User Guide

Configuring a Wireless Network

LAD supports 2.4Ghz, 5Ghz and 6Ghz Wi-Fi signals with installation of an appropriate Wi-Fi card. For the most recent information on hardware, including wifi cards, that has been tested with LAD, please visit http://www.lateralaccessdevice.com/hardware.htm.

LAD is capable of broadcasting simultaneously on multiple Wi-Fi channels, however, the resources available for processing the Wi-Fi activity would be shared among all of the active channels. What that means is that you would have higher per-channel performance if you have one or two channels activated versus if you have three channels activated, however, the speed of your processor will also affect performance.

When LAD is first installed, if it detects the presence of a wireless card, it will automatically enable the 2.4Ghz band with a default SSID “LAD” and password “1234.” It is highly recommended that you change this default SSID and password when you first log into LAD. The 5G and 6G bands would not be enabled until you manually activate them.

The Wi-Fi section of the user interface will still be available even if no Wi-Fi card is available, however, making changes to it will have no affect on the functions and operations of LAD.

• After making any changes on the Wi-Fi monitor page or the Wi-Fi channel page(s), go to "Settings" from the Main Menu and click on "Reboot" at the top of the page to reboot LAD and apply the changes. Using the reboot option on the Settings page is better than powering LAD off and on because it ensures that all data gets properly stored before rebooting (it is also easier on the hard drive).

Wi-Fi Encryption

LAD supports the personal versions of the WPA2 and WPA3 protocols. In testing we found that for most clients WPA2 works best with the 2.4G and 5G bands, while WPA3 works best with 6G. LAD works equally well with either encryption protocol, however, as a standard 6G only works with WPA3.

LAD offers a unique enhancement to the WPA3 protocol. Typically WPA3 only allows one password per SSID, however, for security it is best to have separate passwords for each client device. Through a unique implementation, LAD makes it possible for 6G clients to have individual passwords while sharing the same SSID. See “SSID / Password Options” below.

LAD does not support Wi-Fi encryption protocols prior to WPA2. Although WPA2 is not a strong encryption protocol, the older protocols are weaker.

Create a Wireless Network

To create a wireless network, log into LAD’s web-based user interface and click on “Wi-Fi.” Under “Wi-Fi Settings” checkmark “Active” and click on “Update Flags.” If you wish to disable the wireless functions at any time, simply uncheckmark “Active” and click on “Update Flags.”

Under “Wi-Fi Cards / Channels” are listed the Wi-Fi card(s) that you have installed in your LAD hardware, if available, and the channels pertaining to them. If you have installed more than one Wi-Fi card into LAD, they will all be listed here with their respective channels (individual channels are attached to their respective Wi-Fi card). Clicking on the Wi-Fi card name will bring up a new page showing its status and various performance statistics.

Click on the channel name to make changes to the channel configuration. Please note that a channel must be marked “Active” for it to function.

• If neither 5Ghz nor 6Ghz are checkmarked, the channel will broadcast on the 2.4Ghz band.
• Checkmarking “Broadcast SSID” instructs LAD to send out SSID beacons on the channel at the interval set in the Beacon Interval field at right.
• Checkmarking “BeaconOnDemand” enables the use of “hidden” beacons. See “SSID Beacon Management” below.
• If the channel is 6Ghz, “Enable WPA3” must also be checkmarked.
• When changing channels from active to inactive or vice versa, it is possible that their channel numbers may be reassigned. This has no effect on their functionality.
• When making changes to Wi-Fi channel settings, you must reboot LAD for the changes to take effect.

Please note that the first time LAD boots up, if it detects the presence of a wireless card it will automatically enable the 2.4Ghz band with SSID “LAD” and password “1234.” It is highly recommended that you change this default SSID and password when you first log into LAD.

If your LAD does not have a wireless card installed, the Wi-Fi settings page will be available to look at but none of the wireless features or functions would be available.

Changing a Wi-Fi Channel's Assigned Band

By default LAD assigns each of three bands to one of the three wireless channels made available per Wi-Fi card, however, you may choose to change a channel's band to a different one. To do this, scroll down to the bottom of the channel's page and click on the Set to Defaults button corresponding to the band to which you would like to change the channel.

When changing the channel's band, the channel's current SSID will be preserved. If you need to make any further changes after that, make your changes, save them and then reboot the machine by going to "Settings" from the Main Menu and clicking on "Reboot" at the top of the page.

Multiple SSIDs

LAD may broadcast multiple SSIDs, allowing you to have up to 100 different wireless clients with different SSIDs. The limitation on this is which band you may use. The 5G and 6G bands only allow the broadcasting of one SSID per channel. The 2.4Ghz band, however, allows one broadcast SSID plus additional "secret" SSIDs.

SSID / Password Options

With LAD you have the option of using the same SSID with different passwords for different users, regardless of whether your clients are using WPA2 or WPA3. What this means is that if one client’s password becomes compromised, addressing the problem is limited to the password for that particular client – all other Wi-Fi devices would hum along as normal, with no disruption or password reconfiguration required. User passwords are set by individual user, see “Wireless Users” below for more information.

For some clients using WPA3, the system may require them to attempt to login two or three times the very first time they try to connect to LAD via Wi-Fi 6E, however for many it will work the first time, or the slight delay would be imperceptible. This minor inconvenience has to do with the way LAD works around the WPA3 protocol’s requirement for a single password per SSID.

If you wish to have multiple SSIDs available on the same channel, it is only possible with the 2.4Ghz band. For 5Ghz and 6Ghz, to have multiple SSIDs you must enable more than one channel on the same band. Keep in mind, however, that most wireless cards support up to three channels at a time, so if additional channels are desired multiple wireless cards must be installed.

It is not recommended to use both the same SSID and password for different clients, as this creates confusion in the system about which user client is which, as LAD identifies users by their individual SSID / password combination. If more than one client tries to use the same SSID / password combination, likely only one would be able to connect at a time, meaning that when one client tries to connect it will boot off the other client and vice versa.

The ability to use Wi-Fi without passwords is restricted on LAD. Aside from the fact that it is not a good idea to allow indiscriminate access to your LAN, as explained in the previous paragraph, Wi-Fi users are distinguished from each other by their SSID / password combinations.

What if I use MAC randomization?

Using the same SSID and password for all users on a network and MAC randomization creates a big weakness, by removing the ability to identify or track individual clients and the ability to disable access for individual clients. In the past systems using one SSID and one password network-wide could only track individual clients by their MAC address, however, the introduction of MAC randomization made it impossible to distinguish one user from another. In that environment, if a hacker steals the SSID and password for the network, they will blend in, appearing as just another iteration of the randomized MAC addresses. You may hope that they are only piggybacking on your home or office network to save a little money, but they could be doing much more and you would not be able to tell.

With LAD you have the capability to give all clients different passwords, so even if you employ MAC randomization, you would be able to tell your laptop from your tablet, your phone from your network printer and so on. Additionally, when reviewing LAD’s reports and analyzing network data, you will not be hindered by a myriad of phantom MACs that make it impossible to tell what is going on or who is accessing what... unless you do assign the same SSID and password to multiple clients. LAD gives you the flexibility to manage and track clients individually, as groups or not at all, as you decide.

SSID Beacon Management

Beacons are tools used by the Wi-Fi protocols for a Wi-Fi router to broadcast its SSID(s). It is a Wi-Fi message typically repeated at pre-set intervals containing information about a Wi-Fi network, so that clients can find it and attempt to connect. Depending on the implementation, the client may also probe the channel for other beacons.

LAD allows the user to choose the interval between beacon broadcasts. The frequency of beacon broadcast required by different client devices is variable, so while LAD allows the user to set a frequency between 10ms and 60 seconds, some devices require 50ms intervals and others 100ms intervals. Some 6G client devices will have trouble unless the beacon frequency is set to 20ms. It all depends on the preferences of your wireless client devices and it may take some trial and error to find the best interval for your particular clients (which also may have different “ideal” beacon intervals on different bands).

It is also possible to have so-called “hidden” beacons, which LAD may be configured to broadcast only when a client probes for them. Some clients using the 6Ghz band, however, may work well with hidden beacons (aka hidden SSIDs) and others may not. Please note that the end-user client must also be configured to use the hidden SSID, also called non-broadcasting SSID, in its wireless settings.

With the 2.4Ghz band you may choose to forego all broadcasting of beacons, however, the 5Ghz and 6Ghz bands require the broadcasting of at least one beacon.

LAD also allows the broadcast of multiple beacons, however, this capability should be used with caution. Too many beacons with short intervals would cumulatively utilize a significant amount of bandwidth and may end up slowing things down.

To manage beacons, from the Main Menu click on Wi-Fi and select the band for which you would like to adjust the beacon settings. You may change the interval between beacon broadcasts in 0.1 second increments. You may also enable “BeaconOnDemand,” which instructs LAD only to send out a beacon upon request of a client.

Wireless Users

This section is where you set individual passwords for your wireless users, as well as designate which SSID it should use. Please note that individual wireless users will only be given access if marked “Active.”

Users are tracked by their individual User ID / SSID and password combination, so if you have multiple users using the same SSID and password, they will be tracked collectively under their common SSID / password combination.

When creating a new Wi-Fi user profile, the MAC address field will be blank. This field will populate the first time a client connects using that profile’s SSID / password combination and become a permanent entry regardless of whether different MAC addresses are subsequently used with the same SSID / password combination.

LAD gives you the option of tracking multiple clients collectively using the “Set MAC” option. By checkmarking “Set MAC” and entering the same MAC address in the “Set MAC” field for each client that you wish to collectively track, LAD can track two or more Wi-Fi devices as a single user, which may be useful in cases where the same human user uses two separate Wi-Fi devices.

• Match MAC: This option should be used only if necessary and with caution. It does not improve security much, since LAD allows you to set up different passwords for different users.
• If you use this setting and the client's MAC address changes and you do not know the original MAC address or cannot change it back to the original MAC address, the client would be locked out of the network.
• WPA3 Only: Checkmarking this requires the user to connect using WPA3 encryption.
• When using this option "WPA3 Also" must be uncheckmarked.
• WPA3 Also: Checkmarking this allows the user to use either WPA3 encryption or WPA2 encryption. If it is not checkmarked, only WPA2 encryption may be used, unless "WPA3 Only" is checkmarked.
• When using this option "WPA3 Only" must be uncheckmarked.
• In Use: Checkmark this option if you have a user who is not currently checkmarked as Active, but whose record you wish to retain. The user record will be kept current in the system, but the user's Wi-Fi credentials would not be operational unless "Active" is also checkmarked.
• If a Wi-Fi user is not checkmarked as either Active or In Use, the system may delete or recycle the record.
• Name: In this field you may enter your desired reference or nickname for this particular user. This entry has no bearing on the settings for connecting to Wi-Fi, but is for reference only.
• SSID: Enter the Wi-Fi user's SSID in this field, which must match the SSID for the Wi-Fi channel to which you wish them to be able to connect..
• If you wish the user to use a different Wi-Fi channel, you will have to change this entry to match the new channel's SSID.

You may use the duplicate function available on the Wi-Fi user page to create a Wi-Fi new user profile with the same settings. Simply type in the new user name and click on "Duplicate." It is recommended that you change the new user's password as soon as the new Wi-Fi user profile is created, so as not to use the same SSID/password combination as the original user.

Broadcast Packets

In some cases you may notice Wi-Fi broadcast packets incoming to LAD on a Wi-Fi channel marked as "Allowed," but that do not appear as outgoing from LAD. The reason for this is because these broadcast packets, which are generated by the Wi-Fi client device and sent to so-called "broadcast IP addresses," are actually not routable. Ostensibly these broadcast packets are for network discovery, however, they pose more of a privacy and security risk than serving a useful purpose. Anybody who may be "listening" to your network could use the information in your packets to discover your network's topology and what devices you have located on the network. For these reasons, LAD does not support broadcast IP addresses because the dubious value of the function is not worth the risk.

Restoring Wi-Fi Channels to Default Settings

To restore a Wi-Fi channel to default settings, use one of the Set to Defaults buttons at the bottom of the page. You have a choice of restoring the channel to its original defaults for the band it is currently set to use (either 2.4Ghz, 5Ghz or 6Ghz), or you may convert it to a different bands, with the default settings for the new band.

When restoring to defaults, the channel's current SSID will be preserved. If you need to make any further changes after that, make your changes, save them and then reboot the machine by going to "Settings" from the Main Menu and clicking on "Reboot" at the top of the page.

<< The Main Menu | Connecting and Managing Clients >>