This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

EWC ignore clients Deauth frames

EWC ignore clients Deauth frames

M_Nees
Contributor III

‎01-26-2018 06:14 AM

At several customers EWC installations i am wondering that some clients are reported as active (Reports - All Active clients) although i know they are definitive offline.

To debug this i have connect a recent Windows 7 client to a WPA2 802.1x SSID. After that i disconnect the SSID via Windows normally.

Remote wireshark trace on that AP shows me a vaild Deauth frame:

0d7bf5f15c834b00ad061f064f133b96_RackMultipart20180126-97961-5my6hv-1_inline.png



But EWC report this MAC as active till idle timer after 30 minutes cut the session ...

Why does EWC ignore this above Deauth Frame ?
EWC = 10.31.07

Anybody who observe this behaviour too ?

0 Kudos
11 REPLIES 11

M_Nees
Contributor III
In response to Craig_Guilmette

‎01-26-2018 11:46 AM

Why is idle timer relevant if the clients sending a valid De-Auth Frame ?

Normally the controller should terminate the session immediatelly after receiving this typ of frame.

But EWC ignore it ...
0 Kudos

Michael_Rinner
New Contributor

‎01-26-2018 06:27 AM

The same behaviour can be observed witht WPA2-PSK authentication. EWC: 9.21.19

Best regards

Michael

0 Kudos
GTM-P2G8KFN