Hi.
I don’t know how to describe this because mix Dude server behaviour and a wireless interface deauth log message.
I’m running Dude (consider both 4.0B2 & 3.6) on X86 machines. They´re wired to a LAN where I have two extra notebooks for personal use. So there is 4 PCs, 2 of them running Dude servers. Those machines are connected to a Netgear switch and the WLAN client is a Bullet 2 in bridge mode.
The Mikrotik AP where I’m connected to is a RB411AR where there is a static dhcp server. So my office machines IPs are assigned by this 411AR DHCP server. Since they are static, all MACs are stored there.
At the ARP table, static too, there are some IP addresses (my lan at the office) that always refers to the same MAC, e.g. the Bullet 2 WLAN interface.
From time to time, exact 10 minutes, I noticed some log info that reveals the WLAN-PMP interface sent sucessives deauth to a certain WLAN client because it’s a unknown device. The log says:
MMM/DD/YYYY HH:MM:SS wireless info WLAN-PMP: data from unknown device 00:03:0D:33:3D:05, sent deauth
Ok, this should be normal if a wireless device was trying to connect to the 411AR AP and since it was not at the wireless table access list, it will receive deauth.
For some weeks I’ve been watching this and I thought was some neighbourhood device trying to connect the AP.
The same behaviour hapened at another AP I used to connect to. But different MAC (at this time Dude run at another machine).
This morning at a glance at the dhcp table I figured that the MAC of such unknown device belongs to the Dude server ETH interface (a 100Base TX one).
So … why the AP where I’m connected to thinks that some 100Base TX interface from a LAN behind a Bullet2 bridge is a 802.11 device trying to connect to the WLAN interface?
Which process on Dude (both 4.0B2 & 3.6) have an exact 10 minute cycle, sort of pooling … that makes the WLAN iface broadcast deauth messages?
Any help is apreciated.
Regards