How to understand the Nebula AP Event Log for the Station?

Zyxel_Jay

In the NCC log entries, you might encounter some terms that are not immediately clear. Here's an explanation of common and uncommon log messages:

Normal AP Log Messages:

1. STA Logout:
   • Message: "Station: AA:BB:CC:DD:EE:FF has disassociated by STA Logout."
   • Explanation: The client disconnected from the WiFi, possibly due to moving too far away or manual disconnection.
2. STA Timeout:
   • Message: "Station: AA:BB:CC:DD:EE:FF has disassociated by STA Timeout."
   • Explanation: The AP removed the client due to inactivity over a certain period.
3. STA Leave (L2UPFrame):
   • Message: "Station: AA:BB:CC:DD:EE:FF has disassociated by STA Leave (L2UPFrame)."
   • Explanation: The client has left an AP or is roaming to another access point.
4. Fast Roaming:
   • Message: "STA Fast Roaming MAC: AA:BB:CC:DD:EE:FF."
   • Explanation: The AP uses 802.11r (fast roaming) allowing the client to roam without re-authentication.
5. Intra Roaming:
   • Messages: "Station: AA:BB:CC:DD:EE:FF has deauthenticated by Intra Roaming," followed by "Station: AA:BB:CC:DD:EE:FF has associated."
   • Explanation: The client roams between radios within the same AP (e.g., from 5GHz to 2.4GHz) based on signal quality.

Uncommon AP Log Messages:

1. iwpriv(kickmac):
   • Message: "Station: AA:BB:CC:DD:EE:FF has disassociated by iwpriv(kickmac)."
   • Explanation: Related to fast roaming issues. Turning off 802.11r might resolve this.
2. Hostapd3 + prev-Auth Failed:
   • Message: "Station: AA:BB:CC:DD:EE:FF has blocked by Hostapd3 and has blocked by prev-Auth Failed."
   • Explanation: Indicates unsuccessful WPA2 authentication, possibly due to an incorrect password or packet loss. Check the password and look for high retry-rate logs.
3. PN Check Failed:
   • Message: "PN check failed."
   • Explanation: Suggests environmental interference, often seen with Smart Mesh. Accompanied by messages like "Repeater AP disconnected due to Beacon Miss" and "Repeater uplink disconnected." This indicates channel interference. To address this, try manually changing the channel or using DCS to select a less interfered channel. If issues persist, consider reducing the channel width from 80MHz to 40 or 20MHz."