Subject: RE: Please make sure that you do not run your WLAN in ad hoc mode

From: "Glenn Parsons" <[email-masked]>
Date: Thu, 10 Nov 2005 14:42:07 -0500

FYI,

At the plenary last night the NOC team noticed 107 adhoc networks on
802.11b.  See attachment for the names & MACs.

Cheers,
Glenn.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Pekka Nikander
Sent: Thursday, November 10, 2005 2:06 PM
To: IETF Discussion
Subject: Please make sure that you do not run your WLAN in ad hoc mode

It would be nice if people did not run their WLAN cards in Ad Hoc mode.

Here are MAC addresses of some cards that I currently see advertising
various ad hoc networks.  At least some of these were present also in
yesterday's plenary.

Network name   MAC

Netgear        02-00-10-62-A3-6D
IETF64         02-00-31-9B-69-47
Netgear        02-00-61-76-D2-79
linksys        02-0C-F1-EC-CF-9E
TC_2           02-0E-35-03-D4-C4
IETF64         02-12-F0-00-33-FD
wireless       02-27-97-94-65-56

If you don't know how to check your MAC address or how not to turn off
ad-hoc capability, it may be better to turn off WLAN altogether.

Thank you,

--Pekka Nikander

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Thu, 10 Nov 2005 12:58:58 -0800

I think we should be very strict on this. All this people should get
filtered until they go to the NOC and make sure to get trained about how to
avoid ad-hoc !

Regards,
Jordi

> De: Glenn Parsons <[email-masked]>
> Responder a: <[email-masked]>
> Fecha: Thu, 10 Nov 2005 14:42:07 -0500
> Para: IETF Discussion <[email-masked]>
> Conversación: Please make sure that you do not run your WLAN in ad hoc mode
> Asunto: RE: Please make sure that you do not run your WLAN in ad hoc mode
> 
> FYI,
> 

************************************
The IPv6 Portal: http://www.ipv6tf.org

Barcelona 2005 Global IPv6 Summit
Information available at:
http://www.ipv6-es.com

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

---

From: "Brett Thorson" <[email-masked]>
Date: Thu, 10 Nov 2005 16:59:59 -0500 (EST)

It is hard to be very strict at an IETF meeting.  We first started running
Penalty Boxes at one of the Minneapolis IETF meetings.  Why did we do it? 
Because we had time.  We got the network working reasonably well and could
dedicate our time to ... "Fighting Evil".

So we setup the penalty box, and we put people in there.  We found a mean
MAC addr, set it all up, and then came the question.. Do you really want
to do this?  That was a hard call to make honestly.  There were a lot of
smart people in the NOC (There always are).  Even with all that
intelligence, you could feel the tension in the room as we put 'em in
there.

Why?  Well we have enough people bashing the NOC crew all the time.  Now
we were purposefully messing with people.  How would you like to be the
person that accidentally put the IETF-Chair in the penalty box?

So we put quite a few people in there, and we caught at least one (Thanks
Joel).  Was the guy actually doing malicious things.  We think so.  Did he
act like he didn't know what was going on?  Yep.  Did he unplug his
computer as soon as we found him, yep.  It was all very odd.  Somewhat
rewarding, but still weird.

Ok, let's sum this up.

1.  The people who are running in ad-hoc mode, if you look at a few of
those nets, you will see multiple MAC addresses for the same network. 
Look closer and some of the OUI's look downright spooky.  You could be
chasing them for quite some time.

2.  As someone else pointed out, they would only feel the effects of your
efforts if they connect back to the IETF network.  Do you think they will?

3.  One of the ways we caught the person in Minneapolis was because of the
goo coming out of their WLAN card (scanning), we shut them off, and then
saw the same goo coming out of their wired port.  Doesn't apply to well to
wireless ad-hoc.

I bet you can catch some of the people, but in the end it is probably a
pretty low priority compared with tuning all your APs so the wireless
coverage at the plenary doesn't crash into itself.

I think training would be great.  The only problem is that either they are
doing it to be mean, or they have no idea they are doing it in the first
place and skim over the documentation asking them to check their config as
if it were a note well.  I'm all for the Penalty Box, I thought it was
cool.  But looking at that list of Ad-HOC nets and MAC addresses.  Wow,
that's a lot!

Best of luck to the NOC team, and thanks to UofO for the MP3 streams.

--Brett

> I think we should be very strict on this. All this people should get
filtered until they go to the NOC and make sure to get trained about how
to
Pekka Nikander
>> If you don't know how to check your MAC address or how not to turn off
ad-hoc capability, it may be better to turn off WLAN altogether. Thank
you,
> This electronic message contains information which may be privileged or
confidential. The information is intended to be for the use of the
individual(s) named above. If you are not the intended recipient be
aware
> that any disclosure, copying, distribution or use of the contents of
this
> information, including attached files, is prohibited.
>
>
>
>
>
>

--
Please note that my e-mail address has changed.

---

From: "Spencer Dawkins" <[email-masked]>
Date: Thu, 10 Nov 2005 14:12:50 -0800

Just to be clear - is the problem "ad hoc mode" or "ad hoc mode with SSID 
ietf"?

The last time we were in Minneapolis, Dean Willis noticed that the wireless 
projector controls in the conference rooms used 802.11b ad hoc ... in an 
increasingly IP-deviced world, if the problem is "ad hoc mode", we are going 
to die at an increasing rate over time.

Spencer

---

From: Joel Jaeggli <[email-masked]>
Date: Thu, 10 Nov 2005 14:55:23 -0800 (PST)

> Just to be clear - is the problem "ad hoc mode" or "ad hoc mode with SSID 

The problem basically works out to something like this...

A host with the magic settings, or defaults comes up, for whatever reason 
it can't associate with an accesspoint, so it says hey: I'll flop over to 
bss mode and become an adhoc node.

Now another host comes along as says, hey the strongest network I see is 
this adhoc network, so I'll join that.

So you have a bunch of hosts participating in this bss network, and 
because they're not being managed by an ibss node (an ap) their beacons 
and any traffic they send clobber traffic from the ap's around them making 
the situation worse.

Now, the ibss ap's have their power output turned down so that they don't 
clobber each other, because a certain ap density is needed support all the 
users on this network. So if the ap is transmitting at 15mw and you 
have a laptop with 100mw card which One wins?

The problem with a node that's decided to become adhoc is when would it 
decide to change back? It won't. Probably when your fiddle with your card 
settings, reset the card, sleep the laptop or reboot, that will be enough.

Certain implentations, eg macosX 10.1 would switch to an adhoc network 
with the same ssid as the mananged netowrk even if they were configured 
only to connect to managed networks.

So, good hygiene is:

Configure your laptop to stick to the ssid ietf64

Configure you card to only operate in managed, ibss or accesspoint 
networks.

If you have a card with selectable output power (like an old cisco, prism 
2, or atheros) pick something below 100mw like 15mw or or 30mw.

if you have a card with a density setting like and old lucent orinoco 
card, set it to high.

if you have 802.11a support use it.

> to die at an increasing rate over time.

The number of devices in your pocket and in the environment with radios 
does indeed increase over time. Couple that with the challenges of working 
in a new space, with days or hours of setup time, no decent simulation 
tools for a room with 100 tons of meat and 800 radio's in it. and host 
implementations of widely varying quality, and you have a challenging 
dynamic environment that should make every host scared.

-- 
--------------------------------------------------------------------------
Joel Jaeggli  	       Unix Consulting 	       [email-masked]
GPG Key Fingerprint:     5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Thu, 10 Nov 2005 15:03:00 -0800

Can be the summary of this then that the effort will be more worthy to have
lots of instructions in every meeting room for "how to get the IETF network
working" ?

Regards,
Jordi

> De: Brett Thorson <[email-masked]>
> Responder a: <[email-masked]>
> Fecha: Thu, 10 Nov 2005 16:59:59 -0500 (EST)
> Para: "[email-masked]" <[email-masked]>
> Asunto: Re: Please make sure that you do not run your WLAN in ad hoc mode
>

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Thu, 10 Nov 2005 17:31:14 -0800

A variant of things I've suggested before for other purposes:

Put up a screen in the hallway with continuous display of the ad-hoc mode 
MACs detected at any time.

Lets people check their own MACs in real time.

---

From: Bill Fenner <[email-masked]>
Date: Thu, 10 Nov 2005 18:53:56 -0800

> Lets people check their own MACs in real time.

If people don't know how to turn off ad-hoc mode, will they know how
to check their MAC address against the list?

  Bill

---

From: Lars Eggert <[email-masked]>
Date: Thu, 10 Nov 2005 19:48:51 -0800

Let's just forget about this wireless thing and put switches next to  
the power strips on the floor. We're stringing power through the  
rooms anyway.

(I'm actually half serious, after hours without any connectivity.)

On second thought - I'll just book the terminal room for the DCCP  
meeting next time.

Lars
--
Lars Eggert                                     NEC Network Laboratories