The rekey interval is probably set to 3600 seconds, something dumb breaks after the 10th rekey (36000 seconds), and so when the 11th rekey interval comes around at the 11th hour (39600 seconds) and it hasn't re-key'd, the authentication ends up no longer valid and it disconnects.

Easy way to test this theory:

Set the re-key interval on the AP to like 10 seconds, see if it disconnects after 110 seconds.

() I've only seen misbehaving clients since the EAP fixes to this functionality in hostapd years ago, where btw there's a whole pile of discussion on this issue through the last decade or so.

Hard to say though since no obvious counter comes out to 11 hours. That being said, a counter of some kind going wrong would be the most obvious reason to experience an issue. Maybe there’s a WiFi frame counter that participates in ratcheting the key used to encrypt each frame or something.

A 32-bit unsigned integer would roll over after ~42949 seconds used as a 10 µs counter. That's just shy of 12 hours at 11:55 and change, not just over 11.

then again, thinking about code with timestamps in float makes me scared

Basically every possible edge case came up: floats can be infinity, negative infinity, negative zero, NaN, and even subnormal. The bulk of the problems occurred because we deserialized the float timestamp and proceeded to do unchecked math on it, then expected it to be a normal value.

Of course when I search on DDG I only get "wow the fast inverse square root"

  john carmack time double

Vendors care about only two things: (1) Cost (2) the Gbps they can print on the box.

So today that means 802.11ac and WPA2, unfortunately.

Stability of the software is not a consideration.

One of those sites is my home, another my brother's home and another my dad's and another is at work. At least one of the others, you might have heard of.

I'm not quite so jaded as @roboman. I suggest you keep up with the Joneses. The latest is wifi 7 and if we get a bit conservative, we might consider 6 as current and hence the advice is stick to wifi 4!

That's not my advice. I suggest that we embrace the latest stuff and learn how it works. If necessary you can always spin up another SSID with special properties.

I've got devices from fridges to ESP80266 wired thingies and laptops and phones and whatever all working fine.

I'd even go as far as to say we had as many client tickes from bugs about old hardware from 2 standards (~10 years) ago that weren't receiving patches anymore as we did from the new hardware but at least the new stuff was still getting patches.

That said once you go to consumer/prosumer hardware I'm convinced everything has a litany of bugs that have no hope of getting meaningfully fixed regardless which version you use. For 99% of use cases it'll work fine enough and that's all any vendor selling it will care about, new or old. Often Qualcomm/Broadcom/whoever-made-the-actual-wifi-chip-com will have patched things consumer APs and devices won't have actually updated to anyways.

I’d imagine that every single thing that could happen to an AP would happen.

What hardware did you use?

As far happenings to APs I'd say 90% of the time it was one of two classics on infinite repeat:

- (Particularly after a new install) "This AP near my work desk and I've been having headaches ever since" -> "We'll try turning it off, let us know if things stayed the same or got worse" -> we actually turn the LEDs off and leave the Wi-Fi on at first -> They mostly never follow up, if we do they say things are great. There were a few occasions they'd follow up and we'd really turn the AP off but it never resulted in anyone being able to tell when the AP was on or off without us telling them (or a few who knew enough to check the RSSI near the AP of course). The "happening to the AP part" was there were sometimes people would just take them down (you just need a ladder and then spin it unless you put every AP in offices in an enclosure) the AP as the first step and then we'd get outage alerts thinking it had just died.

- (Particularly by maintenance crew, presumably since they had the ladders and comfort level in taking things apart during work) we get an alert that an AP in a warehouse/break/hidden-office-cubby/etc area is down so send someone out -> arrive and maintenance person says the Wi-Fi has been bad today -> See the AP is not physically there, ask where they put it -> "Oh you mean this? I thought they were putting up a security camera to watch me work".

Neither of these things were particularly common at the individual level but when you have 36,000 you refresh every 5 years somehow it becomes something that happens somewhere every week. The other 10% is boring stuff, APs being ripped off by someone pushing a tall cart down the hall, someone decorating the APs with aluminum foil to make the hall look like it has disco balls, water/sewage leaks taking out a ceiling of APs because someone broke a toilet. For the most part these were extremely rare and I don't really blame people often ('cept the toilet one). E.g. you've got a bunch of old patients and try to make a disco hall, you're a good person - just know that'll kill your and the patient's Wi-Fi or you're just trying to get shit to where it's supposed to be and you stacked it on this thing too high - don't blame ya for being in a rush but keep safety #1 it could have easily been a different accident having stuff that high rushing down the hall.

But we could also count like: 5, 5 Wave II, 6, 6E, 7.

In this case, 2 generations behind would be either Wi-Fi 5 Wave II or Wi-Fi 6. Those are both quite good! My workplace is just deploying Wi-Fi 6 now, and at home I still have Wi-Fi 5 Wave II.

Unifi tends to be a bit divisive in forums such as HN and r/networking and even their own forums! The wailing and gnashing of teeth at every version update is quite something to behold.

For me as an old school sysadmin, running a Linux VM as a Unifi gateway is fine and has been for years. I treat it with respect and read change logs and I have decent backups and so on.

The vast majority of my customers and my already installed gear is wifi5 and any new APs are 6 by default. I'll wait for 7 devices to actually be available but it doesn't bring much to the table. Wifi 6 with the addition of 6GHz was a major upgrade, 7 not so much.

My phone now has way more bandwidth to my home LAN via wifi than the LAN itself! It can use 2.4/5/6 GHz and each band has more than one MIMO. Its not quite that simple but I will be grabbing some 2.5 or 10Gb LAN switches soon. At work 10Gb with 40Gb uplinks is generally indicated ...

https://www.destructoid.com/oopsies-ign-watermark-on-the-cov...

https://www.youtube.com/watch?v=R_GdJiEjSho

Spelling error is at 5-8 seconds in. As that is kinda the first thing you see, it is quite noticable.

You can choose current-generation hardware from a company that chooses to implement less advanced wireless specifications. For example, the gl-inet Flint 2 (MT-6000) runs a fork of OpenWRT out of the box and can be flashed with stock OpenWRT snapshots. That's a very modern piece of hardware that will do wifi 6 (not wifi 6E/7).

So hardware-wise you get the current gen, software-spec-wise you get one generation behind. I don't think practically speaking you're going to feel much pain from using Wifi 6 for the next few years, as it can saturate a 1Gbps link pretty easily.

But it’s nice when your Wi-Fi is just a dumb box with almost no settings that you can upgrade independently.

Currently I have 3 TP-Link AC routers running OpenWrt, RPi 4 running OpenWrt for the router.

Other than that, how was the play Mrs Lincoln.

Why not name it?

besides the algorithmic stability, the new radio bands or their combinations still have merit fwiw.

The nice thing about the newer 2 is 6ghz, for people in highly congested areas. I live on an acre and pick up tons of 2.4ghz, some 5ghz. I can't imagine how bad it would be in a modern tract home development, or worse, a large apartment complex.

When I was still at university, just walking out of my studio appartement and closing the door would already drop my 5GHz signal a good bit. Open the door, much better.

Unfortunately, this also means I'm competing with nearly a hundred different APs in the apartment alone - of which many broadcast in both 2.4GHz and 5GHz - to the point that my Macbook less than a meter away from the router still takes a hot minute to automatically find the AP unless I manually select it.

Of course the -real- benefit to upgrading early is that you'll likely have the 6ghz space to yourself for a couple years.

I do suggest using the latest generation client chipsets with driver support in your OS, though. Whether or not a newer client radio talks to a similarly capable AP, it is likely to have better receive sensitivity than older radios.

I also suggest specifically buying Intel client radios. I have first-hand benchmarking experience that shows that Intel radios are very good at receiving marginal radio frames in heavily congested environments. Qualcomm and Broadcom radios might be just as good, but I wasn't able to evaluate them for lack of driver support for my purpose. Realtek/Mediatek/Ralink radios have pretty good drivers, but the actual radios behave notably worse with congestion. I've had friends living in apartments take my advice and switch from Realtek to Intel, and they've reported back significant gains in wifi stability. I'll also note that the original Steam Deck has a Realtek radio, and many people complain about its mediocre Wifi performance. Some people have gone as far as hot air reworking their Decks to have 802.11ax Intel radios, which happen to be pin compatible.

Are you suggesting there are some good cheap APs that can readily do WDS with more than two spatial streams, or wider channel bandwidth? That could be fun to play with, although at this point my WDS link is just for the lols because I've since run cat6 between buildings...

Yeah. I'm pretty sure that I've seen a toggle-able option in some home user routers for them to automatically reboot themselves once every um... day (or some other time period).

Like "we can't be bothered tracking down the memory leaks in shipped software, so lets just implement an auto-reboot of the router".

It's both funny and tragic at the same time.

My wifi router had a bug that was eventually fixed, but before that I would need to reboot it every hour. That's a simple workaround - if only there was a setting for that.

https://news.ycombinator.com/item?id=35986375

It won't allow every hour though. The options are either daily, weekly, or monthly, and you can set the exact time.

It doesn't seem to allow for more than one reboot schedule either, so it wouldn't be possible to set (say) 24 different daily schedules 1 hour apart as a workaround.

One generation behind is usually where you want to be because your clients usually haven’t caught up anyway.

It seems like most people don't necessarily care per se about wifi performance because you can stuff an AP every 30 ft and call it a day.

Most MSPs seem to become a shop of some kind based around a hardware that isn't necessarily the most performant, but good enough, cheap, easy to manage, etc. (lots of UniFi shops even though I don't consider it a good solution).

In terms of performance, though, I live in a very high density apartment so I have a niche use case: I've been trying to find the access point.

So far, ruckus has been outperforming every other access point I've tried (Aruba, Unifi, extreme, etc.)

I can't find any reliable data on whether or not Ruckus is just literally the best access point, and I still consider myself in the researching phase.

Is there industry knowledge to the contrary? Are there any actual engineering standards that companies aspire to, or is it just a "most people don't measure this, so whatever" industry?

I’d recommend looking at Juniper Mist for high congestion areas because their auto mode actually works and adapts to changes in the environment.

I do have to ask though, do you really need enterprise Wi-Fi? It’s not very neighbourly but buying a high end consumer Wi-Fi router that lets you pick DFS channels, picking the least congested channel, and setting transmit power as high as it will go should do the job in an apartment.

You should visit Chicago some time.

Do I actually need it?

Eh, no, I suppose.

But I can't stop myself from not doing it.

Also, in terms of tangibility, my 2.4ghz is so abysmal due to congestion I'm willing to do anything to maximize it. Even Aruba falls flat with this band but Ruckus does an *okay* job. It's obvious that AP performance is a factor here.

My 4x4 Wifi 6 Aruba 535 gets completely shut out by a 2x2 beige colored clunker Ruckus 510 that I got for $40. It's obvious that price, features or "newness" aren't things I can rely on to give me a good picture.

Aruba outperforms my other models -- I've spent a lot of money just testing this out myself using the use case of 40 competing SSIDs.

(According to my research juniper doesn't perform particularly well. Check the Packet6 report that Ruckus cites. Probably biased, but what else is there? "Data sheets" that don't really say much about anything. I havent purchased a test AP, though.)

No way the big hospital systems / robot warehouses don't light people (VPs and up) up over flaky wireless.

Economy of scale does take a generation or two to get behind in general. Wifi, EV's, heck even apple refurbished macbooks are cheaper because there are more of them (as they are from an older generation).

So "being N generations behind latest tech" is solid advice in general is my point. Thanks.

Mesh, however, it is not about roaming (i.e. multiple APs with same ssid, clients connects to preferred one). Mesh is a topology thing (nodes come and go), wireless mesh also means wireless uplink (i.e. the AP you are connected to itself talks to its uplink wirelessly). These are things you use only if you cannot avoid them; metalic connection to each AP is way more reliable.

WPA3 is only required when operating on the 6ghz bands.

For 802.11ac/ax its not required on the 5ghz bands.

So it is possible to spin up an AP on 6ghz with SAE only, and another AP on 5ghz in WPA2/3 mixed mode. It's not an all or nothing choice for the pi which first of all only supports 802.11ac and secondly does not support 6ghz with the builtin wifi card.

In terms of range and capabilities we've found the mt76 series to be very reliable and support wifi6 and 6-e on the pis with speeds easily reaching 600mbps.

These are the A8000 cards from netgear and the ALFA AWUS036AXML. They're pretty good for what they are. I only wish they were Dual Band Dual Channel.

WiFi 7 will see clients gaining Multi Link Operation capability, they'll be able to simultaneously hit 5ghz and 6ghz and 2.4ghz bands for 2-3x throughput.

> Encryption keys should be changed (or rotated) based on a number of different criteria: (...) After the key has been used to encrypt a specific amount of data. This would typically be 2^35 bytes (~34GB) for 64-bit keys and 2^68 bytes (~295 exabytes) for 128 bit keys.

* https://security.stackexchange.com/questions/259808/why-shou...

Though this would be bit-dependent and not time-dependent.

I'm guessing that this likely some kind of 'uptime bug':

* https://en.wikipedia.org/wiki/Integer_overflow

To be honest, whoever wrote that bit of the spec should have 'probably part of a three letter agency, don't trust what they say' to the top of their Wikipedia page.

The current version of that page reads as:

> This would typically be 2^35 bytes (~34GB) for 64-bit keys and 2^68 bytes (~295 exabytes) for 128-bit block size.

So it's sloppy writing that's the issue, not that people are still using 64-bit keys. (I had a similar question reading the quote above and followed the link where this was pointed out.)

And if you squint, a stream cipher is just a block cipher with a stupidly large block.

"We" are not, and it is not. That is just a general example of the concept of needing key rotation.

The encryption algorithms themselves, if they're even written in a high level language rather than supplied as machine code, perhaps using hardware acceleration, may treat this some other way, but that's completely irrelevant to you in the rest of the code. Maybe it sees this as [u16; 8] or as [[u32; 2]; 2] for some reason, you don't care.

I found that extending the rekey interval makes it happen less. I think i set the interval to something very large

[0]: https://support.apple.com/en-us/102228

Are they so complicated that we can't get a open hardware pcie adapter?

The law states that "an intentional or unintentional radiator must be constructed such that the adjustments of any control that is readily accessible by or intended to be accessible to the user will not cause operation of the device in violation of the regulations" (https://www.law.cornell.edu/cfr/text/47/15.15 )

So if the manufacturer makes a device where changing the firmware is "readily accessible" to the user and there is an open source firmware available that can circumvent the FCC transmission restrictions (for example, change the power limits or channel limits for wifi physical layer), then that would be grounds for FCC refusing to certify that device, as it is not permitted to make, import or sell general unrestricted transmitters to the general public (there are certain exceptions for licensed operators, ham radio, experimental use by manufacturers etc).

It's similar to other clauses that prohibit manufacturers from making it easy for the user to modify the equipment - e.g. 15.203 (https://www.law.cornell.edu/cfr/text/47/15.203) "the use of a standard antenna jack or electrical connector is prohibited." so that the user can't easily replace the antenna with a different one from what was certified.

Now sure, maybe you can convince your closest 10 dozen friends interested in open source hardware to not put everything on one person but at the end of the day there are a few people it's going to be a significant burden on and they have to see it as a worthwhile burden otherwise nobody is going to run the project. It'd probably be easier (though not easy) to stir up enough support to convince an existing manufacturer to make their firmware open source instead.

https://wiki.debian.org/Firmware/Open#Radio

There is also some FPGA based open source WiFi SDR things:

https://github.com/open-sdr/openwifi

> My conclusion: this entire ecosystem is deeply cursed

There is no curse, but cheap junk sold for premium price! Those components are designed for cheap laptops and tvs. Building networks and servers out of this foolish!

If you want stable WiFi, get Intel card connected over Pcie, not USB! It is like 20 USD with official WPA3 support!

Broadcom is famous for their terrible Linux support (typical android style binary firmware blob dump). Many drivers are unofficial, only reverse engineered. Some commenter here even mentions patching binary blobs to fix issues!

Murata Type1GC mentioned here, goes back to 2015. It also has several compromises to keep size small. Hardly stellar config!

What would you recommend instead that fulfills a similar role?

It is quite possible unit is fine, but there is just interference at your place. Those small antennas are not good at dealing with it.

bottom barrel price hardware components usually mean top quality component that failed QA and then went on a lower quality bin and then passed QA there.

it's not a different design or anything. the car analogy would be all factories making only 4x4 cars and the cheap cars just being the 4x4 with the trans axle broken or something, resulting in two wheel drive (doesn't even care which two wheel because the cheap bin QA just test if the car moved). you probably got a chip with two trans axle broken and the chip limped with one wheel drive thru QA and they called it a day.

thanks artificial Monopoly protections via bogus IP laws.

[0] - https://www.broadcom.com/products/ethernet-connectivity/swit...

There's always WINC1500 or ESP-AT if you want your product to be trapped in the stone age.

"Who were you, DenverCoder9? What did you see?"

* https://xkcd.com/979/

You have a problem. You get a Google hit to a Reddit post. The top-voted Reddit comment has replies saying "That worked! Thanks!". But the comment with the answer is deleted, or replaced with boilerplate text protesting Reddit enshitification (and sometimes also advertising the automated tool to do this scorched-earth redaction yourself).

Like both Reddit and the poster with the answer once at least partly understood the altruistic open-sharing global good that the Internet could be, but then they both forgot, or decided other things were more important to them.

Fortunately, you can sometimes recover the answer from archive.org.

One day we will have an "XKCD number", to represent how far from an XKCD reference any existing concept is.

You should submit a Hacker News post for it!

That would be XKCD velocity, I guess.

According to XKCD’s law, the probability to have an xkcd reference is proportional to the number of comments (see https://ploum.net/xkcds-law/index.html )

But adding velocity is really nice. Should think more about it…

The employees of the company are much better equipped with all the insider knowledge, blueprints, source codes et cetera. But the incentive models for companies essentially guarantee that they'll never go through the trouble of solving a persistent problem for an already-on-the-market product, if the problem is not big enough to cause a recall or substantial numbers of product returns

So our only hope is some amateur sleuth operating from home, stabbing blindly at the card with caffeine and hatred as the only tools in their disposal. But they'll probably solve it, and we'll get to read a cool blog post about it!

I ended up just using WPA2, as I don't have any 6GHz or WiFi 7 APs.

Even a 'no' to this question would be a useful addition to this article.

x86 routers are great. x86 phones aren't awful, and could have been amazing if Intel didn't cancel them right before Microsoft released Continuum.

Not sure if I've seen a smart thermostat on x86, but I dunno sure, as long as its got a common wire do it can pull power, should be fine.

And yeah, I do in fact have an x86 router: it's probably going to last for a decade, with software updates and all.

In 2013, Intel made an attempt to make x86 suitable for embedded purposes with the Intel Quark microcontroller:

> https://en.wikipedia.org/wiki/Intel_Quark

and branded developer boards for it under the name Intel Galileo:

> https://en.wikipedia.org/wiki/Intel_Galileo

As far as I aware the markets rather preferred existing microcontroller solutions instead of Intel's offer.

Intel did go far in set top boxes and smart TVs with their atom/canmore (SoC, not MCU) platform in ~2008 and onward. I ported some media software to it. I think a lot of that has been given back to ARM and Android since, however.

Eating up life-cycles with broadcom/infineon issues sounds like one of the circles of hell , personally.

And the Pi is not the only thing to use that chip, it’s just very popular.

So even if one’s attitude is “get a real computer” like the first post in this thread you may still find yourself with this same chip.

1. The chip works perfectly but it's documented badly/ wrongly, e.g. doesn't spell out the whole strategy needed for a periodic key renewal or does so confusingly - driver is written to match the docs or at least the best understanding of these docs, and unfortunately this defect arises after 10 hours but devs with the actual docs have never tested for that long.

2. The chip has a bug, it's not possible to use it correctly per se. Every few hours, just reset it and start over, thus a "good" driver should do resets when quiescent. e.g. After 2 hours, if you did no work for 60 seconds, reset it, after 4 hours make that 15 seconds, after 6 hours, 5 seconds, after 7 hours immediately on quiescence, and after 8 hours just reset immediately rather than wait for the bug.

[Edited to fix numerous typographical errors]