《802.11无线网络权威指南》：部署与安全管理详解

4星 · 超过85%的资源需积分: 10 109 浏览量更新于2024-07-30 2 收藏 4.16MB PDF 举报

《802.11无线网络权威指南》第二版是一本深度探讨802.11无线网络技术的专著，由美国作者Matthew S. Gast撰写，中文版由东南大学出版社出版，于2007年12月发行。该书针对严谨的系统管理员和网络管理员，全面解答了构建、扩展和维护无线网络时遇到的关键问题。 1. **无线网络基础知识**：第一章介绍了无线网络的概念，强调了无线网络的便捷性和背后复杂的协议，特别是当数据通过无线传输而非物理线路时面临的挑战，如移动用户的无缝连接和网络扩展。 2. **802.11协议体系**：第二章概述了802.11标准家族，包括802.11b、11a、g和即将成为标准的11n协议，强调了标准网络规划和架构的重要性，特别是对于移动性、频谱管理和功率控制的关注。 3. **介质访问控制（MAC）层**：第三章详细解析了802.11 MAC层，探讨了内容ions-based访问模式、定时竞争机制、数据帧的格式、碎片重组，以及封装高层协议等技术。 4. **帧结构与加密**：第四章深入解析802.11帧结构，包括数据帧、控制帧和管理帧，重点讲解了 Wired Equivalent Privacy (WEP) 和其存在的问题，随后介绍了更安全的802.1x和802.11i（Wi-Fi保护访问II，即WPA2）加密标准。 5. **安全措施**：第五部分着重于网络安全，介绍了WEP的加密背景、操作原理，以及WEP的局限性，随后转向更高级别的安全协议802.1x，涵盖了网络端口认证在无线局域网中的应用。 6. **管理操作**：第六章涵盖了无线网络的管理架构，包括扫描、认证、配置管理等关键操作，以及如何通过Ethereal等工具进行网络分析和故障排除，这对于网络监控和维护至关重要。作为一本实用手册，书中的内容不仅包含了理论知识，还包括了如何在实践中配置无线网卡、操作系统（Linux、Windows和Mac OS X）以及设置接入点的具体步骤，帮助读者将理论转化为实际操作。由于作者丰富的经验和对业界最新发展的洞察，这本指南不仅适用于当前的无线网络环境，也对未来的技术趋势有所预见。《802.11无线网络权威指南》是一本既适合初学者入门又能满足高级网络管理员需求的综合性参考书，它深入浅出地讲解了无线网络设计、实施、安全和管理的方方面面，是无线网络领域的必备参考资料。

Extended service areas are the highest-level abstraction supported by 802.11 networks. Access points

in an ESS operate in concert to allow the outside world to use a single MAC address to talk to a station

somewhere within the ESS. In Figure 2-5

, the router uses a single MAC address to deliver frames to a

mobile station; the access point with which that mobile station is associated delivers the frame. The

router remains ignorant of the location of the mobile station and relies on the access points to deliver

the frame.

2.2.2 The Distribution System, Revisited

With an understanding of how an extended service set is built, I'd like to return to the concept of the

distribution system. 802.11 describes the distribution system in terms of the services it provides to

wireless stations. While these services will be described in more detail later in this chapter, it is worth

describing their operation at a high level.

The distribution system provides mobility by connecting access points. When a frame is given to the

distribution system, it is delivered to the right access point and relayed by that access point to the

intended destination.

The distribution system is responsible for tracking where a station is physically located and delivering

frames appropriately. When a frame is sent to a mobile station, the distribution system is charged with

the task of delivering it to the access point serving the mobile station. As an example, consider the

router in Figure 2-5

. The router simply uses the MAC address of a mobile station as its destination.

The distribution system of the ESS pictured in Figure 2-5

must deliver the frame to the right access

point. Obviously, part of the delivery mechanism is the backbone Ethernet, but the backbone network

cannot be the entire distribution system because it has no way of choosing between access points. In

the language of 802.11, the backbone Ethernet is the distribution system medium, but it is not the entire

distribution system.

To find the rest of the distribution system, we need to look to the access points themselves. Most

access points currently on the market operate as bridges. They have at least one wireless network

interface and at least one Ethernet network interface. The Ethernet side can be connected to an existing

network, and the wireless side becomes an extension of that network. Relaying frames between the

two network media is controlled by a bridging engine.

Figure 2-6

illustrates the relationship between the access point, backbone network, and the distribution

system. The access point has two interfaces connected by a bridging engine. Arrows indicate the

potential paths to and from the bridging engine. Frames may be sent by the bridge to the wireless

network; any frames sent by the bridge's wireless port are transmitted to all associated stations. Each

associated station can transmit frames to the access point. Finally, the backbone port on the bridge can

interact directly with the backbone network. The distribution system in Figure 2-6 is composed of the

bridging engine plus the wired backbone network..

Figure 2-6. Distribution system in common 802.11 access point implementations

Every frame sent by a mobile station in an infrastructure network must use the distribution system. It is

easy to understand why interaction with hosts on the backbone network must use the distribution

system. After all, they are connected to the distribution system medium. Wireless stations in an

infrastructure network depend on the distribution system to communicate with each other because they

are not directly connected to each other. The only way for station A to send a frame to station B is by

relaying the frame through the bridging engine in the access point. However, the bridge is a

component of the distribution system. While what exactly makes up the distribution system may seem

like a narrow technical concern, there are some features of the 802.11 MAC that are closely tied to its

interaction with the distribution system.

2.2.2.1 Inter-access point communication as part of the distribution system

Included with this distribution system is a method to manage associations. A wireless station is

associated with only one access point at a time. If a station is associated with one access point, all the

other access points in the ESS need to learn about that station. In Figure 2-5

, AP4 must know about all

the stations associated with AP1. If a wireless station associated with AP4 sends a frame to a station

associated with AP1, the bridging engine inside AP4 must send the frame over the backbone Ethernet

to AP1 so it can be delivered to its ultimate destination. To fully implement the distribution system,

access points must inform other access points of associated stations. Naturally, many access points on

the market use an inter-access point protocol (IAPP) over the backbone medium. There is, however,

no standardized method for communicating association information to other members of an ESS.

Proprietary technology is giving way to standardization, however. One of the major projects in the

IEEE 802.11 working group is the standardization of the IAPP.

2.2.2.2 Wireless bridges and the distribution system

Up to this point, I have tacitly assumed that the distribution system was an existing fixed network.

While this will often be the case, the 802.11 specification explicitly supports using the wireless

medium itself as the distribution system. The wireless distribution system configuration is often called

a "wireless bridge" configuration because it allows network engineers to connect two LANs at the link

layer. Wireless bridges can be used to quickly connect distinct physical locations and are well-suited

for use by access providers. Most 802.11 access points on the market now support the wireless bridge

configuration, though it may be necessary to upgrade the firmware on older units.

2.2.3 Network Boundaries

Because of the nature of the wireless medium, 802.11 networks have fuzzy boundaries. In fact, some

degree of fuzziness is desirable. As with mobile telephone networks, allowing basic service areas to

overlap increases the probability of successful transitions between basic service areas and offers the

highest level of network coverage. The basic service areas on the right of Figure 2-7

overlap

significantly. This means that a station moving from BSS2 to BSS4 is not likely to lose coverage; it

also means that AP3 (or, for that matter, AP4) can fail without compromising the network too badly.

On the other hand, if AP2 fails, the network is cut into two disjoint parts, and stations in BSS1 lose

connectivity when moving out of BSS1 and into BSS3 or BSS4.

Figure 2-7. Overlapping BSSs in an ESS

Different types of 802.11 networks may also overlap. Independent BSSs may be created within the

basic service area of an access point. Figure 2-8

illustrates spatial overlap. An access point appears at

the top of the figure; its basic service area is shaded. Two stations are operating in infrastructure mode

and communicate only with the access point. Three stations have been set up as an independent BSS

and communicate with each other. Although the five stations are assigned to two different BSSs, they

may share the same wireless medium. Stations may obtain access to the medium only by using the

rules specified in the 802.11 MAC; these rules were carefully designed to enable multiple 802.11

networks to coexist in the same spatial area. Both BSSs must share the capacity of a single radio

channel, so there may be adverse performance implications from co-located BSSs.

Figure 2-8. Overlapping network types

2.3 802.11 Network Operations

From the outset, 802.11 was designed to be just another link layer to higher-layer protocols. Network

administrators familiar with Ethernet will be immediately comfortable with 802.11. The shared

heritage is deep enough that 802.11 is sometimes referred to as "wireless Ethernet."

The core elements present in Ethernet are present in 802.11. Stations are identified by 48-bit IEEE 802

MAC addresses. Conceptually, frames are delivered based on the MAC address. Frame delivery is

unreliable, though 802.11 incorporates some basic reliability mechanisms to overcome the inherently

poor qualities of the radio channels it uses.

[4]

I don't mean "poor" in an absolute sense. But the reliability of wireless transmission is

really not comparable to the reliability of a wired network.

From a user's perspective, 802.11 might just as well be Ethernet. Network administrators, however,

need to be conversant with 802.11 at a much deeper level. Providing MAC-layer mobility while

following the path blazed by previous 802 standards requires a number of additional services and more

complex framing.

2.3.1 Network Services

One way to define a network technology is to define the services it offers and allow equipment

vendors to implement those services in whatever way they see fit. 802.11 provides nine services. Only

three of the services are used for moving data; the remaining six are management operations that allow

the network to keep track of the mobile nodes and deliver frames accordingly.

The services are described in the following list and summarized in Table 2-1:

Distribution

This service is used by mobile stations in an infrastructure network every time they send data.

nce a frame has been accepted by an access point, it uses the distribution service to deliver

the frame to its destination. Any communication that uses an access point travels through the

distribution service, including communications between two mobile stations associated with

the same access point.

Integration

Integration is a service provided by the distribution system; it allows the connection of the

distribution system to a non-IEEE 802.11 network. The integration function is specific to the

distribution system used and therefore is not specified by 802.11, except in terms of the

services it must offer.

Association

Delivery of frames to mobile stations is made possible because mobile stations register, or

associate, with access points. The distribution system can then use the registration information

to determine which access point to use for any mobile station. Unassociated stations are not

"on the network," much like workstations with unplugged Ethernet cables. 802.11 specifies

the function that must be provided by the distribution system using the association data, but it

does not mandate any particular implementation.

Reassociation

When a mobile station moves between basic service areas within a single extended service

area, it must evaluate signal strength and perhaps switch the access point with which it is

associated. Reassociations are initiated by mobile stations when signal conditions indicate that

a different association would be beneficial; they are never initiated by the access point. After

the reassociation is complete, the distribution system updates its location records to reflect the

reachability of the mobile station through a different access point.

Disassociation

To terminate an existing association, stations may use the disassociation service. When

stations invoke the disassociation service, any mobility data stored in the distribution system

is removed. Once disassociation is complete, it is as if the station is no longer attached to the

network. Disassociation is a polite task to do during the station shutdown process. The MAC

is, however, designed to accommodate stations that leave the network without formally

disassociating.

Authentication

Physical security is a major component of a wired LAN security solution. Network attachment

points are limited, often to areas in offices behind perimeter access control devices. Network

equipment can be secured in locked wiring closets, and data jacks in offices and cubicles can

be connected to the network only when needed. Wireless networks cannot offer the same level

of physical security, however, and therefore must depend on additional authentication routines

to ensure that users accessing the network are authorized to do so. Authentication is a

necessary prerequisite to association because only authenticated users are authorized to use

the network. (In practice, though, many access points are configured for "open-system"

authentication and will authenticate any station.)

Deauthentication

Deauthentication terminates an authenticated relationship. Because authentication is needed

before network use is authorized, a side effect of deauthentication is termination of any

current association.

Privacy

Strong physical controls can prevent a great number of attacks on the privacy of data in a

wired LAN. Attackers must obtain physical access to the network medium before attempting

to eavesdrop on traffic. On a wired network, physical access to the network cabling is a subset

of physical access to other computing resources. By design, physical access to wireless

networks is a comparatively simpler matter of using the correct antenna and modulation

methods. To offer a similar level of privacy, 802.11 provides an optional privacy service

called Wired Equivalent Privacy (WEP). WEP is not ironclad security—in fact, it has been

proven recently that breaking WEP is easily within the capabilities of any laptop (for more

information, see Chapter 5

). Its purpose is to provide roughly equivalent privacy to a wired

network by encrypting frames as they travel across the 802.11 air interface. Depending on

your level of cynicism, you may or may not think that WEP achieves its goal; after all, it's not

that hard to access the Ethernet cabling in a traditional network. In any case, do not assume

that WEP provides more than minimal security. It prevents other users from casually

appearing on your network, but that's about all.

[5]

One of O'Reilly's offices had a strange situation in which apparent "interlopers"

appeared on the network. They eventually discovered that their ESS overlapped

a company in a neighboring office building, and "foreign" laptops were simply

associating with the access point that had the strongest signal. WEP solves

problems like this but will not withstand a deliberate attack on your network.

MSDU delivery

Networks are not much use without the ability to get the data to the recipient. Stations provide

the MAC Service Data Unit (MSDU) delivery service, which is responsible for getting the

data to the actual endpoint.

Table 2-1. Network services

Service

Station or distribution

service?

Description

Distribution Distribution

Service used in frame delivery to determine

destination

address in infrastructure networks

Integration Distribution

Frame delivery to an IEEE 802 LAN outside the wireless

network

Association Distribution

Used to establish the AP which serves as the gateway to a

particular mobile station

Reassociation Distribution

Used to change the AP which serves as the gateway to a

particular mobile station

Disassociation Distribution Removes the wireless station from the network

Authentication Station Establishes identity prior to establishing association

Deauthentication Station

Used to terminate authentication, and by extension,

association

Privacy Station Provides protection against eavesdropping

MSDU delivery Station Delivers data to the recipient

剩余334页未读，继续阅读

netsniper11

粉丝: 6
资源: 116

《802.11无线网络权威指南》：部署与安全管理详解

802.11详解 802.11 Wireless Networks- The Definitive Guide

802.11 Wireless Networks The Definitive Guide, 2nd Edition

802.11 Wireless Networks The Definitive Guide Oreilly.pdf

802.11 Wireless Network 2nd (part3)

802.11Wireless.Network (part5)

802.11 Wireless.Network.2nd (part4)

802.11 Wireless.Networks. 2nd (Part2)

802.11.Wireless.LAN.Fundamentals.Cisco.Press.eBook

802.11-2012.pdf.rar

无线局域网与802.11.pdf

最新资源