Diagnosing an intermittent WiFi connection with particular characteristics

I done a bunch more experimentation but am none the wiser. Tried:

• Access point: Fresh Debian install.
• Access point: Network Manager instead of wpa_supplicant.
• iMac: disabling IPv6, setting manual IP address, DNS, MTU.

No change in symptoms.

I managed to capture a log from point of establishment to disconnection. I did the same for a similar access point and poured through the (1000 line) log line by line but couldn't see anything that appeared in the unsuccessful log which didn't also appear in the successful log, up until the fatal line:

Tue Sep  1 11:42:30.122 Info: <airportd[19249]> <en1> Failed to associate to Wi-Fi network TheSSID, returned error code -3902, retrying

The log on the access point is always the same (connected, DHCP served, disconnected 6 seconds later):

Sep 01 02:43:57 ap-name wpa_supplicant[7198]: HT: Forty MHz Intolerant is set by STA 14:7d:da:24:98:ea in Association Request
Sep 01 02:43:57 ap-name wpa_supplicant[7198]: wlan0: AP-STA-CONNECTED 14:7d:da:24:98:ea
Sep 01 02:43:59 ap-name dnsmasq-dhcp[15213]: DHCPDISCOVER(wlan0) 14:7d:da:24:98:ea
Sep 01 02:43:59 ap-name dnsmasq-dhcp[15213]: DHCPOFFER(wlan0) 10.42.0.185 14:7d:da:24:98:ea
Sep 01 02:44:00 ap-name dnsmasq-dhcp[15213]: DHCPREQUEST(wlan0) 10.42.0.185 14:7d:da:24:98:ea
Sep 01 02:44:00 ap-name dnsmasq-dhcp[15213]: DHCPACK(wlan0) 10.42.0.185 14:7d:da:24:98:ea iMacName
Sep 01 02:44:03 ap-name wpa_supplicant[7198]: wlan0: AP-STA-DISCONNECTED 14:7d:da:24:98:ea

I've attached the unsuccessful wifi log in case any one can spot anything I've missed.

Tried and eliminated a few more things:

• Turned off Bluetooth.
• Tried two different Windows 10 PCs as clients - they also failed mysteriously!! Something in new OS's in general??
• Changed from WEP to WPA2.
• Changed password length, SSID name, etc.

And then tried one more thing...

• Change security to "Open" by turning off password security (in wpa_supplicant, that's "key_mgmt=NONE").

And it works!! WiFi connection established and maintained for at least a few minutes. So still mysterious, but that helps narrow it down a lot.

In summary:

• Works:
  • Early 2013 MacBook Pro running macos 10.14.6 (Mojave)
  • iPhone SE running iOS 13.6
  • Old Toshiba running Windows 7.
• Doesn't work:
  • Late model desktop PC running Windows 10.
  • Ancient ASUS laptop running Windows 10.
• Only works if security is changed to "Open" (no password):
  • 2020 iMac running macos 10.15.6 (Catalina)
  • Win 10 devices not yet checked.

Thanks for the response.

I've tried with and without the Ethernet connection active, with no change in symptoms.

There is no firewall on the network or the router.

There are no security packages to disable and all those ports are open.

I have followed the instructions in that WiFi diagnostics link many times and have tried to interpret the information that appears in the log, but it is very complicated and verbose. I put some of the relevant entries I could find in the original post.

Anything else I can do to fault find?

Why? Did you try the new Location at all?

Creating and deleting a Location is one of many, many suggestions people have made that at least one person has reported success with. In particular, here: https://apple.stackexchange.com/a/353603

Yes, I tried using the new Location before deleting it.

By the way, I've also now tried creating a new user account, logging out and logging into the new account. The WiFi symptoms are the same in the new account.

I've also tried WiFi Explorer Lite, which lists the network (and others) much quicker and more consistently that macos's own lists. There's nothing alarming about the network in WiFi Explorer Lite.

Great suggestion. I certainly was suspicious of the torrent of probes that gets launched on a new network. All the failures to find various AirDrop style services were clogging the logs.

But alas, no change in behaviour even after bringing awdl0 down.

Okay, I have an answer... it's a bit unsettling.

After the "no password" workaround I described above opened a door to explore, I went deep into why the authentication was failing. Most diagnostics were very misleading, but wpa_supplicant itself gave some very vague insight.

Eventually I was able to show that WPA authentication works, but WPA2 does not. The logs showed that in WPA the pairwise key handshake completes and then the group key handshake completes. In WPA2 the pairwise key handshake completes but then the process stops until the connection is dropped, regardless of whether AES, CCMP or TKIP was enabled.

After an exhaustive process of elimination, including endless permutations of dozens of different configuration settings, I found the only working solutions were to disable WPA2, or use hostapd instead. The fact that I tried Network Manager earlier with no success seems to have been a red herring, because under the hood it probably just used wpa_supplicant anyway.

So the theory I have is:

wpa_supplicant, by default, advertises WPA and WPA2 but does not provide a WPA2 Authenticator. Old clients just use WPA and never notice. Newer clients (including Mojave on a 2020 iMac) try WPA2, which does not complete so they drop the connection and mystery abounds.

There does not appear to be a fix on the client side. Catalina does allow you to set up a WiFi connection and specify the authentication used, but the only option that includes WPA also includes WPA2, which seems to be used preferentially with no fallback.

The fix has to be on the access point side: the immensely prevalent wpa_supplicant must be configured with "proto=wpa" to disable WPA2, or wpa_supplicant must be replaced with something that provides an WPA2 Authenticator like hostapd.

I still do not understand why during the 6 seconds before disassociation, the WiFi connection appears to be completely useable.

Phew.

BDAqua wrote:

Perhaps the 6 second window is when it is talking & trying to establish protocol?

That was my hunch too, but isn't that a glaring security hole? There has to be more to it, but I've reached the limits of my visibility.