Comments on David Alison's Blog: Setting up a Time Capsule

@David: No problem. I've had wireless of some typ...

2008-09-26T17:12:20.385-04:00

@David: No problem. I've had wireless of some type for 10 years now, and can understand the difficulties in finding good info. Mine comes from experience of setting up a lot of peoples network, and balancing security with ease of use.

@anonymous: Ahh yes, forgot about MAC filtering. It can be somewhat useful, but doesn't really provide a ton of security. Faking a MAC address is easy as well, so anyone equipped to try and break the encryption on the network isn't going to be slowed down at all by MAC filtering. For me, maintaining the list is just one extra step that I don't want to deal with, as it adds very little benefit, but can be a pain when you bring home a new wireless device.

I find when securing wireless networks, and you do...

2008-09-26T16:48:34.705-04:00

I find when securing wireless networks, and you don't have people who come and go and want to use your wireless then enable mac address filtering (just make sure you do it from a weird machine)

@Tom: Excellent information man, thanks very much!...

2008-09-26T16:40:16.431-04:00

@Tom: Excellent information man, thanks very much!

@mbmcavoy:Mixing G and N devices doesn't bring dow...

2008-09-26T16:29:12.839-04:00

@mbmcavoy:

Mixing G and N devices doesn't bring down the entire network to G speeds, but it does have an impact on maximum speed the N clients can go if the G devices are also using the network. Isolating the types of WiFi is a decent way to keep things speedy.

I personally have a dual band router that can run both 2.4 and 5.8ghz access at the same time. I create two networks, with 5.8 only accepting N clients, and 2.4 accepting G and B for backwards compatibility. Unfortunately the Apple Airport base stations (and Time Capsule) aren't dual radio equipped, so they can only operate on 2.4 or 5.8 individually.

@David:The reason I usually recommend keeping SSID...

2008-09-26T16:25:07.105-04:00

@David:

The reason I usually recommend keeping SSID broadcasts on is that it makes it easier to join for your own machines. I've had the wireless cut out on my Mac before, and to rejoin all I had to do was click on the wireless icon and the network again. With SSID broadcasts off, it won't show up in the menu, so you have to tell it to join again, type in the name, and sometimes the key again. So from the user perspective, it's a pain.

In addition (just checked this to verify) SSID broadcasting is also required for the roaming possibility, as the beacons are used by the clients to decide what access point has the stronger signal and where to go.

As for the security aspect, all it does is stop a casual user from seeing your network. With encryption, they wouldn't be able to join it anyhow, so they are locked out. Any wireless sniffing software will find a network without SSID broadcasting, so if someone is trying to hack into a network, turning off SSID broadcasting doesn't even slow them down.

I don't know of any official docs on locking down as I haven't looked in a while, but the following should help. The key component to keeping the network secure is the encryption. From strongest to weakest, your choices are:

WPA2
WPA-AES
WPA-TKIP
WEP
Open

WPA2 and WPA-AES are also generally the lowest in terms of impact on wireless performance beyond no encryption as they are hardware accelerated in most cases. WEP and TKIP were software only in most implementations. Choose the highest level you can that all your devices support.

Beyond choosing the encryption, passkey length is a factor. The longer, the better, as it is more resistant to brute force attacks. Find a balance between what you want to key in on devices like your iPhone, and how secure you want the network to be.

Currently, cracking WEP is really trivial. Going above WEP requires a lot of effort, and realistically noone is going to casually try to get into your network if it runs WPA or higher. Unless you have something on your network beyond free internet that they really want.

Good discussion here.I don't have any coverage pro...

2008-09-26T16:17:10.962-04:00

Good discussion here.

I don't have any coverage problems in my house. My MacBook is the only wireless-n device I have, but there are several other g devices. My understanding is that n will fall back to g if any other devices connect, with the slower speeds for all. So, I maintained my old router as a g access point, and set the Time Capsule to only support n. It took a little config work on the old router, but it works just fine.

I would also like to say how happy I am with the print server in the TC.

Our inkjet was previously connected to one of our PCs, but Windows XP print sharing simply fails to work. It used to, I but my brief time with OneCare broke it. Besides, it's annoying to have to boot up if you want to print from another computer.

I have a Maxtor NAS with a print server, but the speed was painfully slow, and it didn't always work right. So, I put the printer back. (Time Machine wouldn't use the NAS, probably because it's NTFS-formatted)

The Time Capsule print server is just as fast as direct-connect USB, and works like a charm from every computer.

Finally, the only errors I have had with Time Machine/Time Capsule have been when I have opened and closed the lid for quick lookups; and then it has been a "lost network connection". The errors don't persist, and the next backup works just fine.

@Tom: Interesting suggestion Tom, thanks. I'm curi...

2008-09-26T14:09:03.654-04:00

@Tom: Interesting suggestion Tom, thanks. I'm curious why you think not broadcasting the SSID is helpful? I'm sure it can be discovered in some way but doesn't it cut down on the local kids that just happen to want to hack into your home network?

Anyone have tips or a good site with recommendations on how to effectively secure a wireless network in the home?

One thing you can do now with multiple wireless ac...

2008-09-26T13:49:57.596-04:00

One thing you can do now with multiple wireless access points is ensure good coverage in your house from everywhere. Set up the wireless settings on both devices to match nearly identically. Specifically:

1. Set the SSID identically (and don't bother with hiding the SSID, it's not really any security, and it only makes life more difficult)

2. Set the encryption settings identically (Same WPA2, same passkey, same everything)

3. Set the wireless channels differently.

With this setup, the laptop will choose the one with the best signal, and roam between them without interruption.

Handy other trick too for OS X. If your DHCP server allows, give both the wireless and wired mac addresses the same static IP. This allows you to migrate back and forth between wireless and wired nearly as seamlessly. I've started file copies on my laptop on wireless, decided it was too slow, then plugged into gigabit without interrupting the copy. After a few seconds, it got faster as OS X migrated the connections over.

Since I still haven't upgraded to Leopard (still o...

2008-09-26T11:05:23.125-04:00

Since I still haven't upgraded to Leopard (still on 10.4 Tiger) I have to do without Time Machine, but I use a great piece of freeware called Carbon Copy Cloner. I have it set to backup whenever I plug my external USB HD into my MacBook Pro. It uses rsync in the backend, so incremental backups are easy. Plus, since it's a disk cloning utility, I can boot from the backup drive if I need to. I know Time Machine can do all of these things, and with more eye candy, but I wanted to let any Tiger users know they have a great option as well. Just be sure to do your homework on whether your machine can boot from USB instead of Firewire, if that's a feature you plan to use.

I have a Mac mini I use as my backup and media ser...

2008-09-26T10:51:55.986-04:00

I have a Mac mini I use as my backup and media server. It runs Time Machine with a 500 GB Firewire drive to keep itself and our 2 laptops backed up whenever we're on our home network. It also has two 1 TB Firewire drives, mirrored (RAID 1 using Leopard's built-in software RAID) and which don't get backed up to Time Machine, for my music and video.

The next step is to get an extra Time Machine HD and an extra media HD, so that I can periodically take a copy to the office as an offsite backup. Both Time Machine and RAID makes this easy to implement.

I got me a 500GB Time Capsule when they came out. ...

2008-09-26T09:03:21.661-04:00

I got me a 500GB Time Capsule when they came out. I had bought my first Mac a few weeks before - the day the current MacBook Pro models were released. So, I back up to my Time Capsule. I'm quite happy with how it works.

However, I don't back my iTunes files up with Time Machine. I use iBackup to just copy the files to a different folder on the Time Machine. That way I can access the music from my company-owned laptop while I'm working. I use Media Player to play the mp3s instead of iTunes, though. I've heard bad things about sharing music over multiple computers on iTunes, so I don't bother with it. The music directory is read-only for my work system, too, as an added layer of "just in case".

My wife still uses a Windows computer, and I set up a backup program on her system to go to the Time Machine, too. For her system I just back up the documents and not the programs. Someday she'll get a Mac, but she's perfectly happy with her custom-built (by me) XP system. At least I have her using Firefox and Open Office now, so when it comes time to switch it'll be easy.