The current half-clued user transgression we are wrestling with is unauthorized wireless extensions to corporate networks. The problem is that 802.11 access points have plummeted in price, making it easy for any user with even the most microscopic discretionary budget to buy one.
Problems with users fall into two categories: Those caused because users are clueless and those caused because users have half a clue. The latter group is at least as dangerous as the former and often more so.
What you’d really like to do is put locks on all the PC cases, remove all CD and floppy drives, super-glue any and every cable into its socket, weld covers over every unused port and have a standing rule that any user who does anything to the equipment gets brought before the support desk and given 20 lashes. Alas, such power will exist only in your dreams.
Anyway, the current half-clued user transgression we are wrestling with is unauthorized wireless extensions to corporate networks. The problem is that 802.11 access points have plummeted in price, making it easy for any user with even the most microscopic discretionary budget to buy one.
So how do you keep tabs on authorized wireless networks and detect unauthorized access points, ad hoc networks and wireless clients? Some of the newfangled wireless LAN switches have this capability built in, but the best stand-alone tool we’ve found so far is from Highwall Technologies.
Highwall’s solution consists of a box called the Sentinel with optional Scout Antennas. The Sentinel can detect 802.11a, b and g wireless traffic and runs an embedded version of Linux. It has two RJ45 10Base-T interfaces that support Power over Ethernet and a coaxial connection (which supports power over coaxial). The coaxial connection links to the Scout Antennas, which are used to extend the coverage of the Highwall system.
The Web-based Highwall Management Server provides the management console interface. This requires Microsoft SQL Server under Microsoft Server 2000 or higher with Internet Information Server and ASP.Net.
Configuring the Sentinel hardware requires you to browse to the default address of 192.168.0.33:10000 and change the address to be static or DHCP-allocated. We wish vendors would default to using DHCP – it would make life so much simpler.
Installing the server-based management console software is fairly easy, although you must ensure that SQL Server is configured for mixed-mode authentication (Windows and SQL Server authentication). Otherwise, the Highwall installation process will exit, requiring you to start the installation again.
Once the management console is installed, you must edit the configuration file with Windows Notepad or similar to specify the addresses of the Sentinels, and other operational parameters. When you have finished editing the configuration file you can access the management console through your Web browser.
We could see every operating access point, ad hoc network and wireless client in our vicinity. We could see all the published Service Set Identifiers (the wireless network identifiers), equipment vendors, wireless channels, media access control addresses and IP addresses assigned to non-Wired-Equivalent-Privacy-protected networks. And we could label all the access points and clients so we could filter the lists of equipment as being rogue, domestic or foreign.
The management console displays alerts for each newly encountered wireless device and network, and lets you examine the data and classify it for future reference.
Although we didn’t try the Scout Antennas, they are supposed to be able to locate the physical position of wireless devices to within 10 feet. They are said to allow coverage of buildings of more or less any size with multiple floors. The Highwall system also integrates with UniCenter eTrust and Wireless Site Management products from Computer Associates – the latter providing the most accurate determination of physical location.
Highwall told us about an interesting customer success story, if true: A Fortune 1000 medical company is said to be using the Highwall system to monitor 10,000 wireless devices spread over 200 locations. Given regulatory compliance requirements and privacy concerns, keeping track of authorized infrastructure and identifying and locating rogue systems is critical. Highwall says this particular customer sees about 1,000 alerts every day.
Highwall’s solution is the most comprehensive and powerful wireless network-monitoring product we have seen. Prices start at $14,000, which includes one Sentinel, two Scout Antennas (supporting 802.11a and g) and the management console software. A Scout Antenna that supports 802.11b also is available.
Broadcast your thoughts over the wires to gearhead@gibbs.com.
