How can I troubleshoot wireless disconnection issues?

Question

My college's Wi-Fi has issues where students are frequently disconnected and must reconnect, on both Mac OS X and Windows (I've heard you simply can't connect with Linux but wasn't able to verify that). This was verified over dozens of student devices. It also seems to not happen as much (or at all?) with the "public" network that doesn't use MSCHAPv2 for authentication.

The poor guys are only two people for the whole wireless infrastructure, and recognizing a rare moment the administration reaches out to students for help, I agreed to try and help.

However, they seem rather at loss over the problem, as very little on their side seems to explain the disconnections. I was wondering what I could do on the client side to troubleshoot the issue.

Obviously, I'm getting disconnected, so my computer should be able to tell what happened. Did the AP just stop talking to me? Was there suddenly so much interference that it had to shut me off? This would all be useful information but I don't know how I can see that.

What can you do on Mac OS X and/or Windows 8 to get more information about what caused a disconnection?

EDIT As you can imagine, I don't have much power over the network myself, so I'm more looking for tools to diagnose the problem on the client side (would it be only something that tells me "you've been disconnected because we didn't hear back from the AP in n seconds") than for things that need to be run on the infrastructure side. Still, here's basically all that I know about the network:

• Some buildings use Aruba APs and others use Cisco APs (but the two aren't mixed together);
• They support A, B, G, N and Ac, and use the 2.4GHz and 5GHz bands;
• Over the 2.4GHz band, channels 1, 6 and 11 are used alternatively by APs (channel overlap is apparently not a problem with the 5GHz band);
• The distributed IP addresses are in the private class A block (10.x.x.x) with a 10 bit mask;
• Both OS X and Windows clients are disconnected at approximately equal frequencies, as far as we can tell. I'll usually be disconnected once in any given afternoon if I spend it all with my laptop on.

This makes the short DHCP lease (4 hours), pointed out by Richie086, a likely candidate since a lot of clients will try to renew after 50% of the lease duration and that would fit with the "once in an afternoon" frequency, but until they come back to me about that I'm still interested in more tools for client-side diagnosis.

Answer 1

OS X provides an app called Wireless Diagnostics for such situations. It's located in /System/Library/CoreServices/Applications or available by ⌥-clicking the Wi-Fi button in your menu bar.

Wireless Diagnostics is an application that detects common problems with your wireless connection. It can also monitor your wireless connection for intermittent connectivity failures.

You can also enable logging to show more information:

Answer 2

Since you said in your comments that you are looking more for tools than fixes, here is my short list of tools when your budget is very limited/non-existent (assuming since you are a student and volunteer).

The OSX wireless diagnostics (already referenced by grgarside) is probably one of the best tools for your situation that is part of any mainstream OS.

I would also suggest installing a copy of Wireshark. This is the best free packet capture software you can get (I personally don't know any network professionals without this installed on at least one of their computers - even if they have better paid solution as well). I do know that with Windows, you need to spend money on a driver that allows you to put your wireless adapter in monitor mode (not just promiscuous mode), such as AirPcap. On OSX, I am not sure if you can do so natively.

For seeing what is around you in the air as far as 802.11/wifi, one of the better tools is inSSIDer. Unfortunately, the OSX version does have a small price tag associated to it.

From there, still keeping costs in mind, I would look at BackTrack Linux. This can be run from a bootable CD, installed to a USB stick, run in as a virtual machine (VMs can only use a USB wireless adapter for most tools) or installed directly. It contains a number of tools that can be used to discover various aspects of the wireless around you. The site has links to tutorials/howtos to use many of the tools and your search engine of choice will also be very useful. While you can install most of these tools on any version of *nix, it is nice to have them already pre-installed and ready to go.

Answer 3

See if you can find out what their RADIUS server is sending for the RADIUS Session-Timeout attribute as well as the Termination-Action attribute. Also ask them how their WLAN infrastructure products (APs and WLAN controllers) are configured to handle a RADIUS session timeout (and related settings like 802.11 session lengths) by default.

Note that you can't find this out by sniffing from a wireless client. You'd need to look at how the RADIUS server and WLAN controllers are configured, or sniff a RADIUS transaction "on the wire between" the RADIUS server and a WLAN controller.

It could be that they've set the RADIUS session to expire in just a few hours, and that the default action is to ungracefully terminate the session, rather than gracefully asking for the client to reauthenticate. Or it could be that the RADIUS server isn't providing any guidance and the WLAN infrastructure is using some default value for how long to let 802.11 connections last, and what to do when they time out.

Speaking as someone with plenty of experience in both 802.11 and university networking environments, If I were setting up a university Wi-Fi network with 802.1X authentication, I'd make sure the timeout was at least 24 hours, and set to try to renew, rather than automatically terminate, when the timeout hits.

Answer 4

I really do not think the issue is on the client side considering everyone is having the same issue campus wide.

Here are some questions to ask the guys in charge of the wireless infrastructure:

How is NAT (network address translation) being handled? Are the routers handing out private (hopefully) ip address blocks? By private I mean

10.0.0.0 - 10.255.255.255 (Class A)

172.16.0.0 - 172.31.255.255 (Class B)

192.168.0.0 - 192.168.255.255 (Class C)

What chunks of this IP address space are they using? If you are talking about a large college campus and the IP address space needs to span the entire campus, I suggest using the 10.0.0.0 network due to the number of hosts that are available to this block.

The issue could very well come down to the fact they might be using the default IP address values (knowing the model/make of the router(s) would be nice).

How long are the DHCP leases set for on this network? Basically how long will a computer hold on to its assigned IP address before it will renew it's IP address. If you open a command prompt in windows and type ipconfig /all you can see how long the lease time is

There is a possibility that someone has misconfigured the DHCP renew time (I think the default is 8 days). It very well could be set to 20 minutes or some other totally insane value.

Which wifi technology is in use at this campus? Are the routers multi-band (meaning they do 802.11 A, B, G, N)? Which channels are they using? Are there any sources of interference such as microwave towers, satellite dishes, or anything that generates radio waves that could be causing connections to drop?

Here are some links that should be of some use to your two man IT dept

http://en.wikipedia.org/wiki/Private_network

http://www.subnet-calculator.com/subnet.php?net_class=A

http://support.apple.com/kb/ht1365

http://en.wikipedia.org/wiki/Electromagnetic_interference_at_2.4_GHz

To address what tools you can use to monitor the network to see what is going on it really depends on your comfort level with looking at internet traffic.

Some possibilities are Wire shark (http://www.wireshark.org/) which you could setup to filter and show you only DHCP requests with the following filter

port 67 or port 68

or

bootp

would also work

I am going to have to refer you to google for any further Wire Shark related info, it is a very involved tool.