Re: [93attendees] "ietf - The wireless network appears to have been compromised and will be disabled for about a minute."

Works for me now, stable for about 15 min :-)

From: 93attendees on behalf of Chris Elliott
Reply-To: "chelliot@pobox.com<mailto:chelliot@pobox.com>"
Date: Monday 20 July 2015 14:20
To: Yoav Nir
Cc: Aaron Falk, Simon Perreault, Ross Finlayson, "93attendees@ietf.org<mailto:93attendees@ietf.org>"
Subject: Re: [93attendees] "ietf - The wireless network appears to have been compromised and will be disabled for about a minute."

All,

We've modified the wireless config so that this issue should not reoccur. Please let us know if you see it again.

We continue to monitor our logs, as we saw the issue first there at 10:50am today. I finished configuring the APs at 1:44pm and haven't seen it since. We don't believe that this problem can happen again, despite possible misbehaving clients.

A few details, summarized from my memory. Feel free to correct if you feel inclined!

Wifi can use several different encryption methods--WEP, TKIP, and AES. We stopped using WEP many years ago. However, the first version of WPA modified WEP to add a temporal key and a MIC to check if the packet had been modified in flight. This protocol included draconian measures if the access point detected an incorrect MIC, as the thought was that TKIP was weak and there needed to be strong measures to prevent repeated attacks that might reveal the key. It turned out that the standards organization underestimated the strength of TKIP, so these draconian measures weren't really necessary.

We have had a feature enabled on our APs that should avoid any packet corruption from triggering said draconian measures. However, for the first time in several years, we're once again seeing the APs reacting badly. While we don't know for sure why the APs are doing this, we did determine the few to none of our attendees are using TKIP. Therefore we have now disabled TKIP throughout the IETF network and all encrypted networks are WPA2/AES only. This seems to have mitigated the issue.

We continue to monitor the network to determine if there are any other effects of whatever caused this problem.

As usual, feel free to open a ticket with the NOC if you have any issues on the IETF network.

Enjoy!
Chris.

On Mon, Jul 20, 2015 at 1:59 PM, Yoav Nir <ynir.ietf@gmail.com<mailto:ynir.ietf@gmail.com>> wrote:

> On Jul 20, 2015, at 1:50 PM, Simon Perreault <sperreault@jive.com<mailto:sperreault@jive.com>> wrote:
>
> Le 2015-07-20 13:41, Aaron Falk a écrit :
>> Already a ticket on this.  See https://tickets.meeting.ietf.org/ticket/951.
>
> https://tickets.meeting.ietf.org/ticket/950
>
> Do I win? ;)

Not quite:
  https://tickets.meeting.ietf.org/ticket/949
  https://tickets.meeting.ietf.org/ticket/948
  https://tickets.meeting.ietf.org/ticket/947
  https://tickets.meeting.ietf.org/ticket/946
  https://tickets.meeting.ietf.org/ticket/945 (probably, Does Brian use a Mac?)
  https://tickets.meeting.ietf.org/ticket/944
  https://tickets.meeting.ietf.org/ticket/943 (probably)

_______________________________________________
93attendees mailing list
93attendees@ietf.org<mailto:93attendees@ietf.org>
https://www.ietf.org/mailman/listinfo/93attendees

--
Chris Elliott
chelliot@pobox.com<mailto:chelliot@pobox.com>