I would like to find a root of the WiFi issue we've got in our working environment.
Few words about WiFi infrastructure
We are using now Apple solution. Three brand-new access points from Apple connected into one roaming wireless network with one common ESSID. Two access points withing the range of main access point and around 30+ users. The reason for using three access points is low signal strength in different corners of our big office.
Few times per day we are getting an issue. This issue is
- Loss of internet and connection to internal servers
- Huge round-trip time for ping and losses
- Perfect WiFi strength and no losses of WiFi connectivity
During the issue I have tried to log the WiFi traffic using
airodump-ng. Now I have some data to make conclusions, unfortunately I do not have a lot of experience for such conclusions, thus I would like to ask some help.
During the period of 25 minutes we got:
- 264 deauthentications
- A lot of retransmissions (125) out of 264 deauthentications (In total 257 000 frames been captured, 18 000 are retransmissions)
- Usually deauthentication happens with the reason "Reason code: Class 3 frame received from nonassociated STA (0x0007)"
- The reason code looks strange because I see in the log that user was communicating with STA and had no problems, the deauthentication frame appears right after spontaneously. Then it gets restransmitted up to 25 times
- Approx. frame rate is 167fps
- During normal activity even if people still have internet, I see lots of retransmissions
Maybe it is necessary to do something else? Is it enough to say that it is an deauthentication attack? Would that make sense to switch to managed cisco wifi network with WPA2-Corporate (now WPA2-PSK)? Can 802.11n help?
- The infrastructure: two AirPort Expresses 2013 and one Airport Extreme 2013 in between as main roaming AP
- DHCP is from the Windows Server, no NAT and DHCP on the AirPorts (simple Bridge mode)