Three tools to pinpoint rogue access points

Locating and tracking an object via radio waves has been in everyday use since the WWII invention of RADAR (Radio Detection And Ranging). Today, everybody from automobile drivers to airline pilots to mapmakers to construction professionals rely on GPS, another form of radio-based location and tracking.

It’s unfortunate that GPS doesn’t work indoors because indoor location and tracking is becoming essential in fields as diverse as manufacturing, logistics, transportation, healthcare, education and retail. Plus, there are emerging opportunities such as location-based services (LBS) – finding, for example, the nearest printer, item on store shelves, or defibrillator, just for starters.

Given the increasing presence (and, we believe, eventual ubiquity) of Wi-Fi systems across the enterprise, and the growing potential for Wi-Fi-based location and tracking services, we decided to try out a few of the leading products in an effort to better understand the capabilities and limitations of today’s offerings, and to do a little comparative analysis with as level a playing field as possible.

We chose Network World’s offices in Framingham, Mass., to install, calibrate, and use Wi-Fi-based location and tracking products from Aerohive, Ekahau and Motorola. These products are also sometimes called real-time location systems (RTLS) or asset-tracking systems.

How to hack your own Wi-Fi network

15 free (or almost free) Wi-Fi security testing tools

According to our market research, usage of such systems is in the low single-digits among those with Wi-Fi systems installed. And awareness of the capabilities, applicability, and potential of the technology is only slightly better, so our goal was to put these products on the radar screen, so to speak, of IT professionals who operate Wi-Fi networks.

Test configuration and methodology

Network World’s offices are located in a large, multi-tenant building, and, as can be seen in the illustrations accompanying this article, we used a portion of their space covering about 9,000 square feet. There were a good number of operational wireless LANs located nearby, as determined by our Fluke Networks AirCheck Wireless Tester, but interference was not a concern – location and tracking systems do not require the transfer of large amounts of data.

Instead, a reasonable percentage of “good” samples, quantified as the percentage of 802.11 frames sent by the client and successfully received by the infrastructure, are all that is required for the location and tracking algorithms to do their job. The actual processing involved with all of the products tested here uses RSSI, or received signal strength indication. Given the laws of physics and the vagaries of radio propagation, this technique can get tricky, but, as we saw, it also works quite well in practice. Note that any Wi-Fi-equipped device – from handsets and tablets to notebooks and specialized devices — can be tracked with no modifications or additions to the device.

How we tested

The general process for testing a Wi-Fi-based location and tracking solution usually begins with a properly configured and functioning WLAN infrastructure. With this as a point of departure, we examined three alternatives:

• Using inherent and intrinsic location and tracking services built into the WLAN. Our test subject was Aerohive’s cloud-based HiveManager console using five HiveAP 350 access points.

• Using a third-party location and tracking capability that operates off of RSSI data provided by the WLAN installation. Our example was Ekahau’s RTLS, with RSSI data sourced from the above-mentioned Aerohive system.

• Using a third-party WLAN assurance system, in this case the Proximity and Analytics functionality within the AirDefense (a division of Motorola Solutions) 3652 Appliance connected to five Motorola Solutions 6532 access points.

WLAN assurance systems can be thought of as vendor-independent security, monitoring, and compliance-verification capabilities that use a network of sensors independent of WLAN access points (although in AirDefense’s implementation an access point can do double-duty here).

It’s easy to see how location and tracking is a logical addition to such a sensor network. Also note that in this case the location and tracking solution is totally independent of the WLAN infrastructure, an advantage in facilities where the WLAN cannot be modified or re-configured for reasons of security, integrity or policy.

In each case, we installed and configured the system according to manufacture documentation. Access points in all cases were installed at the corners of the cubicle area (walled offices cover the perimeter of the building), and one access point placed near the middle, which is also where the remainder of the equipment required in each case was installed.

As setup can be tricky, don’t be surprised if you need to call tech support for clarification and assistance, as we did with each of these products. The good news is that the bulk of the effort involved is in the front-end setup process, and, once in operation, each of the solutions we tested was a breeze to use.

The AirDefense and Ekahau systems both required calibration, which is a process whereby the system learns about its environment and builds the databases required to locate clients. The two products use somewhat different processes for calibration, but, again, this activity need only be performed once. The Aerohive system requires no calibration at all and, assuming familiarity with Aerohive’s HiveManager cloud-based management console, takes only minutes to get operational.

SIDEBAR: Location and Tracking Technologies: Understanding the Technology

Once each system was installed and calibrated as required, we performed two basic tests: absolute location of a station both within the rectangle of coverage and at the bottom edge, and the real-time tracking of a moving station. We also looked at reporting and other related capabilities. All three systems performed quite well, although the Aerohive solution does not provide real-time tracking. We found the real value in each to be distinct and fundamentally relative to application requirements.

Aerohive HiveManager: Good for rogue AP detection

Aerohive is best known as a leading vendor of controllerless enterprise-class access points and related equipment, as well as a leading cloud-based network management solution, HiveManager.

The location and tracking functionality built into HiveManager is quite simple and does not include elaborate reporting or real-time tracking of a moving station. But it is remarkably easy to set up and use, and could be of value in simply locating a station of concern – a suspected rogue, for example, or a critical piece of equipment or person.

Aerohive has also gone to great pains to integrate support for both Ekahau’s RTLS, reviewed below, and Aeroscout, another popular location and tracking solution, who were unable to participate in this test. Setup consists primarily of setting the appropriate location and tracking technology to be used in the HiveManager console, importing a map of the space to be covered, and refining a few other low-level settings that affect the tradeoff between time spent on location and tracking and that devoted to normal wireless-networking services.

Again, this setup need be performed only once, and we found Aerohive tech support staff more than helpful in assisting our decision-making process here.

From this point, though, Aerohive diverges with the other two products remarkably: no calibration is required at all. All that’s involved is importing the map of the area to be covered, placing access points on the map via drag-and-drop, and, well, that’s it. Figure 1 shows the location of stations by media access control address, and we found accuracy near the middle of the covered area to be within one meter and at the lower edge about four meters – roughly the same as the other products tested. While this is by no means as robust a solution as those provided by Ekahau and Motorola Solutions, the price is certainly right: the functionality is included at no additional charge with a HiveManager license, and we suspect that many shops will be more than pleased with just the basic services provided here.

We were surprised to find that documentation of this part of HiveManager’s functionality is very minimal, although the online help function was of some value. While a little experimentation will likely answer any questions, again, do not be surprised if a call to tech support is needed to clear up any confusion.

Ekahau RTLS: Accurate, easy to use

Ekahau, based in Finland, is one of the best-known suppliers of Wi-Fi-based RTLS solutions. The company also sells a line of site-survey and deployment-planning products, an obvious logical adjunct to (and, really, a key component of) the firm’s location and tracking capabilities.

While the company’s RTLS products are general-purpose in nature, there’s a distinct marketing emphasis on healthcare applications – asset management, patient and staff safety, and various environmental monitoring functions.

Ekahau also sells a line of Wi-Fi tags and sensors (for temperature and humidity), some of which we used during our testing. What Ekahau doesn’t sell, however, is the basic Wi-Fi infrastructure required, and it’s assumed that customers will have a working and compatible Wi-Fi system up and running before adding Ekahau to the mix.

The communication between the WLAN infrastructure and Ekahau’s RTLS Controller (ERC) software and console (running in our case on a notebook PC) uses Ekahau’s proprietary protocols and, when implemented by a WLAN systems vendor, enables Ekahau’s system to capture the RSSI data that APs always have access to.

But this also means that it’s important to check with Ekahau and your WLAN systems vendor to make sure the intended combination will indeed work. In our case, we used the Aerohive configuration described above – we simply set the HiveManager RTLS policy to Ekahau, and applied a few other minor tweaks that also involved calls to tech support. As an example, having TKIP enabled on the access point interfered with the proper operation of Ekahau’s tags. This was easily corrected, and we then imported our floor-plan and were otherwise off.

The Ekahau calibration procedure is positively a joy to use (Figure 2). The included Site Survey software runs on a notebook PC, and, as is usually the case with such functionality, the person performing the calibration walks around through the facility being calibrated until the system reports that sufficient coverage has been obtained. This is designed to be simple enough for technicians with no particular background in the technology or applications involved. And, in fact, calibration couldn’t be easier: Simply indicate the direction one is moving on the map to the calibration program and walk. Samples are automatically taken, and the access points are even auto-placed (quickly and in fact quite accurately) on the map. “Rails” can be added to normalize calibration, eliminating locations where devices being tracked would never go and thus minimizing the possibility of anomalous or incorrect results. Specific zones can be partitioned off into areas for geofencing applications. All in all, the process couldn’t be easier, and, again, need only be performed once.

Or so we assumed. Initial testing in fact revealed some very anomalous behavior – the RTLS would report the location of a given station, and, with the next reporting period (a few seconds later), would show the station far away and clearly in an incorrect location. We’d seen this before, and such is usually the result of not enough calibration data. So, we carefully re-calibrated a portion of our covered area, this time moving very slowly so as to have a lot of samples taken. And, voila, problem fixed – using Ekahau’s Vision 2.0 console and reporting application, we found the accuracy of fixed stations to be within one meter, and real-time tracking to be within a few meters, four meters being the worst case at the lower edge of the map. This little detour reminded us that it’s always best to try a good number of test cases before concluding that one’s environment is properly calibrated.

Ekahau Vision has a broad range of functionality, including the monitoring of tag-specific data, positioning status of any given station, history over time, and report generation. Stations can be grouped by type (for example, “people”, refrigerators”, etc.) and alerts and alarms can be defined via rules and handled, for example, by sending an e-mail.

One other interesting aspect of Ekahau’s offering is the addition of infrared (IR) emitters that can be sensed by Ekahau’s tags. In most healthcare RTLS applications, for example, it’s important to localize a given station only to a particular room. Place an IR emitter in each room, and the RTLS tag will be able to indicate its location (via Wi-Fi, of course) to that level of precision. This is an example of using multiple wireless technologies to refine location and tracking performance, and is frequently found in wireless (and not necessarily those based on Wi-Fi) RTLS solutions today.

Ekahau’s pricing is scaled according to the number of objects tracked, and ranges from approximately $200 per object tracked to as low as $10 in very large quantities.

Motorola Solutions AirDefense Proximity and Analytics: Real-time tracking, broad feature set

AirDefense is one of the best-known WLAN assurance systems on the market, and is most often associated with intrusion detection and prevention and rogue-AP detection and mitigation. But, as we discovered, AirDefense also optionally incorporates a very powerful location and tracking solution called Proximity and Analytics.

As is the case with Motorola Solutions’ WLAN products, AirDefense’ location and tracking services are aimed primarily at retail-oriented applications, but are essentially general-purpose in nature. The AirDefense solution as provided for this test included a 3652 appliance and five 6532 access points, in this case used only as sensors. It is possible to use these devices as access points and sensors simultaneously, but we did not test this capability. Dedicating access points as sensors allows a broader range of functionality, such as the ability to scan all channels for rogues (or stations being tracked) with no disruption to WLAN services.

After cabling all of the access points and the appliance to a Cisco Catalyst 3560 PoE switch, we imported our office diagram and placed the sensors on the map via a simple drag-and-drop mechanism. We then began the calibration process; this is performed via the Survey Tab on the AirDefense Mobile client application running on a Windows-based notebook PC.

The general procedure is to walk through the covered area, indicating position on the diagram and stopping roughly every eight feet square to take a calibration reading, which takes a few seconds. It’s possible to verify the quality of the calibration and coverage area as one proceeds here; we found this very useful in making sure no areas were missed. If any are, it’s easy to go back and survey just that space. It took about a half-hour to survey our domain and verify with the appliance that we had sufficient data points to begin location and tracking operations. The process overall is quite easy and the real-time feedback as to quality increased our comfort with the process overall.

We then proceeded to operational testing. A client to be tracked must be connected to a WLAN (although not necessarily a particular WLAN) in order to generate the traffic required for location calculations. The traffic can be literally anything, but a completely idle client won’t be seen at all.

Using an iPad, we found accuracy of within one meter within the rectangle defined by the access points at the corners of our covered areas, and within five meters at the lower edge of this zone. Of particular interest, though, was the very high accuracy of real-time (one-second position updates) tracking of a client within the rectangle (Figure 3). With a little tweaking, essentially real-time updates in position of any given client can be displayed, with authorized operational staff literally watching the motion of the client on the system’s Web-based client application.

We also spent some time running various reports and examining alternative views of the data gathered. These include prioritization or isolation of specific clients, heatmaps of activity over time, filtering views by device or user type, geofencing activity (entering, leaving, or dwell time with a defined zone), and historical views. It’s also important to note that Proximity and Analytics includes a very broad range of functionality, including Presence Services, Wi-Fi Analytics, RTLS (what we tested), and Historical Location Analytics. Pricing as provided by Motorola Solutions is as follows:

• Proximity and Analytics License – $99.00/per AP/Sensor

• 60,000 square foot retail facility would require approximately 35 licenses, so ~$3,465.00 total for Proximity and Analytics licensing.

• 150,000 square foot retail facility would require approximately 50 licenses, so ~$4,950.00 total for Proximity and Analytics licensing.

These numbers could of course vary based on local conditions or specific application requirements.

Note that a presence-only solution (knowing that a given station is within a given area but not its precise location) could result in much lower cost-to-solution, as fewer access points/sensors would be required.

A final point: The AirDefense Platform 9.0 User Guide contains only a scant two pages on Proximity and Analytics. A separate Location Based Services Best Practice guide, however, contains a great deal of practical information and should provide at the very least the background necessary for speaking with tech support.

Analysis and conclusions

As we had significant prior experience with both Wi-Fi and other RF, IR, and even ultrasound-based location and tracking solutions, we were not surprised to see such excellent real-time results from the products tested. In general, most Wi-Fi-based location and tracking applications can work quite well with resolution to a single room or other area up to three to five meters square – sufficient for most applications. All of the products tested achieved this level of performance, with resolution down to the order of a meter noted in each case for stationary objects. It was thought for a number of years that solutions based on signal strength were incapable of such accuracy, and we’re pleased to report that such assumptions are now indeed fundamentally exposed as myth.

We did discover, though, a potential issue in the case of the AirDefense and Ekahau products in terms of the calibration activity required by each. This can be time-consuming and, as we noted in the case of Ekahau, the speed at which one moves while performing the calibration can have a profound and even dramatic effect on operational performance.

It’s vital to run a few test cases of a newly calibrated system before beginning production operations, and to note any anomalous results in order to perform any corrective action required – normally, this will involve augmenting or repeating at least portions of the calibration exercise, but might include revising channel assignment(s) and/or the position and/or number of access points/sensors as well.

We believe there is a good opportunity at work here for the application of robotics in the calibration process. While the cost of labor for this work can be managed (via outsourcing to professional technicians in many cases), having a robotic surveyor move through the space being calibrated could have the dual benefits of increasing precision and real-time feedback from the infrastructure as potential coverage or quality issues are uncovered.

On the other hand, since the calibration work in the vast majority of cases will be performed only once, convincing location and tracking vendors to make the investment in the robotic tools required could be problematic at best. But note also that a re-survey may be required when building interiors are reconfigured, as the RF fingerprint derived from the survey could be invalidated if the radio environment is altered in any way. Occasional quality and performance reviews are a good idea regardless.

Selection of a specific solution will likely be primarily a function of the reporting and analytical capabilities of a given product offering subject to local application requirements and policies. And, while there are other location and tracking products on the market, we’re encouraged by the results we saw – while setup can involve a bit of help from the vendor, production use is easy and accurate, and we thus see increasing market penetration for Wi-Fi-based location and tracking solutions once potential users are aware of the capabilities of this technology.

Mathias is a principal at Farpoint Group, a wireless advisory firm in Ashland, Mass. He can be reached at craig@farpointgroup.com.