[Nebula] Understanding wireless event logs in Access Points

Zyxel_Judy

• Station: AA:BB:CC:DD:EE:FF has disassoc by STA Logout on [...]

The client left the Wi-Fi either by getting too far away from the Wi-Fi, or by disconnecting manually.

• Station: AA:BB:CC:DD:EE:FF has disassoc by STA Timeout on [...]

AP didn't receive any traffic from that client for a period of time and kicked out the idle station.

• Station: AA:BB:CC:DD:EE:FF has disassoc by STA Leave(L2UPFrame)

Client has left an access point after client is roaming to another access point

• STA Fast Roaming MAC: AA:BB:CC:DD:EE:FF

Access point is using 802.11r (fast roaming) to get the client to roam without re-authentication

• Station: AA:BB:CC:DD:EE:FF has deauth by Intra Roaming [...]
• Station: AA:BB:CC:DD:EE:FF has associated on [...]

The client has roamed from the radio to another because the AP compared the signal quality and therefore changed the radio (e.g. from 5GHz to 2,4GHz).

• Station: AA:BB:CC:DD:EE:FF has disassoc by iwpriv(kickmac) [...]

Related to the feature of fast roaming, which can cause some issues. Please try to turn 802.11r off to see if it gets better

• Station: xx:xx:xx:xx:xx:xx has blocked by Hostapd3 and has blocked by prev-Auth Failed

The log 'Hostapd3 +  prev-Auth Failed' means the WPA2 authentication is not successful. It might be caused by an incorrect password or packet loss during the authentication process. Please check the key in the password or if there's any high retry-rate information in the logs.

• PN check failed

PN check failed event log stands for environment interference issue.  This mostly when you are using Smart Mesh.  Frequently followed by logs like the one's below.

• Repeater AP disconnected caused by Beacon Miss

This is a sign that interference is affecting the channels who are selected by the radio. To recover from this situation, you could try:

1. Manually change to other channel or use DCS to choose the channel that has least interference.
2. Change the channel width from 80MHz to lower (40 or 20MHz).