5

I visit the airport, I pull out my laptop and connect to a network (no password needed).

I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I presume if I close my browser and then open it back up, it wouldnt ask me to pay twice.

How does the browser know when the user is authenticated?

I know this answer includes 802.1x, EAP and RADIUS protocols but I cannot see how and what the client transmits when all they are doing is opening up a normal web browser?

Improve this question

2 Answers 2

Reset to default
5

Everything is authenticated based upon the mac address of your wireless card. When you connect initially you are assigned a DHCP address by the gateway device which is controlling your DNS. Before you are authenticated all DNS requests are redirected to the HTTP(S) server of the gateway device. This controller has created you an account based upon your mac address and once the payment authorization is received it enables your account to access the public DNS server for full access to the internet.

Improve this answer
3
  • 3
    And keep in mind that because MAC addresses are so easy to duplicate, it is an easy way to gain free Wifi access to otherwise paid hotspots.
    – logicalscope
    Dec 31, 2011 at 22:45
  • @logicalscope, But how would you know which MAC address they are using?
    – Pacerier
    Dec 20, 2014 at 18:00
  • @Mark, What if we bypass DNS by inputting the IP address of the server directly?
    – Pacerier
    Dec 20, 2014 at 18:00
3

The browser does not know anything about the authentication. It is done on the outside: outgoing connections are intercepted. This can be done in several ways; usually, the WiFi router intercepts outgoing TCP connections, and, if the contents of the connection look like an HTTP request, the router serves back the 'pay me' page; all other connections are simply dropped. Once you have paid, the router lifts the restriction and lets TCP connections flow. There is nothing specific about WiFi here.

This kind of access control can be bypassed by using IP-over-DNS: since the router lets DNS requests pass (it intercepts only TCP connections), you can encapsulate arbitrary data traffic within fake DNS requests (provided that you control a DNS server on the outside, which does the reverse operation).

EAP, Radius... are about authentication protocols and their integration within the WiFi connection process. This is irrelevant to your airport situation: you connected without a password, hence, at the WiFi level, there is no authentication whatsoever.

Improve this answer
3
  • Whether DNS queries are forwarded to the outside world or not, depends on the access control software. There are variants, that answer all queries for A-records with the IP-adress of the local webserver and drop all other queries.
    – Hendrik Brummermann
    Jan 19, 2012 at 22:27
  • @Tom, Why would a router block TCP but let DNS requests pass? Isn't that like locking half the gate?
    – Pacerier
    Dec 20, 2014 at 18:02
  • Some routers intercept the first outgoing HTTP connection and replace it with the router "login page"; but the client system will not send that request unless it has first resolved the IP address of the target server, so DNS has to go through.
    – Tom Leek
    Dec 21, 2014 at 22:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .