WAP571 - Clients disconnecting from AP

[Antonio92]

Hello,

I have a Cisco WAP571 AP with 2.4 Ghz band enabled, in 802.11b/g mode. Since a week ago, all clientes connected to it disassociate after some minutes and have to connect them again. It is located in a closed building with only one floor and no more wireless networks around. How can I trace the issue?

It has been working for two years with no problem at all. System log shows the following, from most recent to oldest (apparently no useful information):

2022-Dec-13, 17:01:42	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 17:01:42	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 17:01:42	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 17:01:42	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 17:01:23	info	hostapd[2178]	STA 7c:d5:66:43:48:6f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 17:01:23	info	hostapd[2178]	Assoc request from 7c:d5:66:43:48:6f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 17:01:22	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 17:01:22	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 17:01:20	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 17:01:20	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 17:01:20	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 17:01:20	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 17:01:18	info	hostapd[2178]	STA 00:23:68:d1:57:7d associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 17:01:18	info	hostapd[2178]	Assoc request from 00:23:68:d1:57:7d BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 17:01:18	debug	hostapd[2178]	station: 00:23:68:d1:57:7d deauthenticated
2022-Dec-13, 17:01:18	info	hostapd[2178]	STA 00:23:68:d1:57:7d disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 17:01:18	debug	hostapd[2178]	station: 00:23:68:d1:57:7d deauthenticated
2022-Dec-13, 17:01:18	info	hostapd[2178]	STA 00:23:68:d1:57:7d deauthed from BSSID bc:4a:56:42:18:d0 reason 2: Previous authentication no longer valid
2022-Dec-13, 17:01:14	info	hostapd[2178]	STA 8c:7a:3d:0b:5d:d8 associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 17:01:14	info	hostapd[2178]	Assoc request from 8c:7a:3d:0b:5d:d8 BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 17:01:12	debug	hostapd[2178]	station: 8c:7a:3d:0b:5d:d8 deauthenticated
2022-Dec-13, 17:01:12	info	hostapd[2178]	STA 8c:7a:3d:0b:5d:d8 disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 17:01:12	debug	hostapd[2178]	station: 8c:7a:3d:0b:5d:d8 deauthenticated
2022-Dec-13, 17:01:12	info	hostapd[2178]	STA 8c:7a:3d:0b:5d:d8 deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 17:01:11	debug	hostapd[2178]	station: 7c:d5:66:43:48:6f deauthenticated
2022-Dec-13, 17:01:11	info	hostapd[2178]	STA 7c:d5:66:43:48:6f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 17:01:11	debug	hostapd[2178]	station: 7c:d5:66:43:48:6f deauthenticated
2022-Dec-13, 17:01:11	info	hostapd[2178]	STA 7c:d5:66:43:48:6f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 17:00:59	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 17:00:59	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 17:00:57	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 17:00:57	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 17:00:57	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 17:00:57	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 17:00:40	info	hostapd[2178]	STA 7c:d5:66:43:48:6f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 17:00:40	info	hostapd[2178]	Assoc request from 7c:d5:66:43:48:6f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 17:00:38	debug	hostapd[2178]	station: 7c:d5:66:43:48:6f deauthenticated
2022-Dec-13, 17:00:38	info	hostapd[2178]	STA 7c:d5:66:43:48:6f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 17:00:38	debug	hostapd[2178]	station: 7c:d5:66:43:48:6f deauthenticated
2022-Dec-13, 17:00:38	info	hostapd[2178]	STA 7c:d5:66:43:48:6f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 17:00:37	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 17:00:37	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 17:00:15	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 17:00:15	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 17:00:15	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 17:00:15	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:59:57	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:59:57	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:59:55	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:59:55	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:59:55	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:59:55	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:59:34	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:59:34	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:59:10	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:59:10	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:59:10	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:59:10	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:58:50	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:58:50	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:58:27	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:58:27	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:58:27	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:58:27	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:58:09	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:58:09	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:58:09	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:58:09	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:58:09	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:58:09	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:58:09	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:58:09	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:58:09	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:58:09	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:58:09	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:58:09	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:58:09	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:58:09	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:58:08	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:58:08	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:58:08	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:58:08	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:57:49	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:57:49	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:57:08	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:57:08	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:57:08	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:57:08	info	hostapd[2178]	STA 02:14:59:50:9c:7f deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:56:48	info	hostapd[2178]	STA 02:14:59:50:9c:7f associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:56:48	info	hostapd[2178]	Assoc request from 02:14:59:50:9c:7f BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:53:32	debug	hostapd[2178]	station: 02:14:59:50:9c:7f deauthenticated
2022-Dec-13, 16:53:32	info	hostapd[2178]	STA 02:14:59:50:9c:7f disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS

An older log from another similar issue of disconnects:

2022-Dec-13, 16:22:31	info	hostapd[2178]	STA 00:23:68:d1:57:7d associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:22:31	info	hostapd[2178]	Assoc request from 00:23:68:d1:57:7d BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:22:00	debug	hostapd[2178]	station: 00:23:68:d1:57:7d deauthenticated
2022-Dec-13, 16:22:00	info	hostapd[2178]	STA 00:23:68:d1:57:7d disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:22:00	debug	hostapd[2178]	station: 00:23:68:d1:57:7d deauthenticated
2022-Dec-13, 16:22:00	info	hostapd[2178]	STA 00:23:68:d1:57:7d deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:21:25	info	hostapd[2178]	STA 00:23:68:d1:57:7d associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:21:25	info	hostapd[2178]	Assoc request from 00:23:68:d1:57:7d BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:21:19	debug	hostapd[2178]	station: 00:23:68:d1:57:7d deauthenticated
2022-Dec-13, 16:21:19	info	hostapd[2178]	STA 00:23:68:d1:57:7d disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:21:19	debug	hostapd[2178]	station: 00:23:68:d1:57:7d deauthenticated
2022-Dec-13, 16:21:19	info	hostapd[2178]	STA 00:23:68:d1:57:7d deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or ESS
2022-Dec-13, 16:20:43	info	hostapd[2178]	STA 00:23:68:d1:57:7d associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:20:43	info	hostapd[2178]	Assoc request from 00:23:68:d1:57:7d BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:20:43	debug	hostapd[2178]	station: 00:23:68:d1:57:7d deauthenticated
2022-Dec-13, 16:20:43	info	hostapd[2178]	STA 00:23:68:d1:57:7d disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:20:43	debug	hostapd[2178]	station: 00:23:68:d1:57:7d deauthenticated
2022-Dec-13, 16:20:43	info	hostapd[2178]	STA 00:23:68:d1:57:7d deauthed from BSSID bc:4a:56:42:18:d0 reason 2: Previous authentication no longer valid
2022-Dec-13, 16:20:34	info	hostapd[2178]	STA 8c:7a:3d:0b:5d:d8 associated with BSSID bc:4a:56:42:18:d0
2022-Dec-13, 16:20:33	info	hostapd[2178]	Assoc request from 8c:7a:3d:0b:5d:d8 BSSID bc:4a:56:42:18:d0 SSID Cisco-2.4
2022-Dec-13, 16:20:31	debug	hostapd[2178]	station: 8c:7a:3d:0b:5d:d8 deauthenticated
2022-Dec-13, 16:20:31	info	hostapd[2178]	STA 8c:7a:3d:0b:5d:d8 disassociated from BSSID bc:4a:56:42:18:d0 reason 8: Sending STA is leaving BSS
2022-Dec-13, 16:20:31	debug	hostapd[2178]	station: 8c:7a:3d:0b:5d:d8 deauthenticated
2022-Dec-13, 16:20:31	info	hostapd[2178]	STA 8c:7a:3d:0b:5d:d8 deauthed from BSSID bc:4a:56:42:18:d0 reason 3: STA is leaving IBSS or E

This has been happening for a week now, with all clients, all the time, several times each hour. I updated the firmware to the latest version and restarted the AP several times with no success.

Thank you very much for your help.

[JPavonM]

Due to the frequent deauthentications I would suspect from a nearby network where the admin has enabled some type of WIPS feature and did it wrongly, blacklisting all surronding networks. But first of all I'd recommend you to update all device's wireless drivers to the lates version which is recommended by the manufacturer (Intel, Mediate, Realtek).

If at the end upgrading driver does not fix the disconnections, finding the offender would be more complicated as it needs from an OTA packet capture, and some experience to analyze it and view what could be happening.

[Antonio92]

Drivers are already updated to the latest version.

Can you elaborate on your WIPS suspicion and how to find the supposed offender? Are you referring to sniffing packets with Airodump and looking for something in particular in them with Wireshark? Do you have more detail on this or anything we can try?

[JPavonM]

Due to the difficulties on matching external APs with stations sending deauthentications, using tools such as “WiFi-Hawk” you could be able to check if something similar is happening there.

After processing the packet capture over-the-air (using something like Aircrack and a compatible dongle) you will have an Excel with the report, checking on the 1st sheet you can search for an AP BSSID which is also in the Client column, and that would be the one you are looking for that is sending the packets.

I think this could explain why you started to suffer this issue 2 weeks ago (unless you upgraded code on the APs and that code has somekind of defect).

[Rich R]

Read about the Meraki version of this feature here: https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal

One of our customers (a hotel) suddenly had a problem like this.  We traced it to their neighbour who had recently installed a new Meraki network.  The "IT guy" who knew more or less nothing about wireless networks thought "Hey this looks a cool feature.  I'll turn on containment for everything except my own network".  When we explained to him what he had done, and that it was a criminal offence under UK law - he apologised profusely and turned it off.  Meraki does warn "Containment can have legal implications when launched against neighbor networks" but in my opinion not prominently enough so hardly anyone notices the warning and many (like our case) don't even understand it.