support Wi-Fi-based VLAN setups. This is more so to cater for “guest networks”, FON-style shared-bandwidth setups and IP-based telephony which will make use of these setups. Here, a setup that answers these needs may may have to cater towards replicating the multiple SSIDs and network setups these networks implement while shifting data from each SSID to each “data pipe” like the Internet or a VoIP service.

But I see the Wi-Fi EasyMesh standard leading towards the ability for householders and small businesses to make sure that their small network’s Wi-Fi segment is providing the right coverage to suit their needs.

A wireless router set up in the ordinary way as a base station or hub for your home network isn’t at risk of the KRACK exploit

The computing press has been awash with articles regarding a recently-discovered security vulnerability that affects Wi-Fi wireless networks. This vulnerability, known as KRACK, compromises the authentication process associated with the WPA2 security protocols that most Wi-Fi home and business networks implement.

What is affected

But it mainly affects client devices like laptops, smartphones and the Internet of Things which connect to Wi-Fi networks using WPA2 facilitated through software that isn’t patched against this risk.

It also can affect Wi-Fi infrastructure devices that serve as a repeater or client-side bridge in a Wi-Fi wireless network segment – this encompasses Wi-Fi client bridges used to connect desktop computers or smart TVs equipped with Ethernet connectivity to a Wi-Fi network, Wi-Fi repeaters, distributed-Wi-Fi setups and mobile devices implementing “bridge-to-Wi-Fi” functionality.

Data security risks

The security and privacy risk occurs at the media level of your network connection which would represent the Wi-Fi wireless link to the access point / router.

If you use higher-level encryption protocols like gaining access to Internet resources through SSL / TLS encryption which includes “https” Webpages, implementing a client-based VPN or using IP telecommunications apps that implement end-to-end encryption, you have reduced the risk factor for your data security that the KRACK vulnerability poses. Access to LAN-based resources like your NAS or printer from within your network can be a risk with Wi-Fi clients that aren’t patched to mitigate this risk as with unencrypted Internet resources.

Current remediation efforts

This situation has been rectified for regular computers running Windows 7 onwards through a patch that Microsoft rolled out as part of the October 10 security update. Here Microsoft didn’t disclose this vulnerability until there was a chance for all of industry to have patches in beta testing or “ready to roll”.

Just lately (1 November 2017 AEDT) Apple released patches for MacOS High Sierra, Sierra and El Capitan versions; and iOS 11.1 (iPhone 7 onwards, iPad Pro 9.7″ (2016) onwards); tvOS 11.1 (4K Apple TV onwards) and watchOS 11.1 to address this issue.  The Intego Mac Security Blog post that I culled these details from was miffed about the fact that the large number of iPhone 6 and earlier devices that are still in operation have not been addressed. I would also extend this concern to the older iPad and iPod Touch devices that are also in operation such as those iPod Touches the kids use or the iPad in your living room.

On December 2 2017 US PT, Apple released the iOS 11.2 update which provided this protection for iPhone 5S, iPhone SE and all model variants of the iPhone 6. This update also applies to the 12.9″ iPad Pro (1st generation), the iPad (6th generation), the iPad Air, the iPad Mini 2 onwards; and the iPod Touch (6th generation).

Other regular-computer and mobile operating systems are being updated with security patches that are coming online through the next two months or are already online.

There will also be various pieces of client-side security software that will be updated with extra code that provides extra defence against the KRACK Wi-Fi vulnerability for both the software and the host computer.

The devices you will find as having a strong risk factor for your network are “dedicated-purpose” network devices like Internet AV devices, “smart-home” devices, videosurveillance cameras and the like that don’t benefit from regular firmware updates. This will mainly affect those devices that manufacturers are declaring “end-of-support” on or a lot of “white-box” devices sold by multiple vendors. But check your devices’ manufacturers’ Websites for new firmware that will patch the device against this vulnerability.

This will not affect the typical home or other small network that is based around a wireless router. Nor will it affect networks that implement multiple Wi-Fi access points connected to a wired (Ethernet or HomePlug) backbone. This is because you are dealing with devices that serve as a Wi-Fi base station for that particular wireless network segment.

But if you have Wi-Fi infrastructure devices using some sort of repeater or bridge functionality, check with the vendor for a firmware update for your device.

As well wireless router and access-point manufacturers, especially those courting the business and allied markets, will offer newer firmware to harden their devices against the KRACK vulnerability.

Remember that well-designed devices will implement at best an automatic software-update process or you may have to visit your device’s Settings, Setup or Configuration menu to download new firmware.

As well, the Wi-Fi Alliance have updated their certification tests for network hardware to be sure that such hardware isn’t vulnerable to this risk. These certification tests will be required before a product can show the Wi-Fi Certified logos and will affect products being introduced from this month onwards.

Keeping your network secure until new software is available

If you run Wi-Fi network infrastructure hardware that implements repeater or bridge functionality, disable the Wi-Fi client mode or repeater mode on these devices until your device is running firmware hardened against this vulnerability.

The HomePlug powerline adaptor can help with mitigating risks associated with the KRACK WPA2 Wi-Fi network vulnerability

You may also have to set up your home network with multiple access points linked to a wired backbone as the preferred way to extend the network’s coverage or reach to another building as has been done with this man-cave. A good example of this is to use a HomePlug wireless access point kit which uses your home’s AC wiring for this purpose. If you use a “Mi-Fi” mobile router that supports Wi-Fi data offload, disable this functionality until it is loaded with the latest secure firmware.

Similarly, use a wired network connection such as Ethernet or HomePlug to connect sessile devices like desktop computers, Smart TVs, printers and the like to your home network. This may not be feasible with those devices that only support Wi-Fi connectivity as their network-connection option.

Conclusion

You can mitigate the risk of the KRACK WPA2 Wi-Fi network vulnerability as long as you keep your computer equipment running software that is patched with the latest security updates.

If you use Wi-Fi infrastructure devices that work as a Wi-Fi client like repeaters or client bridges, these have to be updated with the latest firmware from their vendor. As well, use of wired backbones and access points for expanding your home network’s coverage will achieve the proper level of security against this risk if you are dealing with client-capable Wi-Fi infrastructure devices that aren’t updated with the latest software.

Let’s not forget that higher-level encryption protocols like SSL or client-side VPNs do mitigate the risk of data theft through this vulnerability.

Updated (1 November 2017 AEDT) to reflect the latest concerning what is happening with the Apple platforms.

Updated (11 December 2017 AEDT) to reflect the increased number of iPhones and iPads protected against the KRACK exploit by the iOS 11.2 update

NETGEAR Orbi distributed WiFi system – understanding these devices and whether to purchase them or not

A new class of home-network device has been appearing over the last year or so in the form of the “distributed Wi-Fi system”, sometimes known as the “mesh Wi-Fi system”.

These systems consist of two or three modules, one working as your home network’s router and the other modules working as access points. But they have features that are different to setups where you use an ordinary access point and wired-network backbone or a range extender to extend your Wi-Fi wireless network’s coverage.

Some ISPs are even offering distributed-Wi-Fi systems as a product differentiator for their premium packages or as an add-on that customers can buy. They are offering these devices in response to their customer base complaining to their support desks and “bricks-and-mortar” storefronts regarding poor Wi-Fi coverage.

Core features

Simplified setup and self-tuning

When you set up these devices, you don’t have to determine the operating frequency for each of the modules nor do you have to deal with multiple devices for your network to run properly.

Typically the only hands-on requirement is to work with one management interface when adjusting your network’s settings. You may even find that this interface is where you set up things like your Internet connection parameters or your network’s ESSID and enable / disable any particular features the system has.

You may find that the procedure involved with enrolling additional node devices to an existing distributed-Wi-Fi system may be as simple as pairing a network client device to a Wi-Fi network using WPS push-button pairing. This would simply be about pressing a button on the new device then pressing a button on one of the existing devices or the main node.

These systems continually re-adjust the operating frequency and other parameters so as to cope with changes in operating circumstances.

For example, if one or more of your neighbours set up new home networks or add access points and range extenders to these networks, you may find that your network underperforms due to the neighbouring networks operating on the same frequency. Even someone running a “Mi-Fi” mobile router or using their smartphone’s “Internet-share” mode could affect the network’s performance.

But the typical distributed-Wi-Fi system will automatically tune itself to different frequencies when these situations do occur. As well, it may implement other tactics to provide the best signal strength for your client devices.

Automatic creation of a single Wi-Fi network

A problem that users will have especially with wireless range extenders is that your network is split up in to multiple extended service sets or Wi-Fi networks. This can cause problems with users having to switch between different network names to gain the best coverage, something that can daunt a lot of users.

If you set up a traditional access-point setup with a wired (HomePlug or Ethernet) backbone, you have to “copy” the SSID and security parameters to each access point’s setup interface. A few HomePlug access points simplify this task using a WPS-based “Wi-Fi Clone” function where you activate this function then press the WPS button on your router to “copy over” the network parameters to the access point.

But these systems allow you to create your network’s SSID and security parameters with these being reflected across all of the modules that are part of the system. This includes implementing these parameters across all wavebands that these distributed Wi-Fi systems support.

This leads to a network that has the same kind of “roam-ability” as what would be expected for larger Wi-Fi networks with multiple access points. It is similar to what you would have expected with a properly-set-up traditional access-point network.

System types

Mesh-based distributed Wi-Fi system – each device links with each other

There are two different approaches being implemented with distributed Wi-Fi systems. These affect how the wireless backhaul signal is provided between each of the system’s modules.

Mesh system

The mesh method, implemented by Linksys Velop, Google WiFi, and eero require the use of three or more modules with one of these serving as the “edge” router for the network.

Here, the wireless backhaul works on a mesh approach where each module effectively receives signals from and transmits signals to the other modules that are in range. There is some fault-tolerance in these setups where the receiving module (node) can rely on other transmitting nodes if one of them fails. On the other hand, the receiving node aggregates the bandwidth it receives from two or more nodes of the network for higher throughput.

Router-extender / hub-satellite system

Hub-satellite distributed Wi-Fi system – uses extender devices connected to a router

The other approach, followed by the DLink Covr and the Netgear Orbi works in a similar vein to a traditional router and range-extender setup or traditional multiple-access-point setup.

Here, the satellite nodes in this system provide a single backhaul link to the hub node which typically is the router. The better designed systems like the NETGEAR Orbi use a dedicated wireless link for their wireless backhaul. This avoids competition for bandwidth by the portable client devices and the satellite nodes wanting to repeat the signal.

Features and limitations regarding these systems

Router-only or access-point functionality

Most of the distributed wireless setups are connected to the Internet in the same vein as a router where they create their own logical network. This setup appeals to users who have a modem that provides a media-level connection to their Internet service like a cable modem, optical-network terminator or a wireless-broadband modem.

This will be a limitation for users who have a modem router like most xDSL connections or users that implement a router that offers very advanced functionality like a VPN endpoint or VoIP gateway.

If you have one of these setups and want to use a distributed wireless system, look for one that offers access-point functionality or network-level bridging functionality. Here, these systems just connect to an Ethernet LAN socket on the existing router but you would have to disable the Wi-Fi functionality on the router if you use one of these systems if the node is closely located to the router.

Dedicated wireless backbone

Better-designed systems will implement a separate wireless backbone that isn’t used by any of the client devices. These systems will use specific radio front-ends and create a separate wireless network specifically for this backbone while each node has other radio front-ends that simply serve as the Wi-Fi access point for that area.

The benefit that is provided here is that the backhaul isn’t being shared with client devices that in the node’s good-reception area. That allows for optimum bandwidth for your distributed-Wi-Fi setup.

Alternative wired backbone

A handful of these systems are offering a wired backbone as an alternative setup for the network that they establish. This is provided through either an Ethernet LAN connection on the nodes or a setup may implement HomePlug AV500 or AV2 powerline networking as the wired backbone.

This feature may be of value for environments where the wireless backhaul just won’t perform as expected such as houses with interior walls made of highly-dense materials. Or these setups can come in to their own with multi-building home networks, where a wired link like HomePlug AV2 powerline networking for existing setups or Ethernet for new setups could link the buildings. On the other hand, if you wired your home for Ethernet, a distributed wireless system that implements support for an Ethernet wired backbone can exploit this infrastructure by allowing you to push out the network coverage further.

These systems should be able to treat the wired backbone as though it is another wireless backbone or part of the mesh. With some of these systems, you could push out a wireless backbone that refers to one of the nodes connected to the wired backbone as its “master” node rather than the main router.

Internet-dependent operation

There are some distributed-wireless systems that are dependent on an Internet connection for them to operate and for you to manage them. Most likely this is evident if the user interface is through a mobile-platform app that links to an Internet resource; along with heavy talk of “cloud operation” in the product documentation. This kind of setup is one that some new Silicon-Valley outfits are heading down the road towards as they want us to join the Internet-dependent “cloud bus”.

On the other hand, a system that isn’t dependent on an Internet connection for you to manage the network will allow you to visit a Web-page dashboard through a local network address or resource name and fully manage your network via that dashboard created by the router or node. Some of these systems that have UPnP IGD or management functionality enabled may make themselves discoverable using a Windows computer on the same network if you open Windows Explorer / File Explorer and see it listed as a Network device.

This is the traditional practice for most home and small-business network hardware and such a setup may offer the ability to be managed within your network using a mobile-platform app that points to the local resource. But this setup allows you to manage or troubleshoot your network even if the Internet connection is down. You also benefit from the ability to get your network ready before your Internet service is provisioned or deal with service-provisioning scenarios like changing your service provider or connection technology, or dealing with Internet services that authenticate with usernames and passwords.

What should I buy?

Not every distributed-Wi-Fi setup suits every house. This is because different houses come in differing sizes and compositions.

I would pay attention to those distributed-wireless systems like the NETGEAR Orbi that offer a choice of different nodes that have differing signal strengths at different price points. The benefit with these systems is that you can effectively shape your Wi-Fi network’s coverage to your premises size and shape.

For example, an entry-level package with a low-output satellite node could earn its keep with providing coverage to an area at the edge of your small house or apartment where you sometimes have good reception but could do with “pushing out” the coverage a bit further for better response from smartphones and mobile-platform tablets used in that area. But you would find that a standard distributed-wireless package may be overkill for this situation. Here, it is similar to creating a HomePlug powerline segment to serve a baseline HomePlug wireless access point to fill in that dark spot and achieve that same goal.

But for most homes, you could get by with running a standard distributed-Wi-Fi system that just has two nodes. Here, you install one where your Internet connection would customarily be while the other one either is at the centre of the house or towards the opposite side. A two-storey or split-level building may simply require one of the nodes to be placed upstairs while the other one is downstairs. You may find that houses with a large floor plan may require three or more nodes and/or a mesh-based system for optimum coverage.

Systems that support an Ethernet or HomePlug AV wired backhaul in addition to the wireless backhaul earn their keep with those houses that use dense building materials for one or more of their interior walls. If a system only supports an Ethernet wired backhaul, you can team it with a pair of “homeplugs” to gain the benefit of the powerline-network technology which may answer your need with that old house that has a thick brick or sandstone interior wall.

As for system management, I would prefer to use a distributed-Wi-Fi system that implements Internet-independent setup and management. This means that if the Internet connection should go down and you had to re-configure your system or you move or change service providers, you can do so.

Personally- I would like to see these systems be able to support the ability for one to determine the SSID and security parameters for the wireless network that they are creating. This is important for those of us who are using one of these systems to improve our existing network, whether to supplant our existing router or its Wi-Fi functionality. In this situation, you may want to convey your existing network’s parameters to the new network so you don’t have to go around to each client device that uses Wi-Fi to set it up for the network. It is although the procedure is simplified with most of these systems implementing WPS-based “push-to-connect” client-device setup on each module.

Use an access point and a wired backbone or one of these kits?

The distributed-Wi-Fi systems do appeal to people who don’t go for a “hands-on” approach in optimising their home network’s Wi-Fi performance. They are also useful for those of us who live in a high-turnover neighbourhood where people are moving in and out frequently. You will also have to be sure that you are not dealing with radio obstacles like interior walls made out of dense materials like that double-brick home that has am extension.

On the other hand, a traditional access point linked to an Ethernet or HomePlug wired backbone can work well for those of us who don’t mind a hands-on approach to set up the system and don’t face a situation where they have to readjust their home network regularly.

It is also important if we want to use a mix of equipment from different vendors or place high importance on a wired backhaul for reliability. To the same extent, the traditional access point with the wired backhaul is infact the surefire path for dealing with a multiple-building situation such as reaching the granny flat or man-cave garage.

Conclusion

At the moment, the distributed-Wi-Fi system, especially the mesh-based variant, is a technology still in its infancy. What needs to happen for this technology to become more accepted is that it can work in a purely heterogeneous vendor-independent manner, something that has to be facilitated through the implementation of standards that cover mesh networking and simplified setup / configuration requirements.

But the fact that major home-network vendors are coming in on the act rather than it being owned by Silicon-Valley startups means that the product class is becoming increasingly viable as a solution for poor Wi-Fi network coverage.