In this lesson,
we're going to discuss disassociation issues
within our wireless networks.
There's a lot of reasons
that a client would be disassociated from a
wireless access point.
This includes an idle timeout, a session timeout,
wireless network changes, manual deletion,
authentication timeouts, or access point radio resets.
Now, a client dissociation due to an idle timeout
is going to occur whenever a wireless client doesn't send
or receive traffic within 300 seconds,
which is five minutes.
This is the default setting on most wireless access points,
and it's used to free up the network for other clients
to join,
To prevent this from occurring,
some wireless client implementations will send out a
keep alive packet every few minutes
so they can remain connected the entire
time to that wireless network.
Now, a client association can also occur due
to a session timeout, and this will happen
after 1800 seconds.
At this point, the wireless client should reconduct an
authentication again and reestablish their
connection automatically.
This, again, is something that's handled
by your wireless client automatically on your behalf in
coordination with the wireless access point.
Next, we have client associations that occur due
to wireless network changes, and this occurs
whenever the wireless local area network is being changed,
and this change causes the wireless network to be disabled
and then re-enable itself.
For example, if you're going to change the shared passphrase
that secures the network, it's going to reboot the wireless
network and force every device
to reconnect and re-authenticate.
This makes a lot of sense
because we want to make sure they all have the
right password again, right?
Another client association we can have is caused
by manual deletion, and this occurs
whenever a wireless client is removed by an administrator.
This makes sense because if I kick your client off my
network, that means I want you to be dissociated
and removed, and then you'd have to reconnect again.
Now, another way that client associations occur is due
to authentication timeouts, and this occurs
whenever the authentication or key exchange process
fails to finish in a given time.
When this occurs, the wireless client is disassociated from
the access point and needs
to restart the authentication process all over again
to regain access.
Another time you'll find client associations occurring is
when your access point radio is reset.
And this is similar to the change that we made
with the wireless network.
All of our clients are going to be disassociated,
the radio's going to be turned off and turned on
to cause that reset, and then the clients can begin their
association process once more.
Now, why is it important
to understand all these times when disassociation happens?
Well, because sometimes your clients can be disassociated
as part of a de-authentication attack,
and not for one of these real legitimate reasons.
This is a common wireless attack that is used by hackers
to disassociate your wireless clients
and make them attempt to reconnect to the access point.
Now, when this occurs, the attacker is going to attempt
to capture the packets used in the association
and authentication processes,
and then they'll try to crack that shared passphrase
to gain access to the network indefinitely.
So if you see a client
that's continually being de-authenticated,
you need to check your wireless gateways
and your wireless controller logs
to determine the root cause.
It could be one of the ones I just mentioned above,
and all of those are normal and expected,
but if it's not one of those, it could be caused
by an attacker, and that's something you need
to investigate further.