cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4396
Views
0
Helpful
16
Replies

Repeated Event 4201 in client syslog and brief interruption

justin_ostafew
Level 1
Level 1

Hello everyone, I've been trying to track down a very stubborn problem that I've been having at 2

sites now; the client computers show repeated syslog entries of

Event 4201 - The system detected that the [XXX adapter name] was connected to the network, and has initiated normal operation over the network adapter. Each entry coincides with a brief network interruption lasting a few seconds. These interruptions and event log entries happen at seemingly random times, and do not coincide with each on various machines. They might happen once every minute or so for a few minutes, then nothing for an hour or more.

The AP in question is an AIR-AP1242G A-K9 V03 running F/W ver. 12.4(21a)JA1. (same at both sites) We are running WPA2 PSK for security, with no further measures (ie. MAC address filtering).

Client adapter cards at site one are a mixture of Cisco SMB WMP200 and Linksys WMP54G, both on latest drivers. Clients are running XP Pro SP3 on a couple generations of Advantech industrial PCs.

Clients at site two are all Dell optiplex 380 running XP Pro SP3 and all are using Linksys WMP54G ver. 4.1 adapters on Linksys' latest drivers.

I have seen this issue at both sites, but is most pronounced and best documented on the systems at site two.

I have a Metageek Wi-Spy that I've used to monitor for any crazy RF noise (nothing notable found) at both sites.

I would love to get this issue resolved as it has been an ongoing problem and a very difficult one to diagnose. Any assistance would be greatly appreciated.

Thanks in advance

- Justin

16 Replies 16

Ok, I've had a chance to review your last post.

1) Each site has an AIR-1242G on the plant floor and a WAP200 in the office area.

At our Calgary plant, the WAP200 is within range of a couple of the plant floor clients. In Langley a site survey from either WAP will show the other one, but there is way too much obstruction between them for any usefull connection.

I haven't "restricted" the roaming of the shop floor clients in any fashion other than simply never joining them to the SSID for the WAP200.

I've read up on WDS and I don't see how it would apply to my situation as I effectivley have only a single AP at each site. Perhaps I am missing something? Again, I don't consider the WAP200's as available to the plant floor clients. For testing purposes I could disable these devices leaving only the single AIR-1242G unit in range of the clients.

1 & 2) Perhaps I have not been clear about the clients; they are stationary computers on the plant floor, not mobile workstations. Roaming would only occur if the AP were down for eg. and of course that would only apply if there were a 2nd AP available. We do have a few notebooks for the office staff, but those are only joined to the WAP200 in the offices at the moment.

3) Change made.... I was always sure to provide ample distance between the channels used (was 2 and 8 for eg.), but I have now moved the devices to one of channels 1,6,11 as suggested (of course not on the same channel).

4) AP Power; I've confirmed that the APs are currently set at 20dBm (100w) which as I understand it is the maximum allowable in North America. If I drop this I understand that I will improve the signal to noise ratio, but I will also be decreasing my range. I can do some experimentation, but I already have a few clients at each site that have auto-negotiated a 48Mb/s tx rate telling me that they are already seeing a reduced signal strength. Will cutting 3dBm out of the signal not make a big hit on Tx rate for the clients at the edge of the cell?

5) Seems like a simple task but apparently I do not have any sort of service contract and therefore cannot D/L IOS updates..... I will look into the cost to make that available.

I've attached a quick floorplan that I had on file for the layout at our Calgary plant. I dont have one for this plant at the moment but it could be done if it will be helpfull.

I appreciate the time you've spent on this so far and your patience with a novice like myself.

justin_ostafew
Level 1
Level 1

It's been some time but I thought I would update;

Since my earlier posts I have captured 802.11 control packets and not found anything unusual. I have also purchased the support agreement from Cisco for access to IOS upgrades and updated both of the WAPs to the latest version with no change in my symptoms.

I've discovered that is has mostly or entirely to do with that particular NIC and the drivers it uses. I've found that replacing the card with another make & model (I've had good results with D-Link WDA-2320) will prevent the repeated 4201 entries and short, frequent network interruptions. I have also found that using drivers from Ralink for that RT61 (RT2561) chipset will also reduce and nearly eliminate the problem. There is a tradeoff however with the Ralink drivers; I find that while general availability is much better and the number of 4201 entries is significantly reduced, the response time on a PING seems to increase over the drivers provided by Linksys. Overall though I would call it an improvement and have moved a few of the machines using that NIC over to the Ralink drivers for further monitoring.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: