Technology Blog

802.11 - Reason Codes and Status Codes

Guest Blogger

802.11 - Reason Codes and Status Codes

 

The 802.11 standard section 8.4 comments on reason codes and status codes. I’ve used these myself when troubleshooting frame captures. These codes provide insight to Wi-Fi related problems like stations connecting and disconnecting. Lets dive in and see what the standard says about reason and status code fields. Then lets look at real world frame captures and see these codes at work.

 

 

802.11 Standard Overview

 

 

8.4.1.7 Reason Code field

This Reason Code field is used to indicate the reason that an unsolicited notification management frame of type Disassociation, Deauthentication, DELTS, DELBA, DLS Teardown, or Mesh Peering Close was generated. It is contained in the Mesh Channel Switch Parameters element to indicate the reason for the channel switch. It is contained in the PERR element to indicate the reason for the path error. The length of the Reason Code field is 2 octets. The Reason Code field is illustrated in Figure 8-41.

 1.png

2.png

 

8.4.1.9 Status Code field

The Status Code field is used in a response management frame to indicate the success or failure of a requested operation. The length of the Status Code field is 2 octets. The Status Code field is illustrated in Figure 8-43.

 

3.png

4.png

5.png

 

 

Reason Code Field

 

When conducting frame captures you can find the reason code in some  management frames like the response and disassociation frames. I like how the 802.11 standard comments:

“unsolicited notification”.

 

It’s unsolicited information whereby radios can provide connection information.

 

Example: Disassociation frame with reason code 1. This radio is informing the other radio it’s disassociating for unspecified reasons.

6.png 

 

Example:  Deauthentication frame with reason code 7. This radio is informing the other radio to deauth because they isn't an associaation. It’s likely a client is sending an access point frames while not having an association with this access point.

 

7.png

 

Example:  Deauthentication frame with reason code 23. This radio is informing the other radio to deauth because 802.1X authentication failed. This is a client not passing 802.1X.

8.png 

Status Code Field

 

When conducting frame captures you can find the status code field in response management frames to indicate the success or failure of a requested operation. An example would be authentication and association frames.

 

Example: Authentication frame showing a status code of 0. This is a successful authentication.

 

* NOTE - This is 802.11 OPEN / SHARED authentication not 802.1X/PSK authentication.

9.png 

Example: Association response frame showing a status code of 0. This is a successful association.

10.png

 

 

 

Thank you for stopping by and I hope this blog was helpful!

  • Reason Codes
  • Status Codes
Comments
Occasional Contributor II

Could you possibly explain what the deauth reason code 62 is for? I have been seeing clients getting deauthed for this reason and would like to dig a bit deeper into it.

Guest Blogger

Hello! Thank you for teh reply. Im not sure about 62 but chew on this ..

https://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/deauth-reason-codes-8-and-62/m-p/265626 

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Read all about it! If it’s happening now, it’s in the community.

Check out the latest blogs from your community team, the community experts and other industry sources.
Labels