On 01/25/2016 10:34 PM, Janusz Dziedzic wrote:
On 26 January 2016 at 00:22, Ben Greear <greearb@xxxxxxxxxxxxxxx> wrote:
Someone asked me to investigate why their station cannot stay connected to
their AP. A packet trace seems to show proper ACKs and such, but the logs
below may indicate otherwise? Would supplicant be killing the connection
due to the CQM event?
727.275722: RTM_NEWLINK: ifi_index=3 ifname=wlan0 operstate=6 linkmode=1
ifi_family=0 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
727.275790: nl80211: Event message available
727.275830: nl80211: Drv Event 46 (NL80211_CMD_CONNECT) received for wlan0
727.275854: nl80211: Ignore connect event (cmd=46) when using userspace SME
729.000109: nl80211: Event message available
729.000183: nl80211: Drv Event 64 (NL80211_CMD_NOTIFY_CQM) received for
wlan0
730.000218: RTM_NEWLINK: ifi_index=3 ifname=wlan0 operstate=2 linkmode=1
ifi_family=0 ifi_flags=0x1003 ([UP])
730.060155: nl80211: Event message available
730.060229: nl80211: Drv Event 20 (NL80211_CMD_DEL_STATION) received [
730.069076] cfg80211: Calling CRDA to update world regulatory domain for
wlan0
730.060263: nl80211: Delete station 00:1a:70:88:72:6c
730.064538: nl80211: Event message available
730.064614: nl80211: Drv Event 39 (NL80211_CMD_DEAUTHENTICATE) received for
wlan0
730.076483: nl80211: MLME event 39 (NL80211_CMD_DEAUTHENTICATE) on
wlan0(4c:5e:0c:11:73:2f) A1=00:1a:70:88:72:6c A2=4c:5e:0c:11:73:2f
730.076526: nl80211: MLME event frame - hexdump(len=26): c0 00 00 00 00 1a
70 88 72 6c 4c 5e 0c 11 73 2f 00 1a 70 88 72 6c 00 00 04 00
730.076575: nl80211: Deauthenticate event
730.076607: wlan0: Event DEAUTH (12) received
730.076633: wlan0: Deauthentication notification
730.076656: wlan0: * reason 4 (locally generated)
If that is mac80211 based driver :)
mac80211 connection monitor send null frames/probe_req
(IEEE80211_CONNECTION_IDLE_TIME) every 30 seconds
when no RX. When no-ack then trigger deauth you see.
Best check the driver logs, maybe you didn't get an ACK even sniffer
show this frame ...
The kernel logs did not show any obvious disconnect call, but maybe there
is just not a debug message for that in the kernel these guys are using.
I'll try to figure out some more details on their kernel...
It is an ath9k based system.
Thanks,
Ben
--
Ben Greear <greearb@xxxxxxxxxxxxxxx>
Candela Technologies Inc http://www.candelatech.com
_______________________________________________
Hostap mailing list
Hostap@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/hostap
