Subject: [93attendees] "ietf - The wireless network appears to have been compromised and will be disabled for about a minute."

From: Ross Finlayson <[email-masked]>
Date: Mon, 20 Jul 2015 13:39:08 +0200

Whenever I connect to the “ietf” wireless network (with username,password “ietf”) I frequently get a popup window (on a Macbook Pro running OS X 10.10.4) saying:
	ietf
	The wireless network appears to have been compromised and will be disabled for about a minute

Is anyone else seeing these popups?  Should we care?

	Ross.

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 20 Jul 2015 11:41:12 +0000

I was seeing them.  I switched to ietf-2.4only and they went away.

Brian

On 7/20/15, 1:39 PM, "Ross Finlayson" <[email-masked]> wrote:

>Whenever I connect to the “ietf” wireless network (with username,password
>“ietf”) I frequently get a popup window (on a Macbook Pro running OS X
>10.10.4) saying:
>	ietf
>_______________________________________________
>93attendees mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/93attendees

---

From: "Peter van Dijk" <[email-masked]>
Date: Mon, 20 Jul 2015 13:40:13 +0200

Hello Ross,

On 20 Jul 2015, at 13:39, Ross Finlayson wrote:

> Whenever I connect to the “ietf” wireless network (with 
> username,password “ietf”) I frequently get a popup window (on a 
> Macbook Pro running OS X 10.10.4) saying:
> 	ietf

Myself and at least one other user are also seeing this.

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/

---

From: Aaron Falk <[email-masked]>
Date: Mon, 20 Jul 2015 13:41:27 +0200

Already a ticket on this.  See https://tickets.meeting.ietf.org/ticket/951.

--aaron

---

From: Jim Martin <[email-masked]>
Date: Mon, 20 Jul 2015 13:41:30 +0200

Ross,
	I can answer for the masses. Yes! It’s an issue related to the TKIP MIC on the encrypted SSIDs. We’re in the process of updating the AP configurations to force folks to AES, which is expected to resolve the issue. Please give us a few minutes to roll out the change.

	- Jim

> On Jul 20, 2015, at 1:39 PM, Ross Finlayson <[email-masked]> wrote:
>

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 20 Jul 2015 13:42:10 +0200

> Is anyone else seeing these popups?  Should we care?

FWIW I started seeing them after lunch today.
Also running 10.10.4.

    Erik

---

From: Ignacio Solis <[email-masked]>
Date: Mon, 20 Jul 2015 13:43:52 +0200

FYI, not present on v6only.   We saw them around 11am.

On Mon, Jul 20, 2015 at 1:40 PM, Peter van Dijk <[email-masked]

-- 
Nacho - Ignacio Solis - [email-masked]

---

From: "Henderickx, Wim (Wim)" <[email-masked]>
Date: Mon, 20 Jul 2015 11:45:48 +0000

I observe the same issue on my MACbook Pro OS Z 10.10.4 as well

---

From: Pushpasis Sarkar <[email-masked]>
Date: Mon, 20 Jul 2015 11:48:23 +0000

I also saw this for a good 30-45 mins. I turned of wireless and turned it
back on. Since then I don¹t see it anymoreŠ

On 7/20/15, 1:45 PM, "93attendees on behalf of Henderickx, Wim (Wim)"
<[email-masked] on behalf of
[email-masked]> wrote:

>On 20/07/15 13:39, "93attendees on behalf of Ross Finlayson"
><[email-masked] on behalf of [email-masked]> wrote:
>
>>Whenever I connect to the ³ietf² wireless network (with
>>username,password ³ietf²) I frequently get a popup window (on a Macbook
>>Pro running OS X 10.10.4) saying:
>>	ietf

---

From: Simon Perreault <[email-masked]>
Date: Mon, 20 Jul 2015 13:50:43 +0200

> Already a ticket on this.  See https://tickets.meeting.ietf.org/ticket/951.

https://tickets.meeting.ietf.org/ticket/950

Do I win? ;)

Simon

---

From: Simon Perreault <[email-masked]>
Date: Mon, 20 Jul 2015 13:55:51 +0200

> https://tickets.meeting.ietf.org/ticket/950

Apparently not...

https://tickets.meeting.ietf.org/ticket/949
https://tickets.meeting.ietf.org/ticket/948
https://tickets.meeting.ietf.org/ticket/947
https://tickets.meeting.ietf.org/ticket/946
https://tickets.meeting.ietf.org/ticket/945
...

I gave up trying to find the real winner. ;)

Simon

---

From: Yoav Nir <[email-masked]>
Date: Mon, 20 Jul 2015 13:59:53 +0200

> On Jul 20, 2015, at 1:50 PM, Simon Perreault <[email-masked]> wrote:
> 

Not quite:
  https://tickets.meeting.ietf.org/ticket/949
  https://tickets.meeting.ietf.org/ticket/948
  https://tickets.meeting.ietf.org/ticket/947
  https://tickets.meeting.ietf.org/ticket/946
  https://tickets.meeting.ietf.org/ticket/945 (probably, Does Brian use a Mac?)
  https://tickets.meeting.ietf.org/ticket/944
  https://tickets.meeting.ietf.org/ticket/943 (probably)

---

From: Daniel Harkins <[email-masked]>
Date: Mon, 20 Jul 2015 12:10:52 +0000

Hi Jim,

  TKIP was designed to have a shelf-life of 5 years and that passed 2 years ago.
It’s been deprecated by 802.11 and should not be used on any network anymore.

  regards,

  Dan.

On 7/20/15, 4:41 AM, "93attendees on behalf of Jim Martin" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

Ross,

- Jim

On Jul 20, 2015, at 1:39 PM, Ross Finlayson <[email-masked]<mailto:[email-masked]>> wrote:
Whenever I connect to the “ietf” wireless network (with username,password “ietf”) I frequently get a popup window (on a Macbook Pro running OS X 10.10.4) saying:
ietf
The wireless network appears to have been compromised and will be disabled for about a minute
Is anyone else seeing these popups?  Should we care?
Ross.
_______________________________________________
93attendees mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/93attendees

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 21 Jul 2015 00:14:56 +1200

>   https://tickets.meeting.ietf.org/ticket/945 (probably, Does Brian use a Mac?)

No, but Windows 7 was just disconnecting me without the courtesy of
a message. I think it was the same thing.

   Brian

---

From: Chris Elliott <[email-masked]>
Date: Mon, 20 Jul 2015 14:20:51 +0200

All,

We've modified the wireless config so that this issue should not reoccur.
Please let us know if you see it again.

We continue to monitor our logs, as we saw the issue first there at 10:50am
today. I finished configuring the APs at 1:44pm and haven't seen it since.
We don't believe that this problem can happen again, despite possible
misbehaving clients.

A few details, summarized from my memory. Feel free to correct if you feel
inclined!

Wifi can use several different encryption methods--WEP, TKIP, and AES. We
stopped using WEP many years ago. However, the first version of WPA
modified WEP to add a temporal key and a MIC to check if the packet had
been modified in flight. This protocol included draconian measures if the
access point detected an incorrect MIC, as the thought was that TKIP was
weak and there needed to be strong measures to prevent repeated attacks
that might reveal the key. It turned out that the standards organization
underestimated the strength of TKIP, so these draconian measures weren't
really necessary.

We have had a feature enabled on our APs that should avoid any packet
corruption from triggering said draconian measures. However, for the first
time in several years, we're once again seeing the APs reacting badly.
While we don't know for sure why the APs are doing this, we did determine
the few to none of our attendees are using TKIP. Therefore we have now
disabled TKIP throughout the IETF network and all encrypted networks are
WPA2/AES only. This seems to have mitigated the issue.

We continue to monitor the network to determine if there are any other
effects of whatever caused this problem.

As usual, feel free to open a ticket with the NOC if you have any issues on
the IETF network.

Enjoy!
Chris.

On Mon, Jul 20, 2015 at 1:59 PM, Yoav Nir <[email-masked]> wrote:

> >> Already a ticket on this.  See
> https://tickets.meeting.ietf.org/ticket/951.
> >

-- 
Chris Elliott
[email-masked]

---

From: "Henderickx, Wim (Wim)" <[email-masked]>
Date: Mon, 20 Jul 2015 12:36:47 +0000

Works for me now, stable for about 15 min :-)

From: 93attendees on behalf of Chris Elliott
Reply-To: "[email-masked]<mailto:[email-masked]>"
Date: Monday 20 July 2015 14:20
To: Yoav Nir
Cc: Aaron Falk, Simon Perreault, Ross Finlayson, "[email-masked]<mailto:[email-masked]>"
Subject: Re: [93attendees] "ietf - The wireless network appears to have been compromised and will be disabled for about a minute."

All,

We've modified the wireless config so that this issue should not reoccur. Please let us know if you see it again.

We continue to monitor our logs, as we saw the issue first there at 10:50am today. I finished configuring the APs at 1:44pm and haven't seen it since. We don't believe that this problem can happen again, despite possible misbehaving clients.

A few details, summarized from my memory. Feel free to correct if you feel inclined!

Wifi can use several different encryption methods--WEP, TKIP, and AES. We stopped using WEP many years ago. However, the first version of WPA modified WEP to add a temporal key and a MIC to check if the packet had been modified in flight. This protocol included draconian measures if the access point detected an incorrect MIC, as the thought was that TKIP was weak and there needed to be strong measures to prevent repeated attacks that might reveal the key. It turned out that the standards organization underestimated the strength of TKIP, so these draconian measures weren't really necessary.

We have had a feature enabled on our APs that should avoid any packet corruption from triggering said draconian measures. However, for the first time in several years, we're once again seeing the APs reacting badly. While we don't know for sure why the APs are doing this, we did determine the few to none of our attendees are using TKIP. Therefore we have now disabled TKIP throughout the IETF network and all encrypted networks are WPA2/AES only. This seems to have mitigated the issue.

We continue to monitor the network to determine if there are any other effects of whatever caused this problem.

As usual, feel free to open a ticket with the NOC if you have any issues on the IETF network.

Enjoy!
Chris.

On Mon, Jul 20, 2015 at 1:59 PM, Yoav Nir <[email-masked]<mailto:[email-masked]>> wrote:

> On Jul 20, 2015, at 1:50 PM, Simon Perreault <[email-masked]<mailto:[email-masked]>> wrote:
>

Not quite:

--
Chris Elliott
[email-masked]<mailto:[email-masked]>

---

From: Mikael Abrahamsson <[email-masked]>
Date: Mon, 20 Jul 2015 14:45:05 +0200 (CEST)

> Works for me now, stable for about 15 min :-)

I concur, the past 20-30 minutes or so "ietf" has been stable. Before that 
I couldn't connect, but now it seems to work.

So just to be clear, my experience is that the "ietf" ssid was unstable 
past the 1.44pm time that was mentioned before, but now it's working much 
better. I am in Congress Hall III.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Chris Elliott <[email-masked]>
Date: Mon, 20 Jul 2015 16:17:11 +0200

Mikael and all attendees,

The TKIP problem is not the only problem we're dealing with. If we knew
more about exactly what problem you were having I might be able to tell you
the status of any related problem.

We are tracking a problem with excessive broadcast traffic triggered by
scans of our network from the outside. We're actively mitigating that
issue. On occasion it's caused broadcast packets to be dropped before being
delivered to wireless clients. This has affected the ability to use IPv6 on
occasion.

I will note that there also seem to be scans of our network coming from our
clients. Please note that the triggered broadcasts from ARPs, for example,
can affect the performance of everyone. We provide an open network for
everyone to use, and we encourage all of you to use it. However, please be
aware that some actions may hurt performance for others. We ask you to be
respectful of all users.

Thanks
Chris.

-- 
Chris Elliott
[email-masked]