Problem with PMKSA cache usage when roaming

[ambedkar ranganathan]

 ?
Hi,

The observed results is wrong.Whenever you go for re-association with new AP,either full IEEE8021X echange or EAPOL start wont occur,only EAPOL key will be exchanged,that to with new PMKID.If you are going back to first AP,First PMKID-1 will be used to re-associate with the same,etc..

If you send the sniffer capture,propably i can give you more feedback about the scenario.

Please give the clear picture about your setup.

Thanks
Ambedkar.R


On Mon, 17 Sep 2007 Tilman Schoop wrote :
>Hi all,
>
>I have seen a strange behaviour when examining the roaming in
>a WPA2 environment.
>
>There are two phenomena:
>1) no pmkid is sent during roaming reassociation telegram
>2) the same pmkid (appearing in log as pmkid of one of the
>    two access points) is sent with both (Re)association requests
>    to the different APs.
>
>I can reconstruct this behaviour in the following environment:
>
>There are 2 Cisco access points and I test the roaming with a
>client using ipw driver (alternatively using a laptop with
>hostap driver in host_roaming=0 mode) and a wpa2 configuration
>(wpa_supplicant is V0.5.7).
>The access points are located so close to eachother that
>I can see both access points in the scan_results.
>
>To replay the first case of the above mentioned:
>I start wpa_supplicant when radio is in range and
>roam between the APs without loosing the connection.
>=> every roaming leads to a full WPA2 authentication
>
>To replay the second case of the above mentioned:
>When I leave the radio area and get disconnected, then
>going back to reconnect to AP1, afterwards
>I see that pmkid is sent in the Reassociation telegrams,
>but every roaming the sent pmkid is the same. So then,
>the roaming from AP2 to AP1 goes fast (because the pmkid
>pertains to AP1), but when going from AP1 to AP2, this
>one does not accept the pmkid (of course, it is pmkid
>of AP1) and does a full authentification.
>=> every roaming from AP1 to AP2 leads to a full WPA2 authentication
>
>If I test with only one AP and get disconnected and connected again
>the pmksa caching is used to do a fast reauthentication.
>
>Has anyone seen this behaviour?
>is it a problem on the client side or with the AP configuration?
>how can I configure this to get a smart/fast/lossless roaming?
>
>I suspect a wrong cache behavior of wpa_supplicant, when
>there is no CTRL-EVENT-DISCONNECTED, and driver asyncronically
>signals "Associated to new AP". Any ideas?
>
>
>Greetings
>
>
>Tilman Schoop
>
>
>_______________________________________________
>HostAP mailing list
>HostAP at shmoo.com
>http://lists.shmoo.com/mailman/listinfo/hostap
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070918/23e77a92/attachment.htm