Is someone Deauthing my router? Can anyone tell me what's going on here?

[IAmOrion]

Hi There,

So, I've got some odd behaviour with my router and I can't figure out what the hell is happening!! I have the same problem whether I use my RT-AC86U, I then dug out an old RT-AC68U, and recently just purchased an RT-AC88U -- ONLY ONE IN USE AT ANY GIVEN TIME. It only has 2.4GHz enabled, but does have an EERO for the 5GHz which is in bridge mode, all IOT stuff is mostly SONOFF branded (Mostly light switches, 3 or 4 plugs, 1 usb), with the odd few extras being my Haier fridge freezer and my GeoTrio II IHD supplied by Octopus Energy.

The current router in use is the ASUS RT-AC88U, running 386.12 from asuswrt-merlin and my ISP is Sky (So I used this forum to figure out the IPv6 stuff making it connect - it was a google search of that, that led me to this forum a few months ago)

I've had this exact problem no matter what router I use, what basically happens is that for some unknown reason ALL my IOT devices get kicked off the network!! This is a recent thing though, they'd been working fine for a long time without issue. I've not personally added any new on unknown devices. I did build a Deauth Detector (https://github.com/SpacehuhnTech/DeauthDetector) which does get triggered but if I'm honest, I'm not 100% on how reliable it actually is!

I've attached a snippet of my syslog - it is full of deauths!

EG: Sep 10 22:36:25 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 2C:F4:32:A9:8F:4D, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3), rssi:0

There doesn't seem to be a consistent time at which it happens (Eg, never seems to happen at the same time day after day) and if I reboot the router, all seems well again for a good 24 hours ish.

I can't force PMF only because the sonoff devices just won't connect (they obv don't support it) so currently PMF is set to "capable". FWIW the same issue happens when PMF is disabled also.

I really appreciate any advice or thoughts anyone might have! Many thanks in advance

EDIT: Just to add, I've already tried setting to just 20MHz, legacy mode, PMF disabled and a bunch of other things found on reddit and the internet but to no avail

 

[drinkingbird]

Those log messages are just clients leaving, the logs are normal, nobody is deauthing them, they're just disconnecting due to ehatever problem you're having. When you switch from 86 to 68 to 88 are you configuring them manually and not restoring a backup?

All 3 are very old routers, why did you purchase a 10 year old end of life router? Could very well have a dying radio which is also common on the 86.

 

[IAmOrion]

Those log messages are just clients leaving, the logs are normal, nobody is deauthing them, they're just disconnecting due to ehatever problem you're having. When you switch from 86 to 68 to 88 are you configuring them manually and not restoring a backup?

All 3 are very old routers, why did you purchase a 10 year old end of life router? Could very well have a dying radio which is also common on the 86.

I'm not using backups/restoring from backups, I'm doing factory reset, then manually re-setting stuff up etc.

I purchased a 10 year old router (AC88U) because it was like £50 and I can't afford the newer £200+ routers

This post seems to have some info / the same problem as me:

https://www.reddit.com/r/HomeNetworking/comments/ls1btb

Seems to be common (ish) with some suggesting it's an old unfixed asus bug

 

[drinkingbird]

I'm not using backups/restoring from backups, I'm doing factory reset, then manually re-setting stuff up etc.

I purchased a 10 year old router (AC88U) because it was like £50 and I can't afford the newer £200+ routers

This post seems to have some info / the same problem as me:

https://www.reddit.com/r/HomeNetworking/comments/ls1btb

Seems to be common (ish) with some suggesting it's an old unfixed asus bug

Reddit is not a good source of info. That being said, you may have wasted 50 pounds on a dying router, to replace your dying router. At this point I'd focus on the 68 as that's the most reliable of the bunch. Very minimal config, leave everything at defaults to start, only set the SSID and password. Install 386.11 (not 12) and hard (WPS) factory reset after, then configure just the basics.

Don't plug any USB devices in and make sure it is not in proximity of anything that could interfere with 2.4ghz (there are a lot of things). Try to think back to when it started happening, did you move the router, put something new near the router, get a new appliance or electronic device, etc?

It could be as simple as a neighbor got some powerful Bluetooth device or a leaky microwave, baby monitor, etc too.

 

[sfx2000]

Could be - deauth attacks are broadcast, and affect every network within range of the deauth tool as management frames outside of 802.11w/PMF support are in the clear...

WPA2/3 PMF is the only way to protect against these kind of things.

 

[sfx2000]

Seems to be common (ish) with some suggesting it's an old unfixed asus bug

No - there are Asus routers that don't support PMF, but deauth attacks do not discriminate vendors....

The most common tool - one that is based on ESP32/ESP8266 - these tools by default will broadcast for 5 mins, and then turn off - it's in the code, but easy enough to change...

The ESP modules don't have a lot of Tx power, so it's someone close - perhaps time to have a talk with your neighbors...

 

[IAmOrion]

Reddit is not a good source of info. That being said, you may have wasted 50 pounds on a dying router, to replace your dying router. At this point I'd focus on the 68 as that's the most reliable of the bunch. Very minimal config, leave everything at defaults to start, only set the SSID and password. Install 386.11 (not 12) and hard (WPS) factory reset after, then configure just the basics.

Don't plug any USB devices in and make sure it is not in proximity of anything that could interfere with 2.4ghz (there are a lot of things). Try to think back to when it started happening, did you move the router, put something new near the router, get a new appliance or electronic device, etc?

It could be as simple as a neighbor got some powerful Bluetooth device or a leaky microwave, baby monitor, etc too.

I didn't replace the AC86U thinking it was dying, I simply switched it over to the AC86U I had to see if it would have the same issues. I then took a punt on a £50 AC88U to test if that too would have the same issues. It seems unlikely that all 3 routers would have the exact same problem! The AC88U production date (according to the sticker) is 2019 so only 4 years old.

No - there are Asus routers that don't support PMF, but deauth attacks do not discriminate vendors....

The most common tool - one that is based on ESP32/ESP8266 - these tools by default will broadcast for 5 mins, and then turn off - it's in the code, but easy enough to change...

The ESP modules don't have a lot of Tx power, so it's someone close - perhaps time to have a talk with your neighbors...

Yeah I have a flipper zero myself, marauder and also a simple esp8266 deather which I've played with over the years, and recently used the ESP8266 when I was testing the death detector circuit.

For some additional (albeit not very usefull) info, the area is a brand new build area of 21 houses, so 20 new neighbours ha. Sadly, there's so many cut corners and dodgy workmanship amongst the builds!! We all moved in, in Feb of this year, so 7 months now.... This has been an issue since I moved in with dodgy WiFi. For what it's worth, I used the AC86U in my old house and never had an issue. This is all "new" since moving house. The same sonoff switches all came with me when I moved. The only new device to be added was the wifi on my haier fridge/freezer, however I was already getting the same problems and messages in logs prior to adding that device, so I've ruled that out as an issue (and for a sanity check, I did disable the wifi on the fridge/freezer for a week to double check and was still getting same issue).

We do have "Samsung Kodiak Joule" things in the houses that broadcast on 2.4GHz but no one knows how to connect to them and neither the letting agency or the bloody contractors seem to know how to do anything with them! (It's an absolute joke at this point but that's a whole different house build issue lol)

 

[sfx2000]

Samsung Kodiak Joule

that's your HVAC/Heat Pump platform...

 

[IAmOrion]

that's your HVAC/Heat Pump platform...

Yes correct, sorry, I worded it badly, we know what it's to so to speak, just no idea how to turn it off, or connect to it or do anything with it

 

[drinkingbird]

I didn't replace the AC86U thinking it was dying, I simply switched it over to the AC86U I had to see if it would have the same issues. I then took a punt on a £50 AC88U to test if that too would have the same issues. It seems unlikely that all 3 routers would have the exact same problem! The AC88U production date (according to the sticker) is 2019 so only 4 years old.

You said you switched from the 86 to the 68 because the 86 was having problems.

Yeah I have a flipper zero myself, marauder and also a simple esp8266 deather which I've played with over the years, and recently used the ESP8266 when I was testing the death detector circuit.

For some additional (albeit not very usefull) info, the area is a brand new build area of 21 houses, so 20 new neighbours ha. Sadly, there's so many cut corners and dodgy workmanship amongst the builds!! We all moved in, in Feb of this year, so 7 months now.... This has been an issue since I moved in with dodgy WiFi. For what it's worth, I used the AC86U in my old house and never had an issue. This is all "new" since moving house. The same sonoff switches all came with me when I moved. The only new device to be added was the wifi on my haier fridge/freezer, however I was already getting the same problems and messages in logs prior to adding that device, so I've ruled that out as an issue (and for a sanity check, I did disable the wifi on the fridge/freezer for a week to double check and was still getting same issue).

We do have "Samsung Kodiak Joule" things in the houses that broadcast on 2.4GHz but no one knows how to connect to them and neither the letting agency or the bloody contractors seem to know how to do anything with them! (It's an absolute joke at this point but that's a whole different house build issue lol)

Sounds like you just have noisy 2.4ghz. You can try different channels and see if there is improvement, also try playing with the bluetooth coexistence settings, they may or may not help.

Make sure universal beamforming is disabled under advanced, that can be a big problem in congested areas.

AX routers have better 2.4ghz however if the clients are AC it probably won't help much. Given that it started when you moved to this new house and two different routers have the same issue, still not sure why you'd buy another old AC router that is no longer supported and potentially a security risk.

 

[IAmOrion]

You said you switched from the 86 to the 68 because the 86 was having problems.

I switched from the 86 to the 68 because I was getting these "Deauthenticated because sending station is leaving (or has left)" drop-out/disconnects. The 68 had the exact same issues, then so did the 88 (which is the one currently in use).

Sounds like you just have noisy 2.4ghz. You can try different channels and see if there is improvement, also try playing with the bluetooth coexistence settings, they may or may not help.

Make sure universal beamforming is disabled under advanced, that can be a big problem in congested areas.

AX routers have better 2.4ghz however if the clients are AC it probably won't help much.

Beamforming is already disabled, I'll look for the bluetooth coexistence settings though, I don't think I've played with those as of yet.

Given that it started when you moved to this new house and two different routers have the same issue, still not sure why you'd buy another old AC router that is no longer supported and potentially a security risk.

Again, availability of routers and low funds. I can't afford a new asus router (or any other brand of "decent" routers)

We can't all afford £50,000 sports cars, some of us have to make do with the £500 20 year old beaten up car lol

 

[drinkingbird]

I switched from the 86 to the 68 because I was getting these "Deauthenticated because sending station is leaving (or has left)" drop-out/disconnects. The 68 had the exact same issues, then so did the 88 (which is the one currently in use).


Beamforming is already disabled, I'll look for the bluetooth coexistence settings though, I don't think I've played with those as of yet.



Again, availability of routers and low funds. I can't afford a new asus router (or any other brand of "decent" routers)

We can't all afford £50,000 sports cars, some of us have to make do with the £500 20 year old beaten up car lol

My point was, why buy a 3rd nearly identical router when you already have two that worked fine until you moved to your current location (thus being almost certainly not a router issue)? Save the 50 quid and get a $550 car next time?

 

[IAmOrion]

My point was, why buy a 3rd nearly identical router when you already have two that worked fine until you moved to your current location (thus being almost certainly not a router issue)? Save the 50 quid and get a $550 car next time?

What router would you have recommended instead with a budget of £50?

 

[drinkingbird]

What router would you have recommended instead with a budget of £50?

None, that's the point I'm trying to make. You already have two AC routers and are only using one, so why a third when it seems the problem is almost certainly not the router? Or if it is, I wouldn't have gone with a nearly identical Asus for the 3rd if two have the same issue.

 

[chris2kari]

Moved house?
-> Reset router to factory default then only configure what is absolutely needed to be changed.
-> Check for DHCP conflicts of client devices on the LAN.
-> Check WiFi network contention. Find the channel with the least contention & lock your router to that.