0

adb dumpsys wifi gives me, among many others, lines like this:

Event [IFNAME=wlan0 CTRL-EVENT-DISCONNECTED bssid=X reason=7]

What does reason=7 mean? What other reasons are there?

If this applies to Android aswell (I guess so since Android does use wpa_supplicant), reason 7 would translate to "Class 3 frame received from nonassociated STA" - Now what does that mean?

(I'm trying to debug WiFi disconnects that shouldn't happen.)

Improve this question
5
  • 1
    Have you considered that this is a Wifi deauthentication attack? AFAIK in such an attack you will encounter a lot of those messages. See also this paper which describes the attack.
    – Robert
    Jan 17, 2020 at 19:29
  • @Robert While researching this issue, I saw something related on serverfault... It's not impossible, but highly unlikely. This WiFi is part of a business that has two APs - One is open for customers, one is locked for employees. The device connects to the locked one. This doesn't happen often by the way, 1-2 times a day (at most), hours apart.
    – confetti
    Jan 17, 2020 at 19:36
  • @Robert Cool thing. Didn't know that exists. While I sitll find this highly unlikely in the place the AP is. Let's say this did happen - Is there any way I can set up Android so that my phone will automatically re-connect again?
    – confetti
    Jan 17, 2020 at 19:42
  • @Robert Is there really no way to simply have the phone re-connect again? I don't mind the deauth itself, nor a few seconds or even minutes without Wi-Fi, but any sort of automated re-connect attempt would be great. I do have root access on the phone. (Android 5, by the way)
    – confetti
    Jan 17, 2020 at 19:55
  • @Robert I've opened a new question to keep this one about finding the cause and fixing the issue itself, and the new one about re-connecting.
    – confetti
    Jan 17, 2020 at 20:05

1 Answer 1

Reset to default
1

Most likely your problems are caused by one or more attackers performing the Wifi deauthentication attack. Due to a weakness in the Wifi WPA2 protocol it allows to deauthenticate any client ("kick" it out of the Wifi it is connected to).

There are even tiny portable deauther devices which can deauthenticate any client in Wifi range. It does not matter if the Wifi is open or protected by a passphrase. Even if the Wifi is visible or hidden (hidden BSSID) is irrelevant for this attack.

May be some attacker using a deauther is driving by (car, bus, ...) and every time your device gets disconnected.

The only counter measure to prevent such attacks is the new WPA3 protocol which is supported since Android 10. To use it support for WPA3 has to be present in the Wifi AP and the Android device.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .