VPN Problem:  

What is the most secure VPN cryptographic algorithm?   What is the best-practice for choosing IPsec security strength?

Solution:

Use Key Management methodology to determine IPsec security strength.

Key Management

The National Institute of Standards and Technology (NIST) publishes up-to-date guidance for choosing appropriate VPN ciphers.  It uses Key Management methodology to rate the effectiveness of different cryptographic algorithms.

Security Strength 

Security strength is a Key Management assessment that estimates the effectiveness of cryptographic algorithms against known attacks over time.  New or improved attacks may affect these equivalencies in the future.

Security strength uses bits-of-security to represent cipher strength.  Security-bits are not the same thing as key-length bits.  For example, a 1024-bit RSA certificate provides 80-bits of security.

In addition, different security algorithms may share common security strength levels (Table 1).  It's best practice to match similar security strength when working with different sets of cryptography algorithms (e.g., transfer-sets and cipher-sets).  Consider, one depreciated algorithm can compromise the entire security target.

IPsec Cipher Assessment

Use Key Management security strength assessments to implement secure IKEv2 and L2TP/IPsec VPN.  Consider how security-bits represents cipher strength:

• 89 security-bits are vulnerable to known attacks.
• 103 security-bits are not vulnerable to known attacks -for now.  Status forecast to depreciate in the near-future (may be months or years).
• 128 security-bits are not vulnerable to known attacks.  Status forecast remains secure for near-future.
• 192 security-bits are not vulnerable to known attacks.  Status forecast remains secure for long-term future (years).

Table 1 VPN Security Strength
Security Strength	DH	RSA	IKE Encryption	IKE Hash	ESP Encryption	ESP HMAC Hash	Assessment***
80-bit	5	1024	AES-128	SHA1	AES-128	SHA1	Bad
89-bit	5	2048	AES-128	SHA1 SHA256	AES-128	SHA1 SHA256	Bad
103-bit	14	2048	AES-128	SHA1 SHA256	AES-128	SHA1 SHA256	Good
128-bit	15	3072	AES-128	SHA256 SHA384	AES-128	SHA1 SHA256	Better
192-bit*	16	4096**	AES-256	SHA256** SHA384	AES-256	SHA1 SHA256**	Best
Note:  DH-EC not included in this table -for simplicity.  DH-EC provides for a 1024 or 7068 security bit key exchange. *192-bit security level requires 7680-bit RSA. Some systems do not support 7680-bit RSA.  **Security level mismatch. 4096-RSA security-strength is 140-bit (i.e., not 192-bit). This mismatch impacts all security levels. ***The assessment column is not official NIST Key Management.  It is this author's independent qualitative interpretation derived from NIST Key Management.

Table 2 Diffie-Hellmand (DH) Security Strength Levels.
DH Group	DH Key	Security Strength (i.e., Bits of Security)
DH5	1536 bits	89 bits
DH14	2048 bits	103 bits
DH15	3072-bit	128 bits
DH16	4096 bit	192 bits
DH19 (ECP)	256-bit (ECP)	1024
DH20 (ECP)	384-bit ECP	7680

Table 3 Encryption Security Strength Levels
AES	AES Key	Security Strength (i.e., Bits of Security)
AES-128	128	128
AES-256	256	256

​

Table 4 RSA Security Strength
Certificate	RSA Key	Symmetric Key
RSA	1024-bit	80-bit
RSA	2048-bit	112-bit
RSA	3072-bit	128-bit
RSA	4096-bit	140-bits*
RSA	15360 -bit*	256-bit**
*No formal recommendation for Symmetric key. RSA 4096 offers marginal 28bit increase for symmetric key. **15360 is not usable. Therefore, use RSA 3072-bit key.

Table 5 Hash Security Strength
Hash	Hash-only	HMAC	Security Strength (i.e., Bits of Security)
SHA	SHA-1 SHA-256 SHA-512	SHA-1 SHA-256 SHA-512	80
SHA	SHA256 SHA384 SHA256	SHA-1 SHA-256 SHA-512	112
SHA	SHA256 SHA384 SHA256	SHA-1 SHA256 SHA-512	128
SHA	SHA-384 SHA-512	SHA-256 SHA-384 SHA-512	192
SHA	SHA512	SHA-256 SHA-384 SHA-512	SHA256
Note: Hash security level determined by algorithm, scheme or application and by the minimum security-strength provided.

That's it!


References:
https://www.nist.gov/
http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf
http://infosecurity.ch/20100926/not-every-elliptic-curve-is-the-same-trough-on-ecc-security/
http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf

Summary:  

This article explains the differences among UPS cable connectors, lugs and fuses -exciting stuff.  This information applies to multiple UPS units:  APC, Tripplite, Cyberpower, Eaton. etc.

UPS Cable Connectors:

Ever wonder why some UPS cables use grey connectors while others use blue connectors?  Ever wonder if those cables or battery packs are compatible?

UPS units use plastic SB connector assemblies (e.g., Anderson housing) to safely connect insulated battery cables.

Figure 1.  UPS connector and contacts.

Typical UPS two-pole SB connector:

• Amp rating:  175A
• Voltage rating:  600V

Problem:

How to manually estimate UPS runtime based on server load and battery capacity.

Solution:

Use this four-step process to estimate UPS runtime.

1. Identify amp hours (AH).
2. Determine DC amperage for existing load.
3. Create a base ratio from available AH.  Create a second ratio from the DC Amperage estimate. Cross multiply both ratios.
4. Apply power-factor multiple for final conservative runtime estimate. 

N.B., This process is automated with my UPS runtime calculator and spreadsheet tool:  http://www.stevenjordan.net/2016/06/ups-runtime-tool.html

Identify Capacity (i.e., Total Amp Hours):   

Internal batteries usually connect in a series.  That means that the voltage increases and the amperage remains the same.  In most situations, we only need the AH from one internal battery (in a series of two batteries) -not both.  For example:

     2 x 12V18AH batteries (i.e., series) =  18 AH.

N.B., batteries that connect in parallel doubles the AH while the voltage remains consistent.  Parallel connections are common in external battery packs.

Determine Load (i.e., DC Amperage):

Load describes power consumption.  Determine the active load based on amps consumed per hour (AH).  Use the standard power formula to calculate amp use:

   W = V x A.

For example, assume that a HP server uses 300W at any given time.  We're calculating battery capacity so use battery voltage (e.g., 24V) -not 120V.  N.B., It's OK to use server-manufacturer estimates.  It's better to take measurements from UPS or server management tools.

300W = 24V x A

Runtime Calculation:

Runtime uses a ratio of capacity over load.

Capacity:   18AH
Load:         12.5A

Therefore, our initial runtime estimate is 1.44 Hours or 86.4 minutes.

Power Factor

Our initial runtime estimate does not account for power factor, diversity factors, efficiency loss, etc. We must, therefore, multiply our initial runtime estimate with a conservative power factor (e.g., .70):

Original runtime estimate:  41.6 minutes

Power Factor: .7

86.4 minutes x .7 = 60.2 minutes.
 or 1.44 Hours x .7 = 1.008 hours.

That's it!

Problem:  

Ensure UPS unit has sufficient capacity, voltage, and runtime.  This online tool calculates UPS runtime based on server load and UPS capacity.

Directions:  

Edit the AH, Watts, and DC voltage fields for a custom UPS runtime estimate.


Runtime formulas and additional information located at:
 http://www.stevenjordan.net/2016/06/ups-runtime-calculation.html.

Problem:  

Tool that coverts electric power from watts (W) to current in amps (A).  How to choose the correct UPS based on server load.  Ensure backup UPS unit has the correct voltage and amps for runtime.

Solution:  

W = V x A.  Use the voltage from the UPS batteries -not 120V!

Use the Watts-to-Amps tool to calculate Amps/runtime based on server load/Watts:

How to Fix Premature UPS Shutdowns.

Takeaway:  

How to calibrate UPS units.  How to achieve the best runtime.  How to prevent early shutdowns.   Smart-UPS units use Battery Constant to calculate runtime.  Inaccurate battery constant leads to inaccurate runtime calculations (i.e., drifting).

Problem:  

UPS reports inaccurate battery runtimes.  Poorly calculated runtime cause premature shutdowns during power outages.  Misconfigured external battery counts or old firmware can also trigger early shutdowns.

Drifting:

Batteries become less efficient as they age.  The UPS changes its battery constant value to reflect these inefficiencies over time.  The UPS unit is supposed to reset its battery constant after installing new batteries.

Unwelcome drifting occurs if the UPS does not detect new batteries nor reset its battery constant value.  As such, it miscalculates available runtime that leads to premature shutdowns.  According to APC, drifting may occur when factory batteries are replaced with generic brands.  Drifting may also occur during a hot-swap replacement.  Self-tests may also introduce drifting.

Soft Runtime Calibration: 

Initiate a runtime calibration from the management card.  This process recalculates runtime capacity based on its current load.  Run "Soft" Runtime Calibration from the network management card (NMC).

Calibration Tips:  

• Do not run calibration on new UPS units. 

• Re-calibrate after replacing old batteries with generic batteries. 

• Schedule an annual calibration.  

• Discharge and recharge old batteries -before calibration.   

• Calibrate with a 40% load. 

• Completely discharge and completely recharge UPS.

• Change/ reset the number of external batteries from the management card.

Manually configure the battery constant if the soft runtime calibration fails.

Hard-set the Battery Constant:

Change the battery constant value from the serial console -otherwise known as the nuclear option!  Use caution because incorrect commands can brick the UPS.

1.  Shut down UPS.
2.  Remove NMC.
3.  Use an APC serial cable to console to the UPS:
        2400 baud,
        8-N-1,
        Xon/Xoff,
        uncheck FIFO.
4.  Enter Smart mode:  Shift+Y (i.e., CAP "Y").
      Prompt changes to SM#.
5.  Enter Program mode: Y, 1, 1
     N.B., each comma represents a pause. 
6.  Enter "0" to display the battery constant.  The battery constant value (e.g., B2) is located under column 0 and is in HEX format:
   
   UPS Model  4   5   6   0   Hex   Firmware
750XL          EE  F8  B2
7.  Change the battery constant value to FF.
        Use "+" or "-" keys to change the value.  
8. Type "R" to save and exit.

  The FF value is the highest possible battery constant value.  It is entirely inaccurate -don't panic.  Our goal is to maximize runtime and eliminate premature shutdowns.  The UPS will still initiate a shutdown when battery voltage is less than 10.5V per battery.

Use manual calibration method after the battery constant is rest.

Manual/ Hard Calibration

   Hard calibration provides the most accurate runtime estimates.  This method generally corrects inaccurate soft calibration estimates:

1. Move production servers to an alternate power source.
2. This test requires at least 30% load.  Attach old servers, workstations, etc to simulate production load.
3. Ensure batteries hold a full charge.  
4. Pull the plug so that the UPS operates on battery power.  
5. Allow the UPS to operate until it shuts down.
6. Plug the UPS back in and allow it to recharge.

The UPS now provides an accurate runtime estimate.  It is ready to protect production equipment.

That's It!

Problem:

Battery Packs:

   UPS units can run for days with a sufficient number of external batteries -not so for some APC units.  The UPS uses battery count for runtime calculations.  For example, some UPS models cap the number of external batteries.  In other words, runtime won't benefit from additional batteries that exceed this cap.

   UPS units use external battery count for runtime calculation.  This process provides maximum runtime and prevents premature shutdowns.  Configure external batteries in the NMC GUI.

   At first glance this process seems simple enough.  However, determining the correct number of external batteries gets confusing.  For example, does it want a count of all physical batteries?  Or does it want a count of battery packs?

   In most situations, battery count equals the number of physical batteries each battery pack.  N.B., this rule only applies so long as the internal and external batteries are identical.  For example:

•  750XL UPS uses two 12V18AH batteries.  
• SUA24XLBP battery pack uses four 12V18AH batteries. 
• The network management card (NMC) external battery count equals four.

   However, there are situation when internal and external batteries are different.  Consider the following:

• 750XL UPS uses two 12V18AH batteries.
   ~18AH per battery; or a total of ~36AH.  
• UXBP24 battery pack uses four 12V75A.
   ~75AH per battery; or ~300AH total.  

   In this situation, the external battery count is not four.  Rather, it equals 16.  Huh?

   In both examples, the external battery count is the total sum of Amp Hours (AH) of all external batteries; divided by the AH of ONE internal battery.

     AH for total external batteries:  300AH
     AH for single internal battery:    18AH

Figure 2.  Calculating External Battery Count

Console Control:

   Alternately, use the console (i.e., not the NMC) to set the battery count:

1.  Shut down UPS.
2.  Remove NMC.
3.  Use an APC serial cable to console to the UPS:
        2400 baud,
        8-N-1,
        Xon/Xoff,
        uncheck FIFO.
4.  Enter Smart mode:
      Press Shift+Y (i.e., CAP "Y").
      Prompt changes to SM#.
5.  Enter Program mode: Y, 1, 1
     N.B., each comma represents a pause. 
6. Use the "+" or "-" to change the battery count.  
7. Type "R" to save and exit

Problem:

Data Protection Manager (DPM) does not work with new Ultrium-5 LTO-5 tape drive. DPM Library only provides options to clean drive or disable drive. DPM does not correctly identify and detect the new tape drive.
Hardware: HP StoreEver LTO-5 Ultrium-5 tape drive. N.B., this solution works with just about any LTO drive.

 Background: 

 Old LTO-3 drive was running out of space. Purchased HP LTO-5 drive to expand available storage from 800GB to 1.5TB:

• Server has compatible SAS HBA and cable.
• Device Manager recognizes the new drive after a simple hardware swap.
• DPM lists the new hardware under its Libraries.
• Protection groups changed and reflect new hardware. 

 Solution:

 Update the DPMLA.xml file to reflect the new hardware:
C:\Program Files\Microsoft DPM\DPM\Config\DPMLA.xml
XML Before:

<drivelibraryassociation>
<drive drivebayindex="0" scsibus="0" scsilun="0" scsiport="2" scsitargetid="5" serialnumber="HUExxxxxxx">
<library scsibus="-1" scsilun="-1" scsiport="-1" scsitargetid="-1" serialnumber="">
</library></drive></drivelibraryassociation>

XML After:

<drivelibraryassociation>
<drive drivebayindex="0" scsibus="0" scsilun="0" scsiport="2" scsitargetid="5" serialnumber="HUExxxxxxx">
<library scsibus="-1" scsilun="-1" scsiport="-1" scsitargetid="-1" serialnumber="">
</library></drive></drivelibraryassociation>

Tips:

• Serial is located on the physical tape drive. 
• Use the HPE Library and Tape Tool to identify SCSI assignments. 
• Alternately, identify SCSI assignments in the Device Manager → Tape drive → Properties →Details → Location information property.

Final Steps:

• Save changes to DPMLA.xml and restart DPM services. 
•  Rescan the DPM tape library. 
• Inventory tape library.

That's It!

References:

Repair Windows installation licensing errors.

Problem:

   Windows 2012R2 license error reads, "Windows cannot find the Microsoft Software License Terms. Make sure the installation sources are valid and restart the installation".

Background:

  This error occurs after selecting the "operating system you want to install" in the Windows Setup wizard. This error occurs on VMWare, VirtualBox, or Hyper-V virtual machines (VMs). 

Solution:

   This licencing terms error occurs if there is not enough memory allocated to the virtual machine. Increase the VM's start-up memory in the VM settings to resolve.

Problem:  

How to enable Windows 10 to work as a wireless access point.  Use the Netsh WLAN commands to create Ad Hoc networks.  Internet Connection Sharing (ICS) includes a default route and DHCP service for fully pledged access point (AP) routing!

Netsh WLAN is not ground-breaking innovation -but it sure comes in handy!  What's more, the default wireless security settings use WPA2 with AES encryption and CCMP ciphers.  WPA2 provides the best wireless security standard and data rates.  Compare that to your old Linksys AP.

This solution can also be used for basic penetration testing.  Think MITM hotspot for Intercepter-NG ;)

Solution:  

Install additional wireless NIC (e.g., USB).  Create an Ad-Hoc wireless network SSID.  Start broadcasting:

1. Create wireless SSID:
C:\Users\billgates>netsh wlan set hostednetwork mode=allow ssid=Personal-WiFi key=H@rd2Cr@ckKey!!%42
2. Start the wireless SSID: C:\Users\billgates>netsh wlan start hostednetwork

Other Wi-Fi enabled computers may connect to the Ad-Hoc wireless network.  This feature is great for simple file sharing but it falls short of shared Internet access.  Use the ICS to turn this Ad-Hoc network into an Internet AP:

1. Right-click on the network icon located in the taskbar.  Left-click on Open Network and Sharing Center.
   
2. Click on the Wi-Fi connection located next to Connections:
   
3. Click on the Properties button.  Click on the Sharing tab.  Enable ICS Sharing.
4.  Assign the ICS to an available NIC from the pull down menu.  N.B., The pull down list is only visible when the computer has more three or more NICs (either Wi-Fi or Ethernet).

That's It!

Additional Netsh WLAN Commands:

Show Wi-Fi Networks:

C:\Users\billgates>netsh wlan show hostednetwork
Hosted network settings
-----------------------
    Mode                   : Allowed
    SSID name              : "Personal-Wi-Fi"
    Max number of clients  : 100
    Authentication         : WPA2-Personal
    Cipher                 : CCMP

Hosted network status
---------------------
    Status                 : Started

Stop Wi-Fi AP:

C:\Users\billgates>netsh wlan stop hostednetwork

Change password: 

netsh wlan refresh hostednetwork [SSID_Password]

Show wireless profiles: 

netsh wlan show profiles

Retrieve profile key: 

netsh wlan show profiles name=[profile name] key=clear

Delete wireless profiles: 

netsh wlan delete profile name=[profile name]

Set wireless network priority: 

netsh wlan set profileorder name=[profile name]interface=[interface_name] priority=1

Stop automaticac connection: 

netsh wlan set profileparameter name=[profile name] connectionmode=manual

Export a wireless profile: 

netsh wlan export profile name=[profile name]

Import network profile:

netsh wlan add profile filename=[path_and_filename.xml] interface=[interface_name]

Problem:  

Import VMWare virtual machine (VM) into Hyper-V hypervisor.  Convert VMDK virtual disk into VHDX disk.

Solution:  

Use Microsoft Virtual Machine Converter (MVMC) 3.1 to import and convert the VMWare ESXi VM into Hyper-V.

Background:   

The MVMC GUI provides a simple import wizard.  Please note, the GUI only imports VMWare hypervisors (including ESXi) connected to VMSphere.  MVMC PowerShell commands can convert stand-alone ESX and ESXi VMs.

Convert:

1. Download MVMC.  The Microsoft download sites lists MVMC as 3.0.  N.B., the file installs version 3.1.
2. Install MVMC on Hyper-V host.
3. Uninstall VMTools from VMDK VM.
4. Copy VMDK to Hyper-V host.
5. Open PowerShell.  Import MVMC PowerShell library.
   
   Import-Module "C:\Program Files\Microsoft Virtual Machine Converter\MvmcCmdlet.psd1"
6. Use PowerShell to convert VMDK to VHD.  N.B., Do not use VMDK_Flat file!
   
   PS D:\TMP> ConvertTo-MvmcVirtualHardDisk -SourceLiteralPath "D:\VMS\DEV.vmdk" -DestinationLiteralPath "S:\VMS" -VhdType DynamicHardDisk
7. Create new VM in Hyper-V.  Add newly created (i.e., system) disk to IDE adapter.  Additional disks can use the SCSI adapter.  This is the time to configure dynamic memory or add additional CPUs.
   N.B., Do not resize the disk until after the VM starts at least once in Hyper-V!
8. Start-up VM.  Install Hyper-V tools.  Restart.
9. Optional:  New NIC "hardware" causes problems with retaining preexisting static IPs.  Resolve problem by deleting the network adapter and restating.  Windows creates a new network adapter upon start-up.  Manually add IP addresses into new adapter.

Executive Summary:

How to fix iPhone Wi-Fi problems.  Why can't that shiny new iPhone stay connected to the wireless network?  FYI, it's probably not your IT department's fault.  There are steps, however, that can be made to improve the overall connection.  Target audience is for IT professionals but this information is helpful for all end-users.

Problem:

Complaints of poor iPhone (Wi-Fi) performance. iPhones are inconsistently kicked off the Wi-Fi.  iPhones may only connect at low data rates.  End-uses are frustrated when iPhones and iPads disconnect.

Topology:

Corporate Wi-Fi uses Juniper wireless controllers and access point (APs).  Most smart phones connect to dedicated guest network. Wireless network seems to work well for most Android and Windows devices. Majority of problems are with iPhones and iPads.  N.B., topology is similar to Cisco controllers.  Topology is also similar, to a lesser extent, to personal wireless systems.

Symptoms:

iPhones and iPads experience disconnects, delays, packet drops, or total loss from Wi-Fi network. In other instances, Apple devices consistently connect to 802.11n networks at 24Mbps.

Cause:

Aggressive roaming causes most Wi-Fi problems for iPhones and iPads.  Roaming occurs when multiple APs broadcast identical SSIDs.  These Apple devices are quick to jump ship compared to other clients (e.g., Android). Excessive roaming causes wireless drops, slow data rates, and poor battery life.  What's more, all roaming decisions are made by wireless client (i.e., iPhone) –not the wireless AP or controller.

Additional factors can also influence wireless grief:  iPhone standby settings; spectrum preference; legacy rates; encryption; and signal strength -too much or too little.

Influencing Factors: 

1.  Power save handler. iPhones enter standby/ sleep mode based on application activity. iPhones generally disconnect Wi-Fi in standby mode. End-users should understand this behavior is by design (à la Apple). It is not a limitation of their corporate Guest network.
2. Roaming. Clients may disconnect if the roaming process takes too long.
3. Spectrum preference. iPhones prefer the 2.4GHz spectrum over the 5Ghz spectrum. Wireless clients work best on the 5GHz spectrum. Consider disabling 2.4GHz radios from the APs.
4. Data Rates. Legacy 2.4GHz data rates (e.g., 802.11b and 802.11g) harm 802.11n wireless networks. Disable 802.11b and consider disabling 802.11g (i.e., adjust roaming cell size). Wireless networks realize 30% to 50% increases in throughput after disabling 1,2,5.5, and 11 Mbps data rates.
5. Encryption and Ciphers. WPA and TKIP caps/limits Wi-Fi networks to 54Mbps. Juniper recommends only implementing WPA2 with CCMP cipher for 802.11n transmissions. Pre-shared key is acceptable. 802.1X (i.e., WPA2-Enterprise) is better.
6. Range. Signal strength affects client roaming decisions. 802.11b (2.4GHz) has nearly twice the range of 802.11a (5GHz). Adjust radio power levels (i.e., transmit power) so that 5GHz RSSI is great than the 2.4GHz RSSI. For example, set 2.4GHz to 4 dBm; and set 5GHz to 12dBm. 

Power Save:

Apple IOS devices (e.g., iPhones and iPads) use standby/ sleep mode to improve battery life. The phone enters standby five minutes after it locks (i.e., requires PIN to unlock). Active sessions (e.g., web download) transition to standby after thirty minutes.

In most situations, the iPhone disconnects Wi-Fi after it enters standby. It makes sense –who enjoys one hour power? Non-persistent Wi-Fi becomes less of an issue because most devices automatically reconnect when unlocked. N.B., auto-connect introduces security risks via Man-in-the-Middle (MMTM) –we’ll save that discussion for another day.

In some circumstances, there are exceptions to Apple’s non-persistent Wi-Fi policy. For example, some applications use a background task handler (e.g., Exchange ActiveSync) that keeps Wi-Fi connected at all times. Other users experience persistent Wi-Fi while streaming music via Spotify or Pandora.

Provide a power source (i.e., plug it in) or entirely disable the screen lock (also not recommended) are alternate methods for Wi-Fi persistence.

Roaming Rates

Normally, iPhones roam between APs within a few milliseconds. However, in some circumstances clients may take up-to five seconds to complete –ay caramba! Most APs disconnect the session after three minutes. End-users without auto-connect require manual reconnection. Either way, it’s best to keep roaming to a minimum.

Spectrum Preference:

iPhones often prefer the 2.4GHz over 5Ghz spectrum. This 2.4GHz preference is not necessarily by design. The preference results from a combination of roaming thresholds, dual-band APs, and imprecise interpretation of the RSSI signals.

Why does spectrum matter? 2.4 GHz only provides three non-overlapping channels: 1, 6, and 11. In addition, the majority of wireless devices operate on the 2.4GHz spectrum. In contrast, the 5 GHz spectrum provides 23 non-overlapping channels. Relatively few devices use the 5GHz spectrum.

For example, a quick wireless scan shows a total of 81 neighbor APs within range of my office.


This scan shows 86% of my neighbors transmit on the 2.4GHz spectrum; compared to only 13% on the 5GHz spectrum.



This data also shows only six 5GHz channels are in use. That leaves us with 16 pure unused virgin 5GHz channels for unadulterated throughput! Contrast that with the surrounding APs (all 70 of them) saturating the only three 2.4GHz channels: 1, 6, and 11. Additionally, microwaves and cordless phones operate on the same 2.4GHz spectrum.

What is the actual impact of an entire office building sharing the same three channels? Expect a wide range of clients and usage in large office buildings. Neighbor APs share the limited bandwidth across wireless channels. 802.11g radios provide roughly 300Mbps of total throughput. Wi-Fi bandwidth increases (per SSID) with 802.11ng and MIMI antennas. These innovations may further reduce neighbors’ throughput by up to 90%.

Table 1.  Comparison of Wi-Fi Rates and Channels
Standard	802.11a	802.11b	802.11g	802.11ng	802.11na
Spectrum	(5GHz)	(2.4GHz)	(2.4GHz)	(2.4GHz)	(5GHz)
Max Speeds	54 Mbps	11Mbps	54Mbps	300Mbps	300Mbps
Range	50 feet	100 feet	100 feet	50 feet	50 feet
Non-overlapping Channels	24	3	3	3	24

Spectrum Throughput

Data can transmit roughly twice as far over the 2.4GHz spectrum compared to the 5GHz spectrum. The range is impressive but it’s not necessarily better. For example, it’s prudent to keep wireless beacons confined to the office perimeter (i.e., security).

Additionally, 2.4GHz has a negative impact on client data rates and roaming. Sticky clients (e.g., Android) may connect from the parking lot at 1Mb connection rate. These clients may be stuck with low connection rates throughout the day because of their low roaming aggressiveness. Recall the negative impact legacy rates have on the entire network. Likewise, non-sticky clients may experience unnecessary roams. Also, consider the negative impact of signal noise. Wi-Fi works better when it doesn’t detect every neighbor on the block.

RSSI, SNR, and Throughput:

Data transmission rates (i.e., throughput) can be estimated in relation to RSSI and Signal Noise Ratio (SNR). RSSI is the RF signal strength. Large RSSIs represent strong signal strength. For example, -60 dBm is greater than -70 dBm.
SNR is an expression of signal strength minus signal noise. SNR generates a positive number expressed in decibels (dB). For example, SNR is 20 if the RSSI value is -75db and Noise value is -95db. In general, SNR above 20 dB is an acceptable level for transmission.

Table 2.  Legacy Data Rates Estimates.
Rate (Mb/s)	1	2	5.5	11	6	9	12	18	24	36	48	54
SNR (dB)	4	6	8	10	4	5	7	9	12	16	20	21
Signal level (dBm)	-81	-79	-77	-75	-81	-80	-78	-76	-73	-69	-65	-64

Table 3.  802.11ng (2.4GHz) Data Rate Estimates.
2.4GHz Rate (Mb/s) (20MHz)	14.4	28.9	43.3	57.8	86.7	115.6	130	144.4
SNR (dB)	11	14	16	19	23	27	28	29
Signal level (dBm)	-82	-79	-77	-74	-70	-66	-65	-64

Table 4.  802.11na (5GHz) Data Rate Estimates.
5 GHz Rate (Mb/s) (40MHz)	30	60	90	120	180	240	270	300
SNR (dB)	11	14	16	19	23	27	28	29
Signal level (dBm)	-79	-76	-74	-71	-67	-63	-62	-61

iPhone Roaming Process:

iPhone roaming algorithm is based on AP signal strength and client activity:

1. iPhone compares current BSSID (based on radio Mac) and other available AP BSSID signal levels.
2. The roaming decision based on client activity: (a) idle session (phone in pocket) or (b) active session (e.g., web surfing). iPhone searches for a better signal level in both 2.4GHz and 5GHz bands.

     (a.) Idle clients search for new BSSIDs when current signal strength is -70dB or less (e.g. -71dB).

• iPhone roams when it locates another AP with a signal at least +12dB better.
• iPhone scans in 90 second intervals until its current signal strength improves (e.g., -69 dB) or it locates a different BSSID with 12dB stronger signal strength. 

     (b.)  Active client attempts to locate a stronger signal if current signal strength is -70dB or less.

• iPhone chooses new BSSID if it has +8dB or greater RSSI.
• iPhone continues to scan in 90 second intervals until current signal improves or locates a different BSSID at least 8 dB or better. 

Extenuating factors also influence iPhone roaming decisions: (a) Different spectrum signals and (b) client detection imprecision.

The 2.4GHz signal is roughly 7dB higher than the 5GHz signal. Physical attributes of BSSID antenna accounts for the difference in signal strength -it is not a limitation of the AP. By itself, the +7dB difference between RSSI strength is not enough to initiate roaming. Recall, the iPhone only initiates roaming after it identifies a BSSID  with RSSI at least +8dB or greater.

Wireless roaming reaches critical mass the client does not measure RSSI accurately (i.e. client imprecision).  This imprecision accounts for an additional plus or minus 4dBs. In other words, iPhones generally prefer 2.4GHz radios over 5GHz radios

Encryption and Ciphers

WPA and TKIP slows Wi-Fi traffic connection rates to a maximum 54Mbps. These standards are superseded by WPA2 encryptions and CCMP cipher. Do not enable WPA2 and WPA simultaneously. Likewise, do not enable WPA2 and CCMP and TKIP.

*Read the following post for specific fixes, recommendations, and best practices.

References: 

http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-0/iPhone_roam/b_iPhone-roaming.html
http://kb.juniper.net/InfoCenter/index?page=content&id=KB20295&actp=search&viewlocale=en_US&searchid=1301446020120
http://www.greatwhitewifi.com/2015/07/12/fixing-hallway-fi-vol-1/
http://community.arubanetworks.com/t5/Controller-Based-WLANs/How-does-the-quot-beacon-rate-quot-profile-work/ta-p/179242
http://kb.juniper.net/InfoCenter/index?page=content&id=KB28153&actp=search&viewlocale=en_US&searchid=1373982600826
https://en.wikipedia.org/wiki/IPhone
http://www.juniper.net/documentation/en_US/network-director1.5/topics/concept/wireless-encryption-and-ciphers.html
http://blogs.cisco.com/wireless/wi-fi-taxes-digging-into-the-802-11b-penalty
http://www.cisco.com/c/en/us/td/docs/wireless/technology/apdeploy/8-0/Cisco_Aironet_3700AP.html
https://www.wireless.att.com/support_static_files/KB/KB3895.html
http://kb.juniper.net/InfoCenter/index?page=content&id=KB20248&actp=search&viewlocale=en_US&searchid=1456780940943
https://www.youtube.com/watch?v=tihSXW6Yg1M