Unexpected RX reason 22

[DarkLion]

Can anyone tell me what these log entries mean and if they are a serious problem?

Jul 24 15:21:53 RT-AX86U kernel: CONSOLE: 085338.305 Unexpected RX reason 22 {if=wl1 fc=420b seq=c505 A1=f0:2f:74:92:..:.. A2=41:bc:91:55:3b:67}
Jul 24 15:21:53 RT-AX86U kernel: CONSOLE: 085338.332 wl1: wlc_recv: dropping a frame with invalid src mac address41:bc:91:55:3b:67

This is flooding my registry with thousands and thousand of entries!

The first MAC address A1=f0:2f:74:92:..:..... (...censored) belongs to my main PC.
The second MAC address A2=41:bc:91:55:3b:67 does NOT exist in my network and is not even assigned to any vendor according to the site https://www.wireshark.org/tools/oui-lookup.html

Thanks for any help!

 

[L&LD]

Did you search first?

https://www.snbforums.com/threads/rt-ax86u-internet-crapping-out-after-using-homepod-minis.72894/post-692448

Is one hit I found instantly.

 

[DarkLion]

Did you search first?

https://www.snbforums.com/threads/rt-ax86u-internet-crapping-out-after-using-homepod-minis.72894/post-692448

Is one hit I found instantly.

Yes, it was the first thread I read! (and some others, few and without clarifying answers )
But unfortunately it doesn't totally apply to me in any way because I don't have any apple devices! (from the thread: "and they are related to the two Apple Homepod Mini's I have")
Then in the last posts it is clear that the solution was to do a factory reset and i would like to avoid it if possible.
However, I'd like to know what those messages mean and especially where the hell does MAC address 41: bc: 91: 55: 3b: 67 come from for the sake of research and curiosity

 

[ColinTaylor]

The first MAC address A1=f0:2f:74:92:..:..... (...censored) belongs to my main PC.

I think you'll find that particular MAC address is one of the WiFi interfaces on your router.

I've seen the same messages but only a few times and with various different MAC addresses, some valid and some invalid.

 

[L&LD]

Wait until someone posts the reasons for your curiosity.

But waiting to do a full reset isn't helping you at all.

Fully Reset Router and Network

Best Practice Update/Setup Router/AiMesh Node(s) 2021

 

[DarkLion]

I think you'll find that particular MAC address is one the WiFi interfaces on your router.

I've seen the same messages but only a few times and with various different MAC addresses, some valid and some invalid.

No...checked now and the wifi and eth interface of ax86u it is obviously the same prefix as my motherboard which is Asus
F0:2F:74:xx:xx:xx -> Eth
F0:2F:74:xx:xx:xx -> Wifi 2.4
F0:2F:74:xx:xx:xx -> Wifi 5

A1=f0:2f:74:xx:xx:xx A2=41:bc:91:55:3b:67

A1 is my main PC Asus Motherboard eth.
A2 is a "cursed" mysterious mac addr coming from nowhere!

#edited for correction!
A1=f0:2f:74:xx:xx:xx corresponds to Wifi 5 interface!

 

[DarkLion]

Wait until someone posts the reasons for your curiosity.

But waiting to do a full reset isn't helping you at all.

Fully Reset Router and Network

Best Practice Update/Setup Router/AiMesh Node(s) 2021

Yes ok, but restoring router to factory settings is a tedious job because you have to re-enter the various settings...
And in any case it does not seem a solution to ignore something that is not understood.
It's like saying that if you've cut your finger and can't stand the pain, then cut your hand and you won't feel pain in your finger anymore!

 

[L&LD]

No, that is not a good analogy.

When flashing newer firmware, a full reset is (sometimes) required depending on the network environment, the devices used, and how the network is expected to run. In your case, a reset is the solution.

Setting up a network is a 15-30 minute 'job'. Far from tedious for a stable, fast, and secure (as possible) network. If you're customizing your consumer router that much for your home use, that's on you, not on what a stable network requires with these resource-limited devices.

 

[DarkLion]

No, that is not a good analogy.

When flashing newer firmware, a full reset is (sometimes) required depending on the network environment, the devices used, and how the network is expected to run. In your case, a reset is the solution.

Sorry, but from what did you deduce that I flashed the firmware recently? I didn't mention it ..
For clarity, the error was appearing from a couple of days, without flashing firmaware or changing any configuration on router.

Setting up a network is a 15-30 minute 'job'. Far from tedious for a stable, fast, and secure (as possible) network. If you're customizing your consumer router that much for your home use, that's on you, not on what a stable network requires with these resource-limited devices.

If i know what log error message means i can resolve perhaps the problem in 1 minute instead of 15-30 (or more) minute!!

If i cure/reattach the finger with the perfect and right cure to not feel pain anymore, don't need to cut the hand.. the analogy for me fits perfectly well!

 

[ColinTaylor]

No...checked now and the wifi and eth interface of ax86u it is obviously the same prefix as my motherboard which is Asus
F0:2F:74:xx:xx:xx -> Eth
F0:2F:74:xx:xx:xx -> Wifi 2.4
F0:2F:74:xx:xx:xx -> Wifi 5

A1=f0:2f:74:xx:xx:xx A2=41:bc:91:55:3b:67

A1 is my main PC Asus Motherboard eth.
A2 is a "cursed" mysterious mac addr coming from nowhere!

Well that's even more confusing then considering the error messages seem to be coming from the wireless driver.

 

[DarkLion]

Well that's even more confusing then considering the error messages seem to be coming from the wireless driver.

Oh boy ... sorry sorry sorry ... made a huge mistake, I saw wrong !!!

I double checked and the mac address f0:2f:74:92:.. is the macaddr of the 5 Ghz wifi interface!!

 

[ColinTaylor]

I double checked and the mac address f0:2f:74:92:.. is the macaddr of the 5 Ghz wifi interface!!

The RT-AX86U's 5GHz WiFi driver included in the current Merlin build definitely "needs work". The fact that Asus have enabled this extreme level of logging on 5GHz makes me suspect (hope) that Asus are aware there are problems and are using their customers as beta testers while they try and fix it.

When I briefly switched over to stock firmware, which has a newer codebase, I noticed that these sorts of messages are no longer there (or perhaps moved to a lower log level). Hopefully that means they've now fixed the problems rather than just hiding them and hoping nobody will notice.

 

[L&LD]

What work is needed? I have not seen any issues.

 

[ColinTaylor]

What work is needed? I have not seen any issues.

The primary problem I have is described here. That's the main "bug", there are other little things that are more like annoyances. For example the enormous number of log messages as described in this thread which renders the syslog next to useless. At the moment I can work around it so I'm just waiting until Merlin can incorporate the current Asus stuff into a future build before passing final judgement on this router.

 

[DarkLion]

In the meantime i turned off/on all my device using 5 Ghz channel and the infamous log message don't display anymore from about 1 hour... i continue to observe, let's see if the they come back...
Coincidence? I think not!

Stupid me, who turned off / on all devices almost at the same time (all connected to the same electrical outlet) instead of one at a time, could help me identify (if any) who was the culprit ..
The devices are: LG webOS TV, Chromecast-Ultra, Amazon Alexa, Nvidia Shield.

I reread the thread https://www.snbforums.com/threads/r...-after-using-homepod-minis.72894/#post-692448 and there is a link to an article about MAC Address Randomization here: https://blog.elevensoftware.com/how-mac-address-randomization-can-affect-the-wifi-experience

[a snippet of the article - bold highlight added by me]
In late 2019, Google released Android 10 which made MAC randomization the default behavior when both scanning for wireless networks and connecting to them. This was a major change that was intended to prevent tracking across networks.
[...]
There are well-known hospitality brands that have implemented automatic authentication programs for loyalty customers based on storing and recognizing a device’s static MAC address. In the hospitality and multifamily markets, the use of a static MAC address is far reaching in current network architectures.
[...]
MAC address randomization is the increasing trend of device operating systems using a random, anonymous device identifier instead of the real address when connecting to wireless networks. The goal of doing this is to increase user privacy by preventing network operators from being able track devices using the real address as a consistent device identifier.
[END of snippet]

Is there a possibility that some of my 5 Ghz device can utilize (for whatever reason that i don't understand considering that this tech is for privacy reason and from what i understand relate to utilizing PUBLIC wifi) this MAC randomization?

The silly question is : is this sort of "private" MAC address not identificable on OUI lookup database for a legit reason?

 

[thecheapseats]

<snip>... When I briefly switched over to stock firmware, which has a newer codebase, I noticed that these sorts of messages are no longer there...<snip>...Hopefully that means they've now fixed the problems rather than just hiding them and hoping nobody will notice.

this selective error-trapping on asus part is annoying and doesn't help anyone...

 

[ColinTaylor]

Is there a possibility that some of my 5 Ghz device can utilize (for whatever reason that i don't understand considering that this tech is for privacy reason and from what i understand relate to utilizing PUBLIC wifi) this MAC randomization?

My initial thought was that this is a mobile device (iPhone, Android, Windows) as those now randomise their MAC by default. Another possibility is a wireless repeater/extender that may do something similar depending on the model.

The silly question is : is this sort of "private" MAC address not identificable on OUI lookup database for a legit reason?

The addresses created are within the unallocated address range and therefore cannot be associated with a particular manufacturer's OUI.

 

[DarkLion]

My initial thought was that this is a mobile device (iPhone, Android, Windows) as those now randomise their MAC by default. Another possibility is a wireless repeater/extender that may do something similar depending on the model.

The error Unexpected RX reason 22 has not appearead anymore... i don't know what to think.. i suspect the cause was one of my device connected in 5 ghz, but now i can't see if don't happen again.. but prefer that don't happen
Could it have been a 5g connected device in my vicinity (a neighbor) that was misbehaving?

The addresses created are within the unallocated address range and therefore cannot be associated with a particular manufacturer's OUI.

For me in addition to privacy purposes on the other hand it is a generous help for hackers ... (I already knew that you could change the Mac address at will, even for example of your ethernet network card)

 

[ColinTaylor]

Could it have been a 5g connected device in my vicinity (a neighbor) that was misbehaving?

I really have no idea.

For me in addition to privacy purposes on the other hand it is a generous help for hackers ... (I already knew that you could change the Mac address at will, even for example of your ethernet network card)

It's probably of little benefit to hackers as they were already spoofing their MAC address anyway.