When it comes to wireless LANs, which matters most: security, provisioning, management or performance? If you answered "all," there are a bunch of WLAN switch vendors eager for your business. Each vendor in this emerging product category says it delivers all of the above -- and more.

We put these claims to the test in one of the most extensive hands-on assessments of WLAN switches. Four companies submitted products: Airespace, Aruba Wireless Networks, Symbol Technologies and Trapeze Networks. Other vendors we contacted did not have equipment ready at the time of our testing.

We subjected each system to security attacks, a thorough review of provisioning and management, and the first-ever published measurements of WLAN delay and jitter.

Here are some key findings:

•  While all products offer far better security than earlier WLAN products, there's much variation in how these systems handle intrusion attempts and access control.

•  Each vendor uses different tunneling methods for moving traffic, which virtually rules out interoperability and makes troubleshooting more difficult.

•  Traffic forwarding rates fall and delay rises as access points are added to the system. However, some products can adjust dynamically to changes in the wireless environment.

•  Automated site-survey tools can ease planning, but their projections are not perfect.

Picking a winner was difficult, given that each vendor offers something unique. In the end, we declared a tie between Airespace and Aruba, and awarded each of them a World Class Award. Airespace offers a well-designed Web management interface and good security features, and it has the fastest forwarding rates. Aruba is even stronger on security, and it offers the best combination of features.

Time for taxonomy

All four vendors offer switches and access points, and all four support power-over-Ethernet connections to their access points, but the similarities end there.

Because the approaches are so different, much of the testing was spent understanding how these systems work in enterprise settings. We created a mini-RFP that asked each vendor to provision a system for three workgroups in a corporate office. The hands-on review of the responses told us a good deal about WLAN features, provisioning and management.

Aruba's 5000 switch is a modular design that supports Layer 3 forwarding, letting it route traffic between IP subnets, while the three other vendors' switches are fixed-port Layer 2 devices. Trapeze's Mobility Exchange switch requires direct attachment of access points, while other vendors' products let access points be attached to any switch, with traffic tunneled back to the WLAN switch. Trapeze says its next software version, slated for the fourth quarter, does not require direct attachment of access points to its switches.

Vendors differ on access point capabilities too. Airespace and Aruba access points supported the new 802.11g specification. The others do not, but say they're working on it.

Sites with many handheld devices might want to check whether access points support multiple basic service set IDs (BSSID). Without this feature, PDAs and voice-over-IP (VoIP) phones that go into power-saving mode will be woken up by every broadcast message from the access point - and there are at least 10 of them every second. Airespace and Symbol offered multi-BSSID support in the products we tested, and Aruba says it's under development.