Lost your wire? Wireless Networking with OS/2 and eCS. Part 2: Difference between revisions

From OS2World.Com Wiki
Jump to navigation Jump to search
(9 intermediate revisions by 2 users not shown)
Line 1: Line 1:
By [[Jonas Buys]]
''By [[Jonas Buys]]''


==4. Drivers for setting up a wireless device.==
What are the system requirements? Warp3 or higher, eCS, or WSoD and the appropriate device drivers.


==== 4. Drivers for setting up a wireless device. ====
First of all, you need a PCMCIA slot, mostly PC CARD type II. This can be either a regular PC Card slot in a notebook, or it can also be a PCI-to-PCMCIA adapter using the PLX driver (included in Generic PRISM device driver).
 
Please do NOT bombard me with e-mails asking for these drivers; I won't give them. I got them for testing purposes only, and I promised both IBM and the developer that I wouldn't distribute them. Please wait until they become available via SoftWare Choice (which should be really soon now), or get an IBM business contract. Also, please don't bother IBM with questions regarding the drivers in development that are not available to the public yet.
   
   
What are the system requirements? Warp3 or higher, eCS, or WSoD
===4.1. Orinoco compatibles===
and the appropriate device drivers. <br>
The Orinoco (also referred to as WaveLAN) by Lucent/Agere is kind of a debugged and enhanced PRISM chipset. It offers data transfer rates up to 11Mbps. Orinoco-equipped WLAN cards are considerably more expensive then PRISM ones. Compared to the original PRISM2 chipset, Orinoco performs better (though not better than PRISM3) because of ameliorated firmware.
First of all, you need a PCMCIA slot, mostly PC CARD type II. This can be either
a regular PC Card slot in a notebook, or it can also be a PCI-to-PCMCIA adapter
using the PLX driver (included in Generic PRISM device driver).<br>
Please do NOT bombard me with e-mails asking for these drivers; I won't give
them. I got them for testing purposes only, and I promised both IBM and the
developer that I wouldn't distribute them. Please wait until they become available
via SoftWare Choice (which should be really soon now), or get an IBM business
contract. Also, please don't bother IBM with questions regarding the drivers
in development that are not available to the public yet.


====4.1.1. Artem, BinTec, Jakarta====
===== 4.1. Orinoco compatibles =====
The Artem ComCards are - at present - the only wireless cards that come with OS/2 support out-of the box. BinTec and Jakarta Blue cards are OEM variants of the Artem card. They all work with the same driver, the ComCard NDIS 2.01 Treiber (latest version is 1.5), which can be downloaded from the our WiFi drivers download page. This driver is also included in eComStation 1.1 (although not the latest version). Note that the driver available for download
from the Artem web site is not the latest version. The driver comes in a static ZIP-file, which you need to unzip the files of to x:\IBMCOM\MACS, where x: is the drive on which OS/2 is installed. Artem regularly provides updates and bug fixes. There is a also very good article available about how to install these drivers on eCS and OS/2. Mensys distributes all of these cards actively in Europe, and Artem sells directly to individuals in the Americas. OS/2 CHL hardware testing team has tested some of these devices, and they offer very reasonable performance for reasonable pricing. BinTek also hosts a driver for their cards, but that is just the same driver as that of Artem. All Artem cards support 64-bit and 128-bit encryption. Artem driver revisions 1.5 and higher are designed to work with the nice IBM WiFiState utility.
The Orinoco (also referred to as WaveLAN) by Lucent/Agere is kind of a debugged
and enhanced PRISM chipset. It offers data transfer rates up to 11Mbps. Orinoco-equipped
WLAN cards are considerably more expensive then PRISM ones. Compared to the  
original PRISM2 chipset, Orinoco performs better (though not better than PRISM3)
because of ameliorated firmware.


Artem is currently assessing the market to investigate if OS/2 users would be interested in IEEE 802.11g. Thus, it is likely that the company will release drivers for these products too, sooner or later. More about this later...
====== 4.1.1. Artem, BinTec, Jakarta ======
The Artem ComCards are - at present - the only wireless cards that come with
OS/2 support out-of the box. BinTec and Jakarta Blue cards are OEM variants
of the Artem card. They all work with the same driver, the ComCard NDIS 2.01
Treiber (latest version is 1.5), which can be downloaded from the [[our WiFi drivers download page]]. This driver is also included in eComStation
1.1 (although not the latest version). Note that the driver available for download
from the Artem web site is not the latest version. The driver comes in a [[static ZIP-file]], which you need to unzip the files of to x:\IBMCOM\MACS, where
x: is the drive on which OS/2 is installed. Artem regularly provides updates
and bug fixes. There is a also very good [[article]]
available about how to install these drivers on eCS and OS/2. Mensys distributes
all of these cards actively in Europe, and Artem sells directly to individuals
in the Americas. OS/2 CHL hardware testing team has tested some of these devices,
and they offer very reasonable performance for reasonable pricing. BinTek also
hosts a [[driver]]
for their cards, but that is just the same driver as that of Artem. All Artem
cards support 64-bit and 128-bit encryption. Artem driver revisions 1.5 and
higher are designed to work with the nice IBM WiFiState utility.<br>
Artem is currently assessing the market to investigate if OS/2 users would be  
interested in IEEE 802.11g. Thus, it is likely that the company will release  
drivers for these products too, sooner or later. More about this later...


====4.1.2. IBM High Rate Wireless PC Card 128====
====== 4.1.2. IBM High Rate Wireless PC Card 128 ======
Some other very professional device is the IBM High Rate Wireless PC Card 128.  
Some other very professional device is the IBM High Rate Wireless PC Card 128.  
Just as CISCO, IBM can go along the ride with superior performance, combined  
Just as CISCO, IBM can go along the ride with superior performance, combined with extremely high pricing. The driver is specifically for this card, and cannot be used with other Orinoco cards. The driver was in internal IBM beta testing for some months, but now it has finally been made general availability via IBM Device Driver Pak Online (need valid and active SoftWare Choice or PassPort Advantage subscription). It is also available via eComStation download site, if you have a login to access the downloads section. The self-extracting file  
with extremely high pricing. The driver is specifically for this card, and cannot  
ibmwifi2.exe contains a DDP file, a good readme, and all things that can be desirable. Surely,  
be used with other Orinoco cards. The driver was in internal IBM beta testing  
just as is the case with the CISCO driver, this driver was meant to be for business needs. It is also equipped with the WiFiStat.exe utility, discussed in a later section. On the global IBM web site, OS/2 support is stated: "IBM is offering OS/2 device drivers and support for these OS/2 drivers for the IBM PCMCIA Wireless LAN cards on a fee basis. For more information please contact emeawarp@de.ibm.com."
for some months,but now it has finally been made general availability via IBM  
This means, the driver is also available via IBM business contracts in case you wouldn't dispose of a SWC or PPA subscription.
Device Driver Pak Online (need valid and active SoftWare Choice or PassPort  
Advantage subscription). It is also available via eComStation download site,  
if you have a login to access the downloads section. The self-extracting file  
[[ibmwifi2.exe]]
contains a DDP file, a good readme, and all things that can be desirable. Surely,  
just as is the case with the CISCO driver, this driver was meant to be for business  
needs. It is also equipped with the WiFiStat.exe utility, discussed in a later  
section. On the global IBM web site, OS/2 support is stated: &quot;IBM is offering  
OS/2 device drivers and support for these OS/2 drivers for the IBM PCMCIA Wireless  
LAN cards on a fee basis. For more information please contact emeawarp@de.ibm.com.&quot;
This means, the driver is also available via IBM business contracts in case  
you wouldn't dispose of a SWC or PPA subscription.<br>
The IBM High Rate driver performs better than every average WiFi card, but compared
to the CISCO 340 Series physical performance, it gets the worst of it.


The IBM High Rate driver performs better than every average WiFi card, but compared to the CISCO 340 Series physical performance, it gets the worst of it.
====== 4.1.3. Others ======
 
====4.1.3. Others====
There's also a modified version of the Artem driver, which does truly allow  
There's also a modified version of the Artem driver, which does truly allow other devices to work with this driver by specifying the manufacturer and device IDs. In fact, it is one of the older versions of the Artem driver. Current Artem drivers don't have this feature and thus are for Artem, BinTec and Jakarta Blue devices only. As already said, these IDs are used by the device driver to search for and locate the wireless device(s). In fact, this driver is unattainable for the public, but somewhere on the World Wide Web, it is traveling, and offering extreme good support for a great deal of Orinoco-branded cards.
other devices to work with this driver by specifying the manufacturer and device  
 
IDs. In fact, it is one of the older versions of the Artem driver. Current Artem  
As of the Release Candidate 1 release of the IBM Generic PRISM device driver, support for Orinoco chipsets was added to this driver. Please refer to the section about the Generic PRISM device driver for more information.
drivers don't have this feature and thus are for Artem, BinTec and Jakarta Blue  
devices only. As already said, these IDs are used by the device driver to search  
for and locate the wireless device(s). In fact, this driver is unattainable  
for the public, but somewhere on the [[World Wide Web]], it is traveling, and offering extreme good support for a great  
deal of Orinoco-branded cards.<br>
As of the Release Candidate 1 release of the IBM Generic PRISM device driver,  
support for Orinoco chipsets was added to this driver. Please refer to the section  
about the Generic PRISM device driver for more information.


===4.2. PRISM2/2.5/3 compatibles===
===== 4.2. PRISM2/2.5/3 compatibles =====
Just like the Orinoco chipset, PRISM2, PRISM2.5 and PRISM3 chipsets offer a maximum data transfer rate of 11Mbps. The older PRISM1 chipset only supports a maximum of 2Mbps. PRISM3 has the best performance, and can be compared to Orinoco chipset performance. Most WLAN devices are using a PRISM solution, and PRISM chipsets are normally rather cheap WLAN cards.
Just like the Orinoco chipset, PRISM2, PRISM2.5 and PRISM3 chipsets offer a  
maximum data transfer rate of 11Mbps. The older PRISM1 chipset only supports  
a maximum of 2Mbps. PRISM3 has the best performance, and can be compared to  
Orinoco chipset performance. Most WLAN devices are using a PRISM solution, and  
PRISM chipsets are normally rather cheap WLAN cards.


====4.2.1. IBM miniPCI====  
====== 4.2.1. IBM miniPCI ======
This driver has been finished, and also internal IBM beta testing is completed.  
This driver has been finished, and also internal IBM beta testing is completed.  
The driver has become available via SWC download. IBM miniPCI cards are used  
The driver has become available via SWC download. IBM miniPCI cards are used in many newer ThinkPads, like the IBM T30, and some other T2x models. The self-extracting driver ibmprism.exe has served as a basis for the NetGear, LinkSys, PLX9052, and Generic PRISMx  
in many newer ThinkPads, like the IBM T30, and some other T2x models. The self-extracting  
driver. Some PCI-devices of other brands can also work with this driver. E.g. CompuShack SWN-103 PCI Wireless LAN Adapter, a PCI card with an external antenna, and equipped with a PRISM2.5 chipset. Just as the IBM High Rate PC Card 128, this driver is available via SoftWare Choice and PassPort Advantage subscriptions, and can be downloaded from IBM Device Driver Pak Online. Also available via eComStation download site. Please note that IBM ONLY supports this device with this particular driver! Other devices (in particular miniPCI solutions) WILL  
driver [[ibmprism.exe]]
has served as a basis for the NetGear, LinkSys, PLX9052, and Generic PRISMx  
driver. Some PCI-devices of other brands can also work with this driver. E.g.  
CompuShack SWN-103 PCI Wireless LAN Adapter, a PCI card with an external antenna,  
and equipped with a PRISM2.5 chipset. Just as the IBM High Rate PC Card 128,  
this driver is available via SoftWare Choice and PassPort Advantage subscriptions,  
and can be downloaded from IBM Device Driver Pak Online. Also available via  
eComStation download site. Please note that IBM ONLY supports this device with  
this particular driver! Other devices (in particular miniPCI solutions) WILL  
NOT WORK.
NOT WORK.


====4.2.2. NetGear MA-401====
====== 4.2.2. NetGear MA-401 ======
The NetGear company's strategy is something like offering good average-performing devices for a reasonable price. I really like the way their support services handle non-Windows questions. They carefully say that they don't support the operating system referred to, but they try to help you as much as possible.  
Those guys really know the technical details of their products, like the manufacturer and device IDs! Very good, since the documentation that comes with the card is rather limited.
The NetGear company's strategy is something like offering good average-performing  
 
devices for a reasonable price. I really like the way their support services  
The card uses a PRISM2.5 chip, and has two variants: the MA401NA, which is available in North-America; and the MA401RA, for Asia and Europe. Due to the PRISM2.5 chip, the driver is identical to that for IBM miniPCI, but since the manufacturer and device IDs from NetGear and IBM are different, a specific driver for this WLAN NIC has been written. You can also get this device going using the Generic PRISMx driver.
handle non-Windows questions. They carefully say that they don't support the  
 
operating system referred to, but they try to help you as much as possible.  
The MA-401 card performs well for short distances. Even very thick walls don't really diminish its performance. Unfortunately, for large distances, the signals aren't strong enough; I only got the card's waves to one of my neighbors, and not to the next street. But, if you want a good card for wireless home networking, go for this one! The driver is not available to the public yet.
Those guys really know the technical details of their products, like the manufacturer  
 
and device IDs! Very good, since the documentation that comes with the card  
This card is also supported by the newer RC1 release of the official IBM Generic PRISM device driver.
is rather limited.<br>
The card uses a PRISM2.5 chip, and has two variants: the MA401NA, which is available  
in North-America; and the MA401RA, for Asia and Europe. Due to the PRISM2.5  
chip, the driver is identical to that for IBM miniPCI, but since the manufacturer  
and device IDs from NetGear and IBM are different, a specific driver for this  
WLAN NIC has been written. You can also get this device going using the Generic  
PRISMx driver.<br>
The MA-401 card performs well for short distances. Even very thick walls don't  
really diminish its performance. Unfortunately, for large distances, the signals  
aren't strong enough; I only got the card's waves to one of my neighbors, and  
not to the next street. But, if you want a good card for wireless home networking,  
go for this one! The driver is not available to the public yet.<br>
This card is also supported by the newer RC1 release of the official IBM Generic  
PRISM device driver.


====4.2.3. LinkSys Instant Wireless WPC-11 v3====
====== 4.2.3. LinkSys Instant Wireless WPC-11 v3 ======
LinkSys has always been a very reliable brand for network products (that's part of the reasons why CISCO recently bought LinkSys). With its Instant Wireless WPC-11 card, LinkSys offers a great product for a reasonable price (80.00 incl. VAT). Just as a lot of manufacturers, this card comes in several versions.
The third version, equipped with a Prism3 chipset, has a special driver, which is just a modification of the Prism2/2.5/3 driver (and again, it also works with the Generic PRISMx driver). Version 2.5 comes with a Prism 2.5 chipset, but I didn't test this card (though I really don't forsee any problems when you use the PRISM2/2.5/3 driver, using the correct IDs).
LinkSys has always been a very reliable brand for network products (that's  
part of the reasons why CISCO recently bought LinkSys). With its Instant Wireless  
WPC-11 card, LinkSys offers a great product for a reasonable price (&euro; 80.00  
incl. VAT). Just as a lot of manufacturers, this card comes in several versions.  
The third version, equipped with a Prism3 chipset, has a special driver, which  
is just a modification of the Prism2/2.5/3 driver (and again, it also works  
with the Generic PRISMx driver). Version 2.5 comes with a Prism 2.5 chipset,  
but I didn't test this card (though I really don't forsee any problems when  
you use the PRISM2/2.5/3 driver, using the correct IDs).<br>
Taken a look at the card's performance, I was astonished by the good results:  
Taken a look at the card's performance, I was astonished by the good results:  
the cards actually supports a distance of 450 meters outside @ a data transfer  
the cards actually supports a distance of 450 meters outside @ a data transfer rate of 1.2 Mbps. Even CISCO couldn't give these results.
rate of 1.2 Mbps. Even CISCO couldn't give these results.<br>
 
Unfortunately, LinkSys's support services are awful. I had asked them for device  
Unfortunately, LinkSys's support services are awful. I had asked them for device and manufacturer ID, and also the chipset they used in the product, and they simply refused to give "this kind of information"! Documentation is awfully limited, thus, if you're new to WiFi, don't go for this card!
and manufacturer ID, and also the chipset they used in the product, and they  
 
simply refused to give &quot;this kind of information&quot;! Documentation is  
Also, this driver is not available to the public yet. This card is also supported by the newer RC1 release of the official IBM Generic PRISM device driver.
awfully limited, thus, if you're new to WiFi, don't go for this card!<br>
 
Also, this driver is not available to the public yet. This card is also supported  
====4.2.4. Others====
by the newer RC1 release of the official IBM Generic PRISM device driver.
Another modification of the IBM miniPCI driver is a Generic PRISMx driver. Theoretically, the driver was written for PRISM2.5; but because of some backwards compatibility aspect of the chipset's design, it should also work with other PRISM chipsets, if they are Intersil-branded, thus using Intersil firmware.


====== 4.2.4. Others ======
Another modification of the IBM miniPCI driver is a Generic PRISMx driver.
Theoretically, the driver was written for PRISM2.5; but because of some backwards
compatibility aspect of the chipset's design, it should also work with other
PRISM chipsets, if they are Intersil-branded, thus using Intersil firmware.<br>
PC Cards using the PRISM2, PRISM2.5 and PRISM3 chipsets should be supported.  
PC Cards using the PRISM2, PRISM2.5 and PRISM3 chipsets should be supported.  
The Generic PRISM driver is currently in Release Candidate phase, and is intended  
The Generic PRISM driver is currently in Release Candidate phase, and is intended to appear on DDP OnLine via valid and active SWC or PPA subscription.
to appear on DDP OnLine via valid and active SWC or PPA subscription.
 
===4.3. CISCO 340 and 350 Series===
CISCO 340 and 350 products use an AiroNet chipset, which is actually again a greatly enhanced PRISM chipset.
 
Cisco has always been a leading networking company because of its high quality products. Unfortunately, this also reflects in the company's price strategy :( Now, both the CISCO 340 and 350 PC Cards perform excellent. Without a doubt, I dare say that these cards are the best of all the ones I tested. The 340 Series are End Of Life (EOL), but the 350 Series are available now as a replacement, offering the very same functionality.


Installation of the drivers is a breeze. The driver comes in a ZIP-file, that is not self-extracting. An excellent FAQ is included in the readme. It's noticeable that IBM is targeting this product for use under business contracts only, since everything is so smooth... Just copy the drivers in your x:\IBMCOM\MACS directory  
===== 4.3. CISCO 340 and 350 Series =====
(where x: is the driver letter from the drive on which OS/2 has been installed), open MPTS, [[Image:cisco340.jpg|thumb]]and add the card. In my case, I didn't even have to change settings to get the card running! Mark Dodel has written an excellent report about this card for eCS. There seems to be some misunderstanding in the OS/2 community about this driver. This driver ONLY supports PCMCIA cards, thus PCI and ISA variants of the same series won't work under OS/2. Perhaps you can get them to work by the PLX 9052 driver, although the PLX driver offers only support for PRISM.
 
CISCO 340 and 350 products use an AiroNet chipset, which is actually again
Just as is the case with the other cards, there are different variants available of this card. Of each version, there are European and American edition available, since, as was already mentioned earlier, power consumption differs on both continents.  
a greatly enhanced PRISM chipset.<br>
For the CISCO 340 PCMCIA card, three variants have been released: first, there is the AIR-PCM340, which doesn't support WEP. The AIR-PCM341 supports 40 bit WEP encryption, while the latest version, AIR-PCM342 supports up to 128 bit encryption. Setting up WEP protection is really straightforward with this driver; more details about this will be given in the next section. Perhaps you would expect support for LEAP, CISCO's proprietary standard for security. Unfortunately, this is not supported, nor are the other security technologies from CISCO for  
Cisco has always been a leading networking company because of its high quality
WLAN networking.
products. Unfortunately, this also reflects in the company's price strategy
 
:( Now, both the CISCO 340 and 350 PC Cards perform excellent. Without a doubt,
Though I managed to get the AIR-PCM350 running with the 340 driver, IBM does not officially support this. IBM has just started the development of another business-only device driver especially for the CISCO 350 PC Card, which will also officially support the CISCO 340 PCMCIA series and that will incorporate LEAP support in the driver package. Development of this driver should be straightforward, since the 350 is a very close follow-on to the 340, since you can even flash a 340 to make it a 350 card. The new 350 driver should also support the miniPCI version of the 350 Series, including bus mastering.
I dare say that these cards are the best of all the ones I tested. The 340 Series
 
are End Of Life (EOL), but the 350 Series are available now as a replacement,
The old IBM driver is unfortunately not stable, testing made it trap after a few seconds of full traffic load. The support for encryption is only for 40 bits (WEP-64), only one key. With the new 350 Beta driver, there is better throughput than any PRISM-based card. This comes due to a different buffer allocation scheme in the driver.
offering the very same functionality.<br>
Installation of the drivers is a breeze. The driver comes in a ZIP-file, that  
is not self-extracting. An excellent FAQ is included in the readme. It's noticeable  
that IBM is targeting this product for use under business contracts only, since  
everything is so smooth... Just copy the drivers in your x:\IBMCOM\MACS directory  
(where x: is the driver letter from the drive on which OS/2 has been installed),  
open MPTS, [[Image:cisco340.jpg]]and  
add the card. In my case, I didn't even have to change settings to get the card  
running! Mark Dodel has written an excellent [[report]]
about this card for eCS. There seems to be some misunderstanding in the OS/2  
community about this driver. This driver ONLY supports PCMCIA cards, thus PCI  
and ISA variants of the same series won't work under OS/2. Perhaps you can get  
them to work by the PLX 9052 driver, although the PLX driver offers only support  
for PRISM.<br>
Just as is the case with the other cards, there are different variants available  
of this card. Of each version, there are European and American edition available,  
since, as was already mentioned earlier, power consumption differs on both continents.  
For the CISCO 340 PCMCIA card, three variants have been released: first, there  
is the AIR-PCM340, which doesn't support WEP. The AIR-PCM341 supports 40 bit  
WEP encryption, while the latest version, AIR-PCM342 supports up to 128 bit  
encryption. Setting up WEP protection is really straightforward with this driver;  
more details about this will be given in the next section. Perhaps you would  
expect support for LEAP, CISCO's proprietary standard for security. Unfortunately,  
this is not supported, nor are the other security technologies from CISCO for  
WLAN networking.<br>
Though I managed to get the AIR-PCM350 running with the 340 driver, IBM does  
not officially support this. IBM has just started the development of another  
business-only device driver especially for the CISCO 350 PC Card, which will  
also officially support the CISCO 340 PCMCIA series and that will incorporate  
LEAP support in the driver package. Development of this driver should be straightforward,  
since the 350 is a very close follow-on to the 340, since you can even flash  
a 340 to make it a 350 card. The new 350 driver should also support the miniPCI  
version of the 350 Series, including bus mastering.<br>
The old IBM driver is unfortunately not stable, testing made it trap after a  
few seconds of full traffic load. The support for encryption is only for 40  
bits (WEP-64), only one key. With the new 350 Beta driver, there is better throughput  
than any PRISM-based card. This comes due to a different buffer allocation scheme  
in the driver.


===4.4. PLX PCI boards===
===== 4.4. PLX PCI boards =====
The only weak spot in hardware support for OS/2 is PCMCIA or PC Card Socket Services (However, with [[APSoft]]'s OS/2 Socket Services, that problem can be solved quickly). Some very handy solution are PCI-to-PCMCIA adapter devices. These cards enable you to use virtually any WiFi  
The only weak spot in hardware support for OS/2 is PCMCIA or PC Card Socket  
Services (However, with [[APSoft]]'s OS/2 Socket  
Services, that problem can be solved quickly). Some very handy solution are  
PCI-to-PCMCIA adapter devices. These cards enable you to use virtually any WiFi  
PC Card on regular computer. In their specifications, most manufacturers claim  
PC Card on regular computer. In their specifications, most manufacturers claim  
that only one or two <u>'''[[Image:LinkSysPLX.png]]'''</u>specific  
that only one or two [[Image:LinkSysPLX.png|thumb]]specific cards work with the board, but that's just commercial nonsense. Fact is that most of the time, these slots will only work with a particular chipset. Currently supported chipset is the PLX PCI9052 chip, that can co-operate with PRISM2.5 compatibles. In general, if you use a WLAN card with the very same chipset and same voltage, you should be able to use any similar device in the brackets.
cards work with the board, but that's just commercial nonsense. Fact is that  
 
most of the time, these slots will only work with a particular chipset. Currently  
For similar devices using a PLX 9052 chipset, a driver is available. It was written especially for the AmbiCOM WL1100b-PCI card, and has been enhanced and merged into the official IBM Generic PRISM device driver. Also, the NetGear MA-301 PCI-slot-Adapter was found to be compatible with this driver, using almost any PRISM2.5 card. Also Belkin WL11000P and LinkSys Instant Wireless Adapter WDT11 PC are supported. The driver is still in very early development phase, and device IDs are still being added to it.
supported chipset is the PLX PCI9052 chip, that can co-operate with PRISM2.5  
 
compatibles. In general, if you use a WLAN card with the very same chipset and  
This driver should also work with wireless PCI cards, that also use the required chipsets (like 3COM 3CRWE777A PCI WLAN card).
same voltage, you should be able to use any similar device in the brackets.<br>
 
For similar devices using a PLX 9052 chipset, a driver is available. It was  
One VERY IMPORTANT note: do not remove the WiFi card out of the slot before you've turned off the power, either by powering your computer off, either by using the drivers. Ignoring this warning will cause damage to your PLX board and WiFi PC Card. The older beta device driver is still available via login and password on this web site, but we recommend the use of the newer updated IBM Generic PRISM device driver (RC1 version or above). Huge difference is that using the Generic PRISM RC driver, you will be able to use Orinoco and AiroNet PCMCIA cards in conjunction with a PLX card too!
written especially for the AmbiCOM WL1100b-PCI card, and has been enhanced and  
 
merged into the official IBM Generic PRISM device driver. Also, the NetGear  
=== 4.5. Wireless Access Points ===
MA-301 PCI-slot-Adapter was found to be compatible with this driver, using almost  
Wireless devices, such as laptops or PDAs, connect to a wired LAN via a Wireless Access Point, which is a hardware device or computer software which acts as a communications hub (server). Access Points provide heightened wireless security and extend the physical range of a wireless LAN.
any PRISM2.5 card. Also Belkin WL11000P and LinkSys Instant Wireless Adapter  
 
WDT11 PC are supported. The driver is still in very early development phase,  
Using a Wireless Access Point, you can establish several WiFi connections with one single device. Mostly, such devices come with an Ethernet port, which you simply connect to the server. Devices like the Linksys WAP11 Version 2.2, 3COM AP2000, CISCO AIR-AP1120b, HP WL-520, TrendNet TEW-310APB, ZyXEL ZyAir B-1000, Artem access points, etc. work with a flexible web-browser based setup and configuration utility. These devices are compatible with OS/2 Warp (for e-Business) and eCS, and have been tested by the OS/2 CHL. Other come only with software, and thus aren't suitable for use with OS/2, nor Linux. Also, there are Eicon DSL-routers that also allow this kind of configuration. Normally, these devices should act as a DHCP server. Just plug them into your Ethernet port, configure the port to be a DHCP client, and reboot.
and device IDs are still being added to it. <br>
 
This driver should also work with wireless PCI cards, that also use the required  
One tip I'd like to give: if you want to use these devices, make sure your computer has a very recent build of Mozilla installed, and also Java 1.3.1 or higher.
chipsets (like 3COM 3CRWE777A PCI WLAN card).<u><br> </u>One VERY IMPORTANT note: do not remove the WiFi card out of the slot before  
Since M$ Internet Exploder is considered to be standard, older builds won't be able to display everything.
you've turned off the power, either by powering your computer off, either by  
 
using the drivers. Ignoring this warning will cause damage to your PLX board  
Some other good alternative, and then especially for businesses is to use a Wireless Access Point for IEEE 802.11g on the server. OS/2 nodes could use the b-standard, and other Windows nodes could use the g-standard.
and WiFi PC Card. The older beta device driver is still available via login  
and password on this web site, but we recommend the use of the newer updated  
IBM Generic PRISM device driver (RC1 version or above). Huge difference is that  
using the Generic PRISM RC driver, you will be able to use Orinoco and AiroNet  
PCMCIA cards in conjunction with a PLX card too!


=== 4.6. Intel Centrino Mobile Technology===  
===== 4.5. Wireless Access Points =====
[[Image:centrino.jpg|thumb]]With the recent introduction of Intel's Centrino specifications for the latest notebooks, comes a special miniPCI wireless adapter as feature of that specific technology.  
This miniPCI device is the Intel PRO/Wireless 2100 v 3b device. Unfortunately, as of writing, this device is not supported by any of the OS/2 device drivers already available for OS/2. There is a beta device driver available for selected Linux distributions, but it is still very buggy and only works on selected distributions.
Wireless devices, such as laptops or PDAs, connect to a wired LAN via a Wireless
Access Point, which is a hardware device or computer software which acts as
a communications hub (server). Access Points provide heightened wireless security
and extend the physical range of a wireless LAN.<br>
Using a Wireless Access Point, you can establish several WiFi connections with
one single device. Mostly, such devices come with an Ethernet port, which you
simply connect to the server. Devices like the [[Linksys WAP11 Version 2.2]], 3COM AP2000, CISCO AIR-AP1120b, HP WL-520, TrendNet TEW-310APB,
ZyXEL ZyAir B-1000, Artem access points, etc. work with a flexible web-browser
based setup and configuration utility. These devices are compatible with OS/2  
Warp (for e-Business) and eCS, and have been tested by the OS/2 CHL. Other come
only with software, and thus aren't suitable for use with OS/2, nor Linux. Also,  
there are Eicon DSL-routers that also allow this kind of configuration. Normally,
these devices should act as a DHCP server. Just plug them into your Ethernet
port, configure the port to be a DHCP client, and reboot.<br>
One tip I'd like to give: if you want to use these devices, make sure your computer
has a very recent build of Mozilla installed, and also Java 1.3.1 or higher.
Since M$ Internet Exploder is considered to be standard, older builds won't
be able to display everything.<br>
Some other good alternative, and then especially for businesses is to use a
Wireless Access Point for IEEE 802.11g on the server. OS/2 nodes could use the
b-standard, and other Windows nodes could use the g-standard.


More information about the Intel Centrino technology and OS/2 is to be found in the NoteBook/2 part of this website.
===== 4.6. Intel Centrino Mobile Technology =====
'''[[Image:centrino.jpg]]'''With
the recent introduction of Intel's Centrino specifications for the latest notebooks,
comes a special miniPCI wireless adapter as feature of that specific technology.
This miniPCI device is the Intel PRO/Wireless 2100 v 3b device. Unfortunately,
as of writing, this device is not supported by any of the OS/2 device drivers
already available for OS/2. There is a beta device driver available for selected
Linux distributions, but it is still very buggy and only works on selected distributions.
More information about the Intel Centrino technology and OS/2 is to be found  
in the NoteBook/2 part of this website.


==5. Setting up a wireless network==
==== 5. Setting up a wireless network ====
===5.1. What to keep in mind...===
====5.1.1. Ad hoc versus infrastructure modes====
===== 5.1. What to keep in mind... =====
Most WLANs deployed by organizations operate in a mode called "infrastructure". In this mode, all wireless clients connect through an access point (such as LinkSys WAP11 v2.2) for all communications. You can, however, deploy WLAN technology in an easier way that forms an independent peer-to-peer network, which is more commonly called an ad hoc WLAN. In an ad hoc WLAN, laptop or desktop computers that are equipped with compatible WLAN adapters and are within range of one another can share files DIRECTLY, without the use of an access point (compare this to the similar technology USB On-The-GO, which uses a similar approach).  
====== 5.1.1. Ad hoc versus infrastructure modes ======
Most WLANs deployed by organizations operate in a mode called &quot;infrastructure.&quot;
In this mode, all wireless clients connect through an access point (such as  
LinkSys WAP11 v2.2) for all communications. You can, however, deploy WLAN technology  
in an easier way that forms an independent peer-to-peer network, which is more  
commonly called an ad hoc WLAN. In an ad hoc WLAN, laptop or desktop computers  
that are equipped with compatible WLAN adapters and are within range of one  
another can share files DIRECTLY, without the use of an access point (compare  
this to the similar technology USB On-The-GO, which uses a similar approach).  
Thus deploying this strategy, you can use a direct connection between your clients.  
Thus deploying this strategy, you can use a direct connection between your clients.  
The range varies, depending on the type of WLAN system. Laptop and desktop computers  
The range varies, depending on the type of WLAN system. Laptop and desktop computers  
equipped with 802.11b or 802.11g WLAN cards can create ad hoc networks if they  
equipped with 802.11b or 802.11g WLAN cards can create ad hoc networks if they are within at least 500 feet of one another. Computers in a specific ad hoc wireless LAN must be configured to the same radio channel to communicate with one another. More than one ad hoc networks can exist in the same space if it is configured to operate on a different channel. There are a varying number of channels depending on the part of the world you are operating in. Europe  
are within at least 500 feet of one another. Computers in a specific ad hoc  
has 13 channels, the US 11 and Japan 14.
wireless LAN must be configured to the same radio channel to communicate with  
one another. More than one ad hoc networks can exist in the same space if it  
is configured to operate on a different channel. There are a varying number  
of channels depending on the part of the world you are operating in. Europe  
has 13 channels, the US 11 and Japan 14. <br>


The security impact of ad hoc WLANs is significant. Many wireless cards, including  
The security impact of ad hoc WLANs is significant. Many wireless cards, including some shipped as a default item by PC manufacturers, support ad hoc mode. When adapters use ad hoc mode, any hacker with an adapter configured for ad hoc mode and using the same settings as the other adapters may gain unauthorized access to clients.
some shipped as a default item by PC manufacturers, support ad hoc mode. When  
adapters use ad hoc mode, any hacker with an adapter configured for ad hoc mode  
and using the same settings as the other adapters may gain unauthorized access  
to clients. <br>


Ad hoc is a rather cheap solution, because each client needs a wireless NIC  
Ad hoc is a rather cheap solution, because each client needs a wireless NIC that is already available for less than &euro; 80.00 incl. VAT, which sometimes comes built-in with new notebooks. For a regular workstation, a PCI-carrier (with the PLX PCI9052 chipset) can be used. This PCI-to-PCMCIA slot is very handy, the cards can be taken out of the slot at any time you need a WiFi card for your notebook. A pure P2P solution is - of course - only suited for a limited number of nodes/clients.[[Image:adhoc.gif|thumb]]
that is already available for less than &euro; 80.00 incl. VAT, which sometimes  
comes built-in with new notebooks. For a regular workstation, a PCI-carrier  
(with the PLX PCI9052 chipset) can be used. This PCI-to-PCMCIA slot is very  
handy, the cards can be taken out of the slot at any time you need a WiFi card  
for your notebook. A pure P2P solution is - of course - only suited for a limited  
number of nodes/clients.[[Image:adhoc.gif]]<br>


Deploying the infrastructure mode, an AP takes care of all wireless network  
Deploying the infrastructure mode, an AP takes care of all wireless network traffic. The client in your network can communicate to one another via this AP (see it as the server in a client-server network environment). Of course, you can also connect an AP "wired" to your existing wired network.
traffic. The client in your network can communicate to one another via this  
The exact location of your AP can have an implicit impact on the strength of signals, and thus also the bandwidth and range of your WLAN, but using the WiFi Status monitoring utility, you will soon find out the details. Practice has already proven a high-placed AP with the antennas directed to the wireless receivers to deliver the highest signal strength. It's also better to keep the AP as far away as possible from large (metal) obstacles or electrical sources that can cause interference. Also, the same conditions for regular PCMCIA cards are appropriate  
AP (see it as the server in a client-server network environment). Of course,  
you can also connect an AP &quot;wired&quot; to your existing wired network.  
The exact location of your AP can have an implicit impact on the strength of  
signals, and thus also the bandwidth and range of your WLAN, but using the WiFi  
Status monitoring utility, you will soon find out the details. Practice has  
already proven a high-placed AP with the antennas directed to the wireless receivers  
to deliver the highest signal strength. It's also better to keep the AP as far  
away as possible from large (metal) obstacles or electrical sources that can  
cause interference. Also, the same conditions for regular PCMCIA cards are appropriate  
here. Important remark, however! The AP's range is very limited in performance.  
here. Important remark, however! The AP's range is very limited in performance.  
The signal weakens visibly once distances between AP and receiver is larger  
The signal weakens visibly once distances between AP and receiver is larger than approximately 30 meters. So far, no solution yet but to use several APs simultaneously to bridge over these limitations. Nevertheless, using a WAP, the range of wireless connectivity can be greatly expanded. This is because the WAP serves as a central point for routing of all wireless network traffic between the wireless nodes in the network.
than approximately 30 meters. So far, no solution yet but to use several APs  
simultaneously to bridge over these limitations. Nevertheless, using a WAP,  
the range of wireless connectivity can be greatly expanded. This is because  
the WAP serves as a central point for routing of all wireless network traffic  
between the wireless nodes in the network.<br>


Each AP spreads its own zone, but just as is the case with mobile phone antennas,  
Each AP spreads its own zone, but just as is the case with mobile phone antennas, these zones can overlap each other without any problem. This way, you can walk from one zone into another, without cutting off the connection (this is called roaming). The APs themselves can preferably be interconnected using classic wires and, of course, you should configure WLAN properly. [[Image:roaming.gif|thumb]]
these zones can overlap each other without any problem. This way, you can walk  
The WAP can be configured to use encryption or grant access to computers with a specific MAC address. Wireless equipped computers networked together in infrastructure  
from one zone into another, without cutting off the connection (this is called  
mode form a group called Basic Service Set (BSS). The BSS term is comprised of a WAP and all the LAN PCs that are associated with it. Up to 64 individual computers can exist at a single time in a BBS. This is due to the ability of the WAP to handle no more than 64 clients. The diagram below illustrates how the access point will effectively double the distance between wireless equipped computers in a BBS.
roaming). The APs themselves can preferably be interconnected using classic  
wires and, of course, you should configure WLAN properly.<br> [[Image:roaming.gif]]The  
WAP can be configured to use encryption or grant access to computers with a  
specific MAC address. Wireless equipped computers networked together in infrastructure  
mode form a group called Basic Service Set (BSS). The BSS term is comprised  
of a WAP and all the LAN PCs that are associated with it. Up to 64 individual  
computers can exist at a single time in a BBS. This is due to the ability of  
the WAP to handle no more than 64 clients. The diagram below illustrates how  
the access point will effectively double the distance between wireless equipped  
computers in a BBS.<br>


Something else you should remember is that the total available WLAN bandwidth  
Something else you should remember is that the total available WLAN bandwidth is divided between the devices that are connected in the network. P.e., suppose you have a server running with a PLX card, and you've got three other computers connected. You've got no WAP, and all three computers request data at the same time from the server. The server will probably use the entire throughput of 11Mbps, but it will divide the data to serve all clients on an equal basis.  
is divided between the devices that are connected in the network. P.e., suppose  
Thus, the clients each have less than 11 / 3Mbps throughput. This very same restriction applies also to WAPs.
you have a server running with a PLX card, and you've got three other computers  
connected. You've got no WAP, and all three computers request data at the same  
time from the server. The server will probably use the entire throughput of  
11Mbps, but it will divide the data to serve all clients on an equal basis.  
Thus, the clients each have less than 11 / 3Mbps throughput. This very same  
restriction applies also to WAPs.<br>


A term that also applies in the BSS (Infrastructure) operating mode is ESS (Extended  
A term that also applies in the BSS (Infrastructure) operating mode is ESS (Extended Service Set). This is a technology in which more BSS'es can form a single subnetwork. Therefore, ESS is especially interesting for roaming. These services can only be deployed if the Wireless Access Point is configured correctly for that.
Service Set). This is a technology in which more BSS'es can form a single subnetwork.  
Therefore, ESS is especially interesting for roaming. These services can only  
be deployed if the Wireless Access Point is configured correctly for that.
 
                   
{| border="1"
{| border="1"
|-
|-
Line 390: Line 151:
|Rather good reliability
|Rather good reliability
|}   
|}   
====== 5.1.2. EMI - ElectroMagnetic Interference ======
====5.1.2. EMI - ElectroMagnetic Interference ====
                                                             
{| border="1"
{| border="1"
|-
|-
Line 439: Line 199:
|2477
|2477
|}  
|}  
There is often a great concern about electromagnetic radiation. Europe, in  
There is often a great concern about electromagnetic radiation. Europe, in particular, is extremely conscious of the unknown health consequences of electromagnetic &quot;smog&quot;. In the US, we hear periodic claims of handsets causing brain cancer. Whatever the evidence, the topology of multi-hop networks needs less power, as the signals go only a short distance.
particular, is extremely conscious of the unknown health consequences of electromagnetic  
&quot;smog&quot;. In the US, we hear periodic claims of handsets causing brain  
cancer. Whatever the evidence, the topology of multi-hop networks needs less  
power, as the signals go only a short distance. <br>
One can assume that lower power means lower health risk.<br>
Microwave ovens and many cordless phones operate in the 2.4 GHz spectrum, the
same radio spectrum used by 802.11b Wi-Fi wireless networks. That means they
can cause interference (can disturb each other's signals, waves), but in most
instances this will just slow down the Wi-Fi connection; it won't stop transmission
or break the connection.<br>
To reduce interference, you can move a 2.4 GHz cordless phone away from your
Wi-Fi equipped computer or base station. Interference usually only happens with
older microwave ovens. You can also try changing the channel on which your Wi-Fi
network operates. In addition, some manufacturers have developed and implemented
special technologies that can minimize interference from cordless phones and
ovens.<br>
Which brings up the next thing to mention: channels. A channel is a frequency
range within the IEEE 802.11 spectrum over which transmission may occur.<br>
How can we understand channels of IEEE 802.11b? They are part of the spread
spectrum technology, and each channel is a range of frequencies 22MHz wide,
and different channels always overlap a bit. This is how [[UnixWiz.net]]
explains it: &quot;When picking a channel, first see what your 'neighbors' are
using, thus you pick up a channel that overlaps the least with them.&quot;<br>
We already said that a particular wireless network needs to share one same channel.
But what exactly are these channels? Channels specify the band at which WiFi
works more specifically, thus it is more accurate than 2.4GHz. A channel is
a decimal number between one and 11 (13 in Europe) and designates the frequency
on which the network will operate. Channel 1 equals a frequency of 2.412GHz,
channel 2 2.417 and so on with steps of five until 2.462GHz for channel 11.
Not all WiFi cards support the 12th and 13th channels, but if your devices does;
the frequency of those channels are analogous.<br>
Should you have troubles from EMI, the solution is to specify another channel.
Conclusion: electromagnetic interference: no big issue.


One can assume that lower power means lower health risk.
Microwave ovens and many cordless phones operate in the 2.4 GHz spectrum, the same radio spectrum used by 802.11b Wi-Fi wireless networks. That means they can cause interference (can disturb each other's signals, waves), but in most instances this will just slow down the Wi-Fi connection; it won't stop transmission or break the connection.
To reduce interference, you can move a 2.4 GHz cordless phone away from your Wi-Fi equipped computer or base station. Interference usually only happens with older microwave ovens. You can also try changing the channel on which your Wi-Fi network operates. In addition, some manufacturers have developed and implemented special technologies that can minimize interference from cordless phones and ovens.
Which brings up the next thing to mention: channels. A channel is a frequency range within the IEEE 802.11 spectrum over which transmission may occur.
How can we understand channels of IEEE 802.11b? They are part of the spread spectrum technology, and each channel is a range of frequencies 22MHz wide, and different channels always overlap a bit. This is how [UnixWiz.net] explains it: "When picking a channel, first see what your 'neighbors' are using, thus you pick up a channel that overlaps the least with them."
We already said that a particular wireless network needs to share one same channel. But what exactly are these channels? Channels specify the band at which WiFi works more specifically, thus it is more accurate than 2.4GHz. A channel is a decimal number between one and 11 (13 in Europe) and designates the frequency on which the network will operate. Channel 1 equals a frequency of 2.412GHz, channel 2 2.417 and so on with steps of five until 2.462GHz for channel 11. Not all WiFi cards support the 12th and 13th channels, but if your devices does; the frequency of those channels are analogous.
Should you have troubles from EMI, the solution is to specify another channel. Conclusion: electromagnetic interference: no big issue.
   
   
[[Image:80211bchannels.gif]]
[[Image:80211bchannels.gif]]


===5.2. WiFi Status monitoring utility===
===== 5.2. WiFi Status monitoring utility =====
This article only introduces this powerful IBM utility briefly, but this page gives more details and examples.
 
This article only introduces this powerful IBM utility briefly, but [[this page]] gives more details and examples.
====5.2.1. Introduction====
The WiFiStat.exe monitoring utility really is a great utility provided by IBM. It works with all the WLAN WiFi drivers described above except the CISCO 340 driver, and it allows you to change NIC setting on the fly (you do need version 1.5 or higher of Artem's driver). Remember, all settings can be changed using the NIF file via MPTS, but then you are obliged to reboot. WiFiStat removes this obligation. In fact, the only thing you need to do in MPTS is add the driver and attach a protocol to it. [[Image:wifistat.jpg|right]]Also, very nice feature, you can specify up to four different ''Profiles'', so that you can select the appropriate profile in a particular situation.
 
The main window is very easy and straightforward; its title bar states its name and also the currently activated profile.
 
The are two fields that always appear; the ''Status:'' field, which will tell you whether you are still searching a WLAN or whether you're already connected to one. And then, there's the ''SSID:'' field. SSID is the abbreviation of Service Set Identifier. It's a name (a sequence of characters) for the wireless network and it's sometimes simply called Network Name. In infrastructure mode, the SSID should be set to the same value as the WAP; in ad hoc mode, the SSID on ALL notebook (or for PC using PLX board) network cards in the network must be set to the same value. In the example above, my ad hoc network was called ''Wireless''. As you can see, you can hide this field by right-clicking anywhere in the main window, and selecting ''Hide SSID''. Analogous, you can re-enable SSID by selecting ''Show SSID''.
 
Very handy is the green indicator showing you the quality of your connection. The rectangle will be 100% filled when your connection is the full 11Mbps, the maximum. If the speeds are lower, then you will see this in this rectangle. If you haven't got connection yet, but are searching for the presence of a WLAN (and notice a WLAN announces his presence, which causes security issues!), the ''Status:'' field will state ''Connected to IBSS'', and sometimes
it is changed by ''Searching for WLAN''. The rectangle at the right is not green, you can hardly see a small white vertical line.
 
The options ''Radio On'' and ''Radio Off ''in the main windows' pop-up menu respectively will enable and disable your WiFi card's working. This is a handy feature, since you needn't even remove the card when entering an airplane or a hospital (where the WLAN waves could interfere with the infrastructure).
 
As already pointed to above, you can specify several profiles. This means you can specify for example two profiles, one for a connection in a WLAN with a WAP, and another for an ad hoc connection. Instead of having to change this using MPTS an then rebooting, in order to activate that kind of WLAN connection, just right-click the main window, select ''Select Profile'' from the pop-up, and in the submenu, choose the profile you wish. I have called my
profile ''Profile1'', but of course, you can assign it any name you want (for the scenario just described, you could name the ad hoc connection ''AdHoc'' and the infrastructure mode connection ''InfrWAP'', and that name will appear in the ''Select Profile'''s submenu. By selecting a profile, this profile will immediately become active, but first your current connection (if it exists) will be broken. Then, using the new setting, OS/2 will try
to establish a new WLAN connection.
 
Also interesting is that this utility (though copyright from IBM) also works with the Artem WLAN cards, if you have driver revision 1.5 or above. The WiFiStat utility is only provided with miniPCI and High Rate 128 solutions.


===5.2.2. How to specify profiles...===
====== 5.2.1. Introduction ======
[[Image:profedit.jpg]]
The WiFiStat.exe monitoring utility really is a great utility provided by
IBM. It works with all the WLAN WiFi drivers described above except the CISCO
340 driver, and it allows you to change NIC setting on the fly (you do need
version 1.5 or higher of Artem's driver). Remember, all settings can be changed
using the NIF file via MPTS, but then you are obliged to reboot. WiFiStat removes
this obligation. In fact, the only thing you need to do in MPTS is add the driver
and attach a protocol to it. '''[[Image:wifistat.jpg]]'''Also,
very nice feature, you can specify up to four different ''Profiles'', so
that you can select the appropriate profile in a particular situation. <br>
The main window is very easy and straightforward; its title bar states its
name and also the currently activated profile.<br>
The are two fields that always appear; the ''Status:'' field, which will
tell you whether you are still searching a WLAN or whether you're already connected
to one. And then, there's the ''SSID:'' field. SSID is the abbreviation
of Service Set Identifier. It's a name (a sequence of characters) for the wireless
network and it's sometimes simply called Network Name. In infrastructure mode,
the SSID should be set to the same value as the WAP; in ad hoc mode, the SSID
on ALL notebook (or for PC using PLX board) network cards in the network must
be set to the same value. In the example above, my ad hoc network was called
''Wireless''. As you can see, you can hide this field by right-clicking
anywhere in the main window, and selecting ''Hide SSID''. Analogous, you
can re-enable SSID by selecting ''Show SSID''.<br>
Very handy is the green indicator showing you the quality of your connection.
The rectangle will be 100% filled when your connection is the full 11Mbps,
the maximum. If the speeds are lower, then you will see this in this rectangle.
If you haven't got connection yet, but are searching for the presence of a
WLAN (and notice a WLAN announces his presence, which causes security issues!),
the ''Status:'' field will state ''Connected to IBSS'', and sometimes
it is changed by ''Searching for WLAN''. The rectangle at the right is
not green, you can hardly see a small white vertical line.<br>
The options ''Radio On'' and ''Radio Off ''in the main windows'
pop-up menu respectively will enable and disable your WiFi card's working.
This is a handy feature, since you needn't even remove the card when entering
an airplane or a hospital (where the WLAN waves could interfere with the infrastructure).<br>
As already pointed to above, you can specify several profiles. This means
you can specify for example two profiles, one for a connection in a WLAN with
a WAP, and another for an ad hoc connection. Instead of having to change this
using MPTS an then rebooting, in order to activate that kind of WLAN connection,
just right-click the main window, select ''Select Profile'' from the
pop-up, and in the submenu, choose the profile you wish. I have called my
profile ''Profile1'', but of course, you can assign it any name you want
(for the scenario just described, you could name the ad hoc connection ''AdHoc''
and the infrastructure mode connection ''InfrWAP'', and that name will
appear in the ''Select Profile'''s submenu. By selecting a profile, this
profile will immediately become active, but first your current connection
(if it exists) will be broken. Then, using the new setting, OS/2 will try
to establish a new WLAN connection.<br>
Also interesting is that this utility (though copyright from IBM) also works
with the Artem WLAN cards, if you have driver revision 1.5 or above. The WiFiStat
utility is only provided with miniPCI and High Rate 128 solutions.


====== 5.2.2. How to specify profiles... ======
[[Image:profedit.jpg]]<br>
As already said, you can specify up to four profiles for a WLAN device. In this  
As already said, you can specify up to four profiles for a WLAN device. In this  
section we'll discuss how you can specify them. To specify a new profile(, or  
section we'll discuss how you can specify them. To specify a new profile(, or  
Line 592: Line 293:
encryption first.
encryption first.


===5.3. xWireless LAN xCenter Widget===
===== 5.3. xWireless LAN xCenter Widget =====
Many eComStation users have replaced the IBM WarpCenter by the eCenter, a slightly modified xCenter, part of XWorkPlace. The xCenter of XWorkPlace is a complete replacement of the old (sometimes buggy) WarpCenter. The image below shows a possible xCenter. Click the image to magnify it.
Many eComStation users have replaced the IBM WarpCenter by the eCenter, a slightly  
modified xCenter, part of XWorkPlace. The xCenter of XWorkPlace is a complete  
replacement of the old (sometimes buggy) WarpCenter. The image below shows a  
possible xCenter. Click the image to magnify it.
 
   
   
[[Image:closeup.gif]]
[[Image:closeup.gif]]


The xCenter provides several advantages over the WarpCenter, of which some are listed here:
The xCenter provides several advantages over the WarpCenter, of which some  
* Offers the same functionality of the WarpCenter, like CPU usage, shut down, search, lockup, task killer, desktop navigation menu, clock,... ;
are listed here:
* Offers extra functionality like the system of the Windows Start Bar: open programs are displayed in the bar. Clicking them, makes the programs visible;
 
* Offers the same functionality of the WarpCenter, like CPU usage, shut down,     search, lockup, task killer, desktop navigation menu, clock,... ;
* Offers extra functionality like the system of the Windows Start Bar: open     programs are displayed in the bar. Clicking them, makes the programs visible;
* Network Throughput monitor;
* Network Throughput monitor;
* APM battery indicator.
* APM battery indicator.
The extra functionality is achieved by embedding widgets at the places where
you want it in the xCenter. This also implies more customizability than was
previously[[Image:xCwidget.gif]]
the case with the WarpCenter (also called eComCenter*). The remaining part of
this paragraph will deal about the Wireless Widget (wxWireless widget). For
more information about the xCenter, its configuration and available widgets,
we refer to one of the links in the Related Links area of the left navigation
bar.


The extra functionality is achieved by embedding widgets at the places where you want it in the xCenter. This also implies more customizability than was previously[[Image:xCwidget.gif]]
the case with the WarpCenter (also called eComCenter*). The remaining part of this paragraph will deal about the Wireless Widget (wxWireless widget). For more information about the xCenter, its configuration and available widgets, we refer to one of the links in the Related Links area of the left navigation bar.
   
   
To install the wxWireless widget, download the wxWireless ZIP file from the  
To install the wxWireless widget, download the wxWireless ZIP file from the os2warp.be Wireless Device Drivers downloads page, and unzip it in the \plugins\xcenter directory, located in the installation directory of XWorkPlace (for the eCenter included with eComStation 1.1, this folder is c:\ecs\system\ecenter\plugins\ecenter).  
os2warp.be Wireless Device Drivers downloads page, and unzip it in the \plugins\xcenter  
Then, just right-click any free space of the xCenter, click ''Create new widget'', and then select ''XWireless LAN Monitor''. The Wireless Widget is added, and you're ready to configure it and use as a tool to facilitate your daily wireless networking.
directory, located in the installation directory of XWorkPlace (for the eCenter  
included with eComStation 1.1, this folder is c:\ecs\system\ecenter\plugins\ecenter).  
Then, just right-click any free space of the xCenter, click ''Create new widget''
, and then select ''XWireless LAN Monitor''. The Wireless Widget is added,  
and you're ready to configure it and use as a tool to facilitate your daily  
wireless networking.
 
   
   
The widget displays the strength of the signal, in a similar way as WiFiState,  
The widget displays the strength of the signal, in a similar way as WiFiState, described in section ''Line Speeds''. By pointing to the widget, you can see from the picture above, that the other information available from WiFiState is displayed.
described in section ''Line Speeds''. By pointing to the widget, you can  
see from the picture above, that the other information available from WiFiState  
is displayed.


<blockquote>     
* Please note that eComCenter is ''not ''the same as  eCenter. eComCenter equals the WarpCenter, eCenter equals xCenter.
* Please note that eComCenter is ''not ''the same as  eCenter. eComCenter equals the WarpCenter, eCenter equals xCenter.
</blockquote>
For more information about the xWireless LAN Widget, please visit [[http://www.os2warp.be/index2.php?name=wifistate#02]].


==== 6. Security restrictions? What about encryption? ====
For more information about the xWireless LAN Widget, please visit [http://www.os2warp.be/index2.php?name=wifistate#02].
 
==6. Security restrictions? What about encryption? ==
With the increased reliance on wireless local area networks, businesses  
With the increased reliance on wireless local area networks, businesses  
are increasingly more concerned about network security. Network managers need  
are increasingly more concerned about network security. Network managers need  
Line 658: Line 330:
for the network has moved. Without stringent security measures in place, installing  
for the network has moved. Without stringent security measures in place, installing  
a WLAN can be the equivalent of putting Ethernet ports everywhere, including  
a WLAN can be the equivalent of putting Ethernet ports everywhere, including  
the parking lot.<br>
the parking lot.
 
Because of these security concerns, many network managers have been reluctant  
Because of these security concerns, many network managers have been reluctant  
or unwilling to deploy WLANs, especially in light of the vulnerability of  
or unwilling to deploy WLANs, especially in light of the vulnerability of  
Line 671: Line 344:
offered by wired LANs. WEP currently is available in all OS/2 WLAN drivers.
offered by wired LANs. WEP currently is available in all OS/2 WLAN drivers.


===6.1. Traditional WLAN Security===
===== 6.1. Traditional WLAN Security =====
''For this section, I made use of CISCO's White Sheet about Security Issues related to WLANs.''
 
''' <br> ''' ''For this section, I made use of CISCO's White Sheet about Security  
As with other networks, security for WLANs focuses on access control and privacy. Robust WLAN access control prevents unauthorized users from communicating through APs, the WLAN endpoints on the Ethernet network that link WLAN clients to the network. Strong WLAN access control ensures that legitimate clients associate with trusted, rather than &quot;rogue&quot; APs. WLAN privacy ensures that only the intended audience understands the transmitted data. The privacy of transmitted WLAN data is protected only when that data is encrypted with
Issues related to WLANs.''
a KEY that can be used only by the intended recipient of the data.
 
Traditional WLAN security includes the use of Service Set Identifiers (SSIDs), open or shared-key authentication, static WEP keys and optional Media Access Control (MAC) authentication. This combination offers a rudimentary level of access control and privacy, but each element can be compromised. Yes, indeed, all technical term, which will be discussed in the paragraphs below:
 
SSID is a common network name for the devices in a WLAN subsystem; it serves to logically segment that subsystem. An SSID prevents access by any client device that does not have the SSID. By default, however, an AP broadcasts its SSID in its beacon (a beacon frame are the frames that the AP sends every 20 milliseconds whenever it doesn't receive frames anymore). Even if broadcasting of the SSID is turned off, an intruder or hacker can detect the SSID through sniffing (sniffing means, &quot;catching waves&quot; and trying to decode
them).
 
The 802.11 standard, a group of specifications for WLANs created by the Institute of Electrical and Electronics Engineers Incorporated (IEEE), supports two means of client authentication: open and shared-key authentication. Open authentication involves little more than supplying the correct SSID. With shared-key authentication, the AP sends the client device a challenge text packet that the client must then encrypt with the correct WEP key and return to the access point. If the client has the wrong key or no key, authentication will fail and the client will not be allowed to associate with the access point. Shared-key authentication is not considered secure, because a hacker who detects both the clear-text
challenge and the same challenge encrypted with a WEP key can decipher the WEP key. Also, encryption is performed via the RC4 encoding algorithm, which is already well-known to expert-hackers.
 
With open authentication, even if a client can complete authentication and associate with an AP, the use of WEP prevents the client from sending data to and receiving data from the AP, unless the client has the correct WEP key.
 
Another type of key that is often used, but is not considered secure, is a "static" WEP key. A static WEP key is a key composed of either 40 or 128 bits that is statically defined by the network administrator on the AP and all clients that communicate with the AP. When static WEP keys are used, a network administrator must perform the time-consuming task of entering
the same keys on every device in the WLAN.
 
If a device that uses static WEP keys is lost or stolen, the possessor of the stolen device can access the WLAN. An administrator won't be able to detect that an unauthorized user has infiltrated the WLAN, until and unless the theft is reported. The administrator must then change the WEP key on every device that uses the same static WEP key used by the missing device. In a large enterprise WLAN with hundreds or even thousands of users, this can be a daunting task. Worse still, if a static WEP key is deciphered through a tool like AirSnort,
the administrator has no way of knowing that the key has been compromised by a hacker. So you can immediately see now why I've already discommended WLANs for business endings.
 
Some WLAN vendors support authentication based on the physical address, or MAC address, of the client Network Interface Card (NIC). An access point will allow association by a client only if that client's MAC address matches an address in an authentication table used by the access point. But MAC authentication is an inadequate security measure, because MAC addresses can be forged, or a NIC can be lost or stolen.
 
While traditional WLAN security that relies on SSIDs, open or shared-keys, static WEP keys or MAC authentication is better than no security at all, it is not sufficient for the enterprise organization. Only very small businesses, or those that do not entrust mission-critical data to their WLAN networks, can rely on these WLAN security types. All other enterprises and organizations must invest in a robust, enterprise-class WLAN security solution.
 
Although traditional WLAN security that relies on open or shared keys and static WEP keys is better than no security at all, it is not sufficient for the enterprise organization. Only very small businesses, or those that do not entrust mission-critical data to their WLAN networks, can rely on these WLAN security types. All other enterprises and organizations must invest in a robust, enterprise-class WLAN security solution.


 
Nowadays, more modern security measures are available. Newer technologies like IPSec, EAP/802.1x, EAP/TLS, PEAP et cetera. Surely, they will be better then WEP, but they are more software-based security solutions, thus mostly Windows-only, and thus not available on the OS/2 Warp platform.
As with other networks, security for WLANs focuses on access control and
privacy. Robust WLAN access control prevents unauthorized users from communicating
through APs, the WLAN endpoints on the Ethernet network that link WLAN clients
to the network. Strong WLAN access control ensures that legitimate clients
associate with trusted, rather than &quot;rogue&quot; APs. WLAN privacy ensures
that only the intended audience understands the transmitted data. The privacy
of transmitted WLAN data is protected only when that data is encrypted with
a KEY that can be used only by the intended recipient of the data.<br>
Traditional WLAN security includes the use of Service Set Identifiers (SSIDs),
open or shared-key authentication, static WEP keys and optional Media Access
Control (MAC) authentication. This combination offers a rudimentary level
of access control and privacy, but each element can be compromised. Yes, indeed,
all technical term, which will be discussed in the paragraphs below:<br>
SSID is a common network name for the devices in a WLAN subsystem; it serves
to logically segment that subsystem. An SSID prevents access by any client
device that does not have the SSID. By default, however, an AP broadcasts
its SSID in its beacon (a beacon frame are the frames that the AP sends every
20 milliseconds whenever it doesn't receive frames anymore). Even if broadcasting
of the SSID is turned off, an intruder or hacker can detect the SSID through
sniffing (sniffing means, &quot;catching waves&quot; and trying to decode
them).<br>
The 802.11 standard, a group of specifications for WLANs created by the Institute
of Electrical and Electronics Engineers Incorporated (IEEE), supports two
means of client authentication: open and shared-key authentication. Open authentication
involves little more than supplying the correct SSID. With shared-key authentication,
the AP sends the client device a challenge text packet that the client must
then encrypt with the correct WEP key and return to the access point. If the
client has the wrong key or no key, authentication will fail and the client
will not be allowed to associate with the access point. Shared-key authentication
is not considered secure, because a hacker who detects both the clear-text
challenge and the same challenge encrypted with a WEP key can decipher the
WEP key. Also, encryption is performed via the RC4 encoding algorithm, which
is already well-known to expert-hackers.<br>
With open authentication, even if a client can complete authentication and
associate with an AP, the use of WEP prevents the client from sending data
to and receiving data from the AP, unless the client has the correct WEP key.<br>
Another type of key that is often used, but is not considered secure, is a
&quot;static&quot; WEP key. A static WEP key is a key composed of either 40
or 128 bits that is statically defined by the network administrator on the
AP and all clients that communicate with the AP. When static WEP keys are
used, a network administrator must perform the time-consuming task of entering
the same keys on every device in the WLAN.<br>
If a device that uses static WEP keys is lost or stolen, the possessor of
the stolen device can access the WLAN. An administrator won't be able to detect
that an unauthorized user has infiltrated the WLAN, until and unless the theft
is reported. The administrator must then change the WEP key on every device
that uses the same static WEP key used by the missing device. In a large enterprise
WLAN with hundreds or even thousands of users, this can be a daunting task.
Worse still, if a static WEP key is deciphered through a tool like AirSnort,
the administrator has no way of knowing that the key has been compromised
by a hacker. So you can immediately see now why I've already discommended
WLANs for business endings.<br>
Some WLAN vendors support authentication based on the physical address, or
MAC address, of the client Network Interface Card (NIC). An access point will
allow association by a client only if that client's MAC address matches an
address in an authentication table used by the access point. But MAC authentication
is an inadequate security measure, because MAC addresses can be forged, or
a NIC can be lost or stolen.<br>
While traditional WLAN security that relies on SSIDs, open or shared-keys,
static WEP keys or MAC authentication is better than no security at all, it
is not sufficient for the enterprise organization. Only very small businesses,
or those that do not entrust mission-critical data to their WLAN networks,
can rely on these WLAN security types. All other enterprises and organizations
must invest in a robust, enterprise-class WLAN security solution.<br>
Although traditional WLAN security that relies on open or shared keys and
static WEP keys is better than no security at all, it is not sufficient for
the enterprise organization. Only very small businesses, or those that do
not entrust mission-critical data to their WLAN networks, can rely on these
WLAN security types. All other enterprises and organizations must invest in
a robust, enterprise-class WLAN security solution. <br>
Nowadays, more modern security measures are available. Newer technologies  
like IPSec, EAP/802.1x, EAP/TLS, PEAP et cetera. Surely, they will be better  
then WEP, but they are more software-based security solutions, thus mostly  
Windows-only, and thus not available on the OS/2 Warp platform.


===6.2. Why WEP Is Insecure...===
===== 6.2. Why WEP Is Insecure... =====
This section was taught at the WarpWeekend 2003 event in Roermond, the Netherlands.
This section was taught at the WarpWeekend 2003 event in Roermond, the Netherlands.
   
   
This section is only for people who want the theoretical background of why  
This section is only for people who want the theoretical background of why the WEP (Wired Equivalent Privacy) is awfully insecure. If you are currently still having problems with the previous sections, then please skip this section and get back to it at a later time when you have a complete knowledge. One note you should remember during the study of this section is that WEP is defined in the 802.11 standard, not the individual standards for 802.11b, 802.11a,  
the WEP (Wired Equivalent Privacy) is awfully insecure. If you are currently  
and 802.11g task groups. As a consequence, WEP vulnerabilities have the potential to affect all flavors of 802.11 networks (except newer 802.11 standards that replace WEP like 802.11i).
still having problems with the previous sections, then please skip this section  
and get back to it at a later time when you have a complete knowledge. One  
note you should remember during the study of this section is that WEP is defined  
in the 802.11 standard, not the individual standards for 802.11b, 802.11a,  
and 802.11g task groups. As a consequence, WEP vulnerabilities have the potential  
to affect all flavors of 802.11 networks (except newer 802.11 standards that  
replace WEP like 802.11i).<br>
Before we go on, you should be aware of what a XOR port is. A XOR port is
in fact an OR port with only one (indicated in red) input combination different
from the OR. At this moment, we are speaking about Boolean Algebra (algebra
with only 2 values: a zero (false) and a one (true)). Both ports we have referred
to are in fact functions that we offer two inputs, and a function has only
one output. Now consider the two truth tables below:


     
Before we go on, you should be aware of what a XOR port is. A XOR port is in fact an OR port with only one (indicated in red) input combination different from the OR. At this moment, we are speaking about Boolean Algebra (algebra with only 2 values: a zero (false) and a one (true)). Both ports we have referred to are in fact functions that we offer two inputs, and a function has only one output. Now consider the two truth tables below:
{| border="1"
{| border="1"
|-
|OR gate/port:
|OR gate/port:<br>                         
{| border="1"
{| border="1"
|-
|-
Line 787: Line 391:
| 0
| 0
| 0
| 0
| '''0'''
!0
|-
|-
| 0
| 0
| 1
| 1
| '''1'''
!1
|-
|-
| 1
| 1
| 0
| 0
| '''1'''
!1
|-
|-
| 1
| 1
| 1
| 1
| '''1'''
!1
|}  
|}  
|XOR gate/port:<br>                         
|XOR gate/port:
{| border="1"
{| border="1"
|-
|-
| in0
| in0
| in1
| in1
| '''out'''
!out
|-
|-
| 0
| 0
| 0
| 0
| '''0'''
!0
|-
|-
| 0
| 0
| 1
| 1
| '''1'''
!1
|-
|-
| 1
| 1
| 0
| 0
| '''1'''
!1
|-
|-
| 1
| 1
| 1
| 1
| '''0'''
!0
|}  
|}  
|}  
|}  
The columns in0 and in1 are in fact the two inputs, two wires connected to  
The columns in0 and in1 are in fact the two inputs, two wires connected to the gate, and there's only one wire that leaves the gate, called out.
the gate, and there's only one wire that leaves the gate, called out.<br>
Now, WEP employs an integrity check field in each data packet to ensure that
data is not modified during transmission. For this purpose, a 32-bit CRC checksum
is used. But deploying WEP, we need one (select one out of four keys) secret
key, consider it a password to encrypt/decrypt data, generally referred to
as the &quot;WEP key&quot;. WEP also uses the RSA RC4 encryption algorithm.
RC4 is a stream cipher designed by Ron Rivest for RSA Security. A stream cipher
expands a fixed-length key into an infinite pseudo-random key stream for the
purpose of encrypting data. In WEP, plain-text data is bitwise XOR'ed with
the key stream to produce the cipher text. This results in the presentation
below. Now let us continue step by step:


             
Now, WEP employs an integrity check field in each data packet to ensure that data is not modified during transmission. For this purpose, a 32-bit CRC checksum is used. But deploying WEP, we need one (select one out of four keys) secret key, consider it a password to encrypt/decrypt data, generally referred to as the "WEP key". WEP also uses the RSA RC4 encryption algorithm.
RC4 is a stream cipher designed by Ron Rivest for RSA Security. A stream cipher expands a fixed-length key into an infinite pseudo-random key stream for the purpose of encrypting data. In WEP, plain-text data is bitwise XOR'ed with the key stream to produce the cipher text. This results in the presentation below. Now let us continue step by step:
<PRE>
<PRE>
+----------------------------+---------+
+----------------------------+---------+
Line 850: Line 444:
|  V  |            Ciphertext              |
|  V  |            Ciphertext              |
+-----+--------------------------------------+
+-----+--------------------------------------+
</PRE>
</PRE>
What is bitwise XOR'ing? Consider first our data. It is being sent as a plaintext message. That means that in fact, the data is being transferred as text, thus as a sequence of ASCII characters, which we express in binary (strings of 1s and 0s because our computer can only understand those two binary digits). Suppose we are going to bitwise XOR the characters of our plain text string, which are all ASCII characters. Suppose that we are going to XOR the characters n and b. They have ASCII values 110 and 98 respectively, which are decimal
numbers. However, we must express these two characters in binary so that the computer can understand what we mean. If we convert, then we have respective binary values of 01101110 and 01100010. Now, just as we have the units, tens, hundreds, thousands in our decimal number system, in binary (radix two), we have such things too. In fact, these things assign a particular weight to a specific digit. Anyway, consider the bit string of n: 01101110. The rightmost 0 is on the units place, the 1 at the left of it is at the 2^1s place, the
bit at the left at the 2^2s place and so on... Now what we're going to do is just XOR the respective bits of the bit strings of n and b.


What is bitwise XOR'ing? Consider first our data. It is being sent as a plaintext
We're starting from right to left, but note that we can reverse this process without any problem. At the place of the units (2^0) we have respective bits 0 and 0. XOR(0,0) = 0. Now we move one place left (thus we're now at the place 2^1). XOR(1,1) = 0; again one place to the left: XOR(1,0) = 1, and we continue in this way till we reach the left side of the bit strings. This is what bitwise XOR'ing is.
message. That means that in fact, the data is being transferred as text, thus
01101110  The letter  n, in binary
as a sequence of ASCII characters, which we express in binary (strings of
<u>01100010</u>  The letter b, in binary
1s and 0s because our computer can only understand those two binary digits).
00001100  The XOR'ed value
Suppose we are going to bitwise XOR the characters of our plain text string,
As we already explained, WEP requires that each wireless network connection share a secret key for encryption purposes. WEP doesn't define key management techniques such as the number of different keys used within a network or the frequency to change keys. In practice, networks use one key among access points and change keys infrequently, as most vendor implementations of WEP require that keys be changed manually. The key stream produced by WEP's RC4 algorithm  
which are all ASCII characters. Suppose that we are going to XOR the characters
depends upon BOTH the secret key and the Initialization Vector. The Initialization Vector is used to ensure that subsequent data packets are encrypted with different key streams, despite using the same secret key. The Initialization Vector is a 24 bit field that is unencrypted within the header of the data packet, as shown above.
n and b. They have ASCII values 110 and 98 respectively, which are decimal
numbers. However, we must express these two characters in binary so that the
computer can understand what we mean. If we convert, then we have respective
binary values of 01101110 and 01100010. Now, just as we have the units, tens,
hundreds, thousands in our decimal number system, in binary (radix two), we
have such things too. In fact, these things assign a particular weight to
a specific digit. Anyway, consider the bit string of n: 01101110. The rightmost
0 is on the units place, the 1 at the left of it is at the 2^1s place, the
bit at the left at the 2^2s place and so on... Now what we're going to do
is just XOR the respective bits of the bit strings of n and b.
 
         
 
We're starting from right to left, but note that we can reverse this process  
without any problem. At the place of the units (2^0) we have respective bits  
0 and 0. XOR(0,0) = 0. Now we move one place left (thus we're now at the place  
2^1). XOR(1,1) = 0; again one place to the left: XOR(1,0) = 1, and we continue  
in this way till we reach the left side of the bit strings. This is what bitwise  
XOR'ing is.<br>
 
{| border="1"
|-
|<tt>01101110  The letter  n, in binary</tt>
|-
|<tt><u>01100010</u>  The letter b, in binary</tt>
|-
|<tt>00001100  The XOR'ed value </tt>
|}
 
 
As we already explained, WEP requires that each wireless network connection  
share a secret key for encryption purposes. WEP doesn't define key management  
techniques such as the number of different keys used within a network or the  
frequency to change keys. In practice, networks use one key among access points  
and change keys infrequently, as most vendor implementations of WEP require  
that keys be changed manually. The key stream produced by WEP's RC4 algorithm  
depends upon BOTH the secret key and the Initialization Vector. The Initialization  
Vector is used to ensure that subsequent data packets are encrypted with different  
key streams, despite using the same secret key. The Initialization Vector  
is a 24 bit field that is unencrypted within the header of the data packet,  
as shown above.<br>


Now consider the diagram above that explains how we encrypt our data. As already  
Now consider the diagram above that explains how we encrypt our data. As already said, we send our data as plain text, a series of ASCII characters. We target a mathematical function, assume it is called CRC32 on this plaintext. CRC32(Plaintext Message) = a certain number. This certain number is what we're going to convert to base two, and will then fit in 32 bits. We now create a new array of 0s and 1s: the first bar of the diagram. Then we are going to produce a Keystream.  
said, we send our data as plain text, a series of ASCII characters. We target  
Again, we use a mathematical function: this time the RSA RC4 algorithm, that is ''actually the real encoding part of the system''. RC4(V,K) equals a key string, which we can easily convert to binary (1s and 0s). This is the second bar in the diagram. Now, we are going to bitwise XOR these two bars, and we get what is called the Ciphertext. We're now just pasting the Initialization Vector (24 bit) in front of that, and we have our packet of encrypted data  
a mathematical function, assume it is called CRC32 on this plaintext. CRC32(Plaintext  
via WEP.
Message) = a certain number. This certain number is what we're going to convert  
to base two, and will then fit in 32 bits. We now create a new array of 0s  
and 1s: the first bar of the diagram. Then we are going to produce a Keystream.  
Again, we use a mathematical function: this time the RSA RC4 algorithm, that  
is ''actually the real encoding part of the system''. RC4(V,K) equals  
a key string, which we can easily convert to binary (1s and 0s). This is the  
second bar in the diagram. Now, we are going to bitwise XOR these two bars,  
and we get what is called the Ciphertext. We're now just pasting the Initialization  
Vector (24 bit) in front of that, and we have our packet of encrypted data  
via WEP.<br>


Now, in optimal conditions, we have this:
Now, in optimal conditions, we have this:
:11Mbps + ((1500 bytes per packet) * (8 bits per byte)) = 916.67 packets that are transmitted each second.
:16777216 Initialization Vectors + (916.67 packets per second is) = 18302.41745  seconds to use all Initialization Vectors.
:(18302.41745 seconds) *( 60 seconds per minute) * (60 minutes per hour) =  5.0840048 hours to generate all Initialization Vectors.


<blockquote>
We can conclude out of these calculations that an Initialization Vector would be repeated (referred to as an Initialization Vector Collision) about every five hours in a network running @ 11Mbps and transmitting packets of size 1500 bytes.Once an Initialization Vector Collision occurs, and an attacker has two different plain-text messages encrypted with the same ''key stream''', '''''it is possible to obtain the XOR of the two plain-text messages by XORing the two cipher text messages. The XOR that results can then be used to decrypt the traffic. Let's clarify this now with Boolean Algebra:
11Mbps + ((1500 bytes per packet) * (8 bits per byte)) = 916.67 packets that are transmitted each second.<br>
<PRE>
16777216 Initialization Vectors + (916.67 packets per second is) = 18302.41745  seconds to use all Initialization Vectors.<br>
C1 = Ciphertext 1
(18302.41745 seconds) *( 60 seconds per minute) * (60 minutes per hour) =  5.0840048 hours to generate all Initialization Vectors. 
C2 = Ciphertext 2
</blockquote> 
P1 = Plaintext 2
 
P2 = Plaintext 2
We can conclude out of these calculations that an Initialization Vector would  
V = Initialization Vector
be repeated (referred to as an Initialization Vector Collision) about every  
five hours in a network running @ 11Mbps and transmitting packets of size  
1500 bytes.Once an Initialization Vector Collision occurs, and an attacker  
has two different plain-text messages encrypted with the same ''key stream''',  
'''''it is possible to obtain the XOR of the two plain-text messages  
by XORing the two cipher text messages. The XOR that results can then be used  
to decrypt the traffic. Let's clarify this now with Boolean Algebra:
 
<blockquote>
C1 = Ciphertext 1<br>
C2 = Ciphertext 2<br>
P1 = Plaintext 2<br>
P2 = Plaintext 2<br>
V = Initialization Vector<br>
K = Secret Key
K = Secret Key
 
C1 = XOR [ P1, RC4(V,K) ] and C2 =XOR [ P2, RC4(V,K) ], thus:
                         
{| border="1"
XOR (C1, C2) = XOR { XOR [ P1, RC4(V,K) ]; XOR [ P2, RC4(V,K) ] }
|-
</PRE>
|C1 = XOR [ P1, RC4(V,K) ] and C2 =XOR [ P2, RC4(V,K) ], thus:
We now apply the associative law:
|-
XOR [ P1, RC4(V,K), P2, RC4(V,K) ]
|
We now apply the commutative law:
|-
XOR [ P1, P2, RC4(V,K), RC4(V,K) ]
|XOR (C1, C2) =  
RC4(V,K) and RC4(V,K) are two bit strings that are the same.
|XOR { XOR [ P1, RC4(V,K) ]; XOR [ P2, RC4(V,K) ] }
XOR(0,0) = 0 and XOR(1,1) = 0 ==> RC4(V,K) + RC4(V,K) = 000...0 = 0,
|We now apply the associative law:
and thus we can leave this away
|-
  XOR ( P1, P2 )
|
|XOR [ P1, RC4(V,K), P2, RC4(V,K) ]
|We now apply the commutative law:
|-
|
|XOR [ P1, P2, RC4(V,K), RC4(V,K) ]
|RC4(V,K) and RC4(V,K) are two bit strings that are  
          the same. XOR(0,0) = 0 and XOR(1,1) = 0 ==&gt; RC4(V,K) + RC4(V,K) =  
          000...0 = 0, and thus we can leave this away
|-
|
|XOR ( P1, P2 )
|} 
</blockquote> 
 
Example (slightly modified from example from iDEFENSE Inc.):
Example (slightly modified from example from iDEFENSE Inc.):
<blockquote>                 
{| border="1"
{| border="1"
|-
|-
Line 1,024: Line 541:
| XOR - &quot;a&quot; &amp; &quot;b&quot;
| XOR - &quot;a&quot; &amp; &quot;b&quot;
| '''''00000011'''''
| '''''00000011'''''
|}</blockquote>
|}


Therefore, when using the same secret key (just trying, it's only 128 bits  
Therefore, when using the same secret key (just trying, it's only 128 bits long), the XOR'ed value of the plaintext messages (&quot;a&quot; and &quot;b&quot;) is equivalent to the XOR'ed value of the encrypted messages. Thus, if an attacker has knowledge of the contents of one plain-text message when an IV collision occurs, the attacker could then decipher the contents of the other plain-text message without any knowledge of the key stream used for encryption.
long), the XOR'ed value of the plaintext messages (&quot;a&quot; and &quot;b&quot;)  
is equivalent to the XOR'ed value of the encrypted messages. Thus, if an attacker  
has knowledge of the contents of one plain-text message when an IV collision  
occurs, the attacker could then decipher the contents of the other plain-text  
message without any knowledge of the key stream used for encryption.


===== 6.3. Modern Security Technologies =====
===6.3. Modern Security Technologies===
Since Wireless Equivalent Privacy (WEP) is very insecure, both the IEEE and individual manufacturers try to develop newer and more secure technologies for encrypting data. Here are a few of the new ones:
Since Wireless Equivalent Privacy (WEP) is very insecure, both the IEEE and  
{|class="wikitable"
individual manufacturers try to develop newer and more secure technologies  
!WiFi Protected Access (WPA)
for encrypting data. Here are a few of the new ones:
|The WiFi Alliance put together WPA as a data encryption method for IEEE 802.11 wireless LANs. WPA is an industry-supported version of 802.11i utilizing the Temporal Key Integrity Protocol (TKIP, the successor of WEP), which fixes the problems of WEP, including using dynamic keys.
 
WPA will serve until the 802.11i standard is ratified early 2004.
<blockquote>             
{| border="1"
|-
|-
|WiFi Protected Access (WPA)
!Extensible Authentication Protocol (EAP)
|The WiFi Alliance put together WPA as a data encryption
|EAP is an 802.1x standard that allows developers to pass security authentication data between a RADIUS (some dial-in server) and the access point and wireless clients. EAP has a number of variants, most of them are proprietary technologies:
        method for IEEE 802.11 wireless LANs. WPA is an industry-supported version
EAP MD5, EAP-TTLS (EAP-Tunneled TLS), LEAP (LightWeight EAP) and PEAP (Protected EAP).  
        of 802.11i utilizing the Temporal Key Integrity Protocol (TKIP, the successor
        of WEP), which fixes the problems of WEP, including using dynamic keys.
        WPA will serve until the 802.11i standard is ratified early 2004.
|-
|-
|Extensible Authentication Protocol (EAP)
!Cisco LEAP
|EAP is an 802.1x standard that allows developers to pass security authentication
|Or EAP Cisco Wireless is an 802.1x authentication type that uses a log-on password as the shared secret. When a wireless access point communicates with a Cisco LEAP-enabled RADIUS server, Cisco LEAP provides access control through mutual authentication between client devices and the wireless network, and provides dynamic, per-user WEP keys to help protect the privacy of transmitted data. The Cisco 350 OS/2 drivers, which was referred to earlier, is planned to support LEAP. Documents are available under IBM Business Contracts to enable LEAP with the Cisco 340 driver.
        data between a RADIUS (some dial-in server) and the access point and wireless
|}
        clients. EAP has a number of variants, most of them are proprietary technologies:
 
        EAP MD5, EAP-TTLS (EAP-Tunneled TLS), LEAP (LightWeight EAP) and PEAP
===6.4. Where does this leave us with OS/2?===
        (Protected EAP).
For now, WEP is available using all current OS/2 device drivers. As said, the LEAP security protocol is not officially supported by IBM's business device drivers. But documentation to get LEAP running with the CISCO 340 driver is available if you've got IBM business contract for the driver.
|-
 
|Cisco LEAP
==7. And what about Linux? ==
|Or EAP Cisco Wireless is an 802.1x authentication type that uses a log-on  
All devices that[[Image:icon-penguin.jpg|right]] currently work under OS/2 will most likely also work on the Linux platform and vice versa. For the Orinoco chip, two drivers are in wide use. The older wlan_cs driver, and the newer driver orinoco_cs. For the CISCO products, there
        password as the shared secret. When a wireless access point communicates  
is also an Open Source driver available for the AiroNet product series (although you need to specify the WEP keys every bloody time you boot). About PRISM, Linux has fewer drivers than OS/2 for the moment. The only driver that is really usable is a driver for Intersil PRISM2 (there are also other drivers, but they are either unstable, or written for specific devices). [[http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/]] will provide you with all possible answers to your questions. OS/2 CHL is currently putting intense effort in an article identical to this, but which applies to the GNU Linux platform. This article will be included in the OS/2 Hardware Infosheet as is referred to in the links below.
        with a Cisco LEAP-enabled RADIUS server, Cisco LEAP provides access control  
 
        through mutual authentication between client devices and the wireless  
==8. Conclusion.==
        network, and provides dynamic, per-user WEP keys to help protect the privacy  
If you have already hated these wires for so long, I'd definitely go for it. IEEE 802.11b cards that work with OS/2 are not that expensive; also, they are an alternative for wired NICs, for which manufacturers tend to develop less and less NDIS 2.01 drivers, the drivers we need for the OS/2 Community.
        of transmitted data. The Cisco 350 OS/2 drivers, which was referred to  
For business ends, I would say: Go for something else. IEEE 802.11b is not as fast as regular 10/100Mbps network adapters, and certainly is inferior to the speeds offered by Gigabit Networks. WEP is not a really good answer to security issues, and it doesn't seem that effective security solutions will be available in the future. With an eye on the very near future, you'll also be able to use your existing WiFi card for hot spots, a bright new, and interesting technology that could mean TRUE mobility.
        earlier, is planned to support LEAP. Documents are available under IBM  
 
        Business Contracts to enable LEAP with the Cisco 340 driver.
OS/2 has now drivers for the most popular chipsets in use today for IEEE 802.11b devices, and development continues (maybe there will be an Atmel driver soon).  
|}</blockquote>
===== 6.4. Where does this leave us with OS/2? =====
For now, WEP is available using all current OS/2 device drivers. As said,  
the LEAP security protocol is not officially supported by IBM's business device  
drivers. But documentation to get LEAP running with the CISCO 340 driver is  
available if you've got IBM business contract for the driver.


All in all, I would target WiFi cards not for business networked connectivity, but for DSL or cable connections and perhaps for small home networking.
==== 7. And what about Linux? ====
All devices that[[Image:icon-penguin.jpg]]
currently work under OS/2 will most likely also work on the Linux platform
and vice versa. For the Orinoco chip, two drivers are in wide use. The older
wlan_cs driver, and the newer driver orinoco_cs. For the CISCO products, there
is also an Open Source driver available for the AiroNet product series (although
you need t specify the WEP keys every bloody time you boot). About PRISM,  
Linux has fewer drivers than OS/2 for the moment. The only driver that is
really usable is a driver for Intersil PRISM2 (there are also other drivers,
but they are either unstable, or written for specific devices). [[http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/]]
will provide you with all possible answers to your questions. OS/2 CHL is
currently putting intense effort in an article identical to this, but which
applies to the GNU Linux platform. This article will be included in the OS/2
Hardware Infosheet as is referred to in the links below.


==9. References.==
==== 8. Conclusion. ====
If you have already hated these wires for so long, I'd definitely go for
it. IEEE 802.11b cards that work with OS/2 are not that expensive; also, they
are an alternative for wired NICs, for which manufacturers tend to develop
less and less NDIS 2.01 drivers, the drivers we need for the OS/2 Community.
For business ends, I would say: Go for something else. IEEE 802.11b is not
as fast as regular 10/100Mbps network adapters, and certainly is inferior
to the speeds offered by Gigabit Networks. WEP is not a really good answer
to security issues, and it doesn't seem that effective security solutions
will be available in the future. With an eye on the very near future, you'll
also be able to use your existing WiFi card for hot spots, a bright new, and
interesting technology that could mean TRUE mobility. <br>
OS/2 has now drivers for the most popular chipsets in use today for IEEE 802.11b
devices, and development continues (maybe there will be an Atmel driver soon).
<br>
All in all, I would target WiFi cards not for business networked connectivity,
but for DSL or cable connections and perhaps for small home networking.


==10. Acknowledgements.==
==== 9 . References. ====
Please note: IBM (International Business Machine Corp.) is a very large world-wide company. Due to its largeness, a very diverse set of announcements are officially made, but unfortunately, from time to time, a lot of rumors are also passing in the world.  
 
I tried my very best to be as accurate and precise as possible, though mistakes can never be overcome. If, despite of all efforts that have been done with the help of IBM Germany, incorrect statements about IBM should occur, then I do apologize for these inconveniences, and I'll try to correct mistakes as much as possible. It is my intention to provide correct information.
==== 10 . Acknowledgements. ====
Please note: IBM  
(International Business Machine Corp.) is a very large world-wide company. Due  
to its largeness, a very diverse set of announcements are officially made, but  
unfortunately, from time to time, a lot of rumors are also passing in the world.  
I tried my very best to be as accurate and precise as possible, though mistakes  
can never be overcome. If, despite of all efforts that have been done with the  
help of IBM Germany, incorrect statements about IBM should occur, then I do  
apologize for these inconveniences, and I'll try to correct mistakes as much  
as possible. It is my intention to provide correct information.<br> <br>
I'd really like to thank some people for their continuous efforts for OS/2 Warp,
and for helping me either with my OS/2 CHL project, or in assistance of writing
hardware articles for the OS/2 Warp product family:


<blockquote>
I'd really like to thank some people for their continuous efforts for OS/2 Warp, and for helping me either with my OS/2 CHL project, or in assistance of writing hardware articles for the OS/2 Warp product family:
* Especially         [[Jens Glathe]], for his continues effort to support WiFi under OS/2, and        for device driver in-depth details;
* Especially [[Jens Glathe]], for his continues effort to support WiFi under OS/2, and        for device driver in-depth details;
* [[Oliver Mark]],         IBM Germany, for his continuous effort to support OS/2 and the OS/2 Compatible         Hardware List;
* [[Oliver Mark]], IBM Germany, for his continuous effort to support OS/2 and the OS/2 Compatible Hardware List;
* All members         of the OS/2 Warp User Group Belgium, for helping me testing all of those        WiFi cards, and for their continuous efforts to support OS/2 and eCS;
* All members of the OS/2 Warp User Group Belgium, for helping me testing all of those        WiFi cards, and for their continuous efforts to support OS/2 and eCS;
* [[Perry Werneck]], [[Kevin P. Walter]], [[Johan Driesmans]], [[Roderick Klein]], [[Stuart Grey]] for beta testing;
* [[Perry Werneck]], Kevin P. Walter, Johan Driesmans, [[Roderick Klein]], Stuart Grey for beta testing;
* All OS/2 CHL hardware testing team member for their continues effort and drivenness to pursuade with os2warp.be.
* All OS/2 CHL hardware testing team member for their continues effort and drivenness to pursuade with os2warp.be.
</blockquote>
 
[[Category:Hardware Reviews]]

Revision as of 05:25, 6 June 2017

By Jonas Buys

4. Drivers for setting up a wireless device.

What are the system requirements? Warp3 or higher, eCS, or WSoD and the appropriate device drivers.

First of all, you need a PCMCIA slot, mostly PC CARD type II. This can be either a regular PC Card slot in a notebook, or it can also be a PCI-to-PCMCIA adapter using the PLX driver (included in Generic PRISM device driver).

Please do NOT bombard me with e-mails asking for these drivers; I won't give them. I got them for testing purposes only, and I promised both IBM and the developer that I wouldn't distribute them. Please wait until they become available via SoftWare Choice (which should be really soon now), or get an IBM business contract. Also, please don't bother IBM with questions regarding the drivers in development that are not available to the public yet.

4.1. Orinoco compatibles

The Orinoco (also referred to as WaveLAN) by Lucent/Agere is kind of a debugged and enhanced PRISM chipset. It offers data transfer rates up to 11Mbps. Orinoco-equipped WLAN cards are considerably more expensive then PRISM ones. Compared to the original PRISM2 chipset, Orinoco performs better (though not better than PRISM3) because of ameliorated firmware.

4.1.1. Artem, BinTec, Jakarta

The Artem ComCards are - at present - the only wireless cards that come with OS/2 support out-of the box. BinTec and Jakarta Blue cards are OEM variants of the Artem card. They all work with the same driver, the ComCard NDIS 2.01 Treiber (latest version is 1.5), which can be downloaded from the our WiFi drivers download page. This driver is also included in eComStation 1.1 (although not the latest version). Note that the driver available for download from the Artem web site is not the latest version. The driver comes in a static ZIP-file, which you need to unzip the files of to x:\IBMCOM\MACS, where x: is the drive on which OS/2 is installed. Artem regularly provides updates and bug fixes. There is a also very good article available about how to install these drivers on eCS and OS/2. Mensys distributes all of these cards actively in Europe, and Artem sells directly to individuals in the Americas. OS/2 CHL hardware testing team has tested some of these devices, and they offer very reasonable performance for reasonable pricing. BinTek also hosts a driver for their cards, but that is just the same driver as that of Artem. All Artem cards support 64-bit and 128-bit encryption. Artem driver revisions 1.5 and higher are designed to work with the nice IBM WiFiState utility.

Artem is currently assessing the market to investigate if OS/2 users would be interested in IEEE 802.11g. Thus, it is likely that the company will release drivers for these products too, sooner or later. More about this later...

4.1.2. IBM High Rate Wireless PC Card 128

Some other very professional device is the IBM High Rate Wireless PC Card 128. Just as CISCO, IBM can go along the ride with superior performance, combined with extremely high pricing. The driver is specifically for this card, and cannot be used with other Orinoco cards. The driver was in internal IBM beta testing for some months, but now it has finally been made general availability via IBM Device Driver Pak Online (need valid and active SoftWare Choice or PassPort Advantage subscription). It is also available via eComStation download site, if you have a login to access the downloads section. The self-extracting file ibmwifi2.exe contains a DDP file, a good readme, and all things that can be desirable. Surely, just as is the case with the CISCO driver, this driver was meant to be for business needs. It is also equipped with the WiFiStat.exe utility, discussed in a later section. On the global IBM web site, OS/2 support is stated: "IBM is offering OS/2 device drivers and support for these OS/2 drivers for the IBM PCMCIA Wireless LAN cards on a fee basis. For more information please contact emeawarp@de.ibm.com." This means, the driver is also available via IBM business contracts in case you wouldn't dispose of a SWC or PPA subscription.

The IBM High Rate driver performs better than every average WiFi card, but compared to the CISCO 340 Series physical performance, it gets the worst of it.

4.1.3. Others

There's also a modified version of the Artem driver, which does truly allow other devices to work with this driver by specifying the manufacturer and device IDs. In fact, it is one of the older versions of the Artem driver. Current Artem drivers don't have this feature and thus are for Artem, BinTec and Jakarta Blue devices only. As already said, these IDs are used by the device driver to search for and locate the wireless device(s). In fact, this driver is unattainable for the public, but somewhere on the World Wide Web, it is traveling, and offering extreme good support for a great deal of Orinoco-branded cards.

As of the Release Candidate 1 release of the IBM Generic PRISM device driver, support for Orinoco chipsets was added to this driver. Please refer to the section about the Generic PRISM device driver for more information.

4.2. PRISM2/2.5/3 compatibles

Just like the Orinoco chipset, PRISM2, PRISM2.5 and PRISM3 chipsets offer a maximum data transfer rate of 11Mbps. The older PRISM1 chipset only supports a maximum of 2Mbps. PRISM3 has the best performance, and can be compared to Orinoco chipset performance. Most WLAN devices are using a PRISM solution, and PRISM chipsets are normally rather cheap WLAN cards.

4.2.1. IBM miniPCI

This driver has been finished, and also internal IBM beta testing is completed. The driver has become available via SWC download. IBM miniPCI cards are used in many newer ThinkPads, like the IBM T30, and some other T2x models. The self-extracting driver ibmprism.exe has served as a basis for the NetGear, LinkSys, PLX9052, and Generic PRISMx driver. Some PCI-devices of other brands can also work with this driver. E.g. CompuShack SWN-103 PCI Wireless LAN Adapter, a PCI card with an external antenna, and equipped with a PRISM2.5 chipset. Just as the IBM High Rate PC Card 128, this driver is available via SoftWare Choice and PassPort Advantage subscriptions, and can be downloaded from IBM Device Driver Pak Online. Also available via eComStation download site. Please note that IBM ONLY supports this device with this particular driver! Other devices (in particular miniPCI solutions) WILL NOT WORK.

4.2.2. NetGear MA-401

The NetGear company's strategy is something like offering good average-performing devices for a reasonable price. I really like the way their support services handle non-Windows questions. They carefully say that they don't support the operating system referred to, but they try to help you as much as possible. Those guys really know the technical details of their products, like the manufacturer and device IDs! Very good, since the documentation that comes with the card is rather limited.

The card uses a PRISM2.5 chip, and has two variants: the MA401NA, which is available in North-America; and the MA401RA, for Asia and Europe. Due to the PRISM2.5 chip, the driver is identical to that for IBM miniPCI, but since the manufacturer and device IDs from NetGear and IBM are different, a specific driver for this WLAN NIC has been written. You can also get this device going using the Generic PRISMx driver.

The MA-401 card performs well for short distances. Even very thick walls don't really diminish its performance. Unfortunately, for large distances, the signals aren't strong enough; I only got the card's waves to one of my neighbors, and not to the next street. But, if you want a good card for wireless home networking, go for this one! The driver is not available to the public yet.

This card is also supported by the newer RC1 release of the official IBM Generic PRISM device driver.

4.2.3. LinkSys Instant Wireless WPC-11 v3

LinkSys has always been a very reliable brand for network products (that's part of the reasons why CISCO recently bought LinkSys). With its Instant Wireless WPC-11 card, LinkSys offers a great product for a reasonable price (€ 80.00 incl. VAT). Just as a lot of manufacturers, this card comes in several versions. The third version, equipped with a Prism3 chipset, has a special driver, which is just a modification of the Prism2/2.5/3 driver (and again, it also works with the Generic PRISMx driver). Version 2.5 comes with a Prism 2.5 chipset, but I didn't test this card (though I really don't forsee any problems when you use the PRISM2/2.5/3 driver, using the correct IDs). Taken a look at the card's performance, I was astonished by the good results: the cards actually supports a distance of 450 meters outside @ a data transfer rate of 1.2 Mbps. Even CISCO couldn't give these results.

Unfortunately, LinkSys's support services are awful. I had asked them for device and manufacturer ID, and also the chipset they used in the product, and they simply refused to give "this kind of information"! Documentation is awfully limited, thus, if you're new to WiFi, don't go for this card!

Also, this driver is not available to the public yet. This card is also supported by the newer RC1 release of the official IBM Generic PRISM device driver.

4.2.4. Others

Another modification of the IBM miniPCI driver is a Generic PRISMx driver. Theoretically, the driver was written for PRISM2.5; but because of some backwards compatibility aspect of the chipset's design, it should also work with other PRISM chipsets, if they are Intersil-branded, thus using Intersil firmware.

PC Cards using the PRISM2, PRISM2.5 and PRISM3 chipsets should be supported. The Generic PRISM driver is currently in Release Candidate phase, and is intended to appear on DDP OnLine via valid and active SWC or PPA subscription.

4.3. CISCO 340 and 350 Series

CISCO 340 and 350 products use an AiroNet chipset, which is actually again a greatly enhanced PRISM chipset.

Cisco has always been a leading networking company because of its high quality products. Unfortunately, this also reflects in the company's price strategy :( Now, both the CISCO 340 and 350 PC Cards perform excellent. Without a doubt, I dare say that these cards are the best of all the ones I tested. The 340 Series are End Of Life (EOL), but the 350 Series are available now as a replacement, offering the very same functionality.

Installation of the drivers is a breeze. The driver comes in a ZIP-file, that is not self-extracting. An excellent FAQ is included in the readme. It's noticeable that IBM is targeting this product for use under business contracts only, since everything is so smooth... Just copy the drivers in your x:\IBMCOM\MACS directory

(where x: is the driver letter from the drive on which OS/2 has been installed), open MPTS,

and add the card. In my case, I didn't even have to change settings to get the card running! Mark Dodel has written an excellent report about this card for eCS. There seems to be some misunderstanding in the OS/2 community about this driver. This driver ONLY supports PCMCIA cards, thus PCI and ISA variants of the same series won't work under OS/2. Perhaps you can get them to work by the PLX 9052 driver, although the PLX driver offers only support for PRISM.

Just as is the case with the other cards, there are different variants available of this card. Of each version, there are European and American edition available, since, as was already mentioned earlier, power consumption differs on both continents. For the CISCO 340 PCMCIA card, three variants have been released: first, there is the AIR-PCM340, which doesn't support WEP. The AIR-PCM341 supports 40 bit WEP encryption, while the latest version, AIR-PCM342 supports up to 128 bit encryption. Setting up WEP protection is really straightforward with this driver; more details about this will be given in the next section. Perhaps you would expect support for LEAP, CISCO's proprietary standard for security. Unfortunately, this is not supported, nor are the other security technologies from CISCO for WLAN networking.

Though I managed to get the AIR-PCM350 running with the 340 driver, IBM does not officially support this. IBM has just started the development of another business-only device driver especially for the CISCO 350 PC Card, which will also officially support the CISCO 340 PCMCIA series and that will incorporate LEAP support in the driver package. Development of this driver should be straightforward, since the 350 is a very close follow-on to the 340, since you can even flash a 340 to make it a 350 card. The new 350 driver should also support the miniPCI version of the 350 Series, including bus mastering.

The old IBM driver is unfortunately not stable, testing made it trap after a few seconds of full traffic load. The support for encryption is only for 40 bits (WEP-64), only one key. With the new 350 Beta driver, there is better throughput than any PRISM-based card. This comes due to a different buffer allocation scheme in the driver.

4.4. PLX PCI boards

The only weak spot in hardware support for OS/2 is PCMCIA or PC Card Socket Services (However, with APSoft's OS/2 Socket Services, that problem can be solved quickly). Some very handy solution are PCI-to-PCMCIA adapter devices. These cards enable you to use virtually any WiFi PC Card on regular computer. In their specifications, most manufacturers claim

that only one or two

specific cards work with the board, but that's just commercial nonsense. Fact is that most of the time, these slots will only work with a particular chipset. Currently supported chipset is the PLX PCI9052 chip, that can co-operate with PRISM2.5 compatibles. In general, if you use a WLAN card with the very same chipset and same voltage, you should be able to use any similar device in the brackets.

For similar devices using a PLX 9052 chipset, a driver is available. It was written especially for the AmbiCOM WL1100b-PCI card, and has been enhanced and merged into the official IBM Generic PRISM device driver. Also, the NetGear MA-301 PCI-slot-Adapter was found to be compatible with this driver, using almost any PRISM2.5 card. Also Belkin WL11000P and LinkSys Instant Wireless Adapter WDT11 PC are supported. The driver is still in very early development phase, and device IDs are still being added to it.

This driver should also work with wireless PCI cards, that also use the required chipsets (like 3COM 3CRWE777A PCI WLAN card).

One VERY IMPORTANT note: do not remove the WiFi card out of the slot before you've turned off the power, either by powering your computer off, either by using the drivers. Ignoring this warning will cause damage to your PLX board and WiFi PC Card. The older beta device driver is still available via login and password on this web site, but we recommend the use of the newer updated IBM Generic PRISM device driver (RC1 version or above). Huge difference is that using the Generic PRISM RC driver, you will be able to use Orinoco and AiroNet PCMCIA cards in conjunction with a PLX card too!

4.5. Wireless Access Points

Wireless devices, such as laptops or PDAs, connect to a wired LAN via a Wireless Access Point, which is a hardware device or computer software which acts as a communications hub (server). Access Points provide heightened wireless security and extend the physical range of a wireless LAN.

Using a Wireless Access Point, you can establish several WiFi connections with one single device. Mostly, such devices come with an Ethernet port, which you simply connect to the server. Devices like the Linksys WAP11 Version 2.2, 3COM AP2000, CISCO AIR-AP1120b, HP WL-520, TrendNet TEW-310APB, ZyXEL ZyAir B-1000, Artem access points, etc. work with a flexible web-browser based setup and configuration utility. These devices are compatible with OS/2 Warp (for e-Business) and eCS, and have been tested by the OS/2 CHL. Other come only with software, and thus aren't suitable for use with OS/2, nor Linux. Also, there are Eicon DSL-routers that also allow this kind of configuration. Normally, these devices should act as a DHCP server. Just plug them into your Ethernet port, configure the port to be a DHCP client, and reboot.

One tip I'd like to give: if you want to use these devices, make sure your computer has a very recent build of Mozilla installed, and also Java 1.3.1 or higher. Since M$ Internet Exploder is considered to be standard, older builds won't be able to display everything.

Some other good alternative, and then especially for businesses is to use a Wireless Access Point for IEEE 802.11g on the server. OS/2 nodes could use the b-standard, and other Windows nodes could use the g-standard.

4.6. Intel Centrino Mobile Technology

With the recent introduction of Intel's Centrino specifications for the latest notebooks, comes a special miniPCI wireless adapter as feature of that specific technology.

This miniPCI device is the Intel PRO/Wireless 2100 v 3b device. Unfortunately, as of writing, this device is not supported by any of the OS/2 device drivers already available for OS/2. There is a beta device driver available for selected Linux distributions, but it is still very buggy and only works on selected distributions.

More information about the Intel Centrino technology and OS/2 is to be found in the NoteBook/2 part of this website.

5. Setting up a wireless network

5.1. What to keep in mind...

5.1.1. Ad hoc versus infrastructure modes

Most WLANs deployed by organizations operate in a mode called "infrastructure". In this mode, all wireless clients connect through an access point (such as LinkSys WAP11 v2.2) for all communications. You can, however, deploy WLAN technology in an easier way that forms an independent peer-to-peer network, which is more commonly called an ad hoc WLAN. In an ad hoc WLAN, laptop or desktop computers that are equipped with compatible WLAN adapters and are within range of one another can share files DIRECTLY, without the use of an access point (compare this to the similar technology USB On-The-GO, which uses a similar approach). Thus deploying this strategy, you can use a direct connection between your clients. The range varies, depending on the type of WLAN system. Laptop and desktop computers equipped with 802.11b or 802.11g WLAN cards can create ad hoc networks if they are within at least 500 feet of one another. Computers in a specific ad hoc wireless LAN must be configured to the same radio channel to communicate with one another. More than one ad hoc networks can exist in the same space if it is configured to operate on a different channel. There are a varying number of channels depending on the part of the world you are operating in. Europe has 13 channels, the US 11 and Japan 14.

The security impact of ad hoc WLANs is significant. Many wireless cards, including some shipped as a default item by PC manufacturers, support ad hoc mode. When adapters use ad hoc mode, any hacker with an adapter configured for ad hoc mode and using the same settings as the other adapters may gain unauthorized access to clients.

Ad hoc is a rather cheap solution, because each client needs a wireless NIC that is already available for less than € 80.00 incl. VAT, which sometimes comes built-in with new notebooks. For a regular workstation, a PCI-carrier (with the PLX PCI9052 chipset) can be used. This PCI-to-PCMCIA slot is very handy, the cards can be taken out of the slot at any time you need a WiFi card for your notebook. A pure P2P solution is - of course - only suited for a limited number of nodes/clients.

Deploying the infrastructure mode, an AP takes care of all wireless network traffic. The client in your network can communicate to one another via this AP (see it as the server in a client-server network environment). Of course, you can also connect an AP "wired" to your existing wired network. The exact location of your AP can have an implicit impact on the strength of signals, and thus also the bandwidth and range of your WLAN, but using the WiFi Status monitoring utility, you will soon find out the details. Practice has already proven a high-placed AP with the antennas directed to the wireless receivers to deliver the highest signal strength. It's also better to keep the AP as far away as possible from large (metal) obstacles or electrical sources that can cause interference. Also, the same conditions for regular PCMCIA cards are appropriate here. Important remark, however! The AP's range is very limited in performance. The signal weakens visibly once distances between AP and receiver is larger than approximately 30 meters. So far, no solution yet but to use several APs simultaneously to bridge over these limitations. Nevertheless, using a WAP, the range of wireless connectivity can be greatly expanded. This is because the WAP serves as a central point for routing of all wireless network traffic between the wireless nodes in the network.

Each AP spreads its own zone, but just as is the case with mobile phone antennas, these zones can overlap each other without any problem. This way, you can walk from one zone into another, without cutting off the connection (this is called roaming). The APs themselves can preferably be interconnected using classic wires and, of course, you should configure WLAN properly.

The WAP can be configured to use encryption or grant access to computers with a specific MAC address. Wireless equipped computers networked together in infrastructure mode form a group called Basic Service Set (BSS). The BSS term is comprised of a WAP and all the LAN PCs that are associated with it. Up to 64 individual computers can exist at a single time in a BBS. This is due to the ability of the WAP to handle no more than 64 clients. The diagram below illustrates how the access point will effectively double the distance between wireless equipped computers in a BBS.

Something else you should remember is that the total available WLAN bandwidth is divided between the devices that are connected in the network. P.e., suppose you have a server running with a PLX card, and you've got three other computers connected. You've got no WAP, and all three computers request data at the same time from the server. The server will probably use the entire throughput of 11Mbps, but it will divide the data to serve all clients on an equal basis. Thus, the clients each have less than 11 / 3Mbps throughput. This very same restriction applies also to WAPs.

A term that also applies in the BSS (Infrastructure) operating mode is ESS (Extended Service Set). This is a technology in which more BSS'es can form a single subnetwork. Therefore, ESS is especially interesting for roaming. These services can only be deployed if the Wireless Access Point is configured correctly for that.

Adhoc (IBSS) versus Infrastructure mode (BSS)
Point-to-point Client-Server (AP)
No AP required AP must be present
Channels must mach Client finds channel
Limited reliability Rather good reliability

5.1.2. EMI - ElectroMagnetic Interference

Channel Frequency (GHz)
1 2412
2 2417
3 2422
4 2427
5 2432
6 2437
7 2442
8 2447
9 2452
10 2457
11 2462
12 2467
13 2472
14 2477

There is often a great concern about electromagnetic radiation. Europe, in particular, is extremely conscious of the unknown health consequences of electromagnetic "smog". In the US, we hear periodic claims of handsets causing brain cancer. Whatever the evidence, the topology of multi-hop networks needs less power, as the signals go only a short distance.

One can assume that lower power means lower health risk.

Microwave ovens and many cordless phones operate in the 2.4 GHz spectrum, the same radio spectrum used by 802.11b Wi-Fi wireless networks. That means they can cause interference (can disturb each other's signals, waves), but in most instances this will just slow down the Wi-Fi connection; it won't stop transmission or break the connection.

To reduce interference, you can move a 2.4 GHz cordless phone away from your Wi-Fi equipped computer or base station. Interference usually only happens with older microwave ovens. You can also try changing the channel on which your Wi-Fi network operates. In addition, some manufacturers have developed and implemented special technologies that can minimize interference from cordless phones and ovens.

Which brings up the next thing to mention: channels. A channel is a frequency range within the IEEE 802.11 spectrum over which transmission may occur.

How can we understand channels of IEEE 802.11b? They are part of the spread spectrum technology, and each channel is a range of frequencies 22MHz wide, and different channels always overlap a bit. This is how [UnixWiz.net] explains it: "When picking a channel, first see what your 'neighbors' are using, thus you pick up a channel that overlaps the least with them."

We already said that a particular wireless network needs to share one same channel. But what exactly are these channels? Channels specify the band at which WiFi works more specifically, thus it is more accurate than 2.4GHz. A channel is a decimal number between one and 11 (13 in Europe) and designates the frequency on which the network will operate. Channel 1 equals a frequency of 2.412GHz, channel 2 2.417 and so on with steps of five until 2.462GHz for channel 11. Not all WiFi cards support the 12th and 13th channels, but if your devices does; the frequency of those channels are analogous.

Should you have troubles from EMI, the solution is to specify another channel. Conclusion: electromagnetic interference: no big issue.

5.2. WiFi Status monitoring utility

This article only introduces this powerful IBM utility briefly, but this page gives more details and examples.

5.2.1. Introduction

The WiFiStat.exe monitoring utility really is a great utility provided by IBM. It works with all the WLAN WiFi drivers described above except the CISCO 340 driver, and it allows you to change NIC setting on the fly (you do need version 1.5 or higher of Artem's driver). Remember, all settings can be changed using the NIF file via MPTS, but then you are obliged to reboot. WiFiStat removes this obligation. In fact, the only thing you need to do in MPTS is add the driver and attach a protocol to it.

Also, very nice feature, you can specify up to four different Profiles, so that you can select the appropriate profile in a particular situation.

The main window is very easy and straightforward; its title bar states its name and also the currently activated profile.

The are two fields that always appear; the Status: field, which will tell you whether you are still searching a WLAN or whether you're already connected to one. And then, there's the SSID: field. SSID is the abbreviation of Service Set Identifier. It's a name (a sequence of characters) for the wireless network and it's sometimes simply called Network Name. In infrastructure mode, the SSID should be set to the same value as the WAP; in ad hoc mode, the SSID on ALL notebook (or for PC using PLX board) network cards in the network must be set to the same value. In the example above, my ad hoc network was called Wireless. As you can see, you can hide this field by right-clicking anywhere in the main window, and selecting Hide SSID. Analogous, you can re-enable SSID by selecting Show SSID.

Very handy is the green indicator showing you the quality of your connection. The rectangle will be 100% filled when your connection is the full 11Mbps, the maximum. If the speeds are lower, then you will see this in this rectangle. If you haven't got connection yet, but are searching for the presence of a WLAN (and notice a WLAN announces his presence, which causes security issues!), the Status: field will state Connected to IBSS, and sometimes it is changed by Searching for WLAN. The rectangle at the right is not green, you can hardly see a small white vertical line.

The options Radio On and Radio Off in the main windows' pop-up menu respectively will enable and disable your WiFi card's working. This is a handy feature, since you needn't even remove the card when entering an airplane or a hospital (where the WLAN waves could interfere with the infrastructure).

As already pointed to above, you can specify several profiles. This means you can specify for example two profiles, one for a connection in a WLAN with a WAP, and another for an ad hoc connection. Instead of having to change this using MPTS an then rebooting, in order to activate that kind of WLAN connection, just right-click the main window, select Select Profile from the pop-up, and in the submenu, choose the profile you wish. I have called my profile Profile1, but of course, you can assign it any name you want (for the scenario just described, you could name the ad hoc connection AdHoc and the infrastructure mode connection InfrWAP, and that name will appear in the Select Profile's submenu. By selecting a profile, this profile will immediately become active, but first your current connection (if it exists) will be broken. Then, using the new setting, OS/2 will try to establish a new WLAN connection.

Also interesting is that this utility (though copyright from IBM) also works with the Artem WLAN cards, if you have driver revision 1.5 or above. The WiFiStat utility is only provided with miniPCI and High Rate 128 solutions.

5.2.2. How to specify profiles...

As already said, you can specify up to four profiles for a WLAN device. In this section we'll discuss how you can specify them. To specify a new profile(, or to change: then simple change the values already listed), proceed as follows: right-click the main windows, select Add/Edit Profile from the pop-up menu, which will cause this window at the left to appear. If you change your mind, you can leave this window at any time by clicking the Cancel button. Select the profile you want to edit or a new one from scratch by selecting a radio button. By selecting a radio button next to an empty field, you will create a new profile. Before clicking the Profile Settings button, click in the empty field, and type the name of the profile. This name will later appear the the pop-up menu of the main window. After you have specified or changed the name, click the Profile Settings button. A new window will now appear, with name Settings for 'PROFILEX', with PROFILEX the name you just assigned to the profile. You will note immediately that not all the setting available via MPTS are available, but only the most frequent settings are there. In the drop-down box at the right of Operating Mode of the Card you can specify whether you are going to connect to an ad hoc WLAN network or BBS (Base Service Set, thus a WLAN using infrastructure mode) WLAN. Below, you are going to specify the network name that shall be used by the devices to identify the network in which the nodes belong. Just click in the field at the right and type the name you wish. Note the remarks about SSID in section 5.2.1! Below, there's a check-box Create a Network if none found. I have experienced it's best only to enable this with one NIC in an ad hoc network, and not to select it when using a WAP. Next, there's a drop-down box for Encryption. For "secure" data transmissions most WLAN NICs are capable of encryption, scrambling the information that is sent over the air between computers. The WAP uses a form of encryption called WEP (Wired Equivalent Privacy). There are two levels (the latest WiFi cards make three of that by adding 256bit) of WEP encryption, 64-bit and 128-bit. As the numbers imply, 128-bit encryption is more secure than 64-bit encryption. However, using 128-bit encryption uses keys to scramble and unscramble the data that is being sent between the wireless equipped computers. The wireless network must use the same key to be able to communicate using encryption. Note that WEP is an effective security alternative, but if your card supports it, you should use it. To enable security, select one of the options (WEP64, WEP128) from the drop-down box. Be sure your card does support encryption!
In the last four text boxes, you can specify the WEP keys that will serve as a kind of password for data to pass from one node to another, since both the nodes (and in general ALL nodes in the same network) need to have the same WEP keys. You can enter 32 characters per text box. Though you can specify four encryption keys, only one can be active at a time. To make OS/2 use a particular key, specify the number of the key in the TX Key No field. If you do this, be sure that key is specified!
To finish the creation of your profile, in the Settings for Profile 'PROFILEX', click the OK button. To dismiss the changes, press the Cancel button. Then you'll return to the Select a Profile dialog box. Click OK. Now you can immediately start using your profile by right-clicking in the main window, selecting Select Profile from the pup-op, and then choosing the profile you just created.
IMPORTANT! Always, always, always try to get your wireless network going without encryption first.

5.3. xWireless LAN xCenter Widget

Many eComStation users have replaced the IBM WarpCenter by the eCenter, a slightly modified xCenter, part of XWorkPlace. The xCenter of XWorkPlace is a complete replacement of the old (sometimes buggy) WarpCenter. The image below shows a possible xCenter. Click the image to magnify it.

The xCenter provides several advantages over the WarpCenter, of which some are listed here:

  • Offers the same functionality of the WarpCenter, like CPU usage, shut down, search, lockup, task killer, desktop navigation menu, clock,... ;
  • Offers extra functionality like the system of the Windows Start Bar: open programs are displayed in the bar. Clicking them, makes the programs visible;
  • Network Throughput monitor;
  • APM battery indicator.

The extra functionality is achieved by embedding widgets at the places where you want it in the xCenter. This also implies more customizability than was previously the case with the WarpCenter (also called eComCenter*). The remaining part of this paragraph will deal about the Wireless Widget (wxWireless widget). For more information about the xCenter, its configuration and available widgets, we refer to one of the links in the Related Links area of the left navigation bar.

To install the wxWireless widget, download the wxWireless ZIP file from the os2warp.be Wireless Device Drivers downloads page, and unzip it in the \plugins\xcenter directory, located in the installation directory of XWorkPlace (for the eCenter included with eComStation 1.1, this folder is c:\ecs\system\ecenter\plugins\ecenter). Then, just right-click any free space of the xCenter, click Create new widget, and then select XWireless LAN Monitor. The Wireless Widget is added, and you're ready to configure it and use as a tool to facilitate your daily wireless networking.

The widget displays the strength of the signal, in a similar way as WiFiState, described in section Line Speeds. By pointing to the widget, you can see from the picture above, that the other information available from WiFiState is displayed.

  • Please note that eComCenter is not the same as eCenter. eComCenter equals the WarpCenter, eCenter equals xCenter.

For more information about the xWireless LAN Widget, please visit [1].

6. Security restrictions? What about encryption?

With the increased reliance on wireless local area networks, businesses are increasingly more concerned about network security. Network managers need to provide end-users with freedom and mobility without offering intruders access to the WLAN or the information sent and received on the wireless network.
With a WLAN, transmitted data is broadcast over the air using radio waves. This means that any WLAN client within an access point (AP) service area can receive data transmitted to or from the access point, since it is just a matter of "picking up" the waves at a certain frequency (2.4GHz, 5GHz) and "deciphering" them. Because radio waves travel through ceilings, floors, and walls, transmitted data may reach unintended recipients on different floors or even outside the building that houses the AP. With a WLAN, the boundary for the network has moved. Without stringent security measures in place, installing a WLAN can be the equivalent of putting Ethernet ports everywhere, including the parking lot.

Because of these security concerns, many network managers have been reluctant or unwilling to deploy WLANs, especially in light of the vulnerability of the Wired Equivalent Privacy (WEP) keys that are used to encrypt and decrypt transmitted data (even for this limited form a security, there are ways to break it). Several research papers and articles have highlighted the potential vulnerabilities of static WEP keys. In addition, hackers have ready access to tools for cracking WEP keys, such as AirSnort, which enables an attacker to passively monitor and analyze packets of data and then use this information to break the WEP key that encrypts the packets. Network managers need reassurance that WLANs can provide the same level of security, manageability, and scalability offered by wired LANs. WEP currently is available in all OS/2 WLAN drivers.

6.1. Traditional WLAN Security

For this section, I made use of CISCO's White Sheet about Security Issues related to WLANs.

As with other networks, security for WLANs focuses on access control and privacy. Robust WLAN access control prevents unauthorized users from communicating through APs, the WLAN endpoints on the Ethernet network that link WLAN clients to the network. Strong WLAN access control ensures that legitimate clients associate with trusted, rather than "rogue" APs. WLAN privacy ensures that only the intended audience understands the transmitted data. The privacy of transmitted WLAN data is protected only when that data is encrypted with a KEY that can be used only by the intended recipient of the data.

Traditional WLAN security includes the use of Service Set Identifiers (SSIDs), open or shared-key authentication, static WEP keys and optional Media Access Control (MAC) authentication. This combination offers a rudimentary level of access control and privacy, but each element can be compromised. Yes, indeed, all technical term, which will be discussed in the paragraphs below:

SSID is a common network name for the devices in a WLAN subsystem; it serves to logically segment that subsystem. An SSID prevents access by any client device that does not have the SSID. By default, however, an AP broadcasts its SSID in its beacon (a beacon frame are the frames that the AP sends every 20 milliseconds whenever it doesn't receive frames anymore). Even if broadcasting of the SSID is turned off, an intruder or hacker can detect the SSID through sniffing (sniffing means, "catching waves" and trying to decode them).

The 802.11 standard, a group of specifications for WLANs created by the Institute of Electrical and Electronics Engineers Incorporated (IEEE), supports two means of client authentication: open and shared-key authentication. Open authentication involves little more than supplying the correct SSID. With shared-key authentication, the AP sends the client device a challenge text packet that the client must then encrypt with the correct WEP key and return to the access point. If the client has the wrong key or no key, authentication will fail and the client will not be allowed to associate with the access point. Shared-key authentication is not considered secure, because a hacker who detects both the clear-text challenge and the same challenge encrypted with a WEP key can decipher the WEP key. Also, encryption is performed via the RC4 encoding algorithm, which is already well-known to expert-hackers.

With open authentication, even if a client can complete authentication and associate with an AP, the use of WEP prevents the client from sending data to and receiving data from the AP, unless the client has the correct WEP key.

Another type of key that is often used, but is not considered secure, is a "static" WEP key. A static WEP key is a key composed of either 40 or 128 bits that is statically defined by the network administrator on the AP and all clients that communicate with the AP. When static WEP keys are used, a network administrator must perform the time-consuming task of entering the same keys on every device in the WLAN.

If a device that uses static WEP keys is lost or stolen, the possessor of the stolen device can access the WLAN. An administrator won't be able to detect that an unauthorized user has infiltrated the WLAN, until and unless the theft is reported. The administrator must then change the WEP key on every device that uses the same static WEP key used by the missing device. In a large enterprise WLAN with hundreds or even thousands of users, this can be a daunting task. Worse still, if a static WEP key is deciphered through a tool like AirSnort, the administrator has no way of knowing that the key has been compromised by a hacker. So you can immediately see now why I've already discommended WLANs for business endings.

Some WLAN vendors support authentication based on the physical address, or MAC address, of the client Network Interface Card (NIC). An access point will allow association by a client only if that client's MAC address matches an address in an authentication table used by the access point. But MAC authentication is an inadequate security measure, because MAC addresses can be forged, or a NIC can be lost or stolen.

While traditional WLAN security that relies on SSIDs, open or shared-keys, static WEP keys or MAC authentication is better than no security at all, it is not sufficient for the enterprise organization. Only very small businesses, or those that do not entrust mission-critical data to their WLAN networks, can rely on these WLAN security types. All other enterprises and organizations must invest in a robust, enterprise-class WLAN security solution.

Although traditional WLAN security that relies on open or shared keys and static WEP keys is better than no security at all, it is not sufficient for the enterprise organization. Only very small businesses, or those that do not entrust mission-critical data to their WLAN networks, can rely on these WLAN security types. All other enterprises and organizations must invest in a robust, enterprise-class WLAN security solution.

Nowadays, more modern security measures are available. Newer technologies like IPSec, EAP/802.1x, EAP/TLS, PEAP et cetera. Surely, they will be better then WEP, but they are more software-based security solutions, thus mostly Windows-only, and thus not available on the OS/2 Warp platform.

6.2. Why WEP Is Insecure...

This section was taught at the WarpWeekend 2003 event in Roermond, the Netherlands.

This section is only for people who want the theoretical background of why the WEP (Wired Equivalent Privacy) is awfully insecure. If you are currently still having problems with the previous sections, then please skip this section and get back to it at a later time when you have a complete knowledge. One note you should remember during the study of this section is that WEP is defined in the 802.11 standard, not the individual standards for 802.11b, 802.11a, and 802.11g task groups. As a consequence, WEP vulnerabilities have the potential to affect all flavors of 802.11 networks (except newer 802.11 standards that replace WEP like 802.11i).

Before we go on, you should be aware of what a XOR port is. A XOR port is in fact an OR port with only one (indicated in red) input combination different from the OR. At this moment, we are speaking about Boolean Algebra (algebra with only 2 values: a zero (false) and a one (true)). Both ports we have referred to are in fact functions that we offer two inputs, and a function has only one output. Now consider the two truth tables below:

OR gate/port:
in0 in1 out
0 0 0
0 1 1
1 0 1
1 1 1
XOR gate/port:
in0 in1 out
0 0 0
0 1 1
1 0 1
1 1 0

The columns in0 and in1 are in fact the two inputs, two wires connected to the gate, and there's only one wire that leaves the gate, called out.

Now, WEP employs an integrity check field in each data packet to ensure that data is not modified during transmission. For this purpose, a 32-bit CRC checksum is used. But deploying WEP, we need one (select one out of four keys) secret key, consider it a password to encrypt/decrypt data, generally referred to as the "WEP key". WEP also uses the RSA RC4 encryption algorithm. RC4 is a stream cipher designed by Ron Rivest for RSA Security. A stream cipher expands a fixed-length key into an infinite pseudo-random key stream for the purpose of encrypting data. In WEP, plain-text data is bitwise XOR'ed with the key stream to produce the cipher text. This results in the presentation below. Now let us continue step by step:

+----------------------------+---------+
|Plaintext Message (= DATA!!)|   CRC   |
+----------------------------+---------+
+--------------------------------------+
| Keystream = RC4(V,K)                 |
+--------------------------------------+
 
+-----+--------------------------------------+
|  V  |             Ciphertext               |
+-----+--------------------------------------+

What is bitwise XOR'ing? Consider first our data. It is being sent as a plaintext message. That means that in fact, the data is being transferred as text, thus as a sequence of ASCII characters, which we express in binary (strings of 1s and 0s because our computer can only understand those two binary digits). Suppose we are going to bitwise XOR the characters of our plain text string, which are all ASCII characters. Suppose that we are going to XOR the characters n and b. They have ASCII values 110 and 98 respectively, which are decimal numbers. However, we must express these two characters in binary so that the computer can understand what we mean. If we convert, then we have respective binary values of 01101110 and 01100010. Now, just as we have the units, tens, hundreds, thousands in our decimal number system, in binary (radix two), we have such things too. In fact, these things assign a particular weight to a specific digit. Anyway, consider the bit string of n: 01101110. The rightmost 0 is on the units place, the 1 at the left of it is at the 2^1s place, the bit at the left at the 2^2s place and so on... Now what we're going to do is just XOR the respective bits of the bit strings of n and b.

We're starting from right to left, but note that we can reverse this process without any problem. At the place of the units (2^0) we have respective bits 0 and 0. XOR(0,0) = 0. Now we move one place left (thus we're now at the place 2^1). XOR(1,1) = 0; again one place to the left: XOR(1,0) = 1, and we continue in this way till we reach the left side of the bit strings. This is what bitwise XOR'ing is.

01101110  The letter  n, in binary
01100010  The letter b, in binary
00001100  The XOR'ed value

As we already explained, WEP requires that each wireless network connection share a secret key for encryption purposes. WEP doesn't define key management techniques such as the number of different keys used within a network or the frequency to change keys. In practice, networks use one key among access points and change keys infrequently, as most vendor implementations of WEP require that keys be changed manually. The key stream produced by WEP's RC4 algorithm depends upon BOTH the secret key and the Initialization Vector. The Initialization Vector is used to ensure that subsequent data packets are encrypted with different key streams, despite using the same secret key. The Initialization Vector is a 24 bit field that is unencrypted within the header of the data packet, as shown above.

Now consider the diagram above that explains how we encrypt our data. As already said, we send our data as plain text, a series of ASCII characters. We target a mathematical function, assume it is called CRC32 on this plaintext. CRC32(Plaintext Message) = a certain number. This certain number is what we're going to convert to base two, and will then fit in 32 bits. We now create a new array of 0s and 1s: the first bar of the diagram. Then we are going to produce a Keystream. Again, we use a mathematical function: this time the RSA RC4 algorithm, that is actually the real encoding part of the system. RC4(V,K) equals a key string, which we can easily convert to binary (1s and 0s). This is the second bar in the diagram. Now, we are going to bitwise XOR these two bars, and we get what is called the Ciphertext. We're now just pasting the Initialization Vector (24 bit) in front of that, and we have our packet of encrypted data via WEP.

Now, in optimal conditions, we have this:

11Mbps + ((1500 bytes per packet) * (8 bits per byte)) = 916.67 packets that are transmitted each second.
16777216 Initialization Vectors + (916.67 packets per second is) = 18302.41745 seconds to use all Initialization Vectors.
(18302.41745 seconds) *( 60 seconds per minute) * (60 minutes per hour) = 5.0840048 hours to generate all Initialization Vectors.

We can conclude out of these calculations that an Initialization Vector would be repeated (referred to as an Initialization Vector Collision) about every five hours in a network running @ 11Mbps and transmitting packets of size 1500 bytes.Once an Initialization Vector Collision occurs, and an attacker has two different plain-text messages encrypted with the same key stream, it is possible to obtain the XOR of the two plain-text messages by XORing the two cipher text messages. The XOR that results can then be used to decrypt the traffic. Let's clarify this now with Boolean Algebra:

C1 = Ciphertext 1
C2 = Ciphertext 2
P1 = Plaintext 2
P2 = Plaintext 2
V = Initialization Vector
K = Secret Key
C1 = XOR [ P1, RC4(V,K) ] and C2 =XOR [ P2, RC4(V,K) ], thus:
 
XOR (C1, C2) = 	XOR { XOR [ P1, RC4(V,K) ]; XOR [ P2, RC4(V,K) ] }

We now apply the associative law:

XOR [ P1, RC4(V,K), P2, RC4(V,K) ]

We now apply the commutative law:

XOR [ P1, P2, RC4(V,K), RC4(V,K) ]
RC4(V,K) and RC4(V,K) are two bit strings that are the same.
XOR(0,0) = 0 and XOR(1,1) = 0 ==> RC4(V,K) + RC4(V,K) = 000...0 = 0,
and thus we can leave this away
 	XOR ( P1, P2 )

Example (slightly modified from example from iDEFENSE Inc.):

DATA
Letter "a" plain-text 01100001
Letter "n" - secret key 01101110
XOR - "a" 00001111


DATA
Letter "b" plain-text 01100010
Letter "n" - secret key 01101110
XOR - "b" 00001100


DATA
XOR - "a" 00001100
XOR - "b" 00001111
XOR - "a" & "b" 00000011


DATA
Letter "a" plain-text 01100001
Letter "b" plain-text 01100010
XOR - "a" & "b" 00000011

Therefore, when using the same secret key (just trying, it's only 128 bits long), the XOR'ed value of the plaintext messages ("a" and "b") is equivalent to the XOR'ed value of the encrypted messages. Thus, if an attacker has knowledge of the contents of one plain-text message when an IV collision occurs, the attacker could then decipher the contents of the other plain-text message without any knowledge of the key stream used for encryption.

6.3. Modern Security Technologies

Since Wireless Equivalent Privacy (WEP) is very insecure, both the IEEE and individual manufacturers try to develop newer and more secure technologies for encrypting data. Here are a few of the new ones:

WiFi Protected Access (WPA) The WiFi Alliance put together WPA as a data encryption method for IEEE 802.11 wireless LANs. WPA is an industry-supported version of 802.11i utilizing the Temporal Key Integrity Protocol (TKIP, the successor of WEP), which fixes the problems of WEP, including using dynamic keys.

WPA will serve until the 802.11i standard is ratified early 2004.

Extensible Authentication Protocol (EAP) EAP is an 802.1x standard that allows developers to pass security authentication data between a RADIUS (some dial-in server) and the access point and wireless clients. EAP has a number of variants, most of them are proprietary technologies:

EAP MD5, EAP-TTLS (EAP-Tunneled TLS), LEAP (LightWeight EAP) and PEAP (Protected EAP).

Cisco LEAP Or EAP Cisco Wireless is an 802.1x authentication type that uses a log-on password as the shared secret. When a wireless access point communicates with a Cisco LEAP-enabled RADIUS server, Cisco LEAP provides access control through mutual authentication between client devices and the wireless network, and provides dynamic, per-user WEP keys to help protect the privacy of transmitted data. The Cisco 350 OS/2 drivers, which was referred to earlier, is planned to support LEAP. Documents are available under IBM Business Contracts to enable LEAP with the Cisco 340 driver.

6.4. Where does this leave us with OS/2?

For now, WEP is available using all current OS/2 device drivers. As said, the LEAP security protocol is not officially supported by IBM's business device drivers. But documentation to get LEAP running with the CISCO 340 driver is available if you've got IBM business contract for the driver.

7. And what about Linux?

All devices that

currently work under OS/2 will most likely also work on the Linux platform and vice versa. For the Orinoco chip, two drivers are in wide use. The older wlan_cs driver, and the newer driver orinoco_cs. For the CISCO products, there

is also an Open Source driver available for the AiroNet product series (although you need to specify the WEP keys every bloody time you boot). About PRISM, Linux has fewer drivers than OS/2 for the moment. The only driver that is really usable is a driver for Intersil PRISM2 (there are also other drivers, but they are either unstable, or written for specific devices). [[2]] will provide you with all possible answers to your questions. OS/2 CHL is currently putting intense effort in an article identical to this, but which applies to the GNU Linux platform. This article will be included in the OS/2 Hardware Infosheet as is referred to in the links below.

8. Conclusion.

If you have already hated these wires for so long, I'd definitely go for it. IEEE 802.11b cards that work with OS/2 are not that expensive; also, they are an alternative for wired NICs, for which manufacturers tend to develop less and less NDIS 2.01 drivers, the drivers we need for the OS/2 Community. For business ends, I would say: Go for something else. IEEE 802.11b is not as fast as regular 10/100Mbps network adapters, and certainly is inferior to the speeds offered by Gigabit Networks. WEP is not a really good answer to security issues, and it doesn't seem that effective security solutions will be available in the future. With an eye on the very near future, you'll also be able to use your existing WiFi card for hot spots, a bright new, and interesting technology that could mean TRUE mobility.

OS/2 has now drivers for the most popular chipsets in use today for IEEE 802.11b devices, and development continues (maybe there will be an Atmel driver soon).

All in all, I would target WiFi cards not for business networked connectivity, but for DSL or cable connections and perhaps for small home networking.

9. References.

10. Acknowledgements.

Please note: IBM (International Business Machine Corp.) is a very large world-wide company. Due to its largeness, a very diverse set of announcements are officially made, but unfortunately, from time to time, a lot of rumors are also passing in the world. I tried my very best to be as accurate and precise as possible, though mistakes can never be overcome. If, despite of all efforts that have been done with the help of IBM Germany, incorrect statements about IBM should occur, then I do apologize for these inconveniences, and I'll try to correct mistakes as much as possible. It is my intention to provide correct information.

I'd really like to thank some people for their continuous efforts for OS/2 Warp, and for helping me either with my OS/2 CHL project, or in assistance of writing hardware articles for the OS/2 Warp product family:

  • Especially Jens Glathe, for his continues effort to support WiFi under OS/2, and for device driver in-depth details;
  • Oliver Mark, IBM Germany, for his continuous effort to support OS/2 and the OS/2 Compatible Hardware List;
  • All members of the OS/2 Warp User Group Belgium, for helping me testing all of those WiFi cards, and for their continuous efforts to support OS/2 and eCS;
  • Perry Werneck, Kevin P. Walter, Johan Driesmans, Roderick Klein, Stuart Grey for beta testing;
  • All OS/2 CHL hardware testing team member for their continues effort and drivenness to pursuade with os2warp.be.