Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our previous router died, and to replace it I procured an Apple AirPort Extreme. My Mac, my Linksys WRT54GS (with DD-WRT, acting as a bridge) and a Linux machine have had no problem connecting to the wireless. None of the wired clients are having a problem obviously.

The problem is one of my roommates cannot connect. That's not strictly true. He can connect to the network, and will, in fact, get a DHCP lease. However he cannot get any packets out. Can't ping the router, can't access any web sites, nothing.

However he's fine if we switch to an unsecured network. Which is obviously not acceptable.

The AirPort only allows for 'WPA/WPA2 personal' and 'WPA2 personal' (and of course the enterprise versions thereof).

I keep reading about this problem in multiple spots on the web, but never see any actual answers...

Anyway the laptop:
HP/Compaq CQ50-215NR
Vista Home Premium
wireless card: Atheros 5007

The AirPort Extreme is the "Simultaneous Dual Band II" (now called "4th Generation") model.

share|improve this question

If it works when the security is down, it is most likely down to one of a few things:

  1. The laptop does not support the encryption type - Double check it is set and can support WPA2

  2. The router has some sort of MAC restriction list. (However I doubt this as it works when WPA2 is off).

  3. It may be worth checking for a driver upgrade as I know of a few devices where stock drivers have similar issues connecting to secure networks.

share|improve this answer
Definitely not a mac address issue, thats not being filtered. and the previous router used wpa2, even then this is supposed to accept wpa 1. So it's not number 1. I've been looking for newer drivers but this is the newest driver compaq provides for this laptop. – Hutch Feb 8 '10 at 1:07

Had the same problem, my MBPro and phone connected fine but my old vista machine a Fujitsu wouldn't. It could see the new Airport Extreme router, but wouldn't connect to the internet. when I disabled the security it all worked so evidently the WPA was the problem. Following a suggestion on another forum, I updated the Atheros 55007EG adapter, and everything was fine...only took 2 hours.

share|improve this answer

The 802.11n spec requires WPA2 (AES-CCMP) security if you want to use security. Older security modes like WPA (TKIP) and WEP can't keep up with 802.11n data rates.

WPA/WPA2 (what the Wi-Fi Alliance calls "WPA2 Mixed Mode") supports AES-CCMP or TKIP as the unicast cipher, and has to use TKIP as the multicast/broadcast (group) cipher for the sake of older clients that only know TKIP. This mode is compatible with older devices that only do TKIP, but it means that for clients that join using AES-CCMP, not only is there a different encryption key for multicasts/broadcasts as opposed to unicasts, there's a whole different cipher that has to be used.

WPA2-only (AES-CCMP only) is a bit simpler to handle because it uses AES-CCMP for both the unicast and multicast cipher, although it still uses a different key for multicasts/broadcasts than it uses for unicasts.

I've seen a lot of implementations that were buggy about handling the different key and/or cipher for multicast/broadcast, and effectively dropped all multicasts/broadcasts, breaking, most notably, ARP. To be fair, these buggy implementations have almost never been from Apple. Because Apple's popular "Bonjour" protocols makes heavy use of multicasts, Apple is pretty good at making sure the AirPort Base Stations are very solid when it comes to multicast/broadcast handling.

If your router wants to forward a packet to your roommate's Vista laptop, first it may need to send an ARP Request broadcast that the laptop needs to receive and reply to. If your roommate's Atheros 5007 isn't able to decrypt those ARP request broadcasts because it has a bug, then it will never see the ARP Requests, will never reply with an ARP Reply, and thus will be unreachable for the router, because the router will never know which MAC address to address the frames to.

The funny/annoying thing is, the special multicast handling only happens in one direction (from AP to client). So multicasts/broadcasts from the client to the AP would work. DHCP only does broadcasts in one direction, from the client to the server. It almost always uses unicasts from the server to the client. So DHCP usually works even when multicast is broken. This also means the Vista client can probably ARP for the router's MAC address, and even transmit its ping request, but it's when the router needs to send the ping response that it can't because its attempts to user ARP to find the client's MAC address fail.

If you've already tried WPA2-only security and it didn't work, then the solution is to hope someone has updated drivers for your Atheros 5007 card that don't have this bug, or upgrade to a better quality card that doesn't have this bug.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .