真的很牛逼！

2 minute read

Symptom

On the NUC, iwl8265 reached wpa2=ok — yellow logs showed assoc and handshake — but DHCP stayed no offer. Sometimes the discover left (dat=tx / dtx=0201); RX was a string of rx=mic o. Tray said up; address stayed 0.0.0.0. Class goal was plain: home WPA2 → lease → ping gateway. Stuck at “associated, no lease.”

First hypothesis

Two usual lines: GTK never unwrapped, so a multicast Offer cannot decrypt; or data queue / rate / QoS headers wrong so the discover never leaves firmware. Early knives piled into EAPOL, queues, GTK unwrap, host CCMP, and ADD_STA_KEY.

Tries and failures

Queues and station types: wrong queue blocked EAPOL; the right queue finally got wpa2=ok. Negated “we can never send mgmt/data”; DHCP still broken.

GTK was worse: gtk=ok yet multicast mic o; firmware keys left ugly status bits; forcing STA RSN group cipher to CCMP made the AP refuse the handshake (m1to / wpa2=fail). Useful: assoc=gc=02 proved the home AP’s beacon group suite is TKIP. Negated “force assoc cipher to change the AP’s group crypto” and “shove DHCP Offer onto the group key and call it done.”

Another knife set the DHCP discover broadcast flag, hoping Offer would ride the “already unwrapped” multicast path. Still no rx=off — more mic o / disc. Broadcast-flag hypothesis out: on this mixed-mode AP, multicast DHCP is not a reliable delivery plane.

Turning point

Admit mixed mode: unicast already has PTK/CCMP; product-grade GTK/TKIP multicast decrypt is out of class scope. DHCP should not gamble on multicast — Offer must ride unicast PTK. The move is not more wireless key thrash; clear the broadcast flag on the lwIP DHCP discover so the server unicasts the Offer.

Root cause

One line: clear the DHCP broadcast flag; Offer uses unicast PTK. With assoc=gc=02 (beacon group TKIP), setting the broadcast bit pushes the lease onto a multicast plane we cannot cleanly decrypt. Cleared, Offer lands on PTK/CCMP unicast; the host stably sees rx=off, then ok ip=…, then ping gateway replies. Leftover multicast mic o can be ignored — it no longer blocks the class path.

Lessons

  • Associated ≠ addressed; watch rx=off / ok ip=, not only wpa2=ok.
  • On mixed-mode APs, book TKIP multicast and CCMP unicast separately; forcing RSN group CCMP can kill the handshake.
  • Do not silently retry falsified paths (broadcast-flag multicast Offer, forced CCMP group).
  • If third-party stack flags live in a gitignored tree, confirm the broadcast bit is really clear before build/sync — “source looks right, image still wrong.”
  • Wireless knife logs can be long; the bar is still real-machine ping to the gateway, not yellow-log count.

Updated: