Community discussions

MikroTik App
 
conchalnet
Member Candidate
Member Candidate
Topic Author
Posts: 274
Joined: Thu Nov 03, 2005 1:44 pm
Location: Brazil

Log messages: disconnected, reassociating - DEAUTH ATTACK???

Tue Aug 07, 2007 10:51 pm

Hi all,

I'm seeing a lot of the follow messages in the log of my Mikrotik AP:

00:4F:62:0B:CD:AC@AP1: disconnected, reassociating
00:4F:62:0B:CD:AC@AP1: connected
00:4F:62:0B:CD:AC@AP1: disconnected, reassociating
00:4F:62:0B:CD:AC@AP1: connected

It's occurring with different mac address and the clients have a very good signal when they are connected. I observed this in different Mikrotiks. (in different towers)

I'm afraid of an hacker attack that promove the disconnection of my customers to get the WEP key. Is this possible? If yes how can I prevent this?

Regards

Fabrício F. Kammer
 
npero
Member
Member
Posts: 316
Joined: Tue Mar 01, 2005 1:59 pm
Location: Serbia

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Wed Aug 08, 2007 7:57 am

One of my Mikrotik also have messages but is related to clients equipment. MAC 00:4F:62:xx:xx:xx also lots of connection and disconnection messages with very good signal. Other client have identically equipment but don't connected and disconnect possible have problem with version of device,firmware version on this device or interferance. It seems that this only done when don't have traffic trough this device. This client also have much smaller throughput than other and ack timing is very big. Client device is OvisLink WL-5460AP.

Best regards...
 
User avatar
sergejs
MikroTik Support
MikroTik Support
Posts: 6624
Joined: Thu Mar 31, 2005 3:33 pm
Location: Riga, Latvia
Contact:

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Wed Aug 08, 2007 12:54 pm

"reassociating" - happens on AP: connection assumed to be lost, because Station that is considered already associated attempts to associate again. All connection related information must be deleted, because during association process connection parameters are negotiated (therefore "disconnected"). The reason why Station reassociates must be looked for on Station (most likely cause is that Station for some reason dropped connection without telling AP - e.g. data loss, configuration changes).

source,
http://wiki.mikrotik.com/wiki/Wireless_Debug_Logs
 
conchalnet
Member Candidate
Member Candidate
Topic Author
Posts: 274
Joined: Thu Nov 03, 2005 1:44 pm
Location: Brazil

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Wed Aug 08, 2007 2:58 pm

Hi sergejs,

Thanks again to reply my questions!

I saw the wiki before to post the message here. But I looked on the station and everthing is OK. I didn't find anything wrong or with problem. I changed the customer radio, antenna and pigtail. How I said the quality of the signal is very good and the Internet works fine on the customer when I didn't see this information on the log.

Then I suppose that this message can be a result of a "DEAUTH ATTACK". Can this be true?

I need to resolve this problem urgently because I'm seeing this with 5 or 6 customers and they are reclaiming that the Internet don't are working very well.

Even if this isn't true how can I prevent a Deauth Attack in the Mikrotik AP?

Best regards
 
conchalnet
Member Candidate
Member Candidate
Topic Author
Posts: 274
Joined: Thu Nov 03, 2005 1:44 pm
Location: Brazil

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Thu Aug 09, 2007 12:44 am

HI npero,

Thanks for you reply!

The clients radios are Edimax EW-7209APG and everthing was working fine until last week when the Mikrotik's log starts to register this messages.

I don't belive that the problem is on the client because this is ocourring with a lot of customers and all the problem starts simultaneously. Do I start to have problem with a lot of customers equipments at the same time??? I don't belive on it!

I'm crazy with this problem and I need to solve it urgently because the customers are calling my call center all the day with this reclamation.

Regards,

Fabrício
 
npbrasil
Frequent Visitor
Frequent Visitor
Posts: 83
Joined: Wed Jun 02, 2004 8:50 am

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Thu Aug 09, 2007 5:38 am

Hi Fabrício, my english is not very good, sorry. We already had this problem here and it was caused by a disloyal partner. We made the same with him until that he stopped the attack. Is difficult to appeal for the authorities and the laws of this area are very outdated or inexistent. Me mande uma mensagem privada e podemos trocar umas idéias.
 
conchalnet
Member Candidate
Member Candidate
Topic Author
Posts: 274
Joined: Thu Nov 03, 2005 1:44 pm
Location: Brazil

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Thu Aug 09, 2007 2:55 pm

Hi Fabrício, my english is not very good, sorry. We already had this problem here and it was caused by a disloyal partner. We made the same with him until that he stopped the attack. Is difficult to appeal for the authorities and the laws of this area are very outdated or inexistent. Me mande uma mensagem privada e podemos trocar umas idéias.
Bom dia npbrasil,

Me desculpe, mas não achei como lhe enviar uma mensagem privada, não localizei seu endereço de e-mail.

Você poderia me contatar?

MSN: fabricio (at) abcsinformatica.com.br

[]s

Fabrício
 
barrozo
just joined
Posts: 7
Joined: Mon Apr 09, 2007 2:59 pm
Location: São Fidélis / Brazil

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Thu Aug 09, 2007 4:13 pm

Bom dia npbrasil, Fabrício.

Gostaria de participar desta conversa de vocês, se for possível, acho que estou tendo este problema aqui também... hoje aconteceu uma desconexão/reconexão em massa aqui... e em alguns horários acontecem grandes latências tanto em antenas com muitos clientes como em antenas com poucos clientes, tenho dois concorrentes, como sou o mais novo, acho que posso estar sendo atacado por eles...
 
npbrasil
Frequent Visitor
Frequent Visitor
Posts: 83
Joined: Wed Jun 02, 2004 8:50 am

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Thu Aug 09, 2007 7:25 pm

Hi Fabrício and Barrozo, i will contact to you. Podem me contatar em thenpb (at) ig.com.br. Estou disponível somente à noite.
 
Ozelo
Member
Member
Posts: 338
Joined: Fri Jun 02, 2006 3:56 am

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Fri Aug 10, 2007 11:04 pm

Fabrício, Im still waiting your call. :wink:
 
conchalnet
Member Candidate
Member Candidate
Topic Author
Posts: 274
Joined: Thu Nov 03, 2005 1:44 pm
Location: Brazil

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Sat Aug 11, 2007 3:50 am

Fabrício, Im still waiting your call. :wink:
Me cadastra no seu msn
 
User avatar
sergejs
MikroTik Support
MikroTik Support
Posts: 6624
Joined: Thu Mar 31, 2005 3:33 pm
Location: Riga, Latvia
Contact:

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Tue Aug 14, 2007 5:28 pm

Note, that official forum language is english, probably your posted information might be very interesting for other users.
 
conchalnet
Member Candidate
Member Candidate
Topic Author
Posts: 274
Joined: Thu Nov 03, 2005 1:44 pm
Location: Brazil

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Tue Aug 14, 2007 5:55 pm

Hi Sergejs,

Sorry by the portuguese on the forum!

I sent to you more informations about my problem with reassociantion throught the support email.

Did you see it?

Regards,

Fabrício
 
parreira13
just joined
Posts: 1
Joined: Sat Sep 08, 2007 3:35 am

Re: Log messages: disconnected, reassociating - DEAUTH ATTACK???

Sat Sep 08, 2007 4:39 am

galera vcs são fodas em vai pro particular ai como que a galera vai aprender...

Who is online

Users browsing this forum: No registered users and 31 guests