Prevent IP address conflicts on your wireless network by managing DHCP scopes

One of the problems with bringing a wireless access point into a wired network is that the vast majority of wireless access points are configured by default to act as DHCP servers. Unless you plan ahead, this can cause some problems if your network already makes use of DHCP.

There are two main problems that wireless access points can cause when they act as DHCP servers.

The first is that there is the potential for IP address conflicts. The majority of the wireless access points on the market are configured by default to assign clients IP addresses in the 192.168.0.x range. This is a problem because it is fairly common to include multiple wireless access points on a single network segment. If each of these access points is assigned the same DHCP scope, then IP address conflicts are bound to occur. Keep in mind that these address assignments may not be limited to wireless clients. Many wireless access points will assign IP addresses to clients on the wired network as well, so you could potentially have clients on your wired network conflicting with wireless clients.

The other problem with the default DHCP configuration used by most wireless access points is that the 192.168.0.x address range may not mesh with the address range that you are already using. For example, suppose that -- prior to installation of any wireless access points -- your network uses the 190.160.25.x address range (I'm just making up a number). If this were the case, there are two reasons why having a wireless access point assigning clients 192.168.0.x addresses would cause problems.

First, the clients that had been assigned the 192.168.0.x addresses would not be able to communicate with network hosts using the 190.160.25.x addresses. The reason is that clients using the 192.168.0.x address range would think that hosts with the 190.160.25.x addresses were on a different network segment, even if that were not the case. They would therefore look for a router and try to use the routing tables to figure out how to reach this segment. Assuming that both address ranges existed on the same segment, communications simply wouldn't work.

The other problem with allowing wireless access points to assign 192.168.0.x addresses is that these addresses are not routable. If your network consists of multiple segments, you won't be able to use this address range.

Now that I have discussed the problems associated with the way that wireless access points assign IP addresses by default, I want to talk about how to get around these problems. First, I should mention that some wireless access points are more flexible than others. Not all of the techniques I will be discussing will work with all access points.

The best way of preventing IP address conflicts and other communications problems is to decide beforehand what scope of addresses each DHCP server and each access point will manage. That way, you can allow each DHCP server and access point to assign IP addresses as needed, without having to worry about overlaps.

For example, on my own network I use the address range 147.101.x.x. Again, I chose this address range at random. Since I have one DHCP server and one wireless access point, I configured the DHCP server to assign addresses ranging from 147.101.101.1 to 147.101.101.100. I then configured the wireless access point to assign addresses ranging from 147.101.101.101 to 147.101.101.200. That way, all of the IP addresses that could potentially be assigned fall within a common range, but there is no risk of addresses overlapping and causing an IP address conflict.

When you configure an access point to assign a specific IP address range that is unique to your network, a couple of other things need to be taken into account. One thing that you need to consider is that you probably use a few static IP addresses on your network. You must define exceptions for any static IP addresses that are in use, to prevent that address from being assigned. On my own network, for example, I have a DNS server that uses the address 147.101.101.34. This address falls within the range of addresses that my DHCP server is configured to assign. I therefore defined an exception so that the DHCP server would never assign 147.101.101.34 to a client.

The other thing that you need to take into account is that if you configure an access point to assign addresses that are unique to your network, you will also have to configure the access point to assign a DNS address to clients. If you don't do this, clients either won't be made aware of the address of your DNS server, or they will try to use your ISP's DNS server, which of course will not contain the DNS records that are associated with the hosts on your private network.

As you can see, blindly installing a wireless access point can cause a number of problems. Since most access points also act as DHCP servers, it is important that you decide ahead of time how the new access point will fit in with your existing IP address scheme.

fighting peer-to-peer

When network managers find peer-to-peer file sharing overwhelming their networks, some of the best words of wisdom might be to "let it be," just at a slower pace. It is a strategy many colleges have found effective as they manage some of the heaviest users of BitTorrent and other protocols that can wreak havoc on a network -- not to mention land the operator in hot legal water.

Several university network managers who were interviewed said the most effective strategy was using network management devices from companies like Packeteer and Exinda to limit, but not block, peer-to-peer protocols. Slowing down peer-to-peer erodes these methods' usefulness for downloading the latest blockbuster while not making it so difficult that savvy students encrypt or otherwise make their traffic undetectable, which can end up increasing overall peer-to-peer usage.

It also takes colleges out of the sticky problem of policing the legality of content over their networks.

Cindy Borovick, program director with market intelligence firm IDC, said that today's packet-shaping devices were mature and ready to take on the challenge of effectively managing large networks.

"The issue really is: Have customers architected that functionality into their network?" Borovick said. "I think it's a matter of budget and recognizing that you have that need up front."

At Walla Walla University, in College Place, Wash., a relatively lenient approach, coupled with protocol-based traffic shaping, has largely mitigated the effects of file sharing.

"A couple years ago, we used to get one or two [copyright infringement notices] a week, but we haven't gotten any in two years," said Paul Harvey, a network manager at the university. "I don't know if that's because our ISP hasn't been forwarding them on, or because we've stopped being targeted, or why."

A combination of increased user demand and falling per-megabit costs also kept bandwidth expenses relatively stable for Walla Walla during that time. The university uses Exinda hardware to shape and monitor the traffic for its 2000 computers. BitTorrent is given a lower priority and a bandwidth cap, while HTTP and VoIP traffic is given priority. Some traffic, like SQL and Samba, is completely blocked off from the Internet to help cut out security holes and reduce bandwidth consumption.

"We decided to do this because people are going to find a way around [blocking peer-to-peer] anyways," Harvey said. "With the latest Exinda software version, it actually finds the latest encrypted peer-to-peer, and Exinda says don't block it completely, just slow it down because the latest programs will reconfigure the way they work [if blocked]."

Instead of playing cat-and-mouse with student pirates, Walla Walla and other colleges play a waiting game -- but it is peer-to-peer users who have to wait. It also frees the university from having to use deep-packet inspection to actively police what students are downloading and uploading on their networks, deterring all peer-to-peer while not completely closing off legal (or illegal) usage.

"Maybe it's kind of an ostrich with the head in the sand, but the less we know the better it seems," Harvey added. "That's how some people view it at least."

Jason O'Rourke, director of Pavilion ConneXions, provides residential Internet access to students at the University of Lincoln in the United Kingdom and has found success using similar methods.

We found that if you block p2p, students will find a way around it, so … restricting it was more effective Jason O'Rourke Director, Pavilion ConneXions

"We have a very open policy, in that we don't stop anybody from doing anything," O'Rourke said. "The Internet is for their personal use after all. There is a fair-use policy enforced."

He said that peer-to-peer protocols are not stopped but are restricted, particularly during peak usage hours. Occasionally, during maintenance, the Exinda traffic-shaping appliances that Pavilion uses are taken offline and users are immediately reminded why peer-to-peer is restricted: The connection slows to a crawl.

"We found that if you block p2p, students will find a way around it, so … restricting it was more effective," he said.

As of now, only a few colleges have sought to try to block all pirated content outright, and products that take that approach continue to be developed. One such solution is Audible Magic's CopySense appliance, which has been favored by the RIAA (Recording Industry Association of America) as a way of detecting and blocking the transfer of copyrighted files. While not perfect, these methods might get renewed attention if the College Opportunity and Affordability Act of 2007 is passed into law.

taken from :http://searchnetworking.techtarget.com/