One problem with Cliff's approach is that the chipset (in the AP) might choose to look at BSSIDs in its decision to ACK a frame, so its going to have to ACK a (potentially large) range of BSSIDs. Some chipsets support doing this (ahem), but I doubt you get it done on hostap without firmware hacks.
Cisco implements the below marked as "PSPF" (public secure packet forwarding). The most straight-forward approach is to 'mark' any packet arriving on any wlan interface, and then, on output, check for the packet being marked. If it is, drop the packet on the floor. (If its not, forward the packet out the interface.) There are corner cases that need to be thought out (group-addressed frames), etc. jim Cliff Skolnick writes: > When the AP hears the client's associate request, it responds with a > unique BSSID - at least that's what I was thinking of trying at some > point. Pretty easy code wise, should not break any protocol stuff. It > will just look like each client has their own AP. > > This will not deter much of anything sneaky, as any card in monitor > mode can still sniff all the traffic. Where this will help is isolating > client at hot spots to make it harder for viruses to spread (which was > my goal) since the clients are on their own network too. > > Cheers, > Cliff > > On Dec 19, 2003, at 2:39 AM, Matt Peterson wrote: > > > I've found a number of 'Hotspot-in-a-box' units have a feature marketed > > as 'inter-VLAN security'. Essentially, with this enabled, STA's only > > see traffic to the AP & back, not other STA's (associated to the same > > AP). > > > > Funky indeed, 'security though obscurity'. I haven't broken out a > > 802.11 frame sniffer (yet), wondering how this is technically done and > > expierences deploying this? It would seem like all the Hotspot players > > would jump on this, as a "security" solution. > > > > The most 'famous' box, seems to be Handspring's WSG-4000 (relabeled > > from > > ZyXEL, DemarcTech, etc) > > <http://www.handlink.com.tw/eng/products/hotspot/WSG4000/ > > products_hotspot_wsg4000.htm>. > > > > -- > > Matt Peterson another.geek.without.a.life > > [EMAIL PROTECTED] http://matt.peterson.org/ > > ------------------------------------------------- > > -- > > general wireless list, a bawug thing <http://www.bawug.org/> > > [un]subscribe: http://lists.bawug.org/mailman/listinfo/wireless > > > -- > "For every complex problem there is an answer that is clear, simple, > and wrong." > - Henry Louis Mencken > > -- > general wireless list, a bawug thing <http://www.bawug.org/> > [un]subscribe: http://lists.bawug.org/mailman/listinfo/wireless > -- "Speed, it seems to me, provides the one genuinely modern pleasure." -- Aldous Huxley (1894 - 1963) -- general wireless list, a bawug thing <http://www.bawug.org/> [un]subscribe: http://lists.bawug.org/mailman/listinfo/wireless
