supplicant logs, this is disconnecting due to CQM?

[Janusz Dziedzic]

On 26 January 2016 at 00:22, Ben Greear <greearb at candelatech.com> wrote:
> Someone asked me to investigate why their station cannot stay connected to
> their AP.  A packet trace seems to show proper ACKs and such, but the logs
> below may indicate otherwise?  Would supplicant be killing the connection
> due to the CQM event?
>
>
> 727.275722: RTM_NEWLINK: ifi_index=3 ifname=wlan0 operstate=6 linkmode=1
> ifi_family=0 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
> 727.275790: nl80211: Event message available
> 727.275830: nl80211: Drv Event 46 (NL80211_CMD_CONNECT) received for wlan0
> 727.275854: nl80211: Ignore connect event (cmd=46) when using userspace SME
> 729.000109: nl80211: Event message available
> 729.000183: nl80211: Drv Event 64 (NL80211_CMD_NOTIFY_CQM) received for
> wlan0
> 730.000218: RTM_NEWLINK: ifi_index=3 ifname=wlan0 operstate=2 linkmode=1
> ifi_family=0 ifi_flags=0x1003 ([UP])
> 730.060155: nl80211: Event message available
> 730.060229: nl80211: Drv Event 20 (NL80211_CMD_DEL_STATION) received [
> 730.069076] cfg80211: Calling CRDA to update world regulatory domain for
> wlan0
> 730.060263: nl80211: Delete station 00:1a:70:88:72:6c
> 730.064538: nl80211: Event message available
> 730.064614: nl80211: Drv Event 39 (NL80211_CMD_DEAUTHENTICATE) received for
> wlan0
> 730.076483: nl80211: MLME event 39 (NL80211_CMD_DEAUTHENTICATE) on
> wlan0(4c:5e:0c:11:73:2f) A1=00:1a:70:88:72:6c A2=4c:5e:0c:11:73:2f
> 730.076526: nl80211: MLME event frame - hexdump(len=26): c0 00 00 00 00 1a
> 70 88 72 6c 4c 5e 0c 11 73 2f 00 1a 70 88 72 6c 00 00 04 00
> 730.076575: nl80211: Deauthenticate event
> 730.076607: wlan0: Event DEAUTH (12) received
> 730.076633: wlan0: Deauthentication notification
> 730.076656: wlan0:  * reason 4 (locally generated)

If that is mac80211 based driver :)

mac80211 connection monitor send null frames/probe_req
(IEEE80211_CONNECTION_IDLE_TIME) every 30 seconds
when no RX. When no-ack then trigger deauth you see.

Best check the driver logs, maybe you didn't get an ACK even sniffer
show this frame ...

> 730.076685: wlan0:  * address 00:1a:70:88:72:6c
> 730.076702: Deauthentication frame IE(s) - hexdump(len=0): [NULL]
> 730.076739: wlan0: CTRL-EVENT-DISCONNECTED bssid=00:1a:70:88:72:6c reason=4
> locally_generated=1
>
> Thanks,
> Ben
>
> --
> Ben Greear <greearb at candelatech.com>
> Candela Technologies Inc  http://www.candelatech.com
>
>
> _______________________________________________
> Hostap mailing list
> Hostap at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/hostap