TKIP countermeasure - WiFi connection drops [SOLVED]

Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Forum Index -> Marvell MVEBU based Hardware (WRT1900AC etc.)
Goto page 1, 2  Next
Author Message
cedgex
DD-WRT Novice


Joined: 24 May 2017
Posts: 30

PostPosted: Wed May 06, 2020 6:19    Post subject: TKIP countermeasure - WiFi connection drops [SOLVED] Reply with quote
Hi everyone,

I got a pretty bad issue, still unsolved as of today but I am making good progress on the investigation and I guess, you guys can help.

First, my config:
Quote:
DD-WRT WRT1900ACSv2
Firmware: DD-WRT v3.0-r41586 std (11/21/19)


Second, I have bought the following Smart Outlet some time ago (last year) on amazon:
https://www.amazon.com/BN-LINK-Monitoring-Function-Compatible-Assistant/dp/B07CX5KLXN?th=1

They use the 2.4GHz wifi network (ath1 interface) which I have an issue with. It got disconnected every 5 min for 60 seconds.

Code:

May  5 22:36:31 DD-WRT daemon.info hostapd: ath1: STA c4:4f:33:XX:XX:XX WPA: received EAPOL-Key Error Request (STA detected Michael MIC failure (group=1))
May  5 22:36:31 DD-WRT daemon.info hostapd: ath1: STA dc:4f:22:XX:XX:XX WPA: received EAPOL-Key Error Request (STA detected Michael MIC failure (group=1))
May  5 22:36:31 DD-WRT daemon.info hostapd: ath1: IEEE 802.11 TKIP countermeasures initiated
May  5 22:37:31 DD-WRT daemon.info hostapd: ath1: IEEE 802.11 TKIP countermeasures ended

May  5 22:41:32 DD-WRT daemon.info hostapd: ath1: STA 2c:f4:32:XX:XX:XX WPA: received EAPOL-Key Error Request (STA detected Michael MIC failure (group=1))
May  5 22:41:32 DD-WRT daemon.info hostapd: ath1: STA 2c:f4:32:XX:XX:XX WPA: received EAPOL-Key request with invalid MIC
May  5 22:41:32 DD-WRT daemon.info hostapd: ath1: STA c4:4f:33:XX:XX:XX WPA: received EAPOL-Key Error Request (STA detected Michael MIC failure (group=1))
May  5 22:41:32 DD-WRT daemon.info hostapd: ath1: IEEE 802.11 TKIP countermeasures initiated
May  5 22:42:32 DD-WRT daemon.info hostapd: ath1: IEEE 802.11 TKIP countermeasures ended


This TKIP countermeasure thing basically drops my WiFi network for 60 seconds and then, all my devices re-authenticate.

Code:

May  5 21:14:58 DD-WRT user.info : bridge : interface ath1 successfully deleted from bridge br0
May  5 21:14:59 DD-WRT user.info : bridge : interface ath1 successfully deleted from bridge br0
May  5 21:15:19 DD-WRT user.info : bridge : interface ath1 successfully added to bridge br0


Code:
root@DD-WRT:~# dmesg | grep -i ath1
[128360.843642] device ath1 left promiscuous mode
[128360.849177] br0: port 3(ath1) entered disabled state
[128376.620505] br0: port 3(ath1) entered blocking state
[128376.625607] br0: port 3(ath1) entered disabled state
[128376.630815] device ath1 entered promiscuous mode
[128381.781517] br0: port 3(ath1) entered blocking state
[128381.786597] br0: port 3(ath1) entered forwarding state


When I check who is sending the EAPOL-Key Error Request, it is those smart outlets.

Weird thing I have also noted, on their description with the app "Smart Life", each smart outlet declare its IP as a public IP from my ISP (different for each smart outlet and belonging to my ISP) which I thought was impossible. How could they have an public IP from my ISP?

Anyways, I wanted to disable the tkip_countermeasures to see if it solve the connection drops issue but I saw that our firmware does not have the "wl" command implemented (https://wiki.dd-wrt.com/wiki/index.php/Wl_command#tkip_countermeasures)

I need those smart outlets and I can't bring myself to just give up on them.

Does this issue ring a bell to anyone?

Thanks for your help!
Sponsor
blkt
DD-WRT Guru


Joined: 20 Jan 2019
Posts: 3461

PostPosted: Wed May 06, 2020 8:07    Post subject: Reply with quote
It's a known issue with the mwlwifi driver and will likely never be resolved (Marvell sold WiFi/BT to NXP, Linksys to Foxconn).

Use WPA2 Personal and CCMP-128 (AES) only (wireless security, save and reboot) and it might be good enough if you can configure the switches to not use TKIP. Or not as IoT, home automation or smart devices are Marvell WRT's worst enemy.

If you have another router to connect via Ethernet and configure as an access point, the issue can by most easily bypassed by offloading the problematic devices.

Some repeaters have an Ethernet port and can be set into AP mode as well.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 9066
Location: Netherlands

PostPosted: Wed May 06, 2020 8:46    Post subject: Reply with quote
On Broadcom we could set the Key Renewal interval and setting it to 0 sometimes helped (there are security implications) not sure if that is applicable to Marvell
_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
cedgex
DD-WRT Novice


Joined: 24 May 2017
Posts: 30

PostPosted: Wed May 06, 2020 16:29    Post subject: Reply with quote
Thank you both for your replies.

Unfortunately, some of my IoT (including one of my camera) used TKIP and when I switched to AES only, they don't connect to WiFi anymore.

That's too bad this will never be solved.

"If you have another router to connect via Ethernet and configure as an access point, the issue can by most easily bypassed by offloading the problematic devices"
This was my alternate solution but I need to buy an access point because I bricked my other router by playing too much with it.

"Key Renewal interval"
I will give it a try and let you guys know.

Thanks again for reading and bringing your light on my issue!
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 11827
Location: Texas, USA

PostPosted: Wed May 06, 2020 16:39    Post subject: Reply with quote
cedgex wrote:
This was my alternate solution but I need to buy an access point because I bricked my other router by playing too much with it.


What is the other router that is bricked... and have you looked up how to de-brick it, or did you fry it completely?

_________________
Official Forum Rules, Guidelines & Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware‽
DON'T use Chromium-based browsersRTFM/STFW TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is‽
Please DO NOT PM me with questions; Ask in the forum. ---------------------- Linux User #377467 counter.li.org / linuxcounter.net
cedgex
DD-WRT Novice


Joined: 24 May 2017
Posts: 30

PostPosted: Wed May 06, 2020 16:42    Post subject: Reply with quote
I just tested the "Key Renewal interval=0" solution but it didn't work out. Still getting the TKIP countermeasures which basically disconnect all client from the WiFi.
cedgex
DD-WRT Novice


Joined: 24 May 2017
Posts: 30

PostPosted: Wed May 06, 2020 16:45    Post subject: Reply with quote
kernel-panic69 wrote:
cedgex wrote:
This was my alternate solution but I need to buy an access point because I bricked my other router by playing too much with it.


What is the other router that is bricked... and have you looked up how to de-brick it, or did you fry it completely?


It was a Netgear WNR3500 V2. The LEDs don't light up as they should to initiate anything so I can't update the firmware with the means I have right now at home.
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 11827
Location: Texas, USA

PostPosted: Wed May 06, 2020 16:56    Post subject: Reply with quote
cedgex wrote:
kernel-panic69 wrote:
cedgex wrote:
This was my alternate solution but I need to buy an access point because I bricked my other router by playing too much with it.


What is the other router that is bricked... and have you looked up how to de-brick it, or did you fry it completely?


It was a Netgear WNR3500 V2. The LEDs don't light up as they should to initiate anything so I can't update the firmware with the means I have right now at home.


Recovery mode and/or nmrpflash. Worst case is you have to use serial recovery, and that isn't all that difficult. Those should already have the header pins, but if not, pretty easy to make it work if you aren't capable of soldering the header to the board.

_________________
Official Forum Rules, Guidelines & Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware‽
DON'T use Chromium-based browsersRTFM/STFW TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is‽
Please DO NOT PM me with questions; Ask in the forum. ---------------------- Linux User #377467 counter.li.org / linuxcounter.net
cedgex
DD-WRT Novice


Joined: 24 May 2017
Posts: 30

PostPosted: Wed May 06, 2020 16:59    Post subject: Reply with quote
kernel-panic69 wrote:
Recovery mode and/or nmrpflash. Worst case is you have to use serial recovery, and that isn't all that difficult. Those should already have the header pins, but if not, pretty easy to make it work if you aren't capable of soldering the header to the board.


Thanks kernel-panic69, I will check that.
If, in the meantime, you can point me to documents/websites, etc. where they explain how to do that, that would be nice.
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 11827
Location: Texas, USA

PostPosted: Wed May 06, 2020 17:11    Post subject: Reply with quote
Recovery mode (using TFTP):

https://kb.netgear.com/19841/Reinstall-the-firmware-on-a-router-without-the-setup-CD-recovery-tool

https://kb.netgear.com/000059634/How-to-upload-firmware-to-a-NETGEAR-router-using-Windows-TFTP

https://kb.netgear.com/000059633/How-to-upload-firmware-to-a-NETGEAR-router-using-TFTP-client

NMRPFLASH (click on releases to download the binary):

https://github.com/jclehner/nmrpflash

Serial Recovery (second link is for the WNR3500Lv2, but see third link for pinout)

https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery

https://www.myopenrouter.com/article/how-debrick-your-wnr3500lv2-using-windows-and-usb-ttl-cable

http://en.techinfodepot.shoutwiki.com/wiki/Netgear_WNR3500v2

_________________
Official Forum Rules, Guidelines & Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware‽
DON'T use Chromium-based browsersRTFM/STFW TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is‽
Please DO NOT PM me with questions; Ask in the forum. ---------------------- Linux User #377467 counter.li.org / linuxcounter.net
cedgex
DD-WRT Novice


Joined: 24 May 2017
Posts: 30

PostPosted: Wed May 06, 2020 17:19    Post subject: Reply with quote
Great, thank you!!! Very Happy
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 11827
Location: Texas, USA

PostPosted: Wed May 06, 2020 18:54    Post subject: Reply with quote
Also see this post: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324701 ... it was meant to be a reply here, but for now... until it shows up here...
_________________
Official Forum Rules, Guidelines & Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware‽
DON'T use Chromium-based browsersRTFM/STFW TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is‽
Please DO NOT PM me with questions; Ask in the forum. ---------------------- Linux User #377467 counter.li.org / linuxcounter.net
cedgex
DD-WRT Novice


Joined: 24 May 2017
Posts: 30

PostPosted: Wed May 06, 2020 19:27    Post subject: Reply with quote
Thank you. Copying the comment here:

Quote:

From: WENED
Posted: Wed May 06, 2020 17:14

I do apologize if my comments are irrelevant;

Most of my problems over the past couple of years has been with Smart devices (Sonoff) which are a known problem with the wrt series routers as noted in other posts.
As can be seen from my profile I am running fairly current builds successfully.
My point here is I have never setup any camera or other device with TKIP and have seen the problem you are experiencing.
All my cameras have GUI access and I have set them up as static IP and WPA2-PSK Personal (AES).
As for my Sonoff devices which also likely would support TKIP, I ensure that the router is set for AES only before doing the initial connection.
I may be wrong or out of line but have you tried setting the router to AES only and then doing a setup on your smart plugs?
My thought here is that when you did the initial setup you had TKIP active on the router and your smart plugs think that is the way they should connect.
_________________
WRT3200acm Master WDS 5GHz 80Mhz CH 100 (+6) r43055
Ath1 2.4Ghz AP G only wmm Disabled Ch 6 - Three Sonoff Devices and anything else that wants to connect.

WRT3200acm r43028 WDS 5Ghz
5Ghz VAP
Ath1 AP N only Channel 11

WRT1900Ac V1 5Ghz r43028 WDS Station
(Defective, no 2.4Ghz but 5Ghz works great)

WRT1900AC V1 5Ghz AC 80Mhz WDS Station r43028
2.4Ghz AP Ch1 20Mhz N/G mode

WRT1900AC V1 Spare r43028

WRT1200AC V1 r42514 WDS 5Ghz
2.4Ghz Ch 6 Mixed 20Mhz
Spare


WRT54G DD-WRT v3.0-r37305 micro AP CH 6 Mixed -Spare
EX6200 DD-WRT r38535 - Spare
EX7000 Stock Firmware Spare
Devices and Cameras and Sensors
15 WiFi cameras, 4 desktops, 2 laptop, 12 Sonoff Basic/TH16, Artisan 700 Printer, Ongoing testing of other devices.


Thank you for your answer. I will try that as well! Smile
cedgex
DD-WRT Novice


Joined: 24 May 2017
Posts: 30

PostPosted: Wed May 06, 2020 19:32    Post subject: Reply with quote
kernel-panic69 wrote:

Serial Recovery (second link is for the WNR3500Lv2, but see third link for pinout)

https://wiki.dd-wrt.com/wiki/index.php/Serial_Recovery

https://www.myopenrouter.com/article/how-debrick-your-wnr3500lv2-using-windows-and-usb-ttl-cable

http://en.techinfodepot.shoutwiki.com/wiki/Netgear_WNR3500v2


I have soldered the pin as recommended and use a USB to Serial cable but although, I see the router LED light being solid (which means, at least it is powered), I can't communicate with it. Putty remains silent.

I am using a cable that is exactly like this one but bought on AliExpress long time ago for another router:
https://www.adafruit.com/product/954

I will give a try to Wened's solution
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 11827
Location: Texas, USA

PostPosted: Wed May 06, 2020 19:43    Post subject: Reply with quote
TX and RX and GND are only required and you may have to check connections and make sure they are indeed on the correct pins. Also, with the latest version of PuTTY, you have to have everything configured correctly:
Quote:
First and foremost, run putty 0.73 or newer as older versions do not have this option.
Set up your correct com port, then under the connection serial settings make sure to use:
Code:
baud: 115200
databits: 8
stopbits: 1
parity: None
Flow Control: None

and do NOT forget:
Code:
Window > Translation > "Enable VT100 line drawing even in UTF-8 mode"


_________________
Official Forum Rules, Guidelines & Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware‽
DON'T use Chromium-based browsersRTFM/STFW TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is‽
Please DO NOT PM me with questions; Ask in the forum. ---------------------- Linux User #377467 counter.li.org / linuxcounter.net
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   This topic is locked: you cannot edit posts or make replies.    DD-WRT Forum Forum Index -> Marvell MVEBU based Hardware (WRT1900AC etc.) All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum