Archer A9 2.4 Ghz authenticated / disassociated from unknown MAC

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Archer A9 2.4 Ghz authenticated / disassociated from unknown MAC

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Archer A9 2.4 Ghz authenticated / disassociated from unknown MAC
Archer A9 2.4 Ghz authenticated / disassociated from unknown MAC
2020-12-15 20:43:47
Model: Archer A9  
Hardware Version: V6
Firmware Version: 1.1.0 Build 20200416

The router is set up with both the 2.4 and 5 Ghz radios turned on - using WPA2-PSK  AES for secuity / encryption

 

I happened to go into the 'advanced' 'system tools' 'system log' and noticed a couple of unknown MAC's - 68:57:2d:d0:96:ae and less often - but occasionally MAC 08:00:23:9b:5c:7f doing authentication then disassociation over and over as often as every 5 seconds.  The system log entries look like this:

 

2020-12-11 13:35:03 wireless[3333]: <6> 208051 ath0:STA 68:57:2d:d0:96:ae IEEE 802.11 authenticated
2020-12-11 13:30:20 wireless[3333]: <6> 208053 ath0:STA 68:57:2d:d0:96:ae IEEE 802.11 disassociated
2020-12-11 13:29:58 wireless[3333]: <6> 208051 ath0:STA 68:57:2d:d0:96:ae IEEE 802.11 authenticated
2020-12-11 13:28:26 wireless[3333]: <6> 208053 ath0:STA 68:57:2d:d0:96:ae IEEE 802.11 disassociated
2020-12-11 13:28:22 wireless[3333]: <6> 208051 ath0:STA 68:57:2d:d0:96:ae IEEE 802.11 authenticated


2020-12-12 11:02:21 wireless[12062]: <6> 208051 ath0:STA 08:00:23:9b:5c:7f IEEE 802.11 authenticated
2020-12-12 11:02:20 wireless[12062]: <6> 208053 ath0:STA 08:00:23:9b:5c:7f IEEE 802.11 disassociated
2020-12-12 11:02:18 wireless[12062]: <6> 208051 ath0:STA 08:00:23:9b:5c:7f IEEE 802.11 authenticated
2020-12-12 11:02:18 wireless[12062]: <6> 208053 ath0:STA 08:00:23:9b:5c:7f IEEE 802.11 disassociated
2020-12-12 11:02:16 wireless[12062]: <6> 208051 ath0:STA 08:00:23:9b:5c:7f IEEE 802.11 authenticated

 

There is no other indication of those MAC addresses in the system log - meaning they are not requesting or getting an I/P.

 

Through elimination I tracked the issue down to the 2.4 Ghz radio.  As soon as I turned the radio off - the authenticated / disassociated stopped.  if I turned the radio on again - the authenticated / disassociated resumed almost immediately.  I only have two laptops connected to that 2.4 Ghz radio.  Early on I did a test by powering down / turning the two laptops off - and the  authenticated / disassociated continued with the laptops turnd off .... so those laptops are not involved.

 

I then changed the SSID and password on the 2.4 Ghz radio - to no avail -so now none of my devices were connected to that radio and the authenticated / disassociated continued.

 

Then I turned the radio off - changed the ssid and password yet again (so there was no way it was someone or some device that had my ssid and password)  - and set 'hidden' for the SSID - and turned the radio back on.  No authenticated / disassociated messages at all...

 

I then connected the two laptops to the new hidden SSID and new password on the 2.4 Ghz radio - no  authenticated / disassociated messages at all.

 

So for now I leave 'hidden' turned on for the 2.4 Ghz radio - which is not a big deal for me seeing as I only have the 2 laptops accessing it.

.

.

.

The 68:57:2d MAC is associated with Tuya Smart Inc - a maker of 'smart home devices' - like a smart lightbulb or what have you.  I do not have this type of device but who knows what my neighbors might have.

 

The 08:00:23 is associated with Panasonic Communications - and I do have some Panasonic Network Cameras - but they are attached wirelessly to a 2.4 Ghz radio on a completely seperate Ubiquiti based network.

 

I wondered if the authenticated / disassociated might also be happening to the Ubiquiti based network - as it has a Unifi AP AC LR (2.4 and 5 Ghz wifi) so I looked at it's Unifi AP 'messages' file (equivalent to the TP-Link 'system log' file for radio traffic) and did not see either of these 2 MAC addresses - which tells me whatever is doing this is only going after the TP-Link 2.4 Ghz radio - and not the 2.4 Ghz radio on the Ubiquiti network. 

 

Another thought is - could it be some 'bug' in the TP-Link software.

 

I have reported this to TP-Link but thought I would see if other users are experiencing a similar issue (so it is not just me).

 

  0      
  0      
#1
Options
1 Reply
Re:Archer A9 2.4 Ghz authenticated / disassociated from unknown MAC
2020-12-16 03:07:37
That's just probably because some smart home devices (neighbor's most likely) are trying to authenticate against your router, but they can't. That's why the authenticated/disassociated messages are few second away from each other.
  0  
  0  
#2
Options