Re: [93attendees] "ietf - The wireless network appears to have been compromised and will be disabled for about a minute."

All,

We've modified the wireless config so that this issue should not reoccur.
Please let us know if you see it again.

We continue to monitor our logs, as we saw the issue first there at 10:50am
today. I finished configuring the APs at 1:44pm and haven't seen it since.
We don't believe that this problem can happen again, despite possible
misbehaving clients.

A few details, summarized from my memory. Feel free to correct if you feel
inclined!

Wifi can use several different encryption methods--WEP, TKIP, and AES. We
stopped using WEP many years ago. However, the first version of WPA
modified WEP to add a temporal key and a MIC to check if the packet had
been modified in flight. This protocol included draconian measures if the
access point detected an incorrect MIC, as the thought was that TKIP was
weak and there needed to be strong measures to prevent repeated attacks
that might reveal the key. It turned out that the standards organization
underestimated the strength of TKIP, so these draconian measures weren't
really necessary.

We have had a feature enabled on our APs that should avoid any packet
corruption from triggering said draconian measures. However, for the first
time in several years, we're once again seeing the APs reacting badly.
While we don't know for sure why the APs are doing this, we did determine
the few to none of our attendees are using TKIP. Therefore we have now
disabled TKIP throughout the IETF network and all encrypted networks are
WPA2/AES only. This seems to have mitigated the issue.

We continue to monitor the network to determine if there are any other
effects of whatever caused this problem.

As usual, feel free to open a ticket with the NOC if you have any issues on
the IETF network.

Enjoy!
Chris.

On Mon, Jul 20, 2015 at 1:59 PM, Yoav Nir <ynir.ietf@gmail.com> wrote:

>
> > On Jul 20, 2015, at 1:50 PM, Simon Perreault <sperreault@jive.com>
> wrote:
> >
> > Le 2015-07-20 13:41, Aaron Falk a écrit :
> >> Already a ticket on this.  See
> https://tickets.meeting.ietf.org/ticket/951.
> >
> > https://tickets.meeting.ietf.org/ticket/950
> >
> > Do I win? ;)
>
> Not quite:
>   https://tickets.meeting.ietf.org/ticket/949
>   https://tickets.meeting.ietf.org/ticket/948
>   https://tickets.meeting.ietf.org/ticket/947
>   https://tickets.meeting.ietf.org/ticket/946
>   https://tickets.meeting.ietf.org/ticket/945 (probably, Does Brian use a
> Mac?)
>   https://tickets.meeting.ietf.org/ticket/944
>   https://tickets.meeting.ietf.org/ticket/943 (probably)
>
> _______________________________________________
> 93attendees mailing list
> 93attendees@ietf.org
> https://www.ietf.org/mailman/listinfo/93attendees
>

-- 
Chris Elliott
chelliot@pobox.com