851W - Clients repeatedly disassociate/re-associate

johnblackmon · ‎01-03-2006

I am using an 851W configured with WPA-PSK and TKIP. I am getting an awful lot of messages in the log stating that a client has disassociated because it was leaving the BSSID, then the client immediately reconnects. I have duplicated this behavior with two different 851W routers and four different client adapters (Intel 2200BG, Intel 2915ABG, Cisco AIR-CB21AG, and Linksys WPC54GS). It occurs with optional WPA key management as well as mandatory, and cipher suite TKIP+WEP and TKIP alone. Any ideas? Thanks very much.

scottmac · ‎01-03-2006

If you're using only one antenna, try the settings for each & both.

Are you using directly attached antennas, or is there a cable beteen the router and the antenna? If so, how long is the cable? What type of antenna?

Does this occur when the client is fairly close to the AP?

Are you seeing any "MIC" errors in the log? If so, do you see more than one a minute?

Have you checked (with something like NetStumbler) to see what channels are the least congested? What channels have you tried?

Are there any cordless phones, microwave ovens, etc near the client or AP/router?

What is the (radiated) power setting?

It sounds like a weak signal and / or interference.

Let us know

Thanks

Scott

johnblackmon · ‎01-04-2006

My 851W has only one antenna. It is the directly attached antenna that comes with the router, although I tried with a small omni with a 4 ft cable and the results were no different. The behavior occurs no matter whether the client is right next to the AP or 30 feet away. I wondered about the "two-per-minute" rule with the MIC errors, but I haven't seen any in the log. I've used a utility that came with an old Proxim card to do a sort of poor man's site survey, and I haven't seen anything that looks like a strong radio source in the 2.4GHz band. I have tried channels 1, 6, and 11. There are several APs around where I live on channel 6, so I have mainly used 11. I don't have any cordless phones in the house, the AP is about 30 feet away from the microwave (which is rarely used), and I have disabled bluetooth on all mobile phones in the house. I will have to check on the actual power but the setting is for max.

I noticed this morning that my aironet card was disassociating/re-associating EXACTLY every 10 minutes at one point, and every 12 minutes at another. No further errors/info/notices were logged. The aironet site survey utility shows regular fluctuations in signal strength with a period of about eight seconds (eight high, then eight low), but the fluctuations do not correspond with the disassociations. You're right, it does sound very much like interference or signal problems. The regularity of the disassociations, however, makes me suspect that something else is going on. Thanks very much for your quick reply.

scottmac · ‎01-04-2006

It sounds like you have all of the usual / superficial stuff prety much ruled out.

Time to "go deep."

Download a wireless analyzer, like Airmagnet, EtherPeek wireless, or Commview. If you do this kind of work with any regularity, Commview can be had (relatively) cheap. I use it and like it.

Even the demo versions will permit you to capture some traffic to see what's going on between the AP and clients.

I suspect something along the lines of someone within range has "rogue detection" or other wireless IDS / IPS system, and they are detecting you as a rogue and sending disconnects (one of the ways to "remove" rogues). It could even be some flavor of DOS attack or some twerp in the neighborhood screwing things up.

The bottom line, IMO, is that it's time to look at the traffic and see what actual dialog is occurring.

With the Wireless analyzer (wireless sniffer) it should open things up nicely.

You may (depends on the NICs, Drivers, and platforms) be able to load Ethereal and capture traffic ... but Ethereal is operating "too high" (L2+) ... we need to see the L1 traffic.

Check it out & let us know

Scott

johnblackmon · ‎01-04-2006

I have used Kismet and seen the occasional "deauthenticate/disassociate flood" but not since I axed the Intel adapters and installed Aironet cardbus cards in both laptops. I am going to install Commview and will post back the results. Thanks again for helping me out. I really appreciate it. As I said, I will post back this evening with some results...

johnblackmon · ‎01-10-2006

I have not been able to get Commview to work with my client adapters. I am very interested in this "every 12 minutes" phenomenon, though, which continues. Do you think that if I buy a SMARTNet contract for this thing that Cisco will figure it out? I've been eyeing one anyway...

scottmac · ‎01-10-2006

CommView should work with the CB21A (mine does) ... it would be the "Atheros" driver. You have to use the modified driver to get promiscuous mode (monitor mode .... like Kismet).

If you're inclined towards getting a SmartNet contract, I'd say go for it; the more the merrier! and there's a good chance they can nail it down for you.

If you find out what the problem is, please post it up so we can spread it around for the next time.

Good Luck

Scott

johnblackmon · ‎01-11-2006

I am going to get a contract on it this week or the next. If and when they get it figured out, I will definitely post back the solution. Hopefully it's just a configuration thing and I can save someone else a little time and money! Anyway, thanks again for all your help.