Security

last person joined: 2 days ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Deauth of specific user from Access Point

This thread has been viewed 7 times

  • 1.  Deauth of specific user from Access Point

    Posted Oct 24, 2019 05:19 PM

    Hi,

    We are using ArubaOS (MODEL: 224), Version 6.5.3.3

    We often see this message and deauth from specific users for reason unpsecified. 

     

    Oct 24 18:51:29 stm[4633]: <501105> <NOTI> |AP WAP@172.19.134.238 stm| Deauth from sta: a0:d3:7a:7f:09:0e: AP 172.19.134.238-70:3a:0e:39:0f:40-WAP Reason Unspecified Failure
    Oct 24 18:51:29 cli[4605]: <541004> <WARN> |AP WAP@172.19.134.238 cli| recv_sta_offline: receive station msg, mac-a0:d3:7a:7f:09:0e bssid-70:3a:0e:39:0f:40 essid-DeltaWiFi3.
    Oct 24 18:51:31 stm[4633]: <501217> <NOTI> |AP WAP@172.19.134.238 stm| rap_bridge_user_handler 14109: user entry deleted for 172.19.130.136-a0:d3:7a:7f:09:0e
    Oct 24 18:51:31 cli[4605]: <541023> <WARN> |AP WAP@172.19.134.238 cli| recv_sta_move_req,2546: del client a0:d3:7a:7f:09:0e, client count 35.

     

    Oct 24 20:04:02 2019 :>> 2019 172.19.134.240 stm[4767]: <501105> <NOTI> <172.19.134.240 70:3A:0E:CB:91:3C> Deauth from sta: a0:d3:7a:7f:09:0e: AP 172.19.134.240-70:3a:0e:39:13:c0-WAP Reason Unspecified Failure
    Oct 24 20:04:02 2019 :>> 2019 172.19.134.240 cli[4739]: <541004> <WARN> <172.19.134.240 70:3A:0E:CB:91:3C> recv_sta_offline: receive station msg, mac-a0:d3:7a:7f:09:0e bssid-70:3a:0e:39:13:c0 essid-DeltaWiFi1.

     

     

    Timestamp stype SA DA BSS signal Misc
    --------- ----- -- -- --- ------ ----
    Oct 24 20:04:00 deauth a0:d3:7a:7f:09:0e 70:3a:0e:39:13:c0 70:3a:0e:39:13:c0 58 Unspecified Failure (seq num 484)

     

    Thanks

    Ram



  • 2.  RE: Deauth of specific user from Access Point

    EMPLOYEE
    Posted Oct 25, 2019 01:26 AM

    That is a generic error when a client sends a deauth and without any reason. Normally the Client puts a reason code into deauth frame.

     

    Do a "show auth-tracebuf mac a0:d3:7a:7f:09:0e"

     

    Often the issue is a defect Client driver. Try to upgrade the Client WiFi driver to the latest release.