Network

2016-07-02T22:07:49Z

Davidc: remove the team list as it's auto-generated on the team page

== Network ==

[[Team:NOC]] has tried to build and support the fastest network for you, a network comparable to a medium sized ISP built up in just a couple of days. It might not be perfect all the time. If you experience any outage please report them to the [[Team:InfoHelpDesk|helpdesk]].

We will be providing a high speed onsite network with blanket wireless coverage and wired network access to both venues and camping tents.

'''Key points:'''

* You have a public IP address and there is no network firewall or filtering. [[#Security|Keep safe!]]
* Don't set up your own wifi access point. This really is a serious problem in such a dense event and here's why: [[Network/Rogue Access Points]].

== Rules ==

* Be nice and friendly! Do not do to others what you do not wish done to yourself.
* Protect your computer! We cannot be taken responsible or held accountable for any damage your devices might sustain due to security problems, power spikes and other such perils.
* Do not operate your own WiFi access point. This causes a major slow-down for everybody else. Here's why: [[Network/Rogue Access Points]]. Our wireless solution includes 'CleanAir' technology and has rogue access point detection.
* If you are operating anything else in the 2.4GHz spectrum, please clear the frequencies in advance with us.
* Do not attempt to run a DHCP or RA server. You will be found and named and shamed!
* Cabling from your tent to the Datenklo must not cross any roads or fire lanes.
* If you are connecting a Nanode / Arduino Ethernet / other microcontroller to the network please make sure it is using a unique MAC address. Many of the code examples for such devices use an identical MAC address and this will cause problems - if you aren't sure contact the [[Team:InfoDesk|helpdesk]].
* If you are connecting a switch, you need to contact the NOC to enable this on your port. You are only allowed one uplink from your switch to our network - do not attempt to connect multiple cables or to multiple DKs!

If you break these rules, we will track you down or triangulate you, but we'd rather spend the time maintaining the smooth operation of the network, so please don't waste our time. And if you think [[Team:NOC]] cannot locate you just because you're wireless - think again. ;-)

== Uplink ==

Uplink from the campsite is currently being arranged. Details will be announced when firm. As in previous years, we expect to provide many hundred Mbps.

== Wireless ==

The whole field has been covered with many wireless access points to ensure the best possible coverage and to allow you to roam seamlessly without interruption. Naturally, there is additional coverage in popular areas such as the talk tents.

The following SSIDs will be available:

* emfcamp
** This is 5GHz and should you should use this one in preference, if you can see it. The username and password are "emf". This is the most secure, WPA2-Enterprise.
* emfcamp-legacy
** This is 2.4GHz and less resistant to interference, use it only if you have to. The username and password are "emf". This is also WPA2-Enterprise.
* emfcamp-insecure '''Warning: insecure'''
** This is both 5GHz and 2.4GHz, and is for older devices that don't support WPA2-Enterprise. It's unencrypted.
* spacenet
** This is 2.4GHz + 5GHz and WPA2-Enterprise, you can connect with a valid account if your hackerspace is offering spacenet. More information can be found at [https://spacefed.net/ spacefed.net].
* eduroam
** This is 2.4GHz + 5GHz and WPA2-Enterprise, you can connect with a valid account if your university/college/school is offering eduroam. More information can be found at [https://www.eduroam.org/ eduroam.org].

Use of the 5GHz SSIDs is recommended if your device supports them. 802.11b is disabled as it slows everyone else down.

Even if you are using an encrypted network, you should still [[#Encryption|encrypt any sensitive traffic]] sent over the air end-to-end to prevent snooping. Although some SSIDs offer encryption, it is only over-the-air.

We have airtime fairness configured on our wireless controllers, so if you wish to download large files please use a wired connection (there will be plenty about).

For proper wireless support under linux, you should have a kernel newer than 2.6.39.2. There is also a kernel panic with brcmsmac on linux 3.10.3 that can be fixed by downgrading to kernel 3.10.2.

=== WPA2 802.1X, encryption ===

Due to popular demand (and with security in mind) we provide WPA2 802.1X. This will encrypt your traffic, preventing attackers from sniffing your data. Keep in mind that this won't protect you from other network attacks and you should still be aware that you are at a hacker conference! Your link layer should be secure if you do certificate checking (see below).

You might think: "WTF!? Do I need to register a user and password blah, blah". Fortunately not. You can '''use any username/password combination using EAP-TTLS with PAP to login''' (example: "user: fbhfbhiaf pass: bgufwbnkqo" is valid), because we don't care who logs in and who you are. We just want to encrypt your data.

Users which use MSCHAPv2 (like Windows users with default 802.1X supplicant) should use a fixed username and password. You can use "emf/emf" or "guest/guest" as "username/password".

==== Client Settings ====
SSID: emfcamp or emfcamp-legacy
Phase 1: EAP-TTLS or PEAP
Phase 2: MSCHAPv2 or EAP-MSCHAPv2 or PAP

CN = radius.emf.camp
CA = GeoTrust Global CA
Fingerprint = 5E:A7:65:99:25:14:46:A4:0A:CD:2D:22:27:C1:1B:70:AA:A0:CC:1F

Make sure '''you check the certificate''' in order to know you are connecting to the correct network (you should check on both the CN and the CA).

== Camping area and workshops ==

All camping areas will be within 60m of a Datenklo (Data Toilet), please bring around 60-70m of CAT5 cable. Unless a sponsor comes forward for it, we will be unable to supply cable on site. We will be budgeting only for the infrastructure requirements and necessary spares to deal with issues.

Lay your own cable neatly from your tent back to the nearest Datenklo, and leave 6m of slack coiled on the floor in front of it. And please lay it so that it can be clearly seen that it needs to be plugged in - or you risk having your cable overlooked. At regular intervals a member of the NOC team will connect it up and enable the port.

If you wish to be removed from a Datenklo again, contact the [[Team:InfoDesk|helpdesk]] directly.

All of our edge ports are at least 10/100, some support PoE (802.3af), plus Auto-MDX.

== Static IPs ==

If you need a static IP on the wired network, drop by the [[Team:InfoDesk]].

== IPv6 ==

Naturally, IPv6 is available throughout the network and should "just work" for you. Team:NOC does not recommend disabling IPv6 if you have problems, instead try to understand the problem you are experiencing and get educated in the new world order. Contact the [[Team:InfoDesk|NOC helpdesk]] if you need help.

== Multicast ==

We have a TV & radio multicast feed from the BBC. Simply open your media player and browse multicast streams (e.g. in VLC's main window, go to the sidebar "Local Network -> Network Streams (SAP)").

This is currently working on both the wired and wireless network; you will have some expected packet loss if you use wireless though.

Don't forget to turn on deinterlacing to get a proper picture (press 'd' in VLC).

== Services ==

* DNS: 78.158.87.11 and 78.158.87.12
* NTP: 78.158.87.11 and 78.158.87.12 (ntp1.emf.camp and ntp2.emf.camp)
* Nearest Debian mirror: http://debian.mirror.uk.sargasso.net
* Content distribution server - for use by speakers to upload their content to an on-site server - http://content.emf.camp/ . Speakers please contact noc@ to get an account.

== Security ==

=== Recent vulnerabilities ===

'''WARNING: Bring a recent DHCP Client'''. If your OS uses ISC DHCP dhclient make sure you don't run a vulnerable version. https://www.kb.cert.org/vuls/id/410676

=== Encryption ===

Please treat the network as wide open and full of attackers. Although [[Team:NOC]] themselves will not monitor the network, always assume that Alice flirting with Bob will be spied upon by The Third Party.

Any sensitive information including passwords must therefore be encrypted. Please make sure you don't use any software or web applications that send sensitive data or passwords in the clear.

The following mechanisms should be safe:
* Anything that goes through a VPN
* Any website that uses HTTPS
* Any application that uses SSL
** In the case of email, you need to have SSL enabled for both receiving mail (POP, IMAP) and sending it (SMTP)
* ssh and scp
* Where possible, use One-time passwords. Real tokens work best, many of those should be compatible with open source radius servers. [http://perlmonks.org/?node=967433 Here] is a simple Perl radius server implementation for [http://tools.ietf.org/html/rfc6238 RFC6238] tokens that works with ssh and other stuff on linux.

The following are almost always unsafe:

* FTP with login/password (are almost always sent in the clear)
* Telnet with login/password
* Email if you don't use SSL
* Webmail that doesn't use HTTPS
** Someone could trigger a password reminder and then intercept your email
* Websites that use HTTP (not HTTPS) where you need to fill in a password in the page itself

Possibly unsafe, make sure that you understand what you're doing:

* Websites where you need to fill in a password and your ''browser'' (not the website!) tells you it's going to be sent securely
* Websites that require an account but remember you're logged in
** The password ''may'' be protected but not the content or cookies that automatically log you in
* Any time your browser or other application brings up ''anything'' to do with a certificate
* Anything not protected with SSL: someone could be faking DNS answers to impersonate certain sites

Remember: if you're being stupid someone may feel the need to teach you a security lesson in a not so subtle way! (No, that doesn't mean it's ok to hack people just to see if their security is in order.)

=== Firewall ===

There is no network firewall. We operate an unfiltered network that is wide open to the Internet. There is no NAT, and everybody has a public IP address. This is our definition of "network neutrality" - a network that doesn't do anything whatsoever to your IP connection.

If you are used to feeling secure just because you've been sitting behind a NAT router, think again. You are now wide open to the whole Internet. Ensure your personal firewall is enabled and set to "Public Network" and that you have applied all security updates to your OS and applications.

== FAQ ==

=== Can I bring a server? ===

<strike>Yes, though we would rather these were stored centrally in our NOC. This allows us to provision power easily and you also get the added benefit of connecting directly to our core and having UPS backup. If you intend to bring a server please email noc@emfcamp.org so we can fully understand your requirements prior to the event.</strike>

We have not yet determined whether we will be able to provide colocation space for servers, but we would like to in order to save bandwidth on the extensive site network. If this will be helpful for you, please e-mail noc@emfcamp.org so we can gauge demand.

=== Is there a server I can use to host data on site? ===

Yes, ''content.emf.camp'' will be available again for speakers and workshops to store data on site, providing faster access to local users. Prior to the event, the server will be online on a fast Internet connection until around July 29th, at which point it will be shipped to site and won't be available again until the site Internet connection is up.

If you would like to use this facility, please e-mail the NOC. If you need anything other than standard HTTP userdir hosting (http://content.emf.camp/~yournick/) let us know as well.

=== Can I use the 2.4GHz band for non-wifi projects? ===

The following channels are available for adhoc/mesh/other wireless stuff:

* 2.4Ghz: Channel 1
* 5Ghz: Channel 136, 140

We cannot force you to use these channels, but we are trying to build a functional wireless network for the other attendees too. So please, don't do any experiments on other channels.

=== Can I bring an access point? ===

No, this is strictly prohibited! We need all available channels to provide good quality coverage for the rest of the attendees. Please do not be selfish here as you will degrade performance for everyone else, and we WILL track you down.

If you think you can ignore this rule because one little access point can't hurt anyone, think again. This page has the calculations on just how huge a problem it is: [[Network/Rogue Access Points]].

If you are operating a village (using an EMF-supplied tent) that has poor coverage, we may be able to arrange to put an access point in it during the event to improve coverage. Stop by the NOC and ask.

=== Can I bring a switch? ===

Yes, but for stability purposes all edge ports are limited to 3 MAC addresses at a time. If you want to connect a switch, you need to stop by the NOC and ask us to lift the port-security on your port. If you do this, you need to convince us that you know what you're doing and promise not to do anything that may harm the network - in particular, you must not connect the switch to our network by more than 1 cable (not even to a different DK).

=== My port goes up and down every couple of minutes ===

You have probably tripped port security. Most likely scenario is that you have connected a switch without consulting us (see answer to previous question).

Network

2016-07-02T21:52:51Z

Davidc: link to rogue ap page

Network/Rogue Access Points

2016-07-02T21:49:25Z

Davidc: new page about why rogue APs are not allowed

= Policy =

The Electromagnetic Field NOC operates a strict policy prohibiting the use of rogue access points.

A rogue access point is defined as any device operating in the 2.4 Ghz or 5 GHz spectrums, in any mode other than 802.11 client mode, that is operated by anyone other than the Electromagnetic Field NOC.

This includes access points, phones running Wifi tethering, laptops in ad-hoc (peer to peer) mode, and any other device interfering with the 2.4 GHz or 5 GHz spectrum without approval from the NOC.

Rogue access points are not a trivial affair, and we take the problem seriously. Every beacon transmitted consumes airtime '''significantly''' affects everyone around it. With 1,700 people densely packed and using an average of 2 wifi devices each, we cannot afford the loss of any airtime, let alone the enormous amount consumed by low data rate beacons.

= How big is the problem really? =

Big. And if you don't believe us, here are the calculations.

Assumptions:
* Beacons are transmitted at the default interval of 102.4 milliseconds.
* Beacons are always transmitted at the lowest data rate (1 Mbps) and 802.11b long preamble is used.
* Beacons are 380 bytes without preamble.
* EMF NOC transmits 4 beacons for the 4 SSIDs we operate.
* On average there will be 3 EMF APs within range on the same channel.
* For mathematical simplicity, we assume that there are no collisions (this is unlikely, so this calculation is the ''best case'').

Each beacon is transmitted every 102.4 milliseconds and is therefore transmitted 9.765625 times per second.

Long preamble is 144 bits and the PLCP header is 64 bits.
Beacons of 380 bytes are 3040 further bits.
Total size of a beacon frame is therefore 3248 bits.
Each beacon is transmitted 9.765625 times per second so 31718.75 bits per second per beacon.

EMF transmits 4 beacons and there are an average of 3 APs in range on each channel. So 380625 bps are consumed by EMF beacons. At basic data rate 1 Mbps, this consumes 380.625 ms per second.

This means 61.9375% of airtime is available for user data.

A single rogue access point added to the above equation causes the following changes:

An additional beacon of 3248 bits transmitted 9.765625 times per second.
Another 31718.75 bits per second at 1 Mbps is therefore consumed, so another 31.71875 ms of airtime is used per second.

The proportion airtime available for user data falls to 58.765625%

Compared to the rogue access point not being present, the available bandwidth drops to 58.765625 / 61.9375 = 94.879%

The bottom line is obvious: '''every single rogue access point reduces the speed of everyone around it by over 5%'''.

= I won't really be transmitting much data, it won't affect anyone =

Irrelevant. It doesn't matter how much you use the rogue access point or even if you use it at all. Just having turned on means it's transmitting beacons and consuming airtime.

= How about if I have a hidden SSID? =

Irrelevant. You will still be transmitting beacons, the only difference is that the SSID field will be null. This is not a solution, it does not offer any improvement. Hidden SSIDs are not allowed. And we can find you just as easily with a hidden SSID, as you still transmit beacons.

= I'm in a far-flung corner of the field, nobody will see it =

Irrelevant. If any of our APs can see yours, they'll back off when they see your beacon and/or will collide with it and the airtime will still be wasted.

= How about if I increase my beacon interval? =

This would improve it somewhat, but not significantly. Furthermore it would set a bad precedent having non-EMF SSIDs appear on people's lists of networks.

Rogue access points are not allowed, irrespective of the beacon interval or data rate. Besides, most consumer access points do not offer any ability to alter the beacon rate.

= How do you find rogue access points? =

A proportion of our access points run in monitor mode, monitoring the air quality around them. When they detect an unauthorised beacon, they raise an alert, and triangulation between monitor APs give us an exact location to within a few metres.

If there are not enough monitors in a location to triangulate, we fall back to a laptop and an antenna onna stick.

Failing that, we will shut off power to your area until you come forward or a neighbour rats you out.

= What will you do if you find a rogue access point? =

First, '''please''' don't put us in this situation. It is unpleasant for all involved, we'd rather spend our time enjoying the event than being authoritarian.

In the first instance, we will inform you that running your own access point is not permitted and point you to this page to explain why. We hope that you will quickly turn it off and not argue.

If you refuse to turn it off or we later find that it has been turned on again, we will employ sanctions up and including ejecting you from the site in accordance with the [https://www.emfcamp.org/pay/terms terms and conditions] to which you agreed when purchasing a ticket.

2015-12-12T17:04:51Z

Davidc: add link banner

{{link-banner}}
These are the teams which make up the EMF organisation. For more information on how EMF is run, and the duties of team leaders, see the [[Organisation]] page.

If you're interested in getting involved with a team which doesn't currently have a lead, please get in touch on [[IRC]]. If you're interested in joining a team, get in touch with the team lead.

{| class="wikitable sortable"
! Team
! Description
! Lead
! Deputy Lead(s)
|-
| [[Team:Admin]]
| Top-level organisation, licensing, finance, site planning
| [[User:Russ]], WillH, [[User:Jonty]]
|
|-
| [[Team:Power]]
| All things power, as well as basic site lighting.
| [[User:Benny]]
| Will H, Matt (LWK)
|-
| [[Team:Sanitation]]
| Water supply, showers, toilets, rubbish.
| Crypt
|
|-
| [[Team:Security]]
| Making sure the site is safe.
| Crypt
|
|-
| [[Team:NOC]]
| Networking and systems admin
| [[User:JasperWallace]]
| Will H, [[User:davidc]]
|-
| [[Team:Web]]
| Web sites, ticket sales, volunteering, and CfP systems
| [[User:ms7821|Mark]]
| [[User:SamLR|Sam]]
|-
| [[Team:Content]]
| Organising talks/workshops/etc
| [[User:Jonty]]
| Dominic, Alia
|-
| [[Team:Bar]]
| Booze, and such
| [[User:Sde]]
| [[User:Russ]]
|-
| [[Team:First Aid]]
| Making sure we don't kill ourselves, as well as looking after attendee welfare.
| [[User:Oni|Oni]]
| Katie
|-
| [[Team:Catering]]
| Organising food providers
| Nick
|
|-
| [[Team:InfoDesk]]
| Providing information before and during the event
| Kate
|
|-
| [[Team:Volunteering]]
| Managing volunteers across all stages
| Lyndsey
| [[User:SamLR|Sam]]
|-
| [[Team:Kids]]
| Kids area, activities, and childminding
| [[User::theleadingzero]]
|
|-
| [[Team:Stage]]
| Staging, stage lighting, audio, and projection.
| [[User:TimRTerrible]]
| [[User:gmc]]
|-
| [[Team:Video]]
| Liaising with the video streaming and recording people.
| MattG
|
|-
| [[Team:Badge]]
| Badge building, and infrastructure.
| [[User:Dpslwk|Dpslwk]]
| [[User:thinkl33t|Bob]] MattBr
|-
| [[Team:Villages]]
| Looking after villages and their requirements
| Crypt
|
|-
| [[Team:Sponsorship]]
| Looking after sponsors/vendors and their requirements.
| [[User:Jonty]]
|
|-
| [[Team:Lounge]]
| Organising the Lounge area
| [[User:Amx109|amx109]]
| [[User:Will-Do]]
|-
| [[Team:Comfort]]
| Planning conflict resolution and making sure people will feel safe in advance
| Jane
| [[User:martind]]
|-
| [[Team:Logistics]]
| Organising the non-site logistics (e.g. getting stuff like the badges from London to the site)
| Srimech
|
|}

Network

2015-12-12T17:03:27Z

Davidc: too many equals

== Network ==

[[Team:NOC]] has tried to build and support the fastest network for you, a network comparable to a medium sized ISP built up in just a couple of days. It might not be perfect all the time. If you experience any outage please report them to the [[Team:InfoHelpDesk|helpdesk]].

We will be providing a high speed onsite network with blanket wireless coverage and wired network access to both venues and camping tents.

'''Key points:'''

* You have a public IP address and there is no network firewall or filtering. [[#Security|Keep safe!]]
* Don't set up your own wifi access point. [[#Rules|More Rules]]

== Rules ==

* Be nice and friendly! Do not do to others what you do not wish done to yourself.
* Protect your computer! We cannot be taken responsible or held accountable for any damage your devices might sustain due to security problems, power spikes and other such perils.
* Please do not operate your own WiFi access point. This slows things down for everyone else. Our wireless solution includes 'CleanAir' technology and has rogue access point detection.
* If you are operating anything else in the 2.4GHz spectrum, please clear the frequencies in advance with us.
* Do not attempt to run a DHCP or RA server. You will be found and named and shamed!
* Cabling from your tent to the Datenklo must not cross any roads or fire lanes.
* If you are connecting a Nanode / Arduino Ethernet / other microcontroller to the network please make sure it is using a unique MAC address. Many of the code examples for such devices use an identical MAC address and this will cause problems - if you aren't sure contact the [[Team:InfoDesk|helpdesk]].
* If you are connecting a switch, you need to contact the NOC to enable this on your port. You are only allowed one uplink from your switch to our network - do not attempt to connect multiple cables or to multiple DKs!

If you break these rules, we will track you down or triangulate you, but we'd rather spend the time maintaining the smooth operation of the network, so please don't waste our time. And if you think [[Team:NOC]] cannot locate you just because you're wireless - think again. ;-)

== Uplink ==

Uplink from the campsite is currently being arranged. Details will be announced when firm. As in previous years, we expect to provide many hundred Mbps.

== Wireless ==

The whole field has been covered with many wireless access points to ensure the best possible coverage and to allow you to roam seamlessly without interruption. Naturally, there is additional coverage in popular areas such as the talk tents.

The following SSIDs will be available:

* emfcamp
** This is 5GHz and should you should use this one in preference, if you can see it. The username and password are "emf". This is the most secure, WPA2-Enterprise.
* emfcamp-legacy
** This is 2.4GHz and less resistant to interference, use it only if you have to. The username and password are "emf". This is also WPA2-Enterprise.
* emfcamp-insecure '''Warning: insecure'''
** This is both 5GHz and 2.4GHz, and is for older devices that don't support WPA2-Enterprise. It's unencrypted.
* spacenet
** This is 2.4GHz + 5GHz and WPA2-Enterprise, you can connect with a valid account if your hackerspace is offering spacenet. More information can be found at [https://spacefed.net/ spacefed.net].
* eduroam
** This is 2.4GHz + 5GHz and WPA2-Enterprise, you can connect with a valid account if your university/college/school is offering eduroam. More information can be found at [https://www.eduroam.org/ eduroam.org].

Use of the 5GHz SSIDs is recommended if your device supports them. 802.11b is disabled as it slows everyone else down.

Even if you are using an encrypted network, you should still [[#Encryption|encrypt any sensitive traffic]] sent over the air end-to-end to prevent snooping. Although some SSIDs offer encryption, it is only over-the-air.

We have airtime fairness configured on our wireless controllers, so if you wish to download large files please use a wired connection (there will be plenty about).

For proper wireless support under linux, you should have a kernel newer than 2.6.39.2. There is also a kernel panic with brcmsmac on linux 3.10.3 that can be fixed by downgrading to kernel 3.10.2.

=== WPA2 802.1X, encryption ===

Due to popular demand (and with security in mind) we provide WPA2 802.1X. This will encrypt your traffic, preventing attackers from sniffing your data. Keep in mind that this won't protect you from other network attacks and you should still be aware that you are at a hacker conference! Your link layer should be secure if you do certificate checking (see below).

You might think: "WTF!? Do I need to register a user and password blah, blah". Fortunately not. You can '''use any username/password combination using EAP-TTLS with PAP to login''' (example: "user: fbhfbhiaf pass: bgufwbnkqo" is valid), because we don't care who logs in and who you are. We just want to encrypt your data.

Users which use MSCHAPv2 (like Windows users with default 802.1X supplicant) should use a fixed username and password. You can use "emf/emf" or "guest/guest" as "username/password".

==== Client Settings ====
SSID: emfcamp or emfcamp-legacy
Phase 1: EAP-TTLS or PEAP
Phase 2: MSCHAPv2 or EAP-MSCHAPv2 or PAP

CN = radius.emf.camp
CA = GeoTrust Global CA
Fingerprint = 5E:A7:65:99:25:14:46:A4:0A:CD:2D:22:27:C1:1B:70:AA:A0:CC:1F

Make sure '''you check the certificate''' in order to know you are connecting to the correct network (you should check on both the CN and the CA).

== Camping area and workshops ==

All camping areas will be within 60m of a Datenklo (Data Toilet), please bring around 60-70m of CAT5 cable. Unless a sponsor comes forward for it, we will be unable to supply cable on site. We will be budgeting only for the infrastructure requirements and necessary spares to deal with issues.

Lay your own cable neatly from your tent back to the nearest Datenklo, and leave 6m of slack coiled on the floor in front of it. And please lay it so that it can be clearly seen that it needs to be plugged in - or you risk having your cable overlooked. At regular intervals a member of the NOC team will connect it up and enable the port.

If you wish to be removed from a Datenklo again, contact the [[Team:InfoDesk|helpdesk]] directly.

All of our edge ports are at least 10/100, some support PoE (802.3af), plus Auto-MDX.

== Static IPs ==

If you need a static IP on the wired network, drop by the [[Team:InfoDesk]].

== IPv6 ==

Naturally, IPv6 is available throughout the network and should "just work" for you. Team:NOC does not recommend disabling IPv6 if you have problems, instead try to understand the problem you are experiencing and get educated in the new world order. Contact the [[Team:InfoDesk|NOC helpdesk]] if you need help.

== Multicast ==

We have a TV & radio multicast feed from the BBC. Simply open your media player and browse multicast streams (e.g. in VLC's main window, go to the sidebar "Local Network -> Network Streams (SAP)").

This is currently working on both the wired and wireless network; you will have some expected packet loss if you use wireless though.

Don't forget to turn on deinterlacing to get a proper picture (press 'd' in VLC).

== Services ==

* DNS: 78.158.87.11 and 78.158.87.12
* NTP: 78.158.87.11 and 78.158.87.12 (ntp1.emf.camp and ntp2.emf.camp)
* Nearest Debian mirror: http://debian.mirror.uk.sargasso.net
* Content distribution server - for use by speakers to upload their content to an on-site server - http://content.emf.camp/ . Speakers please contact noc@ to get an account.

== Security ==

=== Recent vulnerabilities ===

'''WARNING: Bring a recent DHCP Client'''. If your OS uses ISC DHCP dhclient make sure you don't run a vulnerable version. https://www.kb.cert.org/vuls/id/410676

=== Encryption ===

Please treat the network as wide open and full of attackers. Although [[Team:NOC]] themselves will not monitor the network, always assume that Alice flirting with Bob will be spied upon by The Third Party.

Any sensitive information including passwords must therefore be encrypted. Please make sure you don't use any software or web applications that send sensitive data or passwords in the clear.

The following mechanisms should be safe:
* Anything that goes through a VPN
* Any website that uses HTTPS
* Any application that uses SSL
** In the case of email, you need to have SSL enabled for both receiving mail (POP, IMAP) and sending it (SMTP)
* ssh and scp
* Where possible, use One-time passwords. Real tokens work best, many of those should be compatible with open source radius servers. [http://perlmonks.org/?node=967433 Here] is a simple Perl radius server implementation for [http://tools.ietf.org/html/rfc6238 RFC6238] tokens that works with ssh and other stuff on linux.

The following are almost always unsafe:

* FTP with login/password (are almost always sent in the clear)
* Telnet with login/password
* Email if you don't use SSL
* Webmail that doesn't use HTTPS
** Someone could trigger a password reminder and then intercept your email
* Websites that use HTTP (not HTTPS) where you need to fill in a password in the page itself

Possibly unsafe, make sure that you understand what you're doing:

* Websites where you need to fill in a password and your ''browser'' (not the website!) tells you it's going to be sent securely
* Websites that require an account but remember you're logged in
** The password ''may'' be protected but not the content or cookies that automatically log you in
* Any time your browser or other application brings up ''anything'' to do with a certificate
* Anything not protected with SSL: someone could be faking DNS answers to impersonate certain sites

Remember: if you're being stupid someone may feel the need to teach you a security lesson in a not so subtle way! (No, that doesn't mean it's ok to hack people just to see if their security is in order.)

=== Firewall ===

There is no network firewall. We operate an unfiltered network that is wide open to the Internet. There is no NAT, and everybody has a public IP address. This is our definition of "network neutrality" - a network that doesn't do anything whatsoever to your IP connection.

If you are used to feeling secure just because you've been sitting behind a NAT router, think again. You are now wide open to the whole Internet. Ensure your personal firewall is enabled and set to "Public Network" and that you have applied all security updates to your OS and applications.

== FAQ ==

=== Can I bring a server? ===

<strike>Yes, though we would rather these were stored centrally in our NOC. This allows us to provision power easily and you also get the added benefit of connecting directly to our core and having UPS backup. If you intend to bring a server please email noc@emfcamp.org so we can fully understand your requirements prior to the event.</strike>

We have not yet determined whether we will be able to provide colocation space for servers, but we would like to in order to save bandwidth on the extensive site network. If this will be helpful for you, please e-mail noc@emfcamp.org so we can gauge demand.

=== Can I use the 2.4GHz band for non-wifi projects? ===

The following channels are available for adhoc/mesh/other wireless stuff:

* 2.4Ghz: Channel 1
* 5Ghz: Channel 136, 140

We cannot force you to use these channels, but we are trying to build a functional wireless network for the other attendees too. So please, don't do any experiments on other channels.

=== Can I bring an access point? ===

No, this is strictly prohibited! We need all available channels to provide good quality coverage for the rest of the attendees. Please do not be selfish here as you will degrade performance for everyone else, and we WILL track you down.

If you are operating a village (using an EMF-supplied tent) that has poor coverage, we may be able to arrange to put an access point in it during the event to improve coverage. Stop by the NOC and ask.

=== Can I bring a switch? ===

Yes, but for stability purposes all edge ports are limited to 3 MAC addresses at a time. If you want to connect a switch, you need to stop by the NOC and ask us to lift the port-security on your port. If you do this, you need to convince us that you know what you're doing and promise not to do anything that may harm the network - in particular, you must not connect the switch to our network by more than 1 cable (not even to a different DK).

=== My port goes up and down every couple of minutes ===

You have probably tripped port security. Most likely scenario is that you have connected a switch without consulting us (see answer to previous question).

== Team Internet ==

[[User:JasperWallace]]
[[User:Will-h]]
[[User:Davidc]]

Network

2015-12-12T17:01:16Z

Davidc: move rules up

== Network ==

[[Team:NOC]] has tried to build and support the fastest network for you, a network comparable to a medium sized ISP built up in just a couple of days. It might not be perfect all the time. If you experience any outage please report them to the [[Team:InfoHelpDesk|helpdesk]].

We will be providing a high speed onsite network with blanket wireless coverage and wired network access to both venues and camping tents.

'''Key points:'''

* You have a public IP address and there is no network firewall or filtering. [[#Security|Keep safe!]]
* Don't set up your own wifi access point. [[#Rules|More Rules]]

== Rules ==

* Be nice and friendly! Do not do to others what you do not wish done to yourself.
* Protect your computer! We cannot be taken responsible or held accountable for any damage your devices might sustain due to security problems, power spikes and other such perils.
* Please do not operate your own WiFi access point. This slows things down for everyone else. Our wireless solution includes 'CleanAir' technology and has rogue access point detection.
* If you are operating anything else in the 2.4GHz spectrum, please clear the frequencies in advance with us.
* Do not attempt to run a DHCP or RA server. You will be found and named and shamed!
* Cabling from your tent to the Datenklo must not cross any roads or fire lanes.
* If you are connecting a Nanode / Arduino Ethernet / other microcontroller to the network please make sure it is using a unique MAC address. Many of the code examples for such devices use an identical MAC address and this will cause problems - if you aren't sure contact the [[Team:InfoDesk|helpdesk]].
* If you are connecting a switch, you need to contact the NOC to enable this on your port. You are only allowed one uplink from your switch to our network - do not attempt to connect multiple cables or to multiple DKs!

If you break these rules, we will track you down or triangulate you, but we'd rather spend the time maintaining the smooth operation of the network, so please don't waste our time. And if you think [[Team:NOC]] cannot locate you just because you're wireless - think again. ;-)

== Uplink ==

Uplink from the campsite is currently being arranged. Details will be announced when firm. As in previous years, we expect to provide many hundred Mbps.

== Wireless ==

The whole field has been covered with many wireless access points to ensure the best possible coverage and to allow you to roam seamlessly without interruption. Naturally, there is additional coverage in popular areas such as the talk tents.

The following SSIDs will be available:

* emfcamp
** This is 5GHz and should you should use this one in preference, if you can see it. The username and password are "emf". This is the most secure, WPA2-Enterprise.
* emfcamp-legacy
** This is 2.4GHz and less resistant to interference, use it only if you have to. The username and password are "emf". This is also WPA2-Enterprise.
* emfcamp-insecure '''Warning: insecure'''
** This is both 5GHz and 2.4GHz, and is for older devices that don't support WPA2-Enterprise. It's unencrypted.
* spacenet
** This is 2.4GHz + 5GHz and WPA2-Enterprise, you can connect with a valid account if your hackerspace is offering spacenet. More information can be found at [https://spacefed.net/ spacefed.net].
* eduroam
** This is 2.4GHz + 5GHz and WPA2-Enterprise, you can connect with a valid account if your university/college/school is offering eduroam. More information can be found at [https://www.eduroam.org/ eduroam.org].

Use of the 5GHz SSIDs is recommended if your device supports them. 802.11b is disabled as it slows everyone else down.

Even if you are using an encrypted network, you should still [[#Encryption|encrypt any sensitive traffic]] sent over the air end-to-end to prevent snooping. Although some SSIDs offer encryption, it is only over-the-air.

We have airtime fairness configured on our wireless controllers, so if you wish to download large files please use a wired connection (there will be plenty about).

For proper wireless support under linux, you should have a kernel newer than 2.6.39.2. There is also a kernel panic with brcmsmac on linux 3.10.3 that can be fixed by downgrading to kernel 3.10.2.

=== WPA2 802.1X, encryption ===

Due to popular demand (and with security in mind) we provide WPA2 802.1X. This will encrypt your traffic, preventing attackers from sniffing your data. Keep in mind that this won't protect you from other network attacks and you should still be aware that you are at a hacker conference! Your link layer should be secure if you do certificate checking (see below).

You might think: "WTF!? Do I need to register a user and password blah, blah". Fortunately not. You can '''use any username/password combination using EAP-TTLS with PAP to login''' (example: "user: fbhfbhiaf pass: bgufwbnkqo" is valid), because we don't care who logs in and who you are. We just want to encrypt your data.

Users which use MSCHAPv2 (like Windows users with default 802.1X supplicant) should use a fixed username and password. You can use "emf/emf" or "guest/guest" as "username/password".

==== Client Settings ====
SSID: emfcamp or emfcamp-legacy
Phase 1: EAP-TTLS or PEAP
Phase 2: MSCHAPv2 or EAP-MSCHAPv2 or PAP

CN = radius.emf.camp
CA = GeoTrust Global CA
Fingerprint = 5E:A7:65:99:25:14:46:A4:0A:CD:2D:22:27:C1:1B:70:AA:A0:CC:1F

Make sure '''you check the certificate''' in order to know you are connecting to the correct network (you should check on both the CN and the CA).

== Camping area and workshops ==

All camping areas will be within 60m of a Datenklo (Data Toilet), please bring around 60-70m of CAT5 cable. Unless a sponsor comes forward for it, we will be unable to supply cable on site. We will be budgeting only for the infrastructure requirements and necessary spares to deal with issues.

Lay your own cable neatly from your tent back to the nearest Datenklo, and leave 6m of slack coiled on the floor in front of it. And please lay it so that it can be clearly seen that it needs to be plugged in - or you risk having your cable overlooked. At regular intervals a member of the NOC team will connect it up and enable the port.

If you wish to be removed from a Datenklo again, contact the [[Team:InfoDesk|helpdesk]] directly.

All of our edge ports are at least 10/100, some support PoE (802.3af), plus Auto-MDX.

== Static IPs ==

If you need a static IP on the wired network, drop by the [[Team:InfoDesk]].

== IPv6 ==

Naturally, IPv6 is available throughout the network and should "just work" for you. Team:NOC does not recommend disabling IPv6 if you have problems, instead try to understand the problem you are experiencing and get educated in the new world order. Contact the [[Team:InfoDesk|NOC helpdesk]] if you need help.

== Multicast ==

We have a TV & radio multicast feed from the BBC. Simply open your media player and browse multicast streams (e.g. in VLC's main window, go to the sidebar "Local Network -> Network Streams (SAP)").

This is currently working on both the wired and wireless network; you will have some expected packet loss if you use wireless though.

Don't forget to turn on deinterlacing to get a proper picture (press 'd' in VLC).

== Services ==

* DNS: 78.158.87.11 and 78.158.87.12
* NTP: 78.158.87.11 and 78.158.87.12 (ntp1.emf.camp and ntp2.emf.camp)
* Nearest Debian mirror: http://debian.mirror.uk.sargasso.net
* Content distribution server - for use by speakers to upload their content to an on-site server - http://content.emf.camp/ . Speakers please contact noc@ to get an account.

== Security ==

=== Recent vulnerabilities ====

'''WARNING: Bring a recent DHCP Client'''. If your OS uses ISC DHCP dhclient make sure you don't run a vulnerable version. https://www.kb.cert.org/vuls/id/410676

=== Encryption ===

Please treat the network as wide open and full of attackers. Although [[Team:NOC]] themselves will not monitor the network, always assume that Alice flirting with Bob will be spied upon by The Third Party.

Any sensitive information including passwords must therefore be encrypted. Please make sure you don't use any software or web applications that send sensitive data or passwords in the clear.

The following mechanisms should be safe:
* Anything that goes through a VPN
* Any website that uses HTTPS
* Any application that uses SSL
** In the case of email, you need to have SSL enabled for both receiving mail (POP, IMAP) and sending it (SMTP)
* ssh and scp
* Where possible, use One-time passwords. Real tokens work best, many of those should be compatible with open source radius servers. [http://perlmonks.org/?node=967433 Here] is a simple Perl radius server implementation for [http://tools.ietf.org/html/rfc6238 RFC6238] tokens that works with ssh and other stuff on linux.

The following are almost always unsafe:

* FTP with login/password (are almost always sent in the clear)
* Telnet with login/password
* Email if you don't use SSL
* Webmail that doesn't use HTTPS
** Someone could trigger a password reminder and then intercept your email
* Websites that use HTTP (not HTTPS) where you need to fill in a password in the page itself

Possibly unsafe, make sure that you understand what you're doing:

* Websites where you need to fill in a password and your ''browser'' (not the website!) tells you it's going to be sent securely
* Websites that require an account but remember you're logged in
** The password ''may'' be protected but not the content or cookies that automatically log you in
* Any time your browser or other application brings up ''anything'' to do with a certificate
* Anything not protected with SSL: someone could be faking DNS answers to impersonate certain sites

Remember: if you're being stupid someone may feel the need to teach you a security lesson in a not so subtle way! (No, that doesn't mean it's ok to hack people just to see if their security is in order.)

=== Firewall ===

There is no network firewall. We operate an unfiltered network that is wide open to the Internet. There is no NAT, and everybody has a public IP address. This is our definition of "network neutrality" - a network that doesn't do anything whatsoever to your IP connection.

If you are used to feeling secure just because you've been sitting behind a NAT router, think again. You are now wide open to the whole Internet. Ensure your personal firewall is enabled and set to "Public Network" and that you have applied all security updates to your OS and applications.

== FAQ ==

=== Can I bring a server? ===

<strike>Yes, though we would rather these were stored centrally in our NOC. This allows us to provision power easily and you also get the added benefit of connecting directly to our core and having UPS backup. If you intend to bring a server please email noc@emfcamp.org so we can fully understand your requirements prior to the event.</strike>

We have not yet determined whether we will be able to provide colocation space for servers, but we would like to in order to save bandwidth on the extensive site network. If this will be helpful for you, please e-mail noc@emfcamp.org so we can gauge demand.

=== Can I use the 2.4GHz band for non-wifi projects? ===

The following channels are available for adhoc/mesh/other wireless stuff:

* 2.4Ghz: Channel 1
* 5Ghz: Channel 136, 140

We cannot force you to use these channels, but we are trying to build a functional wireless network for the other attendees too. So please, don't do any experiments on other channels.

=== Can I bring an access point? ===

No, this is strictly prohibited! We need all available channels to provide good quality coverage for the rest of the attendees. Please do not be selfish here as you will degrade performance for everyone else, and we WILL track you down.

If you are operating a village (using an EMF-supplied tent) that has poor coverage, we may be able to arrange to put an access point in it during the event to improve coverage. Stop by the NOC and ask.

=== Can I bring a switch? ===

Yes, but for stability purposes all edge ports are limited to 3 MAC addresses at a time. If you want to connect a switch, you need to stop by the NOC and ask us to lift the port-security on your port. If you do this, you need to convince us that you know what you're doing and promise not to do anything that may harm the network - in particular, you must not connect the switch to our network by more than 1 cable (not even to a different DK).

=== My port goes up and down every couple of minutes ===

You have probably tripped port security. Most likely scenario is that you have connected a switch without consulting us (see answer to previous question).

== Team Internet ==

[[User:JasperWallace]]
[[User:Will-h]]
[[User:Davidc]]