http://www.wi2600.org/mediawhore/nf0/wireless/docs/802.11/WAP11/ (Visit http://www.johncompanies.com/collocation/ for your own collocated FreeBSD server, only $65 per month no hardware or signup fees.) This text file by Xam (C) 2001 .. and all that jazz comments/questions/etc to xam@wi2600.org This file is a result of learning of an interesting set of features available to the user of a "WAP11" access point, sold by Linksys. The origional persons who dispensed this little bit of knowledge are deserving of much thanks and credit, however, I'm not sure if much detail should be gotten into. In any case, the origional discovery was not my own. For now, they are known as the: "super secret canadian wireless group" ****NOTE*NOTE**** To hopeufully put to rest questions like: "Will this also work on the BEFW11S4?" "Will this also work on the DLink 1000AP?" Short answer: I do not know of anything similar that can be done to increase the output signal strength. On the bright side, it has been noted that this process also works to modify the output power of the Netgear ME102, and SMC MC2655W. See the Seattle Wireless website for more hardware compairison. ****************** So, what's the deal with the WAP11? Well, lets cut to the chase; with a little bit of effort, you can turn the "normal" WAP11 into an Access Point with suprising range and power, by simply telling it's radio to output a stronger signal. Yes; the power output IS a software-controlable parameter set. A location in the bridges configuration space called "register CR31" contains 14 values, each one byte in size which serve to control the transmit power. There is one byte per channel. Becuase of this, you're not stuck with a signle output power for all channels. This could serve to be usefull in cases where contoured power output within the 2400 to 2480 Mhz band is needed. Within the tool (discussed later) you'll be setting this byte to various values depending on the power output you're looking for. The scale is as follows: 00----------80----------FF 0mw--------100mw-------0mw The scale is linear, 80h (128 decimal) being the highest power, at nearly 100 mw! YES! The Wap11 in fact, contains a radio which is capable of 100 mw opperation. It is interesting to note that the power falls as you near FF and 00 on either end of the byte values. Listed below is the default channel set power for a WAP11 bought recently within the FCC regulatory domain. It has been noted that often WAP11's (or me102/smc2665w's) will be seen having different power levels. This appears to be related to testing at the factory, possibly finding the best combination of linearity and power. Channel Power 1 c0 2 bf 3 bb 4 bb 5 b9 6 b7 7 b7 8 b7 9 b5 10 b5 11 b5 12 b5 13 b5 14 b5 The defaults are moving away from higher values to lower values as you go from from channel 1 to 14. However, this translates into lower power UP to higher power through the band. This could simply be precompensation for greater absorbtion exerienced by higher frequencies. Or, a number other other reasons. I'm not inclined to think it's due to correcting for absorbtion; we're only talking an ~80Mhz band here, starting from 2400 MHz. In any case, the OEM gives us a good head-scratcher here. In effect, the radio on channel 1, is putting out about 41 mw. At channel 14, we're outputting nearer to 50 mw. As an aside, raising the power to 100 mw only gets us another 3 or 4 db peak envelope power at best. Even though it is only a small gain (contrasted with most external amplifiers providing 15 to 20 db of gain), it can be usefull in cases where you have to overcome long runs of poor-quality coax, or can't mount the AP where you hope. However, take caution if you intend to drive an external amplifier. While many amps' have auto-ranging AGC's on their inputs, many do not. You need to ensure that the +20 dBm range (~100 mw) of input won't harm anything. Also, if you are driving an amp that uses an AGC to clamp its output, and you have a short coaxial run to it, cranking the power in the radio might not help you at all. Your final output power won't gain anything, and you could oversaturate the input. You've been warned. Continuing on, I think we deserve a nice helping of gigahertz radiation. Lets crank all the values to "80h" (128 dec), and revel in our now gratuitously overpowered Access Point. Doing it on Win32 and *nix: To mess with your access point, you'll probably want/need the tools to do it. You can find them here: http://www.wi2600.org/mediawhore/nf0/wireless/utils/ get: Atmel_SNMP_manager_v1.743.exe - this is for the config NOTE: This is a win32 program, prefers nt/2k over 9x NOTE: Will someone please do this procedure, and capture the whole mess on TCPDUMP? I'm 100% sure this SNMP write could be done w/ appropriate *nix tools (net::snmp comes to mind). For *nix boxen, you have at least one option at the time being, and that is to use http://desync.com/linksys You'll need Perl installed and net:snmp available. If you don't have this, visit CPAN. ----------------------------------------------------------- Firmware notes: If you'd like to get a fimeware rev just one step ahead of what Linksys themselves are putting on their site, be sure to grab: AP14g7.rom from: http://www.wi2600.org/mediawhore/nf0/wireless/firmware/ATMEL/ Current (as of 12/17/01) is 1.4g5 for 1.0 hardware, 1.1 hardware seems to like 1.4h.3 better. In general, it's best to keep up yourself with the newer firmware rev's and what's prefered for 1.0/1.1 versions of the AP hardware. Some tell-tale signs that you have 1.0 hardware: -you bought the AP mid-summer 2001, or earlier -when running 1.4h.3, SNMP access is broken -ETSI regulatory domain is setfor US radios Some tell-tale signs that you have 1.1 hardware: -you bought the AP late-summer 2001, or later -when running anything older than 1.4h.3 things are unstable -running 1.4g5 or 1.4g7 firmware 'breaks' the AP -FCC regulatory domain set for US radios ---------------------------------------------------------- ..Now for the *nix folks: (and thanks to Ben @ Desync.com!) If you've allready configed the AP and setup the "password wanabe community string for read/write" in the AP, and you are using 1.4g5 firmware, you're good to go. If not, read into the win32 section a bit and follow the directions there on how to setup those strings. Why run 1.4g5? Becuase I'm not the only person to notice that this doesn't work on older versions. According to http://pasadena.net/aprf/ this has been notice by more than just myself ;) Ok, now go and download the perl script at: http://desync.com/linksys On FreeBSD 'fetch' will do it, on other platforms wget, links, lynx, or any browser will also work. (the quotes, of course, are not literal) Then, do a "chmod 0700 linksys" Then, run the script by typing "./linksys" The built-in help will show you the syntax needed, and then prompt you for the proper community string. After you commit the data, you're done! See how easy *nix makes this stuff? ------------------------------------------------------------ Picking back up for the win32 folks: Now that you've downloaded the Atmel config tool, install it. After the installation is done, go edit the file called: "snmpmanager.ini" .. this will be located in %systemroot%\winnt or \windows depending on your OS. The default values of: [SNMPmanager] AppMode=0 AppView=0 Change both values to "2" .. this will essentialy 'unlock' the features we need in the Atmel config tool. Next, start the Atmel config tool (if you're in 9x you'll actualy need to reboot). Some notes about whats going on. -You'll need to have setup a writeable/readable community string on the AP you're working on. The best way to do this is to download the Linksys SNMP/USB config tool, and setup the AP via USB initialy. Once you get it's base config set, you can then connect via SNMP over IP. --Get the linksys USB/SNMP tool directly from their site -You'll need to be on the same subnet as the AP if your DHCP server isn't handing out leases with a default router specified. For some reason, you can't set a default route with the USB util. So, once you've gotten the bridge on the newer firmware, setup a read/write community string in the USB util, and put the thing on an IP you can contact, you're ready to rock. Within the Atmel tool, go to "connect to access point." You will want to login as "admin" and the community name will be the one you setup for read/write in the USB util. Procede to the "radio" menu, and select "radio config" Vola! Here's the CR31 register control. Go through and set the bytes to the value you love most, and that is "80." Upon hitting "set" your radio will recieve new config data, and restart. When it comes back up, you'll have that crazy power you allways dreamed of! So, that's all there is to it, realy. Spin through the other areas in the Atmel too; there certainly are quite a few more things than included with the Linksys util. ...and with that, enjoy. --------------------------------------------------------- Some links of interest: http://www.bawug.org/howto/ http://www.personaltelco.net/index.cgi/AccessPointReviews http://www.seattlewireless.net/?HardwareComparison http://www.seattlewireless.net/?HardwareComparison#line58 --------------------------------------------------------- SNMP data, breakdown of the MIB, strings to write, etc: Very nice data regarding the percieved signal strength improvement, and SNMP info: http://pasadena.net/aprf/ Perl net::snmp script to change the values of the power control CR31 register. The author is also interested in hearing back on improvements to the code ;) http://desync.com/linksys