Securing your Linksys Wireless Router BEFW11S4 Abstract
Current implementations of the 802.11b wireless LAN standards have several potential pitfalls for security. However, built in security mechanisms in the 802.11b protocol can be used to mitigate most security risks. Out of the box, the Linksys default configuration is insecure. This paper examines how to configure the Linksys Wireless Access Point (BEFW11S4) in a manner which will improve the security of the of your Wireless LAN

Introduction

Wireless networks are becoming increasingly common due to the ease and cost of deployment of the LAN using wireless technologies. Wireless networks provide different challenges than wired networks, especially in securing data in transit between the client and the wireless access point. The wireless standard, 802.11b provides mechanisms for securing wireless data, and despite the limitations of the standard when the provided mechanisms are deployed and maintained in a systematic manner data can be secured against all but the most determined and patient attacker. This paper describes security strategies for the Linksys Wireless Access Point (WAP), model BEFW11S4, Version 2, and the Linksys Instant Wireless Network Adapter Version, model WCP11, version 3. This paper assumes the user is familiar with the Linksys web-based management interface, and how to use a web browser.
Configuration Recommendations
For the Linksys Wireless Access Point I recommend the following configuration settings to secure your wireless LAN. 1. Reset admin password 2. Reset default SSID 3. Disable SSID Broadcast 4. Change from default channel 5. Enable WEP with 128 bit key 6. Change Authentication Type to Shared Key The following sections will describe why and how you should do these steps.

Reset Admin Password

From the factory the Linksys WAP comes with a default password of admin. The Linksys WAP uses a web based interface, and this interface is accessible to anyone on your network. Because this is a wireless network, anyone who can access your network 1/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
will be able to access the GUI interface and attempt to make changes. By setting the password we will at least be able to prohibit unwelcome users from reconfiguring the WAP. The password is reset from the password tab. The password can be up to 63 characters.
Figure 1 Linksys Password Screen
The next three items are all on the setup tab of the GUI.
Reset Default Service Set Identification (SSID)
The service set identification (SSID) defines a network name for your wireless network. In order to communicate the WAP and the clients wireless interface must specify the same SSID. The Linksys WAP comes with a default SSID of linksys The SSID is easily sniffable, but changing it will at least deter the casual attacker. The SSID can be up to 32 characters in length.
2/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
Figure 2 Default Linksys Setup Screen

Disable SSID Broadcast

By default 802.11b broadcasts the SSID to the network to assist devices in finding the network. By default the Linksys WAP enables SSID broadcast. In a closed SOHO configuration this should be disabled.

Change Channel

By default Linksys is set to channel 6. Although it is a minor bit of obscurity it is a good idea to switch to a different channel so a wireless interface in the default configuration cannot access your network.
Enable Wired Equivalent Privacy (WEP)
By default 802.11b broadcasts network traffic in the clear. WEP is link-layer encryption designed to provide confidentiality to the wireless network. WEP has some flaws which limit its effectiveness, but WEP provides adequate protection to deter all but the sophisticated and patient attacker. In order to enable WEP, the WEP configuration needs to be set to Mandatory and the key set. The following figure shows the settings on the Setup tab after the above have been done.
3/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
Figure 3 Proper Settings Linksys Setup Screen

Setting the WEP Key

Linksys supports both 64-bit or 128-bit encryption. Because of WEPs inherent limitations, it is best to use the 128-bit encryption option. To set the WEP key, click the WEP Key Setting button on the main setup page. The default is 64-bit WEP. Start by changing the setting to 128-bit, that will result in a transformation of the page to that in figure 5 below.
4/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.

Figure 4 Default WEP Key Setting Screen 128 Bit
To generate a key you can use two methods. Either a manual key, or through entering of a passphrase. I suggest the passphrase method since it is easier to remember, and duplicate. The passphrase can be up to 31 characters long. Enter the passphrase and then press the Generate button.
5/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.
Figure 5 WEP Key Setting Screen 128 Bit
Shared Secret Authentication
The Linksys WAP supports three authentication setting; open systems authentication, shared-key association, and both. Open systems authentication permits any client to use the WAP as long as they know the SSID. Shared-key authentication uses the WEP key as a shared-key to be exchanged between the client and the WAP as a simple form of authentication. WEP must be enabled to use shared-key authentication. The both setting permits either or these methods to work. The default method in the Linksys WAP is Both. The authentication type is changed by going to the Advanced tab and then the wireless tab and selecting Shared Key from the Authentication Type drop down menu.
Figure 6 Authentication Type Setting Screen
6/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.

Maintenance

According to research, the limitations of the WEP encryption mean that the key can be derived if five to six million packets are captured and analyzed. If you want to ensure the security of your data changing your WEP key regularly should be part of your maintenance steps. I would recommend changing it once a week or more depending on usage.

References

Linksys Corporation, BEFW11S4 Version 2 - Wireless Access Point Router with 4-Port Switch User Guide, 2002 Craiger, Phillip J., 802.11, 802.1x, and Wireless Security, June 23, 2002, URL: http://rr.sans.org/wireless/802.11.php
7/Richard Wanner. All rights reserved. For information contact cerberus@whitehats.ca or rwanner@pobox.com.

The Wireless Access Point Routers LEDs
T h e Figure 1-2 Routers rear panel (as shown in Figure 1-2) is where all of its connections are made. WAN The WAN (Wide Area Network) Port is where you will connect your cable or DSL modem with an Ethernet cable. Your modem connection will not work from any other port. These four LAN (Local Area Network) ports are where you will connect networked devices, such as PCs, print servers, and any other Ethernet devices you want to put on your network. If Port 4 is being used, the Uplink Port will not work. The Uplink Port is where you can expand your network by connecting to another switch or hub. Uplinking to another switch or a hub is done by simply running a cable from the Uplink Port to the other device. The Uplink Port is shared with Port 4. If the Uplink port is being used, Port 4 will not work. The Power Port is where you will connect the included AC Power adapter. The LAN Indicators WLAN Act WLAN Link Uplink Green. This LED indicates wireless activity. Green. This LED indicates that the Routers wireless functions have been enabled through the Web-based utility. Green. This LED indicates that the Routers power is on. Green. This LED serves two purposes. When this LED is lit continuously, this indicates that the Router is connected to a device through the corresponding port (1, 2, 3, or 4). A blinking LED indicates that the Router is actively sending or receiving data over that port. When the Uplink Port is in use, the LED for Port 4 will be lit continuously.

Figure 1-3

Ports 1-4

Power Link/Act

Antenna Jacks The Antenna Jacks are where the included antennas are connected.
Full/Col Green. This LED also serves two purposes. When this LED is lit continuously, the connection made through the corresponding port is running in Full Duplex mode. A blinking LED indicates that the connection is experiencing collisions. Infrequent collisions are normal. If this LED blinks too often, there may be a problem with your connection. Refer to the Troubleshooting Appendix if you think there is a problem. Orange. This LED indicates when a successful 100Mbps connection is made through the corresponding port.
Chapter 2: Connecting the Router
Before You Start Before plugging everything together, its always a good idea to have everything youll need to get the Router up and running. Depending upon how you configure the Router in Chapter 4: Configuring the Router, you may need some of the following values from your ISP: When connecting through a Static IP connection, be sure to have 1) Your broadband-configured PCs fixed Internet IP Address, 2) Your broadbandconfigured PCs Computer Name and Workgroup Name, 3) Your Subnet Mask, 4) Your Default Gateway, and 5) Your Primary DNS IP address. When connecting through a PPPoE connection, be sure to have 1) Your PPPoE User Name and 2) Your PPPoE Password. The installation technician from your ISP should have left this information with you after installing your broadband connection. If not, you can call your ISP to request the data. Once you have the above values, you can begin the Routers installation and setup. Connecting Your Hardware Together and Booting Up Once you are sure that you have the above values on hand, you can begin the Installation and Setup of the Router. 1. Power everything down, including your PCs, your cable or DSL modem and the Router. 2. Connect an Ethernet cable from one of your PCs Ethernet ports to one of the Routers LAN ports (as shown in Figure 21). Do the same with all the PCs you wish to connect to the Router. (LAN Port 4 will become inactive if you use the Uplink port.)

Figure 2-3

You must obtain this information prior to connecting the Router to your network. You can obtain this information by contacting your ISP.
5. Power on the cable or DSL modem. Verify that the power is on by checking the Link LED in the WAN column on the front of the Router. The Link LED will be illuminated if the power is on and the modem is ready. 6. Press the Reset button on the back of the Router. Hold the button in for three seconds, or until the Diag LED illuminates red. This restores the Routers default settings. 7. Power on your PC. The Router is now connected. Continue to the next chapter to configure your PCs.
2. Select the Configuration tab and highlight the TCP/IP line for the applicable Ethernet adapter (as shown in Figure 3-1). If the word TCP/IP appears by itself, select that line. (Note: If there is no TCP/IP line listed, refer to your Ethernet adapters documentation to install TCP/IP now.) Then, click the Properties button.
Chapter 3: Configuring the PCs
Overview These instructions will help you configure each of your computers to communicate with the Router. To do this, you will need to configure your PCs network settings to obtain an IP (or TCP/IP) address automatically. Computers use IP addresses to communicate with each other across a network or the Internet. You will need to know which operating system your computer is running, such as Windows 95, 98, Millennium, 2000, or XP. You can find out by clicking the Start button and then selecting the Settings option. (If your Start menu doesnt have a Settings option, youre running Windows XP. You can select the Control Panel directly from the Start Menu.) Then, click Control Panel and double-click the System icon. Click the Cancel button when done. Once you know which Windows operating system you are running, follow the directions in this step for your computers operating system. If you PC is not configured with the TCP/IP protocol, you will need to do this for each computer you are connecting to the Router. The next few pages tell you, step by step, how to configure your TCP/IP settings based on the type of Windows operating system you are using. Once you've configured your computers, continue to Chapter 4: Configuring the Router. Configuring Windows 95, 98, and Millennium PCs 1. Click the Start button, click Settings and open the Control Panel. From there, double-click the Network icon to open the Network screen.
Figure 3-1 3. Click the IP Address tab and select Obtain an IP address automatically (as shown in figure 3-2).
Figure 3-2 4. Click the Gateway tab and verify that the Installed Gateway field is blank. Click the OK button.
5. Click the OK button again. Windows may ask you for the original Windows installation disk or additional files. Supply them by pointing to the correct file location, e.g., D:\win98, D:\win9x, c:\windows\options\cabs, etc. (This assumes that D is the letter of your CD-ROM drive). 6. If Windows asks you to restart your PC, click the Yes button. If Windows does not ask you to restart, restart your computer anyway. Repeat steps 1-6 for each PC on your network. When all of your PCs are configured, proceed to Chapter 4: Configuring the Router. Configuring Windows 2000 PCs 1. Click the Start button, click Settings and open the Control Panel. From there, double-click the Network and Dial-up Connections icon. This will display the Network screen. 2. Select the Local Area Connection icon for the applicable Ethernet adapter (usually it is the first Local Area Connection listed). Double-click Local Area Connection and click the Properties button. (See Figure 33.)

4. Select Internet Protocol (TCP/IP) (as shown in Figure 3-4) and click the Properties button.
Figure 3-4 5. Select Obtain an IP address automatically and verify that Obtain DNS server address automatically is selected (as shown in Figure 3-5). Then, click the OK button and click the OK button on the subsequent screens to complete the PCs configuration. Figure 3-3
3. When the Local Area Connection Status screen appears, click the Properties button. Figure 3-5 Repeat steps 1-5 for each PC on your network. When all of your PCs are configured, proceed to Chapter 4: Configuring the Router.
Configuring Windows XP PCs The following instructions assume you are running Windows XPs default interface. If you are using the Classic interface (where the icons and menus look like previous Windows versions), please follow the instructions for Windows 2000. 1. Click the Start button, open the Control Panel. and click the Network and Internet Connections icon. Then, click the Network Connections icon to display the Network screen. 2. Select the Local Area Connection icon for the applicable Ethernet adapter (usually it is the first Local Area Connection listed). Double-click Local Area Connection and click the Properties button. (See Figure 36.)
4. Select Internet Protocol (TCP/IP) (as shown in Figure 3-7) and click the Properties button.
Figure 3-7 5. Select Obtain an IP address automatically and verify that Obtain DNS server address automatically is selected (as shown in Figure 3-8). Then, click the OK button and click the OK button on the subsequent screens to complete the PCs configuration.

Figure 3-6

3. When the Local Area Connection Status screen appears, click the Properties button.
Figure 3-8 Repeat steps 1-5 for each PC on your network. When all of your PCs are configured, proceed to Chapter 4: Configuring the Router.
3. If required by your ISP, enter the Routers Host Name and Domain Name in the appropriate fields on the Setup tab. (This is usually required by cable ISPs.) 4. To configure the Router for your wireless network, verify that the Setup tabs Wireless fields (shown in Figure 4-3) are completed as follows: Enable/Disable: Selecting the Enable radio button will enable the Routers wireless feature. Wireless functions will not be available unless enabled. Figure 4-3

SSID: The SSID is a unique name for your wireless network. It is case sensitive and must not exceed 32 characters. The default SSID is "linksys " but you should change this to a personal wireless network name. All wireless points in your network must use the same SSID. Verify that you are using the correct SSID and click the Apply button to set it. Allow Broadcast SSID to associate?: To increase network security, the Routers Utility prevents the SSID from being seen on networked PCs. Without this enabled, someone could easily obtain this information with site survey software of any software and gain access to your network. To enable this function, click the Yes radio button beside this question. Channel Select the appropriate channel from the list provided to correspond with your network settings, between 1 and 11. (Higher channels can only be used outside of the United States and Canada.) All points in your wireless network must use the same channel in order to function correctly. Verify that the correct channel is selected and click the Apply button to set it. WEP (Mandatory/Disable). In order to utilize WEP encryption, select Enable. If you do not wish to utilize WEP encryption, make sure Disable is selected. WEP Key Setting When WEP Encryption is Enabled, press this button to modify the WEP Key Settings. For further details on configuring Wireless Security, using WEP, refer to Appendix C: Configuring Wireless Security. WAN Connection Type The Router supports five connection types: DHCP (obtain an IP automatically), PPPoE, Static IP Address, RAS, and PPTP. These types are selected from the drop-down menu beside WAN Connection Type. The Setup tab and available features will differ depending on what kind of connection type you select. Each option is described on the following pages. Obtain an IP Automatically If your ISP says that you are connecting through a dynamic IP address (or DHCP), select this option from the drop-down menu (as shown in Figure 53). Now, the Router will accept the dynamic IP addresses assigned by your ISP when connecting to the Internet.

Figure 5-3

Note: Due to differences in web browsers, some screen shots may differ.
LAN IP Address and Subnet Mask This is the Routers IP Address and Subnet Mask as seen on the internal LAN. The default value is 192.168.1.1 for IP Address and 255.255.255.0 for Subnet Mask. Wireless (Enable/Disable). In order to utilize the Routers wireless functions, select Enable. If you do not wish to utilize any wireless functions, make sure Disable is selected. (Note: No other wireless functions will be available unless you enable this setting.)

If you have downloaded PC-cillin, complete this section. Enforce PC-cillin Anti-Virus Check this box to enable PC-cillin AntiVirus on the Router. Exempt Computers If you wish to exempt any computers from enforcement of ZoneAlarm Pro and/or PC-cillin, complete this section. Enable/Disable To enable or disable computer exemptions, click Enable or Disable. From IP Address/To IP Address Enter the range of IP addresses for the computers you want to exempt from enforcement of ZoneAlarm Pro and/or PC-cillin.
Help The Help tab, as shown in Figure 5-13, contains links to all of the Utilitys internal support documentation, a link to Linksyss website, and the application that upgrades the Routers firmware. To utility these links, you must have an active Internet connection.
Important: In order to upgrade the Routers firmware, you must use Internet Explorer 5.0 or higher, or Netscape Navigator 4.7 or higher. Upgrading the firmware may cause the Router to be reset to the factory defaults. Make a record of all settings before attempting the upgrade.
Figure 5-14 Figure 5-13 Click the Linksys Website link to connect to the Linksys homepage for Knowledgebase help files and information about other Linksys products. For an Online Manual in PDF format, click that text link. The manual will appear in Adobe PDF format. If you do not have the Adobe PDF Reader installed on your computer, click the Adobe Website link to download this software. Firmware can be upgraded by clicking the Upgrade Firmware link. Do not upgrade your firmware unless you are experiencing problems with the Access Point. To upgrade the Routers firmware: 1. Access the Help tab and click Upgrade Firmware. A new page, shown in Figure 5-14, will appear. 2. Click the Browse button and find the firmware upgrade file that you downloaded from the Linksys website. Double-click the upgrade file. This will place the file into the File Path: field. 3. When the correct file is in the File Path: field, click the Upgrade button and follow the instructions there. This will complete your firmware upgrade. Filters Important: Do not interrupt the firmware upgrade process in any way or power down the Router while the upgrade is in progress as this could damage the Router.

From the Dynamic Routing tab, shown in Figure 5-19, you can automatically adjust to physical changes in the networks layout. The Router, using the RIP protocol, determines the network packets route based on the fewest number of hops between the source and the destination. The RIP Figure 5-19 protocol regularly broadcasts routing information to other routers on the network. To set up Dynamic Routing: 1. Choose the correct Working Mode. Gateway Mode should be used if the Router is hosting your networks connection to the Internet. Router Mode should be selected if the Router exists on a network with other routers. 2. In the TX field, choose the protocol by which you transmit data on the network. 3. In the RX field, choose the protocol by which the Router receives network data. 4. Click the Apply button to save your changes. To view the Routing Table, which shows the network layout, click the Show Routing Table button. To clear any values youve entered on any page, click the Cancel button. To apply any settings youve altered on any page, click the Apply button. Once all settings are correct, click Continue.
Advanced Tab: Static Routing Important: Static Routing is an Advanced Function. No changes should be made to this tab without a thorough understanding of networking concepts.
2. Enter the following data to create a new static route: Destination LAN IP. The Destination LAN IP is the address of the remote network or host to which you want to assign a static route. Enter the IP address of the host for which you wish to create a static route here. If you are building a route to an entire network, be sure that the host portion of the IP address is set to zero. For example, the Routers standard IP address is 192.168.1.1. Based on this address, the address of the network to which the Router is connected is 192.168.1. You would enter the IP address 192.168.1.0 if you wanted to route to the entire network, rather than just to the Router. Subnet Mask. The Subnet Mask indicates which portion of an IP address is the network portion and which portion is the host portion. If, for instance, you use a Subnet Mask of 255.255.255.0 with the example shown above for Destination LAN IP, then this would indicate that the first three numbers of an network IP address identifies this particular network, while the last number in the network address (from 1 to 254) would identify the specific host. Gateway IP. This IP address should be the IP address of the gateway device that allows for contact between the Router and the remote network or host. Hop Count. This value gives the number of nodes that a data packet passes through before reaching its destination. A node is any device on the network, such as switches, PCs, etc.

15. I can't access my email, web, or VPN, or I am getting corrupted data from the Internet. The Maximum Transmission Unit (MTU) setting may need to be adjusted. By default, the MTU is set at 1500. For most DSL users, it is strongly recommended to use MTU 1492. If you are having some difficulties, perform the following steps: A. To connect to the Router, go to the web browser, and enter http://192.168.1.1 or the IP address of the Router. B. Enter the password, if asked. (The default password is admin.) C. Click the Advanced => Filter tab. D. Look for the MTU option, and select Enable. In the Size field, enter 1492. E. Click the Apply and Continue buttons to continue. If your difficulties continue, change the Size to different values. Try this list of values, one value at a time, in this order, until your problem is solved: 16. I need to use port triggering. Port triggering looks at the outgoing port services used and will trigger the Router to open a specific port, depending on which port an Internet application uses. Follow these steps: A. To connect to the Router, go to the web browser, and enter http://192.168.1.1 or the IP address of the Router. B. Enter the password, if asked. (The default password is admin.) C. Click the Advanced => Forwarding tab, and click the Port Trigger button. D. Enter any name you want to use for the Application Name. E. Enter the Triggered Port Range. Check with your Internet application provider for more information on which outgoing port services it is using. F. Enter the Incoming Port Range. Check with your Internet Application provider for more information on which incoming port services are required by the Internet application.
17. The Diag LED stays lit continuously. The Diag LED lights up when the device is first powered up. Meantime, the system will boot up itself and check for proper operation. After finishing the checking procedure, the LED turns off to show that the system is working fine. If the LED remains lit after this time, the device is not working properly. Try to flash the firmware by assigning a static IP address to the computer, and then upgrade the firmware. Try using the following settings, IP Address: 192.168.1.50 and Subnet Mask: 255.255.255.0. 18. When I enter a URL or IP address, I get a time-out error or am prompted to retry. Check if other PCs work. If they do, ensure that your workstations IP settings are correct (IP Address, Subnet Mask, Default Gateway, and DNS). Restart the computer that is having a problem. If the PCs are configured correctly, but still not working, check the Router. Ensure that it is connected and ON. Connect to it and check its settings. (If you cannot connect to it, check the LAN and power connections.) If the Router is configured correctly, check your Internet connection (DSL/cable modem, etc.) to see if it is working correctly. You can remove the Router to verify a direct connection. Manually configure the TCP/IP with a DNS address provided by your ISP. Make sure that your browser is set to connect directly and that any dialup is disabled. For Internet Explorer, click Tools, Internet Options, and then the Connection tab. Make sure that Internet Explorer is set to Never dial a connection. For Netscape Navigator, click Edit, Preferences, Advanced, and Proxy. Make sure that Netscape Navigator is set to Direct connection to the Internet. 19. The Full/Col LED keeps flickering continuously. Check the Category 5 Ethernet cable and its RJ-45 connectors. There may be interference with other network devices. Try removing other PCs or network devices to see if the problem persists. Eliminate each network device one at a time to determine the cause.

3. At the DOS command prompt, type ping mail (assuming that the location for which youre trying to find an IP address is configured as mail). Press Enter. Information such as the following data, taken from a ping of Microsoft Networks e-mail server, will be displayed. C:\>ping mail Pinging mail [24.53.32.4] with 32 bytes of data: Reply Reply Reply Reply from from from from 24.53.32.4: 24.53.32.4: 24.53.32.4: 24.53.32.4: bytes=32 bytes=32 bytes=32 bytes=32 time<10ms time<10ms time<10ms time<10ms TTL=128 TTL=128 TTL=128 TTL=128
Appendix B: How to Ping Your ISPs E-mail and Web Addresses
Virtually all Internet addresses are configured with words or characters (i.e., www.linksys.com, www.yahoo.com, etc.) In actuality, however, these Internet addresses are assigned to IP addresses, which are the true addresses on the Internet. For example, www.linksys.com is actually 216.23.162.142. Entering that into your web browser will bring up at the Linksys home page every time. IP and web addresses, however, can sometimes be long and hard to remember. Because of this, certain ISPs will shorten their server addresses to single words or codes on their users web browser or e-mail configurations. If your ISPs email and web server addresses are configured with single words (www, email, home, pop3, etc.) rather than whole Internet Addresses or IP Addresses, the Router may have problems sending or receiving mail and accessing the Internet. This happens because the Router has not been configured by your ISP to accept their abbreviated server addresses. The solution is to determine the true web addresses behind your ISPs code words. You can determine the IP and web addresses of your ISPs servers by pinging them.
Note: If you dont have your ISPs web and e-mail IP addresses, you must either get them from your ISP or follow these steps prior to connecting the Router to your network.
Ping statistics for 24.53.32.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
4. Write down the IP address returned by the ping command. (In the example above: 24.53.32.4.) This IP address is the actual IP address of the server mail, or any other word or value you have pinged. Step Two: Pinging for a Web Address While the IP address returned above would work as your e-mail server address, it may not be permanent. IP addresses change all the time. Web addresses, however, usually dont. Because of this, youre likely to have fewer problems by configuring your system with web addresses rather than IP addresses. Follow the instructions below to find the web address assigned to the IP address you just pinged. 1. At the DOS command prompt, type ping -a 24.53.32.4, where 24.53.32.4 is the IP address you just pinged. Information such as the following data will be displayed.

Appendix D: Finding the MAC Address and IP Address for Your Ethernet Adapter
This section describes how to find the MAC address for your Ethernet adapter to do either MAC Filtering or MAC Address Cloning for the Router and ISP. You can also find the IP address of your computers Ethernet adapter. The IP address is used for filtering, forwarding, and DMZ. Follow these steps to find the MAC address or IP address for your adapter in Windows 95, 98, ME, NT, 2000, and XP. For Windows 95, 98, and ME: 1. Click on Start and Run. In the Open field, enter winipcfg, as shown in Figure D-1. Then press the Enter key or the OK button.
Figure D-1 2. When the IP Configuration window appears, as shown in Figure D-2, select the Ethernet adapter you are using to connect to the Router via a CAT 5 Ethernet cable.
Figure C-10 Click the OK button to save the settings. Click on OK buttons until you get back to the Wireless Network Connection Status window. Close any open windows to get back to the Windows XP desktop. Close any applications and reboot your PC. After reboot, WEP configuration is complete and you should be able to connect wirelessly to the Router.

Figure D-2

3. Write down the Adapter Address as shown on your computer screen (see Figure D-3). This is the MAC address for your Ethernet adapter and will be shown as a series of numbers and letters. The MAC address/Adapter Address is what you will use for MAC Address Cloning or MAC Filtering.
2. In the command prompt, enter ipconfig /all. Then press the Enter key.
Figure D-3 The example in Figure F-3 shows the IP address of your Ethernet adapter as 192.168.1.100. Your computer may show something different. Note: The MAC address is also called the Adapter Address. For Windows NT, 2000, and XP: The following steps show an alternative way of obtaining the MAC address and IP address for your Ethernet adapter. 1. Click on Start and Run. In the Open field, enter cmd, as shown in Figure D-4. Press the Enter key or click the OK button. Figure D-5 3. Write down the Physical Address as shown on your computer screen; it is the MAC address for your Ethernet adapter. This will appear as a series of letters and numbers. The MAC address/Physical Address is what you will use for MAC Address Cloning or MAC Filtering. Note: The MAC address is also called the Physical Address. The example in Figure D-5 shows the IP address of your Ethernet adapter as 192.168.1.100. Your computer may show something different.

cially useful in education and other environments where users change frequently. Using very short leases, DHCP can dynamically reconfigure networks in which there are more computers than there are available IP addresses. DHCP supports static addresses for computers containing Web servers that need a permanent IP address. DMZ (Demilitarized Zone) - Allows one IP address (or computer) to be exposed to the Internet. Some applications require multiple TCP/IP ports to be open. It is recommended that you set your computer with a static IP address if you want to use DMZ Hosting. DNS - The domain name system (DNS) is the way that Internet domain name are located and translated into Internet Protocol (IP) addresses. A domain name is a meaningful and easy-to-remember "handle" for an Internet address. Domain - A subnetwork comprised of a group of clients and servers under the control of one security database. Dividing LANs into domains improves performance and security. Download - To receive a file transmitted over a network. In a communications session, download means receive, upload means transmit. DSL (Digital Subscriber Line) - A technology that dramatically increases the digital capacity of ordinary telephone lines into the home or office and, by employing unused bandwidth, still allows for normal phone usage. DSL provides "always-on" operation, eliminating the need to dial in to the service. DSSS (Direct-Sequence Spread Spectrum) - DSSS generates a redundant bit pattern for all data transmitted. This bit pattern is called a chip (or chipping code). Even if one or more bits in the chip are damaged during transmission, statistical techniques embedded in the receiver can recover the original data without the need for retransmission. To an unintended receiver, DSSS appears as low power wideband noise and is rejected (ignored) by most narrowband receivers. However, to an intended receiver (i.e. another wireless LAN endpoint), the DSSS signal is recognized as the only valid signal, and interference is inherently rejected (ignored). DTIM (Delivery Traffic Indication Message) - A DTIM field is a countdown field informing clients of the next window for listening to broadcast and multicast messages. When the AP has buffered broadcast or multicast messages for
associated clients, it sends the next DTIM with a DTIM Interval value. AP Clients hear the beacons and awaken to receive the broadcast and multicast messages. Dynamic IP Address - An IP address that is automatically assigned to a client station in a TCP/IP network, typically by a DHCP server. Network devices that serve multiple users, such as servers and printers, are usually assigned static IP addresses. Dynamic Routing - The ability for a router to forward data via a different route based on the current conditions of the communications circuits. For example, it can adjust for overloaded traffic or failing lines and is much more flexible than static routing, which uses a fixed forwarding path. Encryption - A security method that applies a specific algorithm to data in order to alter the data's appearance and prevent other devices from reading the information. ESS (Extended Service Set) - A set of more than two or more BSSs (multiple access points) forming a single network. Ethernet - IEEE standard network protocol that specifies how data is placed on and retrieved from a common transmission medium. Has a transfer rate of 10 Mbps. Forms the underlying transport vehicle used by several upper-level protocols, including TCP/IP and XNS. Fast Ethernet - A 100 Mbps technology based on the 10Base-T Ethernet CSMA/CD network access method. FHSS (Frequency Hopping Spread Spectrum) - FHSS continuously changes (hops) the carrier frequency of a conventional carrier several times per second according to a pseudo-random set of channels. Because a fixed frequency is not used, and only the transmitter and receiver know the hop patterns, interception of FHSS is extremely difficult. Finger - A UNIX command widely used on the Internet to find out information about a particular user, such as telephone number, whether currently logged on or the last time logged on. The person being "fingered" must have placed his or her profile on the system. Fingering requires entering the full user@domain address.

IP Address - In the most widely installed level of the Internet Protocol (Internet Protocol) today, an IP address is a 32-binary digit number that identifies each sender or receiver of information that is sent in packet across the Internet. When you request an HTML page or send e-mail, the Internet Protocol part of TCP/IP includes your IP address in the message (actually, in each of the packets if more than one is required) and sends it to the IP address that is obtained by looking up the domain name in the Uniform Resource Locator you requested or in the e-mail address you're sending a note to. At the other end, the recipient can see the IP address of the Web page requestor or the e-mail sender and can respond by sending another message using the IP address it received. IPCONFIG - A Windows NT or 2000 utility that provides for querying, defining and managing IP addresses within a network. A commonly used utility for configuring networks with static IP addresses. IPSec (Internet Protocol Security) - A suite of protocols used to implement secure exchange of packets at the IP layer. IPSec supports two basic modes: Transport and Tunnel. Transport encrypts the payload of each packet, leaving the header untouched, while Tunnel mode encrypts both the header and the payload and is therefore more secure. IPSec must be supported on both transmitter and receiver and must share a public key. Tunnel mode is widely deployed in VPNs (Virtual Private Networks). IPX (Internetwork Packet EXchange) - A NetWare communications protocol used to route messages from one node to another. IPX packets include network addresses and can be routed from one network to another. ISM band - The FCC and their counterparts outside of the U.S. have set aside bandwidth for unlicensed use in the ISM (Industrial, Scientific and Medical) band. Spectrum in the vicinity of 2.4 GHz, in particular, is being made available worldwide. This presents a truly revolutionary opportunity to place convenient high-speed wireless capabilities in the hands of users around the globe. ISP - An ISP (Internet service provider) is a company that provides individuals and companies access to the Internet and other related services such as Web site building and virtual hosting. LAN - A local area network (LAN) is a group of computers and associated devices that share a common communications line and typically share the resources of a single processor or server within a small geographic area (for example, within an office building).

MAC (Media Access Control) Address - A unique number assigned by the manufacturer to any Ethernet networking device, such as a network adapter, that allows the network to identify it at the hardware level. Mbps (MegaBits Per Second) - One million bits per second; unit of measurement for data transmission. MIB (Management Information Base) - A set of database objects. This set contains information about a specific device for utilizing SNMP. mIRC - mIRC runs under Windows and provides a graphical interface for logging onto IRC servers and listing, joining and leaving channels. Multicasting - Sending data to a group of nodes instead of a single destination. NAT (Network Address Translation) - The translation of an Internet Protocol address (IP address) used within one network to a different IP address known within another network. One network is designated the inside network and the other is the outside. Network - A system that transmits any combination of voice, video and/or data between users. NNTP (Network News Transfer Protocol) - The protocol used to connect to Usenet groups on the Internet. Usenet newsreaders support the NNTP protocol. Node - A network junction or connection point, typically a computer or work station. Packet - A unit of data routed between an origin and a destination in a network. Passphrase - Used much like a password, a passphrase simplifies the WEP encryption process by automatically generating the WEP encryption keys for Linksys products. PC Card - A credit-card sized removable module that contains memory, I/O, or a hard disk. Ping (Packet INternet Groper) - An Internet utility used to determine whether a particular IP address is online. It is used to test and debug a network by sending out a packet and waiting for a response.
Plug-and-Play - The ability of a computer system to configure expansion boards and other devices automatically without requiring the user to turn off the system during installation. Port - A pathway into and out of the computer or a network device such as a switch or router. For example, the serial and parallel ports on a personal computer are external sockets for plugging in communications lines, modems and printers. PPPoE (Point to Point Protocol over Ethernet) - PPPoE is a method for the encapsulation of PPP packets over Ethernet frames from the user to the ISP over the Internet. One reason PPPoE is preferred by ISPs is because it provides authentication (username and password) in addition to data transport. A PPPoE session can be initiated by either a client application residing on a PC, or by client firmware residing on a modem or router. PPTP (Point-to-Point Tunneling Protocol) - A protocol (set of communication rules) that allows corporations to extend their own corporate network through private "tunnels" over the public Internet. Effectively, a corporation uses a wide-area network as a single large local area network. A company no longer needs to lease its own lines for wide-area communication but can securely use the public networks. This kind of interconnection is known as a virtual private network. RIP (Routing Information Protocol) - A simple routing protocol that is part of the TCP/IP protocol suite. It determines a route based on the smallest hop count between source and destination. RIP is a distance vector protocol that routinely broadcasts routing information to its neighboring routers. RJ-45 (Registered Jack-45) - A connector similar to a telephone connector that holds up to eight wires, used for connecting Ethernet devices. Roaming - In an infrastructure mode wireless network, this refers to the ability to move out of one access point's range and into another and transparently reassociate and reauthenticate to the new access point. This reassociation and reauthentication should occur without user intervention and ideally without interruption to network connectivity. A typical scenario would be a location with multiple access points, where users can physically relocate from one area to another and easily maintain connectivity.

Router - Protocol-dependent device that connects subnetworks together. Routers are useful in breaking down a very large network into smaller subnetworks; they introduce longer delays and typically have much lower throughput rates than bridges. RTS (Request To Send) - An RS-232 signal sent from the transmitting station to the receiving station requesting permission to transmit. Server - Any computer whose function in a network is to provide user access to files, printing, communications, and other services. SMTP (Simple Mail Transfer Protocol) - The standard e-mail protocol on the Internet. It is a TCP/IP protocol that defines the message format and the message transfer agent (MTA), which stores and forwards the mail. SNMP (Simple Network Management Protocol) - A widely used network monitoring and control protocol. Data is passed from SNMP agents, which are hardware and/or software processes reporting activity in each network device (hub, router, bridge, etc.) to the workstation console used to oversee the network. The agents return information contained in a MIB (Management Information Base), which is a data structure that defines what is obtainable from the device and what can be controlled (turned off, on, etc.). Software - Instructions for the computer. A series of instructions that performs a particular task is called a "program." The two major categories of software are "system software" and "application software." System software is made up of control programs such as the operating system and database management system (DBMS). Application software is any program that processes data for the user. A common misconception is that software is data. It is not. Software tells the hardware how to process the data. Spread Spectrum - Spread Spectrum technology is a wideband radio frequency technique developed by the military for use in reliable, secure, mission-critical communications systems. It is designed to trade off bandwidth efficiency for reliability, integrity, and security. In other words, more bandwidth is consumed than in the case of narrowband transmission, but the trade off produces a signal that is, in effect, louder and thus easier to detect, provided that the receiver knows the parameters of the spread-spectrum signal being broadcast.
If a receiver is not tuned to the right frequency, a spread-spectrum signal looks like background noise. There are two main alternatives, Direct Sequence Spread Spectrum (DSSS) and Frequency Hopping Spread Spectrum (FHSS). SPI (Stateful Packet Inspection) - A firewall technology that monitors the state of the transaction so that it can verify that the destination of an inbound packet matches the source of a previous outbound request. It examines not just the headers of the packet, but also the contents, to determine more about the packet than just its source and destination information. It is called "stateful" because verifies that the stated destination computer has previously requested the current communication. In this way, it verifies that all communications are initiated by the recipient computer and are taking place only with sources that are known and trusted from previous interactions. In addition to being a more rigorous inspection, stateful packet inspection closes off ports until connection to the specific port is requested. This allows an added layer of protection from the threat of port scanning. SSID (Service Set IDentifier) - A unique name shared among all points in a wireless network. The SSID must be identical for each point in the wireless network and is case-sensitive. Static IP Address - A permanent IP address that is assigned to a node in an IP or a TCP/IP network. Static Routing - Forwarding data in a network via a fixed path. Static routing cannot adjust to changing line conditions as can dynamic routing. Subnet Mask - The method used for splitting IP networks into a series of subgroups, or subnets. The mask is a binary pattern that is matched up with the IP address to turn part of the host ID address field into a field for subnets. Switch - 1. A data switch connects computing devices to host computers, allowing a large number of devices to share a limited number of ports. 2. A device for making, breaking, or changing the connections in an electrical circuit. TCP (Transmission Control Protocol) - A method (protocol) used along with the IP (Internet Protocol) to send data in the form of message units (datagram) between network devices over a LAN or WAN. While IP takes care of handling the actual delivery of the data (routing), TCP takes care of keeping track of the individual units of data (called packets) that a message is divided into for effi-