Limiting AP Range for Security Purposes

Within the wireless realm, there exists many devices to boost the AP signal (repeaters, bridges etc.) Now, this may sound like an odd question, but are there devices that can limit the AP's signal strength? I'll explain why I'm asking.
Let's assume the average wireless router can transmit give or take 300 feet. Obviously there are physical ways to limit the AP range (walls, obstacles etc). Now let's say I have a small, open studio type (no walls etc) office space, that doesn't need the full 300 foot range the router provides. Let's add to that that my office is located on a main street in the downtown area situated about 20-30 feet from the main road (with windows of course)...a.k.a the perfect place for rogue sniffers driving by to try and connect to my network. Also assume I currently have all the proper security measures in place that are available for my wireless network.
Now, here's my question. Does a device exist that can actually weaken the signal around the perimeter of my office space, so that my signal won't stretch beyond the exterior of the office?
A sort of wireless 'wall' if you will. Maybe something that actually recieves the signal of my wireless router and blocks any further transmission of it to the exterior. I'm not sure how you could actually 'direct' the signal itself so that you don't loose connectivity within the perimeter. I googled around using key words like "limiting AP range" but found mostly articles relating to placing the AP around physical obstacles to prevent the full range but nothing on actual devices that can limit the AP range. Does such a device exist?

Ever try Wireless reflecting paint?

Hawked here: http://www.forcefieldwireless.com/defendair.html

Hey, you could even use alternating layers of insulating paint to get real big capacitors and shock the heck out of unsuspecting people who grab the door knob.

:rolleyes:

You could also check the settings in your access point. I know the access point I'm running (Dlink, forgot specific model) has settings to change the signal strength in percentage. Just connect to your AP with a web browser and check around. Probably there somewhere.

- Xierox

Sure... reduce its power. Any number of ways to do this, including just looking on ebay for an old UPS that is on permanent brown out mode. ;)

cheers,

catch

REduce Transmitter Power (as mentioned) in the AP settings
Connect extra cable between the AP and the Aerial (this will reduce the reciever sensitivity)
Place a metal sheet in the direction you DONT NEED Coverage..(basic if you want details..pse ask) this is similar to ZT3000's reflective paint

Shag, these are all good suggestions; I'm gonna rock the boat.

Why reduce the signal? Are you using WPA with AES encryption? If not, range doesn't matter. Seriously...you can reduce the signal...I'll just get a bigger antenna to point at your studio.

It's not a bad idea, to go along with using the right encryption, mac filtering, etc. You may have already considered these things...I just wanted to make sure you ARE considering them. ;)

I appreciate all the suggestions. thanks again.
Reducing the transmitting power is a good idea. I also use a D-Link (DI-784) to be precise. What I'm concerned about with the transmitting power is that two particular PC's connected to the LAN seem to have connectivity issues when I decrease the transmitting power to 75%. I checked all the electronic devices in my office...none operate on the 5ghz range (we use 802.11a only). Once I put the transmitting power back up 100%, the problem disappears.

Quote:

---

Why reduce the signal? Are you using WPA with AES encryption?

---

Current Settings:
WPA-PSK with TKIP encryption (37 character passphrase - combo of letters/numbers/symbols)
MAC Filtering
Limited IP Range to number of computers in office
Static IP's
Changed the default SSID
Changed all default passwords to maximum length more complicated passwords
Disabled any/all options that offer an avenue for remote attacks (such as remote management, etc.)
Disabled the ping responses to the WAN side
Modified the default firewall settings to limit outbound traffic (generally to ports 80, 443, 25, 110) etc. your typical outbound ports
Modified log options to allow me to see all traffic (by default my D-Link logging didn't show all the traffic I was looking for)

I think that's it. As it stands now, this reflecting paint may be the way to go. I just have to talk with the guys at work to make sure it's ok to paint the walls with this reflective paint...maybe a nice hot pink and purple zebra striped look? :eek:

Quote:

---

Originally posted here by ShagDevil
Current Settings:
WPA-PSK with TKIP encryption (37 character passphrase - combo of letters/numbers/symbols)
MAC Filtering
Limited IP Range to number of computers in office
Static IP's
Changed the default SSID
Changed all default passwords to maximum length more complicated passwords
Disabled any/all options that offer an avenue for remote attacks (such as remote management, etc.)
Disabled the ping responses to the WAN side
Modified the default firewall settings to limit outbound traffic (generally to ports 80, 443, 25, 110) etc. your typical outbound ports
Modified log options to allow me to see all traffic (by default my D-Link logging didn't show all the traffic I was looking for)

---

What about turning off the SSID broadcast?

- X

xierox,
I'm not a huge fan of security through obscurity. IMO, disabling the SSID can be likened to the Children's Psych concept of "If I don't see it, It doesn't exist". Also, I don't want to chance any confusion by disabling the broadcast. As it stands now, I feel that the security mechanisms in place should suffice. I'm not saying disabling the SSID is stupid, it's just not something I feel is worth the effort.

WPA-PSK with TKIP encryption with a 37-character password like the one you have is as close as you can get to a secure network - apart from AES. Did you check to see if your router and wireless cards support it?
Even without AES, I wouldn't loose one second of sleep over the security of my wireless :)

Get rid of the MAC filtering - it'll only give your attacker more info, and it's worthless. And I fully agree with your point on turning off SSID broadcast, Shag :)

Quote:

---

Originally posted here by Negative
Get rid of the MAC filtering - it'll only give your attacker more info

---

Could you elaborate on this point? :confused:

- Xierox

http://blogs.zdnet.com/Ou/index.php?p=43

I agree that MAC filtering is defeatable, but it still adds one more layer of protection. In an environment with 1-2 wireless users MAC filtering is great. I use it on my home LAN and wouldn't operate without it. Yes, someone can sniff my MAC and use it, but I don't use my the wireless from my laptop all that often. This would mean an intruder would be forced to sniff my network for days-weeks at a time just to sniff out the right MAC to use. Can it be broken easily, yes. But it still increases the time it would take someone to jump on your network.

The likeness of the security guard is without MAC filtering, its like leaving the door open and letting anyone walk through regardless of what name tag they're wearing.

xierox,

Quote:

---

MAC address filtering is easy to defeat for someone who has the right tools. Using a wireless sniffer an attacker can watch the wireless traffic of your network and easily pick MAC addresses of valid users out of the frames floating through the air, even if they are encrypted.

---

From This article (I had this link from an old thread) This was the first indication that MAC filtering was relatively useless and once I read further into the WPA-PSK encryption method, I realized that the only thing that actually secured my network was the passphrase. It's amazing the information a cracker can get from the "4 Way Handshake". You can check out this thread if you want an elaboration on the subject matter.

XTC46 and myself had a debate on this some time ago and I came to this conculsion:

Quote:

---

Is MAC filtering better than nothing? Yes. However, for someone who is tech savvy and knows how to use wireless sniffers and other tools of the trade, I believe MAC Filtering is of no help to the Admin trying to stop him/her/it from accessing the network.

---

Now, after reading the article Negative provided, it just reinforced my beliefs that MAC filtering is hardly a useful security mechanism. My guess (and the only reason I say it's better than nothing)? The slim chance that it might stop a not-so-tech-savvy cracker, an "idiot" if you will.
Yes Yes, I know...I'm contradicting myself. I say disabling the SSID is pointless and don't use it, yet I say MAC filtering is just about pointless but I use it. The simple answer: it makes the guys that use the LAN at work happy. They seem to think it's this wonderful end-all solution to securing the network, so I just nod my head and go back to planting the greener grass on the other side of the fence ;)