iMac disconnect/reconnect from wireless router hourly

Question

aselvan Author

Level 1

39 points

iMac disconnect/reconnect from wireless router hourly

I have two macs running same version of macOS Catalina. They are siting right next to

each other and connect to same router (Asus GT-AX110000) on same Band (5GHz-2). The

following are the model/OS version of both.

MacBook Pro (15inch, 2019) , Version: 10.15.4 (19E287)

iMac (Retina 5K, 27-inch, 2017), Version: 10.15.4 (19E287)

MacBook Pro has no problem and continue to stay connected, while the iMac on every

hour like a clock work, does Deauth, Assoc, Auth, from wireless router; of course loosing connection

for 30 sec or so during that process and stays continually connected for exactly an hour and repeats the same.

The following is from my router log.

Deauth_ind 24:F6:xx:xx:xx:xx, status: 0, reason: Deauthenticated because sending station is leaving...
Assoc 24:F6:xx:xx:xx:xx, status: 0, reason: d11 RC reserved (0)
Auth 24:F6:xx:xx:xx:xx, status: 0, reason: d11 RC reserved (0)

What is causing this and is there a fix/work around?

The wireless connection, signal info etc are below for both the computers are below.

MacBook Pro:

     agrCtlRSSI: -63
     agrExtRSSI: 0
    agrCtlNoise: -91
    agrExtNoise: 0
          state: running
        op mode: station 
     lastTxRate: 390
        maxRate: 1300
lastAssocStatus: 0
    802.11 auth: open
      link auth: wpa3-sae
          BSSID: d4:xx:xx:xx:xx:xx
           SSID: myssid
            MCS: 4
        channel: 161,80

iMac:

     agrCtlRSSI: -57
     agrExtRSSI: 0
    agrCtlNoise: -92
    agrExtNoise: 0
          state: running
        op mode: station 
     lastTxRate: 351
        maxRate: 217
lastAssocStatus: 0
    802.11 auth: open
      link auth: wpa3-sae
          BSSID: d4:xx:xx:xx:xx:xx
           SSID: myssid
            MCS: 3
        channel: 161,80

iMac 27" 5K, macOS 10.15

Posted on Apr 26, 2020 4:52 PM

Reply

Answer 1

Best reply

aselvan Author

Level 1

39 points

May 5, 2020 4:01 PM in response to aselvan

In case anyone runs into this problem, I found a workaround. Basically, I traced this problem down to iMac with specific firmware update to wifi card i.e. Broadcom BCM43xx 1.0 (7.77.111.1 AirPortDriverBrcmNIC-1600.4). Most likely it was broken with the last macOS catalina 10.15.4 update pushed on 4/8/2020 or earlier updates. The basic problem is that the wifi driver is unable to complete the "WPA group rekey" exchange properly with the AP once the "group key interval" time is reached as evidenced by the router log below and as a result, it gets deauthenticated by the router.

May  4 14:05:03 hostapd: eth7: STA 24:f6:xx:xx:xx:xx WPA: received EAPOL-Key with invalid MIC
May  4 14:05:04 hostapd: eth7: STA 24:f6:xx:xx:xx:xx WPA: received EAPOL-Key with invalid MIC
May  4 14:05:05 hostapd: eth7: STA 24:f6:xx:xx:xx:xx WPA: received EAPOL-Key with invalid MIC
May  4 14:05:06 hostapd: eth7: STA 24:f6:xx:xx:xx:xx WPA: received EAPOL-Key with invalid MIC
May  4 14:05:07 hostapd: eth7: STA 24:f6:xx:xx:xx:xx WPA: group key handshake failed (RSN) after 4 tries 
May  4 14:05:07 wlceventd: wlceventd_proc_event(392): eth7: Deauth_ind 24:F6:xx:xx:xx:xx, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3)

Workaround:

Increase the group key rotation interval (typically defaults to 3600 i.e. 1 hr) on your router to a longer period that you are comfortable with. Keep in mind that making it very long essentially downgrades your WPA authentication protocol and makes it less secure.

Reply

Answer 2

den.thed

Level 9

77,152 points

Apr 26, 2020 5:27 PM in response to aselvan

Could very well be interference from a USB 3.0 or TB drive running Time Machine.

see > https://support.apple.com/en-us/HT201542

As a test try ejecting and removing your TM and/or other external drives for an hour or two. Then if the problem goes away, try moving your drive(s) and re-routing the cable(s) or try using better shielded cable(s).

Reply

Answer 3

rkaufmann87

Level 10

140,532 points

Apr 26, 2020 5:37 PM in response to aselvan

Okay, again don't assume that if one Mac works okay there is a problem with the other. Its likely a network issue. Please change the DNS settings to Google's DNS settings on the iMac.

If after changing the DNS settings and no luck, please do the following:

Please navigate to the Mac App Store or navigate to www.Etrecheck.com and download the free version of EtreCheck. Once you have you downloaded the app and installed it, please run the report and save it. This report will help us get a good idea what has been installed on your system and help us be able to diagnose what may be wrong.

When you have your report, you can attach it when you reply to this message and we can then review it and help you determine what is needed to get your system running well again.

For instructions on how to download your EtreCheck report and attach it to your reply to this message please click https://discussions.apple.com/docs/DOC-250000211

Reply

Answer 4

rkaufmann87

Level 10

140,532 points

Apr 26, 2020 5:19 PM in response to aselvan

Got it that one Mac works and the other does not, before you do anything ensure the modem and router have up to date firmware. Then please do the following in this order:

Restart Modem
Restart Router
Restart iMac
Test

Reply

Answer 5

aselvan Author

Level 1

39 points

Apr 26, 2020 5:52 PM in response to rkaufmann87

Sorry, not sure I follow what you are saying. What is DNS setting had to do with wireless device purposely de-authenticating and associating back w/ the wireless router periodically (i.e. approximately an hour apart). Coincidently, I do have 8.8.8.8 as my DNS but again, that is nothing to do with my problem. I did sniff the wireless traffic and did capture the de-auth frame. Just don't understand why this node is getting it; one possibility is some neighbor is purposely or inadvertently doing Wi-Fi de-authentication attack but I very much doubt it. It is something in the iMac that is causing it to leave and re-join.

Reply

Answer 6

den.thed

Level 9

77,152 points

Apr 26, 2020 7:57 PM in response to aselvan

aselvan wrote:

Thank you for the reply.

You're welcome!

don't have any USB or any external drives connected to iMac and certainly not using Time Machine,

Time Machine backs-up hourly and it could have easily fit into that pattern.

never did.

So if you don't mind me asking, how do you backup?

Reply

Answer 7

aselvan Author

Level 1

39 points

Apr 26, 2020 9:02 PM in response to den.thed

@den.thed,

I backup everything I need via a cronjob (basically a script that does rsync) nightly to a raid device attached to my Linux server like so below.

arul@lion$ crontab -l |grep backup
# lion backup to gorilla @ 2.01am
01 02 * * * /Users/arul/data/src/scripts/backup_lion_to_trex.sh >/Users/arul/tmp/backup_lion_to_trex.log 2>&1

Reply

Answer 8

aselvan Author

Level 1

39 points

Apr 26, 2020 5:26 PM in response to rkaufmann87

Thanks for the response.

I have done all that and I don't think its the modem or router which would not explain Macbook Pro siting right next to iMac working with no issues.

Reply