Ipv4 and ipv6 (same device) on 2 different SSIDs?

Scope · November 2, 2024, 10:41pm

Setup:

2 SSIDs running on 2 different routers (router+ap)
1 device appears to connect to both, ipv4 on 1 SSID, and ipv6 on the other..

Is this possible?

SSID1:

SSID2:

The screenshots where taken at the same time.. I have entries in both logs (20 seconds apart) that the authentication is taking place on both SSIDs.

golialive · November 2, 2024, 11:08pm

The signal isn't exactly strong on both of them. Is there a chance the client switched from one SSID to the other for batter connectivity but tried to hold the first connection while establishing the second?

What's the client doing at that time? Is it actually connected to both SSIDs from the clients' perspective?

Does one of those connections, supposedly the one being established first, disappear after a couple of minutes? That would indicate the client dropped the connection without telling the router about it.

brada4 · November 2, 2024, 11:13pm

Likely SSID2 did not receive deauth due to super low signal and is waiting for inactivity timeout. You can check that with eg hostapd_cli

_bernd · November 3, 2024, 12:15am

As @brada4 said it's probably the result that the client roamed.
This can be lead to issues when the neighbor table isn't updated soonish after the client roamed and another client still on the old ap is exchanging data with the roamed client.
As soon as the roamed client sends data to the other client the neighbor table of the new ap is updated as well as the neighbor table on the old ap because both see a frame with the roamed clients mac address on another local interface.
If you however need a distributed arp and ndp table then have a look at batman-adv.

Ps: traffic to the Internet should be uneffected however. The issue I mentioned is only visible on local intranet traffic.

Scope · November 3, 2024, 9:43am

I'll be honest with you, Im not even sure which device this is.. Im trying to identify all device in static leases to name them, but these days with too many laptops/smart speakers/phones/tv's/iot's its not that easy. Even searching the mac address for a clue doesnt always work.

For completeness I have picked out the entries from the logs - but to answer your question, at 00:30, 2 hours after connecting the logs shows a "disassociated due to inactivity"..

Log entries from both routers.. (lines are prefixed 1 and 2

2: Sat Nov  2 21:54:33 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: authenticated
2: Sat Nov  2 21:54:33 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: associated (aid 2)
2: Sat Nov  2 21:54:33 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-CONNECTED 12:ec:XX:XX:97:67 auth_alg=open
2: Sat Nov  2 21:54:33 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 WPA: pairwise key handshake completed (RSN)
2: Sat Nov  2 21:54:33 2024 daemon.notice hostapd: Traadloes-5Ghz: EAPOL-4WAY-HS-COMPLETED 12:ec:XX:XX:97:67

1: Sat Nov  2 22:25:54 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: authenticated
1: Sat Nov  2 22:25:54 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: associated (aid 4)
1: Sat Nov  2 22:25:54 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-CONNECTED 12:ec:XX:XX:97:67 auth_alg=open
1: Sat Nov  2 22:25:54 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 RADIUS: starting accounting session 59F978C5D263EA13
1: Sat Nov  2 22:25:54 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 WPA: pairwise key handshake completed (RSN)
1: Sat Nov  2 22:25:54 2024 daemon.notice hostapd: Traadloes-5Ghz: EAPOL-4WAY-HS-COMPLETED 12:ec:XX:XX:97:67

2: Sat Nov  2 22:27:26 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-DISCONNECTED 12:ec:XX:XX:97:67
2: Sat Nov  2 22:27:26 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: authenticated
2: Sat Nov  2 22:27:26 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: associated (aid 1)
2: Sat Nov  2 22:27:26 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-CONNECTED 12:ec:XX:XX:97:67 auth_alg=open
2: Sat Nov  2 22:27:26 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 WPA: pairwise key handshake completed (RSN)
2: Sat Nov  2 22:27:26 2024 daemon.notice hostapd: Traadloes-5Ghz: EAPOL-4WAY-HS-COMPLETED 12:ec:XX:XX:97:67

1: Sat Nov  2 22:27:43 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-DISCONNECTED 12:ec:XX:XX:97:67
1: Sat Nov  2 22:27:43 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: authenticated
1: Sat Nov  2 22:27:43 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: associated (aid 4)
1: Sat Nov  2 22:27:43 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-CONNECTED 12:ec:XX:XX:97:67 auth_alg=open
1: Sat Nov  2 22:27:43 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 RADIUS: starting accounting session 59F978C5D263EA13
1: Sat Nov  2 22:27:43 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 WPA: pairwise key handshake completed (RSN)
1: Sat Nov  2 22:27:43 2024 daemon.notice hostapd: Traadloes-5Ghz: EAPOL-4WAY-HS-COMPLETED 12:ec:XX:XX:97:67

2: Sat Nov  2 23:16:51 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan) 192.168.0.111 12:ec:XX:XX:97:67
2: Sat Nov  2 23:16:51 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan) 192.168.0.111 12:ec:XX:XX:97:67

2: Sun Nov  3 00:40:30 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-DISCONNECTED 12:ec:XX:XX:97:67
2: Sun Nov  3 00:40:30 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: disassociated due to inactivity
2: Sun Nov  3 00:40:31 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)

1: Sun Nov  3 02:23:48 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-DISCONNECTED 12:ec:XX:XX:97:67
1: Sun Nov  3 02:23:48 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: authenticated
1: Sun Nov  3 02:23:48 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 IEEE 802.11: associated (aid 4)
1: Sun Nov  3 02:23:48 2024 daemon.notice hostapd: Traadloes-5Ghz: AP-STA-CONNECTED 12:ec:XX:XX:97:67 auth_alg=open
1: Sun Nov  3 02:23:48 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 RADIUS: starting accounting session 59F978C5D263EA13
1: Sun Nov  3 02:23:48 2024 daemon.info hostapd: Traadloes-5Ghz: STA 12:ec:XX:XX:97:67 WPA: pairwise key handshake completed (RSN)
1: Sun Nov  3 02:23:48 2024 daemon.notice hostapd: Traadloes-5Ghz: EAPOL-4WAY-HS-COMPLETED 12:ec:XX:XX:97:67

2: Sun Nov  3 02:23:48 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan) 192.168.0.111 12:ec:XX:XX:97:67
2: Sun Nov  3 02:23:48 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan) 192.168.0.111 12:ec:XX:XX:97:67

2: Sun Nov  3 08:24:22 2024 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan) 192.168.0.111 12:ec:XX:XX:97:67
2: Sun Nov  3 08:24:22 2024 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan) 192.168.0.111 12:ec:XX:XX:97:67

Anyway, the question was more for curiosity on my part - I am having another issue on my routers and happened to keep a close eye on the logs, just wanted to see if there was an explanation, and it is probably like most of you mention: the device is trying to connect to both and are doing some roaming.

_bernd · November 3, 2024, 9:53am

Be aware that the(se) link local addresses (fe80::xxx) are only valid on the link layer.
And yes it can be handy to have a list from all known clients with their mac address as well as their link local addresses.