Reply
MVP

Interpreting logs

Since a few days an installation is experiencing clients that disconnect every so often (too often). The logs are showing the following output for this user.
Can somebody explain how to interpret this?

Aug 25 12:21:39 :501105: |AP d8:c7:c8:c1:f1:a9@10.0.6.74 stm| Deauth from sta: 00:1c:bf:8a:2c:3c: AP 10.0.6.74-d8:c7:c8:9f:1a:93-d8:c7:c8:c1:f1:a9 Reason Unspecified Failure
-> I'm correct in assuming its actually the client telling the AP its deauthenticating here? Any way to dig down in to what the 'unspecified failure' could be?


Aug 25 12:21:39 :501105:   |AP d8:c7:c8:c1:f1:a9@10.0.6.74 stm|  Deauth from sta: 00:1c:bf:8a:2c:3c: AP 10.0.6.74-d8:c7:c8:9f:1a:93-d8:c7:c8:c1:f1:a9 Reason Unspecified Failure
Aug 25 12:21:39 :501000: |AP d8:c7:c8:c1:f1:a9@10.0.6.74 stm| Station 00:1c:bf:8a:2c:3c: Clearing state
Aug 25 12:21:39 :501105: |stm| Deauth from sta: 00:1c:bf:8a:2c:3c: AP 10.0.6.74-d8:c7:c8:9f:1a:93-d8:c7:c8:c1:f1:a9 Reason Unspecified Failure
Aug 25 12:21:39 :501065: |stm| Sending STA 00:1c:bf:8a:2c:3c message to Auth and Mobility Unicast Encr WPA2 PSK AES Multicast Encr WPA2 PSK AES VLAN 0x1, wmm:1, rsn_cap:0
Aug 25 12:21:39 :500511: |mobileip| Station 00:1c:bf:8a:2c:3c, 0.0.0.0: Received disassociation on ESSID: SSID-A Mobility service ON, HA Discovery on Association Off, Fastroaming Disabled, AP: Name d8:c7:c8:c1:f1:a9 Group default BSSID d8:c7:c8:9f:1a:93, phy g, VLAN 1
Aug 25 12:21:39 :501000: |stm| Station 00:1c:bf:8a:2c:3c: Clearing state
Aug 25 12:21:39 :501105: |AP d8:c7:c8:c1:f1:a9@10.0.6.74 stm| Deauth from sta: 00:1c:bf:8a:2c:3c: AP 10.0.6.74-d8:c7:c8:9f:1a:93-d8:c7:c8:c1:f1:a9 Reason Unspecified Failure
Aug 25 12:21:39 :501044: |AP d8:c7:c8:c1:f1:a9@10.0.6.74 stm| Station 00:1c:bf:8a:2c:3c: No authentication found trying to de-authenticate to BSSID d8:c7:c8:9f:1a:93 on AP d8:c7:c8:c1:f1:a9
Aug 25 12:21:39 :522036: |authmgr| MAC=00:1c:bf:8a:2c:3c Station DN: BSSID=d8:c7:c8:9f:1a:93 ESSID=SSID-A VLAN=1 AP-name=d8:c7:c8:c1:f1:a9
Aug 25 12:21:39 :522004: |authmgr| MAC=00:1c:bf:8a:2c:3c ingress 0x105e (tunnel 30), u_encr 32, m_encr 32, slotport 0x1028 , type: local, FW mode: 0, AP IP: 0.0.0.0
Aug 25 12:21:39 :522004: |authmgr| station free: bssid=d8:c7:c8:9f:1a:93, valid=1, @=0x1091915c
Koen (ACMX #351 | ACDX #547 | ACCP)

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Guru Elite

Re: Interpreting logs

"Deauth from Station" does mean that the client initiated it, but the log message is generic and inconclusive.

Try:

show auth-tracebuf mac

That would show more information about what is going on behind the scenes, but in a busy network the output of this command gets discarded fairly quickly.


Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: