I would like to find a root of the WiFi issue we've got in our working environment.

Few words about WiFi infrastructure

We are using now Apple solution. Three brand-new access points from Apple connected into one roaming wireless network with one common ESSID. Two access points withing the range of main access point and around 30+ users. The reason for using three access points is low signal strength in different corners of our big office.


Few times per day we are getting an issue. This issue is

  1. Loss of internet and connection to internal servers
  2. Huge round-trip time for ping and losses
  3. Perfect WiFi strength and no losses of WiFi connectivity


During the issue I have tried to log the WiFi traffic using airodump-ng. Now I have some data to make conclusions, unfortunately I do not have a lot of experience for such conclusions, thus I would like to ask some help.

During the period of 25 minutes we got:

  1. 264 deauthentications
  2. A lot of retransmissions (125) out of 264 deauthentications (In total 257 000 frames been captured, 18 000 are retransmissions)
  3. Usually deauthentication happens with the reason "Reason code: Class 3 frame received from nonassociated STA (0x0007)"
  4. The reason code looks strange because I see in the log that user was communicating with STA and had no problems, the deauthentication frame appears right after spontaneously. Then it gets restransmitted up to 25 times
  5. Approx. frame rate is 167fps
  6. During normal activity even if people still have internet, I see lots of retransmissions


Maybe it is necessary to do something else? Is it enough to say that it is an deauthentication attack? Would that make sense to switch to managed cisco wifi network with WPA2-Corporate (now WPA2-PSK)? Can 802.11n help?

Additional Info

  1. The infrastructure: two AirPort Expresses 2013 and one Airport Extreme 2013 in between as main roaming AP
  2. DHCP is from the Windows Server, no NAT and DHCP on the AirPorts (simple Bridge mode)
  • 1
    Pretty well exposed problem :). Too soon to diagnose an attack.
    – dan
    Jul 23, 2014 at 10:18
  • Have you looked into 802.11w? It should help if this is a management frame spoofing issue. en.wikipedia.org/wiki/IEEE_802.11w-2009
    – JZeolla
    Jul 23, 2014 at 10:48
  • Yes I did, unfortunately as I've understood it is not implemented on Windows 7 (only starting from Windows 8), also I am not sure if it is implemented on Apple devices (we have 50/50).
    – Dexterite
    Jul 24, 2014 at 6:49
  • Within your OQ, could you include: - which model are your 3 AP? - how DHCP is configured?
    – dan
    Jul 24, 2014 at 9:15
  • @danielAzuelos, two AirPort Expresses 2013 and one Airport Extreme 2013 in between as main roaming AP. DHCP is from the Windows Server.
    – Dexterite
    Jul 24, 2014 at 10:51

1 Answer 1


I'd suggest you to investigate your wireless misbehaviour at 2 levels:

1. Access points

Activate the syslog function on all your AP toward a dedicated syslog server within your network. Beware, the access to this function was suppressed with the version 6 of AirPort Utility: AirPort Utility 6.0 missing a number of features

2. Environnment

Install iSTumbler or any equivalent level tool on a portable and secured Mac to make a serious environnment survey at 2 levels.

  • A first one when you don't see any misbehaviour and which you'll keep as a reference of your basic environnement. This survey will have to cover all your office and most notably all your wireless coverage. Keep in mind that this wireless coverage is a huge 3 dimensionnal potatoe. Don't hesitate to investigate the border where interferences may be a nightmare and not detected from the central point of vue of the AP.
  • A second one when you encounter a misbehavioiur of your network.

Once you will be equiped with these 2 tools, familiarize yourself with them.

Within a few hours you will be able to unravel radio interferences problems, 802.11n misbehaviour, AP misbehaviour, DHCP problem, ARP problem, IP problem, 802.11n attack, ARP attack, IP attack…

  • Wow, awesome! Do you know if syslog can be activated on AirPort Extreme and how?
    – Dexterite
    Jul 23, 2014 at 9:45
  • Yes I used this logging function on a small set of AP (~ 20). But apparently the access to this function was suppressed from the GUI. Please check if this function is still accessible through your official support or good documentation. I'd appreciate your return about this function to improve my answer.
    – dan
    Jul 23, 2014 at 10:16
  • only one thing I have observed with iSTumbler. The AP power graph looks like a saw. Nothing special in Log of iSTumbler. Unfortunately with all guidelines for installing the AirPort utility from Lion I have not succeeded, mainly because of the lack of time.
    – Dexterite
    Jul 24, 2014 at 6:45
  • Which AP does present this saw like graph? How many wireless network are received at the point where you experiment regular loss of network?
    – dan
    Jul 25, 2014 at 18:19
  • the number of wireless networks around is about 30. I see the "saw" on all three APs.
    – Dexterite
    Jul 28, 2014 at 6:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .