Beacon Errors!

  • 1
  • Question
  • Updated 4 years ago
  • Answered
We setup kiwi syslogging.
Logging is OK.
But!
We get thousands of beacon errors.
Is this a configuration problem?
Photo of Ouellette Michael

Ouellette Michael

  • 7 Posts
  • 0 Reply Likes

Posted 4 years ago

  • 1
Photo of Gary Smith

Gary Smith, Official Rep

  • 299 Posts
  • 61 Reply Likes
Hi,

Can you share the error that you see please?

Kind Regards,
Gary Smith

Photo of J. Goodnough

J. Goodnough, Champ

  • 266 Posts
  • 32 Reply Likes
does it resemble this?

<182>kernel: [wifi]: wifi0.4: Bad beacon IE(dd) len(221), remained IEs len(11) is out of bound from ac7f:3eeb:3038.

Photo of Gary Smith

Gary Smith, Official Rep

  • 299 Posts
  • 61 Reply Likes
Hi,

What I understand about this info message is that the AP has received a beacon or probe request with an IE length which exceeds the remaining frame length. As it is not correct, it gets dropped.

I am sorry that my description does not give more detail but I hope it helps a little.

Kind Regards,
Gary Smith
Photo of J. Goodnough

J. Goodnough, Champ

  • 266 Posts
  • 32 Reply Likes
So bad beacon spam indicates a misbehaving client?
Photo of Gary Smith

Gary Smith, Official Rep

  • 299 Posts
  • 61 Reply Likes
Hi,

"<182>kernel: [wifi]: wifi0.4: Bad beacon IE(dd) len(221), remained IEs len(11) is out of bound from ac7f:3eeb:3038"

The message received does suggest that this is a client issue.

Kind Regards,
Gary Smith
Photo of Ouellette Michael

Ouellette Michael

  • 7 Posts
  • 0 Reply Likes
This is exactly it.
So how do you go about resolving this issue?
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Find the bad acting clients:

1) Update them if an update is available and see if they behave.
2) If that fails, open a support case with the responsible vendor(s) seeking resolution with a good issue breakdown with packet captures.
3) If that's not possible, just filter out the entries at the Syslog server.
Photo of J. Goodnough

J. Goodnough, Champ

  • 266 Posts
  • 32 Reply Likes
personally I'd recommend against 3), but that's up to your personal/instituational logging preferences, really.
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Agreed, but can always filter after the logging has occured to just get the view you want of the log entries at the point in time that you review them.
(Edited)
Photo of J. Goodnough

J. Goodnough, Champ

  • 266 Posts
  • 32 Reply Likes
100% agreed. I'm logging everything to my server with the exception of the kernel and amrp2 proxy messages. Those are getting dropped before they hit the index. Too much white noise.
Photo of J. Goodnough

J. Goodnough, Champ

  • 266 Posts
  • 32 Reply Likes
Not much you can do about it from software, the AP is already doing what it is supposed to.
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Remember that Syslog is a debugging mechanism, everything is behaving as expected here.

If you simply do not want to see these entries, you are conceptually free to filter the entries as you see fit at the Syslog server... Via something like a regular expression, you should be able to exclude logging these beacon errors in the first place if you really want to (not recommended) or showing them when you view the log so that you can look for other things without being overwhelmed (recommended).

(This assumes Kiwi supports this, if not, use a different Syslog server.)

Nick

(Edited)