The Futility Of Limiting AP “Bleed-Over”

We at Connect802 commonly come across wireless networks in which the APs’ output power has been decreased so as to minimize signal “bleed-over” outside of the building. At first glance, this may seem like a prudent security precaution, but in this article, you’ll learn why it’s not as effective as you might think.

Before we discuss the effectiveness of turning down AP power to limit bleed-over, let’s take a quick look at the effect of decreased AP output power on AP coverage.

]

The image above shows the predicted coverage for a typical access point in a typical office environment. The AP is transmitting at 30 mW and the green-colored area represents a signal strength of -65 dBm or higher, which is a common design target for high-quality data transmission and Voice-Over-IP. Notice that the green area does not extend outside of the building, but of course, this doesn’t mean that bleed-over is under control. The -65 dBm green area is where clients will get excellent coverage to meet high enterprise standards. Off-the-shelf wireless adapters can receive signals that are much weaker than this—down to about -85 dBm at least.

Let’s see how far away from the building you have to get before you’re down to -85 dBm.

The brown-colored area in the image above represents a signal strength of -85 dBm and above.The modeling software wouldn’t allow the image to be zoomed out any further, so the contour extends off the edges of the screen! The distance is over 300 feet! To be fair, in real life, obstacles such as trees and other buildings would limit the range of this signal, but the point remains: in order to limit “bleed-over,” you have to think about the weakest signal that can be received by an unwanted device, and those weak signals go pretty far.

]

The image above shows the predicted coverage with the AP’s output power reduced to 1 mW. The brown bleed-over area outside the building has been substantially reduced, but notice that it still extends about 100 feet in some direction. On the one hand, bleed-over distance has been reduced by a factor of 5 or more. On the other hand, it’s still about 100 feet, which is a substantial amount! Keep in mind that this is with some pretty conservative assumptions. 1 mW is the lowest output power that APs can use, and the walls of the building are being modeled as solid concrete block. A real building, with windows, would have even more bleed-over.

Additionally, notice how much the AP’s coverage inside the building has been reduced. Whereas at 30 mW, the entire building could have been covered with about two APs, at 1 mW, it may take three or four. And this is a building with a relatively open cubicle area in the middle, so coverage is maximized. A building with more interior walls would see an even larger increase in the number of APs required to cover it.

There’s still more to the story. The range of a wireless signal depends not only on the transmit power, but also on the receiver’s sensitivity. An attacker could easily buy a 20 dBi gain antenna and hook it up to his or her wireless card. You decreased output power from 30 mW to 1 mW, which is a 13 dB decrease. The attacker’s antenna has 20 dBi of gain, compared to 2 dBi for a typical client device, which is an 18 dB increase. Effectively speaking, the attacker’s high-gain antenna has more than offset your reduction in power, and put the effective range of your “bleed-over” right back where you started.

Let’s take a final, very specific example, that further illustrates the futility of trying to limit signal “bleed-over.” Say that you had a building with shielding in the walls such that an AP at 1 mW was effectively un-detectable outside of the building. Don’t pat yourself on the back yet! What about all those hundreds of client devices out there? They’re still transmitting at their default output power, which is probably somewhere in the range of 12 to 30 mW. Oops. There’s your bleed-over! You see, 802.11 does not currently have a standard way for an administrator to limit the output power of client devices across the board. Each device’s output power usually has to be manually configured, and is then fixed, for all wireless networks that the device associates with. There are some proprietary exceptions to this rule, but they only work on certain client devices, with certain APs.

“But wait,” you might say. “What if the shielding on the wall was so strong that the clients’ 30 mW transmissions didn’t leak out either?” Then you might as well put the APs back at 30 mw and cut your AP count in half (or more).

So what’s the answer? From the standpoint of security, forget about bleed-over. Practically speaking, it takes enormous effort to limit bleed-over, and the tradeoffs aren’t worth it. Instead of fretting about who can hear your data, set up a strong, secure encryption mechanism, like WPA2, or even WPA-PSK if a strong passphrase is chosen, and then don’t worry about who can hear your data, because they can’t make any sense of it anyway.