Disassociation notification received - possible foul play?
Michael Zintakis
michael.zintakis
Mon Jun 4 17:34:34 PDT 2012
After connecting to my AP, sometimes - seemingly at random intervals - I
get my device disconnected. Getting a full debug log was very difficult
due to the fact that this happens seemingly at random intervals and it
is very unpredictable, but it always happens after 4way handshake with
the AP is completed.
Yesterday I had a bit more time and thought to create a gigantic log by
running both the wpa_supplicant and the hostapd machines on full debug
(I was determined to get to the bottom of this). I wasn't disappointed!
I was finally able to "capture" a couple of such "disconnection" events
and the log, particularly on the wpa_supplicant was quite interesting.
After 4way handshake is completed, either immediately or soon after, the
supplicant reports the following sequence of events:
wlan0: State: 4WAY_HANDSHAKE -> GROUP_HANDSHAKE
RSN: received GTK in pairwise handshake - hexdump(len=18): [REMOVED]
WPA: Group Key - hexdump(len=16): [REMOVED]
wlan0: WPA: Installing GTK to the driver (keyidx=2 tx=0 len=16)
WPA: RSC - hexdump(len=6): 00 00 00 00 00 00
wpa_driver_wext_set_key: alg=3 key_idx=2 set_tx=0 seq_len=6 key_len=16
wlan0: WPA: Key negotiation completed with 00:23:cd:18:9e:e8 [PTK=CCMP
GTK=CCMP]
wlan0: Cancelling authentication timeout
wlan0: State: GROUP_HANDSHAKE -> COMPLETED
EAPOL: External notification - portValid=1
RTM_NEWLINK: operstate=1 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
WEXT: if_removed already cleared - ignore event
Wireless event: cmd=0x8b15 len=24
Wireless event: new AP: 00:00:00:00:00:00
wlan0: Event DISASSOC (1) received
wlan0: Disassociation notification
wlan0: WPA: Auto connect enabled: try to reconnect (wps=0)
wlan0: Setting scan request: 0 sec 100000 usec
Added BSSID 00:23:cd:18:9e:e8 into blacklist
wlan0: Not rescheduling scan to ensure that specific SSID scans occur
wlan0: CTRL-EVENT-DISCONNECTED bssid=00:23:cd:18:9e:e8 reason=0
wlan0: Disconnect event - remove keys
I keep the full logs of at least 4 such attempts and could provide them
if there is interest.
The way I look at this, my STA is receiving "Disassociation
notification" (from where I don't know!) and then disconnects. I don't
know enough in order to judge whether this is deliberate action done by
somebody or is simply a "glitch" or bug in the system, though there is
no doubt that this "intermittent" disconnection is very annoying as it
disrupts my device (I am running a lot of things on it, which require
constant network traffic). Any ideas what could be the cause of this and
whether there is a potential for foul play?
A couple of other related queries: If I am able to get my wireless on
the client to run in 802.11w mode (the AP is already fully configured to
run and supports such mode), I am guessing events like the one I listed
above would become a thing of the past, is that correct?
If I am *not* able to do that for whatever reason, would it be possible
to alter the wpa_supplicant source code to "ignore" these
"Disassociation" notifications? Where do I do it - any idea? What
possible risks, if any, would there be if I go that route? Thank you in
advance!
More information about the Hostap
mailing list