Atheros wifi card: warnings in system logs…

firestar · Jun 26, 2007, 6:34 PM

Hello,
in the last week I read these warnings in the system logs:

Jun 17 02:36:42 hostapd: ath0: STA  WPA: received EAPOL-Key 2/2 Group with unexpected replay counter
Jun 17 02:35:40 last message repeated 8 times
Jun 17 02:27:40 last message repeated 2 times
Jun 17 02:25:40 hostapd: ath0: STA  WPA: group key handshake completed (RSN)
Jun 17 02:24:40 hostapd: ath0: STA  WPA: group key handshake completed (RSN)
Jun 17 02:24:20 hostapd: ath0: STA  WPA: pairwise key handshake completed (RSN)
Jun 17 02:24:19 hostapd: ath0: STA  WPA: received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun 17 02:24:19 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:24:18 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:24:18 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:24:17 hostapd: ath0: STA  WPA: received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun 17 02:24:15 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:24:13 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:24:13 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:24:10 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:24:09 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:24:09 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:24:06 hostapd: ath0: STA  WPA: received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun 17 02:24:06 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:24:05 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:24:05 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:24:03 hostapd: ath0: STA  WPA: received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun 17 02:24:02 hostapd: ath0: STA  WPA: received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun 17 02:24:02 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:24:00 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:24:00 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:24:00 hostapd: ath0: STA  WPA: received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun 17 02:23:57 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:23:56 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:23:56 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:23:53 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:23:52 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:23:52 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:23:52 hostapd: ath0: STA  WPA: received EAPOL-Key 2/2 Group with unexpected replay counter
Jun 17 02:23:49 hostapd: ath0: STA  WPA: received EAPOL-Key 2/2 Group with unexpected replay counter
Jun 17 02:23:49 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:23:47 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:23:47 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:23:45 hostapd: ath0: STA  WPA: received EAPOL-Key 2/2 Group with unexpected replay counter
Jun 17 02:23:44 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:23:43 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:23:43 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:23:42 hostapd: ath0: STA  WPA: received EAPOL-Key 2/2 Group with unexpected replay counter
Jun 17 02:22:40 hostapd: ath0: STA  WPA: group key handshake completed (RSN)
Jun 17 02:22:03 hostapd: ath0: STA  WPA: pairwise key handshake completed (RSN)
Jun 17 02:22:03 last message repeated 9 times
Jun 17 02:22:02 hostapd: ath0: STA  WPA: received EAPOL-Key 2/4 Pairwise with unexpected replay counter
Jun 17 02:22:02 hostapd: ath0: STA  IEEE 802.11: associated
Jun 17 02:22:00 hostapd: ath0: STA  IEEE 802.11: deassociated
Jun 17 02:22:00 hostapd: ath0: STA  IEEE 802.11: deauthenticated due to local deauth request
Jun 17 02:21:58 last message repeated 2 times
Jun 17 02:21:57 hostapd: ath0: STA WPA: received EAPOL-Key 2/4 Pairwise with unexpected replay counter

I've been using WPA2-PSK AES with an Atheros 5212 PCI card on a x86 machine running pfSense 1.0.1.
What does 'ath0: STA WPA: received EAPOL-Key x/x Pairwise with unexpected replay counter' mean?
Is a problem on the client side (Windows XP SP2) or on the server side (hostapd)?
I've tried to run pfSense Beta 1.2 LiveCD (not the latest CVS) but it complains about WDMA2 used by the harddisk drive (pfSense 1.0.1 set it as PIO4 instead).
What should I do? Daily updated 1.2 Betas have updated atheros driver than the stable 1.0.1 version and WDMA2 bug fixed?
I can't understand why it happens. It is a wifi card based on Atheros 5212 card and it should work on FreeBSD for sure ???

Help me, please! :)

firestar · Jul 2, 2007, 10:08 PM

pfSense configured to be an access-point through hostap. Data taken from Status-Interfaces:

OPT1 interface (ath0)
Status 	associated
MAC address 	xx:xx:xx:xx:xx:xx
Media 	autoselect mode 11g <hostap>
Channel 	5
SSID 	HIDE
In/out packets 	145706/169408 (31.39 MB/123.76 MB)
In/out errors 	167269/285
Collisions 	0
Bridge (bridge0) 	learning
Interrupts/Second 	3190161 total
85 rate</hostap>

Are they ok? Is it ok that In Errors are more than In packets? Should be 0/0 In/Out Errors or is it normal for a wifi card? Note that ath0 is a PCI wifi-card based on an Atheros chipset.
I need to know from users using pfSense as an access-point configured with WPA or WPA2 encryption, if you read any warning related to EAPOL (as written in the first topic) in your system logs. THANK YOU!!

I don't understand what's going wrong ??? :'(

Bye!

firestar · Jul 3, 2007, 9:27 PM

Adding to previous unanswered help. Output from athstats:

150938 tx management frames
2403 tx frames discarded prior to association
1 tx discarded empty frame
1340 tx failed 'cuz FIFO underrun
5768 tx failed 'cuz bogus xmit rate
13779 tx frames with rts enabled
139462 tx frames with an alternate rate
14 tx frames with 11g protection
219484 rx failed 'cuz of FIFO overrun
3 rx failed 'cuz frame too short
125670 rx management frames
466490 beacon setup failed 'cuz no mbuf
1822437425 beacons transmitted
1659 periodic calibration failures
4489 tx used alternate antenna
Antenna profile:
[2] tx   130950 rx   143641
[3] tx    21048 rx       10

What is antenna profile 2 and 3? I have only one external antenna through a R-SMA connector! ???
I don't believe nobody use pfSense as an access-point, too. :-
At least, tell me who to contact to get an help….

dotdash · Jul 4, 2007, 2:29 AM

There are many sysctl tweaks for the atheros hal. Search around in the wireless forum, there is quite a lot of discussion on the antenna diversity settings. If you are using a laptop mini-pci card, the firmware settings are to use both antennas, and the settings seem to have a way of changing back after you change them in the shell. There are some examples somewhere of adding the settings to the config.xml and setting a cron job to set it back.

firestar · Jul 4, 2007, 1:44 PM

@dotdash:

There are many sysctl tweaks for the atheros hal. Search around in the wireless forum, there is quite a lot of discussion on the antenna diversity settings. If you are using a laptop mini-pci card, the firmware settings are to use both antennas, and the settings seem to have a way of changing back after you change them in the shell. There are some examples somewhere of adding the settings to the config.xml and setting a cron job to set it back.

I've already tried sysctl tweaks, but I had no luck with them. I've also added lines to sysctl.conf as described in a topic, but FreeBSD got a kernel panic at the next reboot forcing me to reinstall pfSense.
I've been using a PCI wifi-card with an Atheros 5212 chipset. Do these tweaks useful only for miniPCI cards?
I think I have to enable a sort of debugging, but I don't know how to do it since I am a Window$ user and I know few things about linux/unix.

1- Is it possibile to get more details from hostapd while it is running? It would help me to understand better the problem, because those annoying EAPOL warnings in the system logs are not so useful alone. What I have to edit/configure?

2- I've seen some fields in hostapd_ath0.conf, but they're replaced with default value. Can they be useful to enable a detailed debugging? Or is there another way?

I'm getting crazy because I've never debugged a wireless network problem. It is time to learn now… :'(

Thank you