I think I got it

[mike-hostap at tiedyenetworks.com]

	So this weird problem seems to take a strange turn - the bridge 
doesn't seem to have a complete table. For example, the station 
'00:50:04:99:34:4e' (a server), one that the ap complains about, is on the 
wired side and is the syslog server. If I dump the arp cache, we see:


# ip neigh show
x.x.x.x dev br0 lladdr 00:50:04:99:34:4e nud stale
x.x.x.x dev br0 lladdr 00:00:0c:92:5b:0c nud delay
	
	Now, if I dumpo the bridge table, I see:


# brctl showmacs br0
port no mac addr                is local?       ageing timer
  2     00:00:0c:92:5b:0c       no                 0.02
  2     00:00:24:c1:e1:c0       yes                0.00
  1     00:02:6f:06:37:ee       yes                0.00
  2     00:c0:b7:92:39:79       no               274.63


	Entry #1 is the router on the wired side (and is in the arp cache)
	Entry #2 is the ethernet interface
	Entry #3 is the wireless interface
	Entry #4 is an apc masterswitch power reboot bar

	Note that #4 here is never referenced from the AP (it's on it's 
own ip address range and is only connected to the same switch for 
management conveience). Probbly it had to arp for something so that's why 
it showed up here.

	If I ping the server, and then dump the bridge table:

# brctl showmacs br0
port no mac addr                is local?       ageing timer
  2     00:00:0c:92:5b:0c       no                 0.01
  2     00:00:24:c1:e1:c0       yes                0.00
  1     00:02:6f:06:37:ee       yes                0.00
  2     00:30:ab:24:c0:25       no               117.33
  2     00:50:04:99:34:4e       no                 4.89
  2     00:c0:b7:92:39:79       no               220.77


	You can see that 00:50:04:99:34:4e magically showed up (finially), 
and I'm not getting "drop packet to non-associated sta" anymore. 


	What triggered this was an observation in syslog about when the 
messages start. This snippet shows the system quiescient and then all of a 
sudden at 12:16:53, syslog on the AP emits a mark message, triggering a 
cascade of messages. Since the last syslog message was +5 minutes ago, the 
AP would have had to arp for the mac of the syslog box. Here's the log:

Apr  5 12:01:08 pppoe-lv syslog-ng[27495]: STATS: dropped 0
Apr  5 12:04:58 pppoe-lv sshd(pam_unix)[21480]: session closed for user 
root
Apr  5 12:11:09 pppoe-lv syslog-ng[27495]: STATS: dropped 0
Apr  5 12:16:53 x.x.x.x -- MARK --
Apr  5 12:16:53 x.x.x.x klogd: AP: drop packet to non-associated STA 
00:50:04:99:34:4e
Apr  5 12:16:53 x.x.x.x klogd: AP: drop packet to non-associated STA 
00:50:04:99:34:4e
Apr  5 12:16:53 x.x.x.x klogd: AP: drop packet to non-associated STA 
00:50:04:99:34:4e

+ millions of more where this came from....

	

-- 

WillitsOnline.Com - Your LOCAL provider of High Speed Internet!