CSS334 — Wireless Networks & Firewalls Cheat Sheet

Exam-ready summary | Lecture 13 | All topics included
⚠️ Final Exam reminder: IP calculation, CIDR, VLSM, configure routing, series questions (design IPs → use to configure routing). 1 A4 sheet allowed.

1. Elements of a Wireless Network

⚠️ Wireless ≠ Mobile. A desktop with a Wi-Fi card is wireless but not mobile.

Two Connection Modes

Analogy: Infrastructure = must go through a convenience store counter to reach the outside world. Ad-hoc = neighbours talking directly to each other.

2. Wireless Link Challenges

Analogy: Radio signal = shouting in a room. Farther away = quieter. Obstacles = damage. Echo = multipath.

3. SNR & BER

Signal-to-Noise Ratio (SNR)

$\text{SNR (dB)} = \text{Received Signal Power (dBm)} - \text{Noise Floor (dBm)}$

• Larger SNR = better — easier to extract signal from noise
• Recommended minimums:
  • Data networks: ≥ 20 dB
  • Voice/VoIP: ≥ 25 dB

Bit Error Rate (BER)

$\boxed{BER = \frac{\text{Number of bit errors}}{\text{Total bits sent}}}$

• Lower BER = better — fewer corrupted bits

SNR vs BER Tradeoff

Modulation Schemes (Higher modulation = faster but needs better SNR)

Analogy: Like speaking in a noisy room — if it's too loud, speak slowly and clearly (low modulation). If quiet, speak quickly (QAM256).

Rate Adaptation: AP + device dynamically switch modulation as SNR changes with movement. SNR drops → switch to lower modulation to maintain reliable connection.

4. 802.11 WiFi Standards

• All standards use CSMA/CA for multiple access
• All support both infrastructure and ad-hoc modes

5. Frequency Bands: 2.4 GHz vs 5 GHz

2.4 GHz = slow but far, like FM radio.
5 GHz = fast but short, like Bluetooth.

2.4 GHz Channels (Key Rule)

• Each channel = 20 MHz wide, spaced 5 MHz apart → heavy overlap
• Only channels 1, 6, and 11 are truly non-overlapping — always use these for adjacent APs
• Configure neighbouring APs on different non-overlapping channels to avoid interference

5 GHz Channels

• More channels available, no overlap between adjacent channels
• Some channels require DFS (Dynamic Frequency Selection) — must avoid conflict with TDWR (Terminal Doppler Weather Radar) used at airports

6. 802.11 LAN Architecture

• BSS (Basic Service Set) = one "cell" = one AP + its associated wireless hosts
• SSID (Service Set Identifier) = the human-readable Wi-Fi network name

Associating with an AP (Host Joining Process)

Passive vs Active Scanning

Passive = sit and listen for who's broadcasting. Active = shout "anyone home?" used when SSID is hidden.

7. 802.11 Frame Addressing (4 MAC Addresses)

| frame ctrl | duration | addr1 | addr2 | addr3 | seq ctrl | addr4 | payload | CRC |

Example: H1 → Internet (H1 sends through AP → Router R1)

Wi-Fi frame carries 3 MACs because the AP acts as a relay — it needs to know where the frame came from (H1), where it's going next (R1), and who it is itself.

8. CSMA/CA — Collision Avoidance

Why NOT CSMA/CD for Wi-Fi?

• Cannot detect collisions wirelessly — transmitting signal drowns out received signal (fading)
• Hidden terminal problem — two hosts can't hear each other but both can hear the AP
• Solution: avoid collisions instead of detecting them → CSMA/CA

CSMA/CA Sender Algorithm

1. Sense channel:
     Idle for DIFS duration → transmit entire frame (no collision detection)
     Busy → start random backoff timer
       - Timer counts down while channel idle
       - When timer = 0 → transmit
       - If no ACK received → increase backoff interval → repeat

Key Timing Parameters

SIFS < DIFS → ACKs and CTS always get priority over new data frames.

Analogy: Polite meeting — wait for the speaker to finish (sense channel) + wait extra time (DIFS), then speak. If two people start simultaneously, both back off randomly.

RTS/CTS: Optional Collision Avoidance Enhancement

Solves the hidden terminal problem:

1. Sender → AP:  RTS (Request to Send) — small control frame via CSMA
2. AP → ALL:     CTS (Clear to Send)   — broadcast, all nodes hear it
3. All nodes hear CTS → defer transmission (virtual carrier sense)
4. Sender transmits full data frame
5. AP → Sender:  ACK

RTS may still collide, but it's tiny → much less wasted bandwidth than full data frame collision.

Analogy: Booking a room — tell the AP you need it, AP announces "Room reserved for A", everyone else waits.

9. 802.11 Mobility & Power Management

Mobility Within Same Subnet

• Host moves from AP1 to AP2 — same subnet, same IP (no DHCP needed)
• Switch updates its self-learning table when it sees the host's MAC arrive from a different port
• Seamless handoff — IP address unchanged

Power Management

• Node tells AP: "I'm going to sleep until the next beacon frame"
• AP buffers frames for sleeping node
• Beacon frame contains a list of mobiles with pending frames
• Node wakes before beacon → checks list → stays awake if frames waiting, goes back to sleep if none

10. 802.11 Wireless Security

Security Challenges

• Guest/contractor access needs (separate guest SSID)
• Mobile/endpoint devices — hard to control
• Untrusted devices and apps
• Cloud integration risks

Signal Hiding Techniques

WEP vs WPA vs WPA2

WPA2 Details

• Based on IEEE 802.11i standard
• Two modes:
  • Personal (PSK): Pre-Shared Key — password for home/small office
  • Enterprise: Per-user authentication via EAP (Extensible Authentication Protocol) — requires RADIUS server

Additional Protection

• Multiple SSIDs — separate guest SSID with client isolation (guests get internet but cannot reach internal LAN — perfect for visitor Wi-Fi)
• WPA2 + strong password + anti-virus + firewall = layered protection

WEP = easy-copy door key. WPA = key changes every use. WPA2 = military-grade AES encryption.

11. Firewalls

What Is a Firewall?

• Security system that monitors and controls incoming/outgoing traffic based on predefined rules
• Placed between internal network and the internet
• Can be hardware (dedicated appliance) or software (Windows Firewall, iptables)

Why Firewalls?

Inbound vs Outbound Rules

12. Firewall Strategies

a) Blacklisting (Default ACCEPT)

• Default: allow everything
• Add rules to DROP specific bad traffic
• Use case: outbound rules (flexibility for users to access internet)

b) Whitelisting (Default DROP)

• Default: block everything
• Add rules to ACCEPT only known good traffic
• Use case: inbound rules (most secure — nothing enters unless explicitly permitted)

Blacklisting = door is open, bouncer has a list of banned people.
Whitelisting = door is locked, only VIP list gets in.

13. Firewall Zones (Network Segmentation)

Group assets by trust level → define inter-zone traffic rules instead of per-IP rules.

Inter-Zone Traffic Matrix

Analogy: DMZ = castle forecourt. Visitors can enter the forecourt (DMZ) but cannot enter the castle (internal LAN).

14. Types of Firewalls (Increasing Security)

15. Stateless Packet Filtering

Filters each packet individually — no memory of previous packets.

Decision based on:

• Source / Destination IP address
• TCP/UDP source / destination port numbers
• ICMP message type
• TCP SYN / ACK flag bits

ACL (Access Control List) Format

| action | source addr | dest addr | protocol | src port | dst port | flag |

ACL is read top-to-bottom — first matching rule wins (like an if-else chain). Always end with a default deny all.

Example ACL Rules

Common Stateless Filtering Policies

16. Stateful Packet Filtering

Problem with stateless: It admits nonsense packets — e.g., an ACK arriving with no prior SYN (no TCP connection was opened).

Stateful inspection adds:

• Tracks every TCP connection — connection setup (SYN) and teardown (FIN/RST)
• Verifies incoming packets match an established session
• Times out inactive connections → stops admitting their packets

Analogy: Stateless = checking each letter individually. Stateful = remembering who called you first — if someone sends a reply but never called, it's suspicious.

17. Firewall in Practice

Linux iptables (3 Chains)

Each chain has a default policy (ACCEPT or DROP) + ordered rules applied top-to-bottom.

# Example iptables rules:
Chain INPUT (policy ACCEPT):
  DROP  icmp  from 192.178.18.0/24   ← Drop all ICMP from this subnet
  DROP  tcp   from 192.178.18.10     ← Drop all TCP from this specific host
 
Chain FORWARD (policy ACCEPT):
  DROP  udp   from 192.178.18.10     ← Block UDP in both directions
  DROP  udp   to   192.178.18.10
 
Chain OUTPUT (policy DROP):
  ACCEPT icmp  to any                ← Allow outgoing ICMP (ping works out)

AWS Defence-in-Depth

Internet Gateway → Route Table → Network ACL (subnet level) → Public Subnet → Security Group (instance level) → EC2 Instance

• Misconfiguration in one layer doesn't fully expose the host — two layers must both fail.

18. IDS — Intrusion Detection System

Firewall Limitations (Why IDS is Needed)

IDS vs Firewall

IDS Capabilities

• Deep Packet Inspection (DPI): looks at packet contents — checks against virus/attack signature database
• Anomaly detection: compare traffic against baseline "normal" → detect zero-day attacks
• Signature matching: match patterns against known threat signatures
• Correlation analysis across multiple sessions:
  • Port scanning detection
  • Network mapping detection
  • DoS attack detection

Two Types of IDS

NIDS Component Pipeline

IDS Placement Strategy

• Inside internal network: detects insider threats and lateral movement
• In the DMZ: monitors public-facing servers (web, mail, DNS)
• Multiple sensors at different positions = different types of checking coverage