Could someone explain wireless kernel message "TKIP: received packet without ExtIV"

jschiwal · 12-17-2007, 04:30 AM

I am seeing the kernel message:
TKIP: received packet without ExtIV flag from 00:16:xx:xx:xx:xx

The MAC address is from someone else's router or wireless interface:

Code:

          Cell 03 - Address: 00:16:xx:xx:xx:xx
                    ESSID:"<hidden>"
                    Protocol:IEEE 802.11bg
                    Mode:Master
                    Channel:10
                    Frequency:2.457 GHz (Channel 10)
                    Encryption key:on
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 6 Mb/s; 9 Mb/s
                              11 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
                              48 Mb/s; 54 Mb/s
                    Quality=86/100  Signal level=-59 dBm  Noise level=-68 dBm
                    Extra: Last beacon: 52ms ago

I am using WPA_PSK on channel 11. Is this you would normally see from another wireless network on an adjacent network?

I think that the message is being printed by ieee80211_crypt_tkip.c

coferm · 12-17-2007, 09:35 AM

I see the same thing as you. I have not been able to figure out which machine is sending these packets. I know it is not the access point. It appears that I am getting around 100 of the errors ever 10 seconds. If anybody has any ideas what is going on, please let us know.

dmesg output:

Code:

[  790.432000] printk: 32 messages suppressed.
[  790.432000] TKIP: received packet without ExtIV flag from 00:14:bf:xx:xx:xx
[  794.732000] printk: 39 messages suppressed.
[  794.732000] TKIP: received packet without ExtIV flag from 00:14:bf:xx:xx:xx
[  799.752000] printk: 24 messages suppressed.
[  799.752000] TKIP: received packet without ExtIV flag from 00:14

(I am running Ubuntu 7.10 x86.)

Thanks! Matt

UPDATE: I found this link in which a person claims that changing the Channel their AP was using resolved the issue. I am at work and unable to change the channel my AP uses, so I cannot confirm this. I do believe this is quite possibly the solution though. I can verify that the MAC sending the bad packets is not a server or workstation in my office and thus it must be one in a nearby office. Could it simply be two Cisco/Linksys APs using the same channel that are seeing each others packets?

If anybody has the ability to change the channel and verify this problem stops, please report your results here!

jschiwal · 12-17-2007, 01:01 PM

I'm thinking it is noise from crosstalk. Perhaps the AP is in scanmode or maybe scaning for a WI-FI extender. I'm guessing. A better knowledge of the ieee802.11 protocol is probably needed.

I'll see two a second, and then two more after around 5 seconds. I am seeing it from a single AP which is on an adjacent channel. I'll probably change the channel anyway because someone else is using ch. 11 now.

I couldn't find info using google. Mostly ubuntu users submitting bug reports.