Unknown MACIDs spamming my XT8 logs with Auth/Deauth_ind entries, no Assoc

[crawfish]

The MACIDs belong to "Tuya Smart", so I guess it's some neighbor's IoT thing? Entries are as follows and repeated many times:

Jan 30 06:11:44 wlceventd: wlceventd_proc_event(527): eth4: Auth xx:xx:xx:xx:xx:xx, status: Successful (0), rssi:0
Jan 30 06:11:44 wlceventd: wlceventd_proc_event(491): eth4: Deauth_ind xx:xx:xx:xx:xx:xx, status: 0, reason: Unspecified reason (1), rssi:0

I also found a final "Disassoc" entry, but I couldn't find any "Assoc" entries like I do for my devices that actually connect. These Tuya devices don't get an IP address from what I can tell. Any idea what's going on?

Jan 30 07:12:13 wlceventd: wlceventd_proc_event(508): eth4: Disassoc xx:xx:xx:xx:xx:xx, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0

 

[Tech Junky]

Could be a device using randomized MAC turned on for each connection attempt like a phone.

 

[crawfish]

I turned that off on my phone a while back, and when it was active, it didn’t use a macid assigned to a company, and it connected successfully to my router. This macid belongs to “Tuya Smart” like I said, and I’d like to be certain it isn’t getting onto my network, which I think is true since there are no “assoc” entries in the log or assigned IP addresses. However, I’m not sure what the log entries actually mean and am looking for clarification on these things.

 

[paulbates]

The associate / drop behavior is not uncommon for smart home end devices, I have thermostat remote sensors that behave that way, its to save battery... I don't know why it's picking your SSID, maybe a neighbor accidently clicked your ssid configuring a device?

 

[crawfish]

That's what I figured happened. I'd still love to read an explanation of the log entries, the significance of "Auth" and "Deauth_ind" vs "Assoc" and "Disassoc", and how I could get a "disassoc" without a preceding "assoc".

 

[Tech Junky]

"disassoc" without a preceding "assoc".

A device could be hitting you with FIN packets just looking for a response. Or someone playing with a WIFI sniffer and sending probe packets.

 

[paulbates]

The associated versus authenticated is a matter of the client seeing the SSID and attempting to connect to it (assoc), versus being challenged to provide credentials to access the network (auth)
I don't know, can't guess why you're seeing only disassociated messages sometimes.. I've seen it myself