I have a problem: my cable modem comes into the house in the spare room upstairs, where it goes through the firewall and drops down to the switch.
This then runs to the other computers in the spare room, and then the Rio Receivers in the upstairs bedrooms.
At the moment, there is no way to plug anything into the network downstairs, so I'm exploring some options:

1. Use HPNA. This would work great for the HSX-109 and for the Rio Receiver, but won't work so well for the car player. I could put a small PC downstairs to bridge PNA->Ethernet, but I'm trying to avoid this.
Are there standalone PNA->Ethernet bridges available?
Also, this'd require US->UK phone convertors. Do these work with PNA?
I'm reluctant to do this, 'cos PNA isn't great.

2. Run Ethernet downstairs, inside. This would be the ideal solution, but there's a problem. I live in a rented house, which has got all sorts of nice-looking coving in it, and a wooden floor in the lounge.
To get Ethernet from the spare room to next to the fireplace (which is where the amp and TV are) is going to be tricky at best. Any ideas for hiding UTP cable?

3. Run Ethernet downstairs, outside. This is probably the simplest solution - get a big drill and put a hole in the wall of the spare room, and another in the wall of the lounge. This would allow running the cable down the front of the house.
However, there's a difference of opinion in the office w.r.t isolation, if it gets hit by a lightning strike (Peter thinks this could happen, Hugo doesn't, John says you can't tell).
I don't want to lose a couple of grand worth of computer gear. Isolators aren't cheap. Are they necessary?
On the bright side, ISTR that my UPS has a UTP isolator in it, so that's one end catered for.

4. Wireless. This is obviously the coolest solution, but I'm not sure how to proceed. It's likely that I'll have more than one device downstairs, but won't have a PC.
It's also possible that, in future, I'll want wireless access from elsewhere (e.g. a laptop). This kinda dictates that the wireless access point has to go upstairs.
Which means that I need some way of connecting the empeg to it, from downstairs.

Suggestions?

http://www.2wire.com/products/hpspecs.html

Does this help?

Bob

Are there standalone PNA->Ethernet bridges available?

Yes, but they are expensive. The one I found was about $200. With the adaptors that you may need for the US->UK issue, it is probabl not worth it for the slow speed.

I'm not sure what would happen if ethernet on the outside was hit by lightning. I am running a cable like this in a similar situation, but it's fairly low on the house, and a ton of ancient trees are around that I figure will take a hit before the house does. And it is grounded from the satelite coax ground run, so hopefully it's fine.

Wireless might be the best way to go. It can cost a bit, but the ability to sit somewhere on the network with no cords is well worth it. Theres enough wireless devices that you should be able to buy two and do whatever you need (access point and bridge, etc...)

In your case (rented house) I would recommend a Wireless solution ... Plug an access point in upstairs, then to get good signal downstairs (if necessary) get another access point that will bridge off of the connected one, extending your range.

I would look for access points that are future compatible if possible ... like those that will allow you to change a pcmcia card out for a newer technology. Orinoco (Lucent) does this, and I believe Linksys is on the right track with their newer access points.

802.11b is pretty available now and moderately inexpensive. Very cool. This is what I run at home, and what they have around my school. It's a bit faster than your cable modem or dsl line, so it won't be a bandwidth constraint. 11 Mbits/sec ... so a little faster than 10BT right?

802.11a is the new cousin to that. Some manufacturers are getting near 90 Mbit/sec in "turbo" mode ... that's almost filling a 100BaseT pipe. These products are out, but not every manufactuer has advertised support. Proxim has and they've got a few products out ... a little pricey but very fast.

Orinoco has a good backbone to support these new technologies, and a very strong reputation for support, compatibility, innovation, ... this is what I would probably get in your case.

The Linksys WAP11 can operate as an "Access Point Client" to another WAP11 acting as a normal access point. This allows you to bridge two ethernet networks while still having an access point to be used by regular 802.11b clients. For your configuration, you could hang one WAP11 off your switch upstairs and set it up to be an access point. Downstairs you can hang the second WAP11 off a hub/switch or directly into the HSX-109 (might need a crossover for direct connection... not sure). The downstairs WAP11 would be set up as an access point client and you'd configure it with the MAC address of the upstairs WAP11.

WAP11's run about $140 in the US. I'm planning a similiar configuration for my Rio Receiver because HPNA has proven to be unreliable in my house and I'd rather spend money than deal with dropping an ethernet cable in the living room.

I believe this access point client configuration is proprietary to Linksys and won't work with other brands, but I'm not sure. Anyone know?

-Dylan

There was some other technology that offered the base 54mbps and "vendor enhanced" speeds that still worked in the 2.4ghz range. I have a feeling this will do better since most people will be able to just upgrade their existing setup, and remain backwards compatible, compaired with an 802.11 a/b compatible product needing to use two different frequency ranges.

Okay i shall go for the low tech option

An isulated wire outsie is unlikely to be hit by lighting as i imagine you have points higher than this with exposed metal like the tv arieal

If you have a phone line going where you want you could be real brave an tape a new telephone wire and ethernet cable without plugs to it and try pulling it throught the house. The best way to do this is to get some string do a load of half hitches round it and tape it up and then attach new stuff to it. get one preson to feed and one to pull gently.

Dependant on the age of the house and how it has been wired you might be able to remove the sockets on the walls and run with the power cables but that would need loads of messing around.

Another thing is can you get under the floor to run cables under the house

If you have central heating see where the pipes go from downstairs to upstairs

Or if you are cohabiting with a woman convince her that you need to redecorate then once she has decided on a new colour scheme before you wall paper/paint cut a nice big channel through the plasterboard and run your cables. Also if it is a rented house some landlords can be persuaded to contribute to redecortion costs.

If you have central heating see where the pipes go from downstairs to upstairs

Heh, I forgot that I do this in my house now. My cable modem and server sit in the basement, and I run a Cat5 cable up into the exposed pipework of the house. It then eventually dusappears into a vent, and reappears in the bathroom, where it hides under the rug, and goes into the hub in the next room.

Works rather well, and the response from someone who notices the Cat 5 under the rug is always fun

You have five cats under your rug !

How do you feed them?

Go to your local hardware store and purchase a long flexible drill bit. You can use these to drill small holes in the sill/floorboards/whatever inside the wall via a cutout that you'll have to make anyway for a jack plate. It's then pretty easy to run the cable through that hole, as long as you make sure that you cut a hole in the drywall at the right place below it. Given that your house has studs 20 inches on center, at most, you don't have to fish around too much to find the cable once you've threaded it through. Nice and tidy.

Studs 20 inches on centre? Roger's in the UK. God only knows what kind of house he's living in. :) I wouldn't even assume his walls are using drywall (gypsum-board, etc).

Bruno

16 inches on centre where I live in Canada - 2x4" lumber.

Oops. There goes my US-centrism again. Sorry. Still, it's likely that it will still work, unless you have stone separating those floors. But cutting through plaster and lath is a huge pain, if that's what his walls are.

Around here (North Carolina), 16" on-center is, by far, the most common, but I think code allows up to 24" on-center in certain low-load situations, but I've never actually seen that. I've seen some old homes with them 20" on-center, though.

Tsk, my parents house has stone walls that are over 24" thick in parts (stays really cool in the summer!), and not exactly totally straight. Ditto for the ceilings. I think they call it "character".

...then again, it was built in 1649 ;)

Roger's place looks to me like it was built somewhere between the 1950s and early 1980s. Brick & plaster.

Hugo

This is what I would do. Its the most trouble free way to go and it only costs 300 dollars.

Sean

Yeah, but you only get 11Mbps at most.

That should be fine in most cases. All the empeg/hsx/rio reciever stuff will only run at 10 anyway, right?

Sean

Generally, it's more than adequate. My home network:

1 Apple Airport base station (for client 802.11b access, 128-bit WEP -- I replaced the WaveLAN siver with a gold card)

2 LinkSys WAP11 base stations bridging my home office and my living room LANs

at least 2 notebooks simultaneously web browsing, listening to streaming media, logging into/transferring files to/from machine on my home office LAN or systems in colocation facilities via 802.11b PCMCIA cards

at least two handhelds doing similar things, plus running either VNC or Microsoft's remote access client (basically the same as VNC, but for Windows) via 802.11b cards

Occasionally one of my Tivos also pulls its updates via a Toshiba Libretto running OpenBSD and networked via an 802.11b connection.

1 SliMP3 on the living room LAN streaming MP3s from Live365 via the 802.11b bridge, or from my MP3 server on my home office LAN (also via the 802.11b bridge)

I've had the SliMP3, both notebooks, and Tivo all sucking data simultaneously, without placing any strain on that 11Mbps pipe.

...new telephone wire and ethernet cable without plugs to it and try pulling it throught the house

Won't work. Tried that. The telephone cable vanishes into the depths of the walls too thoroughly for that to work.

We also tried threading the cable through the front wall, along with the cable TV, but without success. This is why I purchased a drill.

Another thing is can you get under the floor to run cables under the house

Not easily, the living room floor is wood-panel, so lifting it is likely to be tricky.

You can see the walls (including the coving) in this photo: http://www.riocar.org/modules.php?set_albumName=album42&id=aaa&op=modload&name=gallery&file=index&include=view_photo.php

You can't see the floor in this one, but maybe I'll take more pictures later.

...if you are cohabiting with a woman convince her that you need to redecorate...

Well, I share the house with Toby (prolux), and persuading him that we need to redecorate wouldn't be hard. The landlord, on the other hand...

So, let me get this straight -- if I get a pair of Linksys WAP11 boxes, I can configure them to do bridging? Ethernet level bridging, or IP routing?

Also, is the security in these things adequate? If I was running another PC downstairs, I could route PPP over an ssh tunnel over the wireless, which would be a cool hack, but slightly overkill.

Studs 20 inches on centre? Roger's in the UK. God only knows what kind of house he's living in. :) I wouldn't even assume his walls are using drywall (gypsum-board, etc).

Yes, it is probably an actual house (you know, bricks, mortar, concrete, that kind of stuff), not an oversized shipping crate...

In reply to:

---

Yeah, but you only get 11Mbps at most.

---

I think its really only 5.5mps in each direction. Sort of mis-leading.

Its ethernet level bridging as far as I know. You can set it up to where it will only talk to a certain mac address, and there is 128 bit wep available. Im sure there are other ways to increase the security by encrypting things at both ends, but I haven't tried them.

Sean

Bricks and mortar are still adhered to a stick frame. By themselves, brick walls don't hold up too well in building-type applications. That is, when they have to support a load, like a roof or a second story.

Won't work. Tried that. The telephone cable vanishes into the depths of the walls too thoroughly for that to work.

Did you try using a fish tape?

Er, I beg to differ.

Hmm. It seems modern construction techniques are quite different (moreso than I imagined) between the US and the UK. I've never seen the load-bearing porion of a house made of masonry in the US. But then, your link suggests that most houses have a facade made of masonry as well, which is only seen on about, at a guess, a third of the houses over here. (And that's near Sanford, NC, one of the ``brick capitals of the world''.) I guess it probably has to do with the differing amounts of wood historically available. It was probably much easier for American colonists to build wooden houses than to build stone ones based solely on resources availabe and it probably continued that way.

Regardless, how do internal walls work in these masonry-built houses? Surely there's not bare masonry exposed internally. And gypsum board is only about 50 years old. Is there strapping adhered to the masonry to which the plaster lath is attached? Is there any insulation involved at all?

Regardless, how do internal walls work in these masonry-built houses? Surely there's not bare masonry exposed internally....to which the plaster lath is attached? Is there any insulation involved at all?

I'm not completely sure -- I only live in one -- but I found some information here which seems to confirm my suspicions that you simply put wet plaster directly on the internal (brick) wall.

As far as the external walls go, newer houses tend to have a cavity wall, where the inside is breeze-block, and provides the load support, and the external wall is brick, which doesn't contribute much to the load support.

ISTR that the outer wall is held in place with the help of the eaves around the roof.

This kind of construction is limited in height, but for two to four storeys, it's not a problem.

Also, I suspect that early settlers in the US couldn't find the clay they needed to make brick (they were too busy trying to survive to go digging in the ground and building kilns), so they made do with wooden construction.

Since it works fine, they didn't bother making bricks when they did have the spare time.

To be fair, in modern houses (in Croatia, anyway :-) load-bearing elements (corners, beams above openings and at the top of each floor) are usually made of reinforced (or, in the case of very high structures pre-stressed) concrete. Bricks, hollow concrete blocks or blocks made of porous concrete (they mix it with hydrogen peroxide so that released oxigen makes trapped bubbles - very light and good insulator) are used to fill the skeleton. However, that was not always the case.

Gypsum boards are used very rarely in residential buildings. Masonry is usually covered by mortar (plaster? - anyway, mostly lime, sand and water); sometimes wood paneling is used.

Bricks are very good insulator if they are not solid. Modern non-load-bearing bricks have voids of perhaps 75% of horizontal cross-section. However, one usually puts a layer of insulating plaster (normal lime- or cement-based or synthetic resin-based, mixed with beads of insulating material - clinker, volcanic ash, polystirene) between masonry and final, decorative layer of facade. Another aproach is puting a layer of polystirene blocks between masonry and plastic mesh that holds together outer layer of plaster (not very vandal-proof).

Also, is the security in these things adequate?

By default, probably not. A neighbor with an 802.11b card could probably hang around on your network.

In our town, we have an internet service provider who has an 802.11b network in their central office. This is not my provider, it's my provider's competitor.

Well, the owner of my provider's company, Scott, likes to take his laptop with him when he has lunch at Burger King. See, Burger King is next door to this competing ISP's office, and Scott can surf the net using their 802.11b router.

Scott, on the other hand, builds little custom 802.11b routers using his own custom-modified Debian distro running from flash RAM. He locks everything down so that others cannot do what he does at Burger King.

One of his tricks is to lock out all MAC addresses except the ones he specifies. So only a given set of cards will be able to access the router. I don't know if that would be possible to do on the off-the-shelf routers, but if it is, that would be adequate security for your home LAN, I think.

Also, I suspect that early settlers in the US couldn't find the clay they needed to make brick

You've obviously never been to North Carolina. (The Roanoke (Lost) colony was either in southern Virginia or northern North Carolina.) There is nothing but nasty red clay as far as the eye can see. Right on the surface. At the same time, trees were probably more readily available and needed to be cleared an order to build a structure anyway.

It's actually pretty easy to set up the encryption that comes with these things, which is called WEP (Wired Equivalence Protection). You have to make up your own key, so it's not on by default, but it's easy to do. It's not the best encryption ever, but it'll keep your neighbors out. The Orinoco Gold cards have even better encryption available, if you're concerned, though.

It's actually pretty easy to set up the encryption that comes with these things, which is called WEP (Wired Equivalence Protection).

http://techupdate.zdnet.com/techupdate/stories/main/0,14179,2803615,00.html

So which is easier, hacking the WEP key, or spoofing a card's MAC address? Is the latter even possible?

It's much easier to spoof a MAC address. The Orinoco cards don't allow you to do it by default, but it's pretty much a requirement for bridging. All operating systems I've seen other than Windows have a very easy interface for modifying MAC addresses for most NICs. And no one said it was perfect, but it'll keep Grampa Jones next door from snooping on your network.

Yeah my Linksys BEFSR41 router can do it as well. MAC's were designed to be globally unique, but nobody really enforced that.

And no one said it was perfect, but it'll keep Grampa Jones next door from snooping on your network.

I'm not worried about Grampa Jones, it's that slacker teenage grandson of his with the funny haircut.

That's not entirely true, either. There is a bit in the MAC address that indicates whether it is a globally unique address or not. If it's not set, you can set the MAC address to whatever you desire. Of course, no one ever really enforced the rest of the spec, other than manufacturers do ship with only their assigned prefixes.

In reply to:

---

And no one said it was perfect, but it'll keep Grampa Jones next door from snooping on your network.

I'm not worried about Grampa Jones, it's that slacker teenage grandson of his with the funny haircut.

---

Oh HIM...

IPSEC.

Your guy rolls his own routers, it should be (almost) trivial for him to just encapsulate all legitimate traffic in an IPSEC packet, and then reject any wireless traffic that is not ipseced, with the right key.

He's probably already doing it. If he's not, then he should be.

IPSEC really makes WEP and MAC locking look.... pathetic.

...other than manufacturers do ship with only their assigned prefixes.

Not even that. I was once troubleshooting a small network for a friend. Nothing worked. It turned out that all of 3 or 4 ultracheap no-name Ethernet cards he bought had the same MAC address. Perhaps it was possible to reassign them, but there was not a sheet of documentation, drivers, nothing (they emulated some popular card, I don't remember which). We just tossed them. Serves him right.

Funny. But I would still be surprised if they didn't use that no-name manufacturer's IEEE assigned ID as the first few digits of the MAC address, even if the rest of the address was the same as well.

In reply to:

---

So, let me get this straight -- if I get a pair of Linksys WAP11 boxes, I can configure them to do bridging? Ethernet level bridging, or IP routing?

Also, is the security in these things adequate? If I was running another PC downstairs, I could route PPP over an ssh tunnel over the wireless, which would be a cool hack, but slightly overkill.

---

Yes, two LinkSys WAP11's will do Ethernet (i.e., layer 2) bridging via 802.11b.

The security is 128-bit WEP. And since WEP has been completely cracked, you'll want to limit access by MAC address, use host and user-based RADIUS authentication, and use something like ssh or similar strong encryption for anything you don't want sniffed. There are evil people running around with homebrew directional Yagis (*sound of skritch hiding that threaded rod, Pringles can, and length of PVC piping next to his desk*).

In reply to:

---

One of his tricks is to lock out all MAC addresses except the ones he specifies. So only a given set of cards will be able to access the router. I don't know if that would be possible to do on the off-the-shelf routers, but if it is, that would be adequate security for your home LAN, I think.

---

All commercial access points have this functionality, including the LinkSys and Apple models.

In reply to:

---

It's actually pretty easy to set up the encryption that comes with these things, which is called WEP (Wired Equivalence Protection). You have to make up your own key, so it's not on by default, but it's easy to do. It's not the best encryption ever, but it'll keep your neighbors out. The Orinoco Gold cards have even better encryption available, if you're concerned, though.

---

Actually, the Gold cards do 64-bit and 128-bit WEP. The Silver cards do only 64-bit WEP.

Cisco cards and access points can use EAP/LEAP, which is basically RADIUS authentication and a bit of added trickery.

And, as I mentioned earlier, WEP has been completely cracked. I'm giving a talk in April on a handheld device I put together that is trivially concelable and can crack WEP.

Ok, within reason, what can I use to supplement WEP?

Well, what are you looking to do? Prevent people from seeing your traffic? Prevent people from using your network without your knowledge? And what are you doing with your network? Just web-based stuff? All external access? Or do you access local machines on that network?

For now, I am using WEP and the mac addresses to limit access. I use the wap to access local machines on the network, print, surf the web, that sort of thing. Theres nothing extremely important going on, but I don't want people seeing my traffic. I don't want people to be able to use my network with me knowing about it.

Sean

I dunno about him, but I'm planning on bridging from the upstairs LAN to the living room, which will _not_ have a PC in it, but will have a couple of empeg-compatible devices.

All of the obvious things (a VPN or PPP over SSH) require a PC at both ends, so that's out.

So, unless I can beef up the encryption provided by the access points (given that they'll be running as peer-to-peer), I'll have to put up another set of rules in my firewall, and park the wireless gear outside it. This is a pain.

Also, both of these solutions mean that the Ethernet-level bridging no longer works, which is less than ideal, because of the need to get subnet-local IP broadcasts over this thing.

Are you sure that you can't get a cable run in the walls? I've run cables hundreds of yards and been able to find it. The trick is to use the fish tape to start as far back as possible and then tie the end of the cable to it before pulling back. Then repeat as many times as necessary. Or did we cover that implicitly in our stick-frame/masonry discussion? How are your electrical wires run now?

They're most likely run in channels cut in the plaster. At least, I think that this is how it's usually done.

I think that sounds right. Sometimes you can see it on some older houses in the US. The electricity must have been added after the house was built. Wireless sounds like the only way unless you want to run cables out windows and down the side of the house.

In bridge mode, nobody else will be able to use the access points, so that takes care of that problem. With 128-bit WEP, and assuming you're sensible about the data you push over the bridge (everything encrypted that should be encrypted), it's fairly secure.

You don't think RIAA is going to sue him for broadcasting MP3s to hordes of pirates on 'wardriving' path?

BTW, how easy is it now to actually break through WEP protection? I mean, is it broken in the sense that an attack is described which still needs sophisticated algorithm and weeks of processor time, or is it more like DeCCS? (The link to Shamir et al paper on your site does not work and I don't have ghostscript on this #@!% machine...)

Hm. Thanks for the heads up. I just fixed that link. It now points to an HTML version of the paper.

As to difficulty, it can be cracked in hours. In certain circumstances, it can be cracked in minutes. Horsepower isn't necessary. What's needed is a good sampling of the traffic, including the initialization vectors (IVs).

This is difficult to get in a mobile scenario, unless you're on a busy network (e.g., a company network). In a home scenario, the frequency of computers establishing a session with the AP will be low, and it will take much longer to collect the necessary data. This is bad for people trying to hack WEP by strolling or driving by, but of no consequence to neighbors, who have as much time as necessary to collect the data.

So, it's not like you need to go build Deep Crack ($10,000 homebrew kit for breaking DES in real time), but it's not as simple as ROT13ing the data stream, either.

Update all devices using WEP to the latest firmware, and make sure it's been released after DEC 2001, the solution to the WEP security was only made in DEC '01.
So new firmware should be Rolling out for all devices.

If you want to go wireless and you can't have a dedicated PC downstairs to be your VPN bridge, then you might be able to buy a dedicated IPsec bridge which you put behind your wireless gateway. This is serious overkill.

Probably the right answer for the home network is to have the wireless be outside the firewall, and limit the incoming connection to the specific IP address and destination ports. That would mean that a dedicated outsider would be able to run emplode and see your car stereo, which is probably an acceptable (if humorous) risk.

Think of the possibilities for mischief, particularly from your friends who now know all about your potential home setup. Drive by with a laptop and a wireless Ethernet, and they can add new music, delete old music, relabel tracks, and heaven knows what else...

Maybe you really should have a PC downstairs. Rather than the WAP11 gateway, just get an old laptop or get one of those micro-case PCs. PC Power and Cooling (the Silencer folks) sell a 1GHz P3 computer in a 1U box for $1000.

sell a 1GHz P3 computer in a 1U box for $1000

Yeah, but it doesn't really need to be 1Ghz, though, does it? I've already got plenty of horsepower in the server^H^H^H^H^H^Hspare room .

Personally, I've been looking for an excuse to buy one of those Shuttle SV24 boxes (about £169 plus CPU, RAM, HD, CD, FDD), although I'd probably just network boot it -- quieter that way.