Community discussions

MikroTik App
 
mikroscope
just joined
Topic Author
Posts: 10
Joined: Wed May 06, 2020 2:44 am

Attack or something else? 4-way handshake timeout

Tue Sep 21, 2021 6:30 pm

I would like to shed more light on a situation that I see from time to time on my Wi-Fi network. I would like to enable more technical details/logging to reveal what is happening when I see these messages reported by my CAP AP devices.
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 disconnected, 4-way handshake timeout",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 connected, signal strength -48",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 disconnected, 4-way handshake timeout",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 connected, signal strength -47",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 disconnected, 4-way handshake timeout",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 connected, signal strength -47",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 disconnected, 4-way handshake timeout",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 connected, signal strength -47",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 disconnected, 4-way handshake timeout",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 connected, signal strength -48",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 disconnected, 4-way handshake timeout",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 connected, signal strength -47",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 disconnected, 4-way handshake timeout",
  "message": "xx:xx:xx:xx:xx:xx@2G--CAP-1-2 connected, signal strength -48",
<snip. hundreds more of the same messages were observed before I power-cycled the printer and it connected find after that>
Through testing I've found that entering an invalid Wi-Fi password can trigger this same message ("4-way handshake timeout"). I also see the message recently was triggered thousands of times in a row by a printer near (5 feet) the AP. I want to find out what the heck the printer was doing. If it were to be backdoored and guessing the Wi-Fi password I want the logs to tell me that. If it's having problems connecting for some other reason I want to know that too.

How do I crank up logging on the CAP (managed by CapsMAN) so that I can shed more light on this error?
 
gotsprings
Forum Guru
Forum Guru
Posts: 2087
Joined: Mon May 14, 2012 9:30 pm

Re: Attack or something else? 4-way handshake timeout

Tue Sep 21, 2021 8:06 pm

Who is online

Users browsing this forum: No registered users and 26 guests