What does this indication mean?

[Jouni Malinen]

On Thu, May 31, 2007 at 07:23:02PM -0000, Queisser, Andrew (VfB Stuttgart '07!!) wrote:

> In my Michael tests I'm coming across the following message from hostapd
> running in WPA-PSK mode:
> 
>   Wireless event: cmd=0x8c02 len=81
>   Custom wireless event: 'MLME-MICHAELMICFAILURE.indication
>      (keyid=9 unicast addr=00:0f:20:94:54:b9)'
>   MLME-MICHAELMICFAILURE.indication for not 
>       associated STA (00:0f:20:94:54:b9) ignored
> 
> I also sometimes get MLME-REPLAYFAILURE from the same MAC addr.
> 
> Can someone explain why a non-associated station would tell hostapd that
> there's been a MIC failure?

This message is not from a remote host; it is from the local driver. In
other words, the driver is reporting that it received a frame with
invalid Michael MIC (or replay). This particular Michael MIC failure
report looks invalid, though, not only because of the address being from
a non-associate STA, but also because of the key index 9 being claimed
for a unicast frame while unicast is only using key index 0. In other
words, this looks more like a driver bug of some sort.

-- 
Jouni Malinen                                            PGP id EFC895FA