MikroTik

Hi

Can anyone help me with a sort of urgent problem, we just put up a 3 radio tower with 120 degree sectors, it seemed to work fine the first day but now we are getting major issues with deauths and disconnects, no 2.4 clients can connect for more than about 1 second aparently. Here is a sample of the logs. Am I being attacked with a deauth flood possibly? or is this simply that the signal is too low from these clients to make a strong connection,like less than -90? Any tips or insight very welcomed, thx!

JM

05:23:29 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:29 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected
05:23:29 wireless,info 00:14:A4:2F:AF:A3@wlan1: connected
05:23:29 wireless,info 00:14:A4:2F:AF:A3@wlan1: disconnected, decided to
deauth: authentication not valid (2)
05:23:29 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:30 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected
05:23:30 wireless,info 00:04:23:64:39:7F@wlan1: connected
05:23:30 wireless,info 00:04:23:64:39:7F@wlan1: disconnected, decided to
deauth: authentication not valid (2)
05:23:30 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:30 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected
05:23:31 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:31 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected
05:23:31 wireless,info 00:04:23:64:39:7F@wlan2: connected
05:23:31 wireless,info 00:04:23:64:39:7F@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:31 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:31 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected
05:23:32 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:32 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected
05:23:32 wireless,info 00:04:23:64:39:7F@wlan2: connected
05:23:33 wireless,info 00:04:23:64:39:7F@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:33 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:33 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected
05:23:33 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:33 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected
05:23:34 wireless,info 00:13:CE:DB:A4:B8@wlan2: disconnected, decided to
deauth: authentication not valid (2)
05:23:34 wireless,info 00:13:CE:DB:A4:B8@wlan2: connected

[admin@PROSP-2] >

what firmware are you running?

jonmansey,

for sure ! You are a deauth attack victim. I read about this kind of attack and there are an efficient defense as described at links below.

http://sysnet.ucsd.edu/~bellardo/pubs/u ... slides.ppt
http://sysnet.ucsd.edu/~bellardo/pubs/j ... poster.pdf

Some MT guru know how to set this DEAUTH MANAGEMENT FRAME TIMEOUT TO 5s - 10s range at MT?

Sds,

Sérgio Brito

jonmansey,

for sure ! You are a deauth attack victim. I read about this kind of attack and there are an efficient defense as described at links below.

http://sysnet.ucsd.edu/~bellardo/pubs/u ... slides.ppt
http://sysnet.ucsd.edu/~bellardo/pubs/j ... poster.pdf

Some MT guru know how to set this DEAUTH MANAGEMENT FRAME TIMEOUT TO 5s - 10s range at MT?

Sds,

Sérgio Brito