Hi all,

I'm seeing a lot of the follow messages in the log of my Mikrotik AP:

00:4F:62:0B:CD:AC@AP1: disconnected, reassociating
00:4F:62:0B:CD:AC@AP1: connected
00:4F:62:0B:CD:AC@AP1: disconnected, reassociating
00:4F:62:0B:CD:AC@AP1: connected

It's occurring with different mac address and the clients have a very good signal when they are connected. I observed this in different Mikrotiks. (in different towers)

I'm afraid of an hacker attack that promove the disconnection of my customers to get the WEP key. Is this possible? If yes how can I prevent this?

Regards

Fabrício F. Kammer

One of my Mikrotik also have messages but is related to clients equipment. MAC 00:4F:62:xx:xx:xx also lots of connection and disconnection messages with very good signal. Other client have identically equipment but don't connected and disconnect possible have problem with version of device,firmware version on this device or interferance. It seems that this only done when don't have traffic trough this device. This client also have much smaller throughput than other and ack timing is very big. Client device is OvisLink WL-5460AP.

Best regards...

"reassociating" - happens on AP: connection assumed to be lost, because Station that is considered already associated attempts to associate again. All connection related information must be deleted, because during association process connection parameters are negotiated (therefore "disconnected"). The reason why Station reassociates must be looked for on Station (most likely cause is that Station for some reason dropped connection without telling AP - e.g. data loss, configuration changes).

source,
http://wiki.mikrotik.com/wiki/Wireless_Debug_Logs

Hi sergejs,

Thanks again to reply my questions!

I saw the wiki before to post the message here. But I looked on the station and everthing is OK. I didn't find anything wrong or with problem. I changed the customer radio, antenna and pigtail. How I said the quality of the signal is very good and the Internet works fine on the customer when I didn't see this information on the log.

Then I suppose that this message can be a result of a "DEAUTH ATTACK". Can this be true?

I need to resolve this problem urgently because I'm seeing this with 5 or 6 customers and they are reclaiming that the Internet don't are working very well.

Even if this isn't true how can I prevent a Deauth Attack in the Mikrotik AP?

Best regards

HI npero,

Thanks for you reply!

The clients radios are Edimax EW-7209APG and everthing was working fine until last week when the Mikrotik's log starts to register this messages.

I don't belive that the problem is on the client because this is ocourring with a lot of customers and all the problem starts simultaneously. Do I start to have problem with a lot of customers equipments at the same time??? I don't belive on it!

I'm crazy with this problem and I need to solve it urgently because the customers are calling my call center all the day with this reclamation.

Regards,

Fabrício

Hi Fabrício, my english is not very good, sorry. We already had this problem here and it was caused by a disloyal partner. We made the same with him until that he stopped the attack. Is difficult to appeal for the authorities and the laws of this area are very outdated or inexistent. Me mande uma mensagem privada e podemos trocar umas idéias.

Hi Fabrício, my english is not very good, sorry. We already had this problem here and it was caused by a disloyal partner. We made the same with him until that he stopped the attack. Is difficult to appeal for the authorities and the laws of this area are very outdated or inexistent. Me mande uma mensagem privada e podemos trocar umas idéias.

Bom dia npbrasil,

Me desculpe, mas não achei como lhe enviar uma mensagem privada, não localizei seu endereço de e-mail.

Você poderia me contatar?

MSN: fabricio (at) abcsinformatica.com.br

[]s

Fabrício

Bom dia npbrasil, Fabrício.

Gostaria de participar desta conversa de vocês, se for possível, acho que estou tendo este problema aqui também... hoje aconteceu uma desconexão/reconexão em massa aqui... e em alguns horários acontecem grandes latências tanto em antenas com muitos clientes como em antenas com poucos clientes, tenho dois concorrentes, como sou o mais novo, acho que posso estar sendo atacado por eles...

Hi Fabrício and Barrozo, i will contact to you. Podem me contatar em thenpb (at) ig.com.br. Estou disponível somente à noite.

Fabrício, Im still waiting your call.

Fabrício, Im still waiting your call.

Me cadastra no seu msn

Note, that official forum language is english, probably your posted information might be very interesting for other users.

Hi Sergejs,

Sorry by the portuguese on the forum!

I sent to you more informations about my problem with reassociantion throught the support email.

Did you see it?

Regards,

Fabrício

galera vcs são fodas em vai pro particular ai como que a galera vai aprender...