topic Re: Wireless clients complain about slowness and frequent disconnectio in Wireless

Wireless clients complain about slowness and frequent disconnections.

MohanKumar30269 — Fri, 01 Oct 2021 07:27:31 GMT

Hello Wireless Ninjas,

Our Wireless clients connected to the same AP complain about slowness and frequent disconnections. The only strange logs flooding in the AP which I noticed are mentioned below.

%DOT11-4-CCMP_REPLAY: Client 84c5.a6fc.2f97 had 2 AES-CCMP TSC replays
%DOT11-4-CCMP_REPLAY: Client 84c5.a6fb.ceda had 1 AES-CCMP TSC replays
%DOT11-4-CCMP_REPLAY: Client 84c5.a6fc.2f97 had 1 AES-CCMP TSC replays

%WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:2 Channel:1 Source MAC:a618.88c7.50b5

%WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:2 Channel:6 Source MAC:a618.88c7.559b

%WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:2 Channel:11
%WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:2 Channel:1

%DOT11-6-ASSOC: Interface Dot11Radio0, Station 84c5.a6fc.2f97 REAP Associated KEY_MGMT[Open]
%DOT11-6-DISASSOC: Interface Dot11Radio0, Deauthenticating Station 84c5.a6fc.2f97 Sending station has left the BSS
%DOT11-6-ASSOC: Interface Dot11Radio0, Station 84c5.a6fc.2f97 REAP Associated KEY_MGMT[Open]

%DOT11-4-BAD_BASSN: Client d472.2626.2bee(40165) DELBA upstream for priority 0 on packet seq jump
%DOT11-4-BAD_BASSN: Client d472.2626.2bee(40165) DELBA upstream for priority 0 on packet seq jump

AP Model:AIR-CAP3602I-N-K9

AP Version: 15.3(3)JD16

LWAPP image version 8.3.143.0

Kindly help to solve this problem. we tried changing the channel but getting the same error on the new channel as well.

Please let me know if you need any other details.

Thank You

Re: Wireless clients complain about slowness and frequent disconnectio

Kasun Bandara — Fri, 01 Oct 2021 07:54:44 GMT

Hi, while investigating i found below bug report and can be related to your issue.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs40343/?rfs=iqvred

also by reading logs, it seems like some wireless client sending replay packets and WIDS detecting them as a attack. if someone trying to do DOS kind attack, other user's traffic will get dropped and users will feel slowness and disconnections. last logs are kind of related to sequence number mismatching, which can occur with packet drops. better to check AP statistics and connected clients list to identify any abnormal traffic behaviors or unknown users. WLC's client list can use to get good idea about user list and observe unknown/known abnormal details for each client.

Good luck

Re: Wireless clients complain about slowness and frequent disconnectio

Leo Laohoo — Fri, 01 Oct 2021 09:59:14 GMT

@MohanKumar30269 wrote:

Our Wireless clients connected to the same AP complain about slowness and frequent disconnections.

Slowness and frequent disconnections happening to wireless clients connecting to ONE AP? Is that correct?

Re: Wireless clients complain about slowness and frequent disconnectio

MohanKumar30269 — Fri, 01 Oct 2021 10:03:44 GMT

Yes, there is only one AP at the site.

Re: Wireless clients complain about slowness and frequent disconnectio

Leo Laohoo — Fri, 01 Oct 2021 10:21:40 GMT

If 2.4 Ghz is turned off, is the wireless better?

Re: Wireless clients complain about slowness and frequent disconnectio

MohanKumar30269 — Fri, 01 Oct 2021 10:26:44 GMT

We haven’t tried that but most of them are connected to 2.4GHz, are you recommending to try that ? Will those same clients be able to connect 5 GHz, if we shutdown 2.4 GHz ?

Re: Wireless clients complain about slowness and frequent disconnectio

Leo Laohoo — Fri, 01 Oct 2021 10:40:47 GMT

@MohanKumar30269 wrote:
Will those same clients be able to connect 5 GHz, if we shutdown 2.4 GHz ?

Depends if the wireless clients have dual band radios (2.4 Ghz & 5.0 Ghz).

@MohanKumar30269 wrote:
We haven’t tried that but most of them are connected to 2.4GHz, are you recommending to try that ?

2.4 Ghz in an enterprise environment will never work. There are too many co-channel interference that can cripple 2.4 Ghz.

Re: Wireless clients complain about slowness and frequent disconnectio

MohanKumar30269 — Fri, 01 Oct 2021 11:20:13 GMT

Leo,

I'll try that, I have attached the complete logs and few show commands, I would really appreciate it if you could review that.

Thank you for the quick response

Regards,

Mohan Kumar

Re: Wireless clients complain about slowness and frequent disconnectio

Leo Laohoo — Fri, 01 Oct 2021 11:39:39 GMT

@MohanKumar30269 wrote:

I have attached the complete logs and few show commands

And? What is the objective of showing me the logs?
The logs tell me Channel 11 is being hammered. That leaves 2 channels in the 2.4 Ghz to use. What are the chances there are co-channel interference there too?

Re: Wireless clients complain about slowness and frequent disconnectio

MohanKumar30269 — Fri, 01 Oct 2021 13:07:59 GMT

Yes, Channel 11 and 149 are being hammered. I tried changing to channel 11 to 6 in 2.4GHz and 149 to 64 in 5GHz but there is no improvement in performance and the clients are kept disconnecting and reconnect very frequently.