The wireless user is disconnected abnormally and the communication is unstable

Hello, guys
I found that my wireless user is disconnected abnormally and the communication is unstable.
about this situation, what can I do ?
and what should I check ?

Possible Cause

(1) The keepalive page is closed.

(2) The wireless signal is weak.

(3) The rogue AP has enabled the countering function.

(4) There is serious same frequency interference.

(5) The wireless network has ARP attacks.

(6) The problem is caused by the wireless NIC.

(7) The performance of this version is unstable.

Step 1: Check whether the keepalive page is closed (applicable for first generation Web authentication)

Check whether the AC enables first generation Web authentication. Currently, most mobile terminals do not support multiple processes. When another page is visited, the keepalive page is automatically closed. In this case, disable the page keepalive function of the Eportal serveror change the authentication mode to second generation Web authentication.

Disable the traffic keepalive function on the Eportal server

If the traffic keepalive function is disabled but the problem still persists, go to Step 2.

Step 2: Check the signal strength of the wireless network

On the AP, run the show dot11 associations all-client command to display the RSSI value. If the RSSI value is lower than 20, the strength of the STA signal received by the AP is lower than the threshold value. You can adjust the RSSI threshold value to a smaller value to improve the access stability. If the wireless network connection is still unstable after adjustment, the wireless signal is too weak. The root cause is the small signal coverage. You can improve the signal coverage by adding more APs, changing the omni directional antenna to adirectional antenna, moving the AP closer to the STA, or changing the ground-mounted to an i-Share AP. If the network connection is still slow after the RSSI value is modified, go to Step 3.

Step 3: Check whether a rogue AP has enabled the countering function

If the AP signal is strong but the STA is still disconnected from the wireless network and the STA status displayed on the AP is still Online, it is greatly possible that a rogue AP has enabled the countering function. All other APs except for the client's AP are rogue APs,including the D-Link or TP-Link APs deployed by the students. If the wireless packet capturing NIC (Cisco Linksys AE1000) can capture packets from the wireless network, the AP enabling the countering function often broadcasts agreat amount of disasociation or deauthentication packets, as shown in the following figure.

The rogue AP makes the wireless RF environment uncontrollable and need to be disabled. If the wireless network connection is stable after the rogue AP isdisabled, the problem is caused by the countering function of the rogue AP. In this case, disable the rogue AP or the countering function. If the connectionis still unstable after the rogue AP is disabled, go to Step 4.

Step 4: Check the existence of same frequency interference

Use WirelessMon or other wireless scanning software to scan the current RF environment to check the existence of same frequency interference (when the channel of multiple APs is 1, 6, or 11 simultaneously and the signal strength is above -75 dBm). If there is same frequency interference, change the working channel of the wireless network to a channel of a different frequency. For example, run the following command to adjust the channel of Radio1 to channel 1. If the wireless network connectionis stable after adjustment, the problem is caused by same frequency interference. If the wireless network connection is still unstable, go to Step5.

(The channel 1, 6, and 11 can be used. For a 2.4 GB network, the channels can not be repeated. You can use the three channels for the best effect.)

Step 5: Check the existence of ARP attacks

Log on to the gateway deviceto view the gateway MAC address. If the wireless network is disconnected, runthe arp –a command to see whetherthe gateway MAC address is changed. If yes, the network has ARP attacks. Inthis case, bind the static gateway address arp -s 192.168.33.1xx-xx-xx-xx-xx-xx on the DOC or enable anti-ARP attack function on the network.. If the network has no ARP attacks but is still disconnected, go to Step6.

Run the following command if the gateway isdeployed on a switch:

SW#show interfaces vlan 10

Index(dec):4106 (hex):100a

VLAN 10 is UP  , line protocol isUP   

Hardware is  VLAN, address is 0000.5e00.0185 (bia 0000.5e00.0185) //Displays the MAC address.

Interface address is: 192.168.33.1/24

ARP type: ARPA, ARP Timeout: 3600 seconds

  MTU 1500 bytes, BW 1000000 Kbit

Step 6: Check the wireless NIC

If the problem persists after the above steps, the wireless NIC may be the cause. You can either connect to the wireless network from a laptop or upgrade the wireless NIC driver to the latest official version. The latest wireless NIC driver can be downloaded from the official website or by the downloading software such as Driver Genius. If the problem is solved after you connect to the wireless network from a PC or updatethe wireless NIC driver, the problem is caused by the wireless NIC driver. If the problem still persists, troubleshoot the problem further.

Step 7： check whether the versions of AC and AP are the latest or not.

Go to AC, and input the command show version all and show version to check the versions of ap and ac, if they are not in the latest verison, please upgrade them. If the problem still exists, please contact our online support for help.