Re: TKIP: replay detected: WTF?

[Jouni Malinen <jkmaline@cc.hut.fi>]

On Fri, Feb 17, 2006 at 06:40:51PM -0500, Mark Lord wrote:

> Lately I've been seeing my kernel logs spammed by these events:
> 
> Feb 17 18:38:48 localhost kernel: TKIP: replay detected: 
> STA=00:13:46:16:96:b8 previous TSC ffff80723500 received TSC 000000000001

netdev could be better mailing list for this kind of issue. Anyway, it
looks like something managed to set the last packet number to very high
number which will make all future frames dropped as replays.

> This is with the various 2.6.16-rc*-git* kernels, and possibly older 2.6.15 
> series as well.
> They always seem to arrive in large bursts, like the bunch shown above.  
> Using wifi
> over ipw2200 to a WPA2 AP.

Are you using wpa_supplicant to take care of the WPA2 handshake? If yes,
it would be interesting to see debug log from it for the key handshake
that happened just prior to this replay issue occurring.

> Either this is "normal" behaviour, in which case the code should NOT be 
> spamming me,
> or something is broken, in which case.. what?

This is not normal behavior, i.e., something is indeed broken
(driver/supplicant/AP). Though, the those messages could be disabled by
default if there were a useful counter for detecting this kind of issues
easily. Anyway, these debug messages are quite useful in figuring out
what could have caused the "replays".

-- 
Jouni Malinen                                            PGP id EFC895FA