Unicast packets stop being transmitted to a particular station, under load, when WPA2 is enabled

[Avery Pennarun]

On Mon, May 12, 2014 at 3:07 AM, Avery Pennarun <apenwarr at gmail.com> wrote:
> On Mon, May 12, 2014 at 1:05 AM, Ben Greear <greearb at candelatech.com> wrote:
>> If it's getting on the air, then I think the only way to figure out
>> what is wrong is to decode the packets and see if they are encrypted
>> properly or not.  I think there is a way to get wireshark to decode
>> pkts by feeding it the proper keys, but I have not ever actually tried
>> doing that.
>
> Okay, here is a fairly reduced capture of my wireshark trace:
> http://apenwarr.ca/tmp/ath10k-utorrent-dropout-v2-reduced.pcapng.gz
> [...]

>From what I can see, the most suspicious part of this trace is an
802.11 Action - Add Block Ack Request at time 181.1456.  In a longer
version of this trace, I can see these occurring sporadically.  Each
one has a different TI field:

Time 8.367: TID=0
Time 9.609: TID=6
Time 156.188: TID=1
Time 178.076: TID=2
Time 181.145: TID=3  <-- almost exactly the time of the failure
Time 190.127: TID=5

I don't know how 802.11 QoS works, but I don't think it makes sense to
keep negotiating block ack policies with different TIDs.  Also, the
Block Ack Starting Sequence Number field is always zero; I don't know
what that does, but it seems weird to me.

Nevertheless, I can certainly see things being ACKed in my wifi
traces.  I think maybe some incorrect Add Block Ack Request packets
may be triggering a bug in the wifi driver on my macbook?

IEEE 802.11 wireless LAN management frame
    Fixed parameters
        Category code: Block Ack (3)
        Action code: Add Block Ack Request (0x00)
        Dialog token: 0x01
        Block Ack Parameters: 0x1017, A-MSDUs, Block Ack Policy
            .... .... .... ...1 = A-MSDUs: Permitted in QoS Data MPDUs
            .... .... .... ..1. = Block Ack Policy: Immediate Block Ack
            .... .... ..01 01.. = Traffic Identifier: 0x0005
            0001 0000 00.. .... = Number of Buffers (1 Buffer = 2304 Bytes): 64
        Block Ack Timeout: 0x0000
        Block Ack Starting Sequence Control (SSC): 0x0000
            .... .... .... 0000 = Fragment: 0
            0000 0000 0000 .... = Starting Sequence Number: 0


Thanks,

Avery