NetEqualizer Bandwidth Shaping Solution: Hotels & Resorts

In working with some of the world’s leading hotels and resorts, we’ve repeatedly heard the same issues and challenges facing network administrators. Here are just a few:

Download Hotels White Paper

  • We need to do more with less bandwidth.
  • We need a solution that’s low cost, low maintenance, and easy to set up.
  • We need to meet the expectations of our tech-savvy customers and prevent Internet congestion during times of peak usage.
  • We need a solution that can meet the demands of a constantly changing clientele. We need to offer tiered internet access for our hotel guests, and provide managed access for conference attendees.

In this article, we’ll talk about how the NetEqualizer has been used to solve these issues for many Hotels and Resorts around the world.

Download article (PDF) Hotels & Resorts White Paper

Read full article …

How to Implement Network Access Control and Authentication

There are a number of basic ways an automated network access control (NAC) system can identify unauthorized users and keep them from accessing your network. However, there are pros and cons to using these different NAC methods.  This article will discuss both the basic network access control principles and the different trade-offs each brings to the table, as well as explore some additional NAC considerations. Geared toward the Internet service provider, hotel operator, library, or other public portal operator who provides Internet service and wishes to control access, this discussion will give you some insight into what method might be best for your network.

The NAC Strategies

MAC Address

MAC addresses are unique to every computer connected to the network, and thus many NAC systems use them to grant or deny access.  Since MAC addresses are unique, NAC systems can use them to identify an individual customer and grant them access.

While they can be effective, there are limitations to using MAC addresses for network access. For example, if a customer switches to a new computer in the system, it will not recognize them, as their MAC address will have changed.  As a result, for mobile customer bases, MAC address authentication by itself is not viable.

Furthermore, on larger networks with centralized authentication, MAC addresses do not propagate beyond one network hop, hence MAC address authentication can only be done on smaller networks (no hops across routers).  A work-around for this limit would be to use a distributed set of authentication points local to each segment. This would involve multiple NAC devices, which would automatically raise complexity with regard to synchronization. Your entire authentication database would need to be replicated on each NAC.

Finally, a common question when it comes to MAC addresses is whether or not they can be spoofed. In short, yes, they can, but it does require some sophistication and it is unlikely a normal user with the ability to do so would go through all the trouble to avoid paying an access charge.  That is not to say it won’t happen, but rather that the risk of losing revenue is not worth the cost of combating the determined isolated user.

I mention this because some vendors will sell you features to combat spoofing and most likely it is not worth the incremental cost.  If your authentication is set up by MAC address, the spoofer would have to also have the MAC address of a paying user in order to get in. Since there is no real pattern to MAC addresses, guessing another customer’s MAC address would be nearly impossible without inside knowledge.

IP Address

IP addresses allow a bit more flexibility than MAC addresses because IP addresses can span across a network segment separated by a router to a central location. Again, while this strategy can be effective, IP address authentication has the same issue as MAC addressing, as it does not allow a customer to switch computers, thus requiring that the customer use the same computer each time they log in. In theory, a customer could change the IP address should they switch computers, but this would be way too much of an administrative headache to explain when operating a consumer-based network.

In addition, IP addresses are easy to spoof and relatively easy to guess should a user be trying to steal another user’s identity. But, should two users log on with the same IP address at the same time, the ruse can quickly be tracked down. So, while plausible, it is a risky thing to do.

User ID  Combined with MAC Address or IP Address

This methodology solves the portability issue found when using MAC addresses and IP addresses by themselves. With this strategy, the user authenticates their session with a user ID and password and the NAC module records their IP or MAC address for the duration of the session.

For a mobile consumer base, this is really the only practical way to enforce network access control. However, there is a caveat with this method. The NAC controller must expire a user session when there is a lack of activity.  You can’t expect users to always log out from their network connection, so the session server (NAC) must take an educated guess as to when they are done. The ramification is that they must log back in again. This usually isn’t a major problem, but can simply be a hassle for users.

The good news is the inactivity timer can be extended to hours or even days, and should a customer login in on a different computer while current on a previous session, the NAC can sense this and terminate the old session automatically.

The authentication method currently used with the NetEqualizer is based on IP address and user ID/password, since it was designed for ISPs serving a transient customer base.

Other Important Considerations

NAC and Billing Systems

Many NAC solutions also integrate billing services. Overlooking the potential complexity and ballooning costs with a billing system has the potential to cut into efficiency and profits for both customer and vendor. Our philosophy is that a flat rate and simple billing are best.

To name a few examples, different customers may want time of day billing; billing by day, hour, month, or year; automated refunds; billing by speed of connections; billing by type of property (geographic location); or tax codes. It can obviously go from a simple idea to a complicated one in a hurry. While there’s nothing wrong with these requests, history has shown that costs can increase exponentially when maintaining a system and trying to meet these varied demands, once you get beyond simple flat rate.

Another thing to look out for with billing is integration with a credit card processor. Back-end integration for credit card processing takes some time and energy to validate. For example, the most common credit card authentication system in the US,, does not work unless you also have a US bank account.  You may be tempted to shop your credit card billing processor based on fees, but if you plan on doing automated integration with a NAC system, it is best to make sure the CC authorization company provides automated tools to integrate with the computer system and your consulting firm accounts for this integration work.

Redirection Requirements

You cannot purchase and install a NAC system without some network analysis. Most NAC systems will re-direct unauthorized users to a Web page that allows them to sign up for the service. Although this seems relatively straight forward, there are some basic network features that need to be in place in order for this redirection to work correctly. The details involved go beyond the scope of this article, but you should expect to have a competent network administrator or consultant on hand in order to set this up correctly. To be safe, plan for eight to 40 hours of consulting time for troubleshooting and set-up above and beyond the cost of the equipment.

Network Access for Organizational Control

Thus far we have focused on the basic ways to restrict basic access to the Internet for a public provider. However, in a private or institutional environment where security and access to information are paramount, the NAC mission can change substantially. For example, in the Wikipedia article on network access control, a much broader mission is outlined than what a simple service provider would require. The article reads:

“Network Access Control aims to do exactly what the name implies—control access to a network with policies, including pre-admission endpoint security policy checks and post-admission controls over where users and devices can go on a network and what they can do.”

This paragraph was obviously written by a contributor that views NAC as a broad control technique reaching deep into a private network.  Interestingly, there is an ongoing dispute on Wikipedia stating that this definition goes beyond the simpler idea of just granting access.

The rift on Wikipedia can be summarized as an argument over whether a NAC should be a simple gatekeeper for access to a network, with users having free rein to wander once in, or whether the NAC has responsibilities to protect various resources within the network once access is attained. Both camps are obviously correct, but it depends on the customer and type of business as to what type of NAC is required.

Therefore, in closing, the overarching message that emerges from this discussion is simply that implementing network access control requires an evaluation not only of the network setup, but also how the network will be used. Strategies that may work perfectly in certain circumstances can leave network administrators and users frustrated in other situations. However, with the right amount of foresight, network access control technologies can be implemented to facilitate the success of your network and the satisfaction of users rather than serving as an ongoing frustrating limitation.

The True Price of Bandwidth Monitoring

By Art Reisman

Art Reisman CTO

For most IT administrators, bandwidth monitoring of some sort is an essential part of keeping track of, as well as justifying, network expenses. Without visibility into a network load, an administrator’s job would degrade into a quagmire of random guesswork. Or would it?

The traditional way of  looking at monitoring your Internet has two parts: the fixed cost of the monitoring tool used to identify traffic, and the labor associated with devising a remedy. In an ironic inverse correlation, we assert that costs increase with the complexity of the monitoring tool. Obviously, the more detailed the reporting tool, the more expensive its initial price tag. The kicker comes with part two. The more expensive the tool, the more  detail  it will provide, and the more time an administrator is likely to spend adjusting and mucking, looking for optimal performance.

But, is it a fair to assume higher labor costs with  more advanced monitoring and information?

Well, obviously it would not make sense to pay more for an advanced tool if there was no intention of doing anything with the detailed information it provides. Why have the reporting tool in the first place if the only output was to stare at reports and do nothing? Typically, the more information an admin has about a network, the more inclined he might be to spend time making adjustments.

On a similar note, an oversight often made with labor costs is the belief  that when  the work needed to adjust the network comes to fruition, the associated adjustments can remain statically in place. However, in reality, network traffic changes constantly, and thus the tuning so meticulously performed on Monday may be obsolete by Friday.

Does this mean that the overall productivity of using a bandwidth tool is a loss? Not at all. Bandwidth monitoring and network mucking can certainly result in a cost-effective solution. But, where is the tipping point? When does a monitoring solution create more costs than it saves?

A review of recent history reveals that technologies with a path similar to bandwidth monitoring have become commodities and shunned the overhead of most human intervention.  For example, computer operators disappeared off the face of the earth with the invention of cheaper computing in the late 1980’s.  The function of a computer operator did not disappear completely, it just got automated and rolled into the computer itself. The point is, anytime the cost of a resource is falling, the attention and costs used to manage it should be revisited.

An effective compromise with many of our customers is that they are stepping down from expensive complex reporting tools to a simpler approach. Instead of trying to determine every type of traffic on a network by type, time of day, etc., an admin can spot trouble by simply checking overall usage numbers once a week or so. With a basic bandwidth control solution in place (such as a NetEqualizer), the acute problems of a network locking up will go away, leaving what we would call only “chronic” problems, which may need to be addressed eventually, but do not require immediate action.

For example, with a simple reporting tool you can plot network usage by user.  Such a report, although limited in detail, will often reveal a very distinct bell curve of usage behavior. Most users will be near the mean, and then there are perhaps one or two percent of users that will be well above the mean. You don’t need a fancy tool to see what they are doing; abuse becomes obvious just looking at the usage (a simple report).

However, there is also the personal control factor, which often does not follow clear lines of ROI (return on investment).

What we have experienced when proposing a more hands-off model to network management is that a customer’s comfort depends on their bias for needing to know, which is an unquantifiable personal preference. Even in a world where bandwidth is free, it is still human nature to want to know specifically what bandwidth is being used for, with detailed information regarding the type of traffic. There is nothing wrong with this desire, but we wonder how strong it might be if the savings obtained from using simpler monitoring tools were converted into a trip to Hawaii.

In our next article, we’ll put some real world numbers to the test for actual break downs, so stay tuned. In the mean time, here are some other articles on bandwidth monitoring that we recommend. And, don’t forget to take our poll.

List of monitoring tools compiled by Stanford

Linux Tips
How to set up a monitor for free

Created by APconnections, the NetEqualizer is a plug-and-play bandwidth control and WAN/Internet optimization appliance that is flexible and scalable. When the network is congested, NetEqualizer’s unique “behavior shaping” technology dynamically and automatically gives priority to latency sensitive applications, such as VoIP and email. Click here for a full price list.

NetEqualizer Seminar at Eastern Michigan University

NetEq. Seminars

On January 27, we will be hosting a complimentary NetEqualizer Seminar at Eastern Michigan University in Ypsilanti, Michigan. EMU, which has been a NetEqualizer user for several months, is the home of over 23,000 students, providing for a first-hand look at the NetEqualizer’s capabilities. In addition, door prizes will be awarded to attendees, including a number of Garmin GPS systems.We’ll cover:

  • The various tradeoffs regarding how to stem p2p and bandwidth abuse
  • Recommendations for curbing RIAA requests
  • Demo of the new NetEqualizer network access control module
  • Lots of customer Q&A and information sharing on how Eastern Michigan University is using the NetEqualizer, including some hands on probing of a live system

When: Tuesday, January 27, 10 a.m. to noon


Eastern Michigan University
Bruce T. Halle Library Building, Room 302
955 West Circle Drive
Ypsilanti, MI 48197

This will be a great opportunity to learn more about the issues and challenges facing network administrators as well as see the NetEqualizer in action. If you’re in the area, be sure not to miss it! For more information, contact us at

Network Access Control lease plan now available from APconnections

APconnections to Offer Managed Network Access Control with no upfront costs.

LAFAYETTE, Colo., January 6, 2009 — APconnections, a leading supplier
of plug-and-play bandwidth shaping products and the creator of the
NetEqualizer, today announced it would begin offering a network access
control management services with no upfront  costs.

The services will be targeted toward networks that typically see a
high degree of turnover among users, such as airports, hotels, and
Internet cafes. For qualifying customers, APconnections will remotely
manage access to Internet connections, leaving clients free from the
worry of regulating and distributing short-term Internet service.

The suggested initial management package will offer users the option
of utilizing a complimentary 128 kbs connection or upgrading to a
high-speed 1-megabit connection for a fee. Upon accessing the network,
users will be directed to a billing page, which will offer the two
levels of service. The content of this page will largely be determined
by the client, including the option to display advertisements from
local vendors, providing the opportunity to further increase revenues.

In addition to clients no longer having to worry about regulating
Internet access, APconnections will also be responsible for all
billing and technical support. On a monthly basis, clients will be
provided with a statement showing income and network usage.

The only cost to clients will be a pre-determined percentage of the
income from customers’ high-speed upgrades. While this service can be
provided for customers with an existing ISP, Internet service can also
be established or expanded through APconnections directly for an
additional fee.

To qualify, clients must average a set number of monthly users. A
one-month trial of the service will be offered at no charge, at the
conclusion of which a service contract must be signed.

For more information, please contact APconnections at 1-888-287-2492
or via e-mail at

APconnections is a privately held company founded in 2003 and is based
in Lafayette, Colorado.

Art Reisman
303-997-1300 extension 103
720-560-3568 cell

NetEqualizer Network Access Control Module Helps Generate Revenue

Background: The NetEqualizer network access control module (NAC), which was released this past September, allows users to re-direct “unknown” or “unauthorized” traffic to a web server hosted on the NetEqualizer.  Once redirected, you can have the NetEqualizer perform a variety of actions, including:

1) Authenticating a user via login
2) Allowing the unknown user to create a paid account (using a credit card, for example)
3) Allowing the user to pass through to the Internet without logging in

Did you know that the NetEqualizer network access control module offers several options to generate revenue? One of the dilemmas many of our customers have mentioned is that in order to be competitive they don’t want to charge for their Internet service (hotels, etc.). Well, the cool thing about the NAC module is that you can offer multiple logins with different rate limits. For example, one could be your standard free service and another could be a paid service with higher bandwidth rates.

An additional revenue generating feature of the NAC module is the ability to run advertisements on the login screens. For example, if you’re a hotel operator, even if you’re not charging for Internet service, you could have your guests login on a screen with the logo and name of a local merchant, or anybody that is interested in cross marketing with your hotel.

The NAC module also has customizable splash screens on its default login page that you can edit, thus welcoming your users with whatever content you choose.

For more information about the NetEqualizer network access control module, visit our Web page at or contact us at 1-888-287-2492 or via email at

Network Access Control Features Redirection for Delinquent Customers

What should an Internet service provider do to customers who are late with their payment?   If you simply block the user completely  at your firewall, you will likely generate a costly call to  your support engineering. But, there are other options…

A better way to collect payment without creating support calls is to redirect the delinquent user to a splash screen  informing them they need to pay their bill.  Obviously a customer won’t call unless they are ready to pay, hence no costly call to support engineering. For the suggested redirection capability, you do not need a fully automated network access control system (requiring a login  and credit card payment), but you do need a way to redirect delinquent customers to a Web page telling them to pay their outstanding bill.

With our latest version that is available now, we can set up IP redirection to a custom web page for a nominal support charge.

Note:  We now host the redirection page right on your NetEqualizer, so there is no need for another third party server.

Call us if you are interested:  303-997-1300

Update: NetEqualizer Access Control Module Running Live at Portola Hotel & Spa

Well, we did it. The new NetEqualizer access control module is now up and running at the Portola Hotel and Spa in Monterey, California. Of course, we wanted to be there for the maiden voyage.

We retrofitted one of the existing NetEqualzier bandwidth controllers at the Portola Hotel with our network access controller and have been live in their lobby areas without an issue going on 36 hours now.

According to Phillip Pennington of Portola Plaza’s IT department, he was not surprised with the results as our NetEqualizer products (they have four of them) have worked flawlessly throughout the complex since being installed 18 months ago.

We have just a few minor customizations to make for their billing needs, and plan to bring up the rest of the hotel in January 2009.

If you were waiting for our latest release with our NAC, now is a good time to call.

The price for any trials next month will start at $2500 and include two hours of consulting.

Note: Customers will need some HTML experience to customize their text pages. Customers will also need to meet basic network configurations to be eligible. Contact us for details at 303-997-1300 or see our Web page for more information.

Portola Plaza Personalized Welcome Screen

Returning Users Sign In Screen

NetEqualizer Network Access Control Rollout

After several months in development, the NetEqualizer network access control module is now available for trial.

The basic features of the Module are what you would expect (think airport T Mobile daily access etc):

1) The ability to dynamically authenticate/restrict users through a login process.

2) Automated payment processing for users who do not have a login.

3) The ability to selectively exempt an IP range from authentication redirection server. For example well known IP addresses on your network will not be forced to login, while other open IP address ranges (guest network) will require a login to obtain access.

4) The ability to custom brand  login pages and redirection service

Plus a couple of new twists that go above and beyond normal Network Authentication products:

1) Class of Service Specification When Customers Sign Up

For example, you will be able to offer customers a free standard service at modem speed with an option to pay for an upgrade for a faster connection. We have been playing with this feature at the office with our test system and the option to upgrade is very compelling. This could be a great way to increase revenue for those who might otherwise not log on at all if asked to purchase up front. Of course, this is made possible because the network access control is hosted by our NetEqualizer platform with full access to rate limiting features.

2) Group Licenses

This was one of the main requests from Portola Plaza Hotel (our beta site). They wanted to know if we could offer a system that allowed them to sell a group license (limited by total simultaneous sessions) to conference attendees. The other part of the challenge was to maintain a pay as you go option for individual hotel guests at the same time. Well, we have all that in there and it really is pretty impressive!

3) Smooth Service

For those hotels and institutions that have not been able to pull the trigger on something to eliminate their busy hour congestion, they will get the full power of our automated bandwidth controller. Many hotels and institutions have too many irons in the fire to address this issue, and perhaps their management cannot quantify the cost of slow Internet service, so they just live with it. These same institutions love to implement pay for internet service because that feature is clear-cut revenue generating device. So, now they will get both — revenue and smoother service for their paying customers all in one swoop!

4) Reliable Engineering

As many of our customers already know, we are an engineering company that developed a product, not an investor with a business plan that hired an engineering company. What this means is that our roots are conservative and we are in no hurry to put a solution on the market that will cause customers headaches as a result of some greedy business plan and offshore engineering. We do the work here in the U.S. and pay our engineers salaries of U.S. quality. The end result is a smoother process from start to finish. In addition, we are very conservative with our roll out and will not sell more than we can support at one time.

Needless to say, we were very excited to see the control module in action. It’s been even better to see that the months of research and development have paid off. For more information about the NetEqualizer network access control module, please visit our Web site at

%d bloggers like this: