I have mikrotik router and I use it like home AP. I see in the log that unknown MAC address is connected and 5 seconds after that disconnected with "unicast key exchange timeout". And this repeat every ~5 minutes in 2-3 hours period per day.
What tries to do this device? How I can block it (in the log there are different MAC addresses in different days)?

Part of the log:
15:43:02 wireless,info 86:D5:AC:8B:25:3D@wlan1: connected
15:43:07 wireless,info 86:D5:AC:8B:25:3D@wlan1: disconnected, unicast key exchange timeout
15:48:23 wireless,info 86:D5:AC:8B:25:3D@wlan1: connected
15:48:28 wireless,info 86:D5:AC:8B:25:3D@wlan1: disconnected, unicast key exchange timeout
15:53:40 wireless,info 86:D5:AC:8B:25:3D@wlan1: connected
15:53:45 wireless,info 86:D5:AC:8B:25:3D@wlan1: disconnected, unicast key exchange timeout

Hi,

Someone or something is trying to connect using the incorrect wpa/wpa2 key.

What you could do is add all the wifi devices you trust in the access list and disable default authentication.

Even if someone has your wifi password they wont be able to connect from an unknown device.

What you could do is add all the wifi devices you trust in the access list and disable default authentication.

Hi!
Is access list based on the MAC address? Far as I know there are a lot of tools for scanning clients connected to a AP.
What I did to this moment:
Hide wireless network name - no effect
Rename the network - there are not unknown in the log for 2 days, but I will continue to check the log

What you could do is add all the wifi devices you trust in the access list and disable default authentication.

Hi!
Is access list based on the MAC address?

Its based on the mac address yes.

Authentication is a must as it encrypts data; Mac spoofing is two clicks and "hacked" by a 6 year old.

What I did:
- Set very strong password
- Change SSID
- Hide SSID
There are no unknown MACs more