MAC LayerL2

Status & Reason Codes

STATUS CODES - IEEE 802.11-2020 Table 9-50 | Returned in Auth / Assoc / Action responses | Wireshark: wlan.fixed.status_code34 rows#

Code	Name (spec)	Meaning	Escalation Engineer Notes / Common Root Cause
0	SUCCESS	Operation succeeded.	The only good status. Anything else in Assoc/Auth Resp = investigate.
1	Unspecified failure	Generic failure.	Vendor catch-all - check AP logs, often RSN/capability parse issue.
10	Cannot support all requested capabilities	Capability Info mismatch.	Client requested capability bits AP cannot honor (e.g. short slot).
11	Reassociation denied - no prior association	AP has no context for reassoc.	Client roamed but target AP lost/never had its entry - client falls back to full assoc.
12	Association denied - outside scope of standard	Vendor/policy denial.	Commonly used by band-steering / load-balancing features to push a client away.
13	Unsupported authentication algorithm	Auth alg number not supported.	Client tried SAE (3) on WPA2-only AP, Shared Key (1) on open, FT (2) without 11r, etc.
14	Auth transaction sequence out of order	Auth seq number unexpected.	Retry storms or state mismatch after interference; also SAE confirm before commit.
15	Authentication challenge failure	Shared-key WEP challenge failed.	Legacy WEP only. In SAE, wrong password surfaces as failed Confirm or 4-way timeout (Reason 15) instead.
16	Authentication timeout	Peer too slow.	AP-side timer expired waiting for next auth frame.
17	Association denied - AP capacity	AP cannot handle more STAs.	Max-clients-per-radio/BSS reached - check load balancing settings.
18	Association denied - basic rates	STA does not support all BasicRates.	Classic: AP requires 24 Mbps basic, legacy client only 1-11. Check rate config.
19	Association denied - short preamble	Legacy DSSS preamble mismatch.	2.4 GHz legacy interop.
25	Association denied - short slot time	2.4 GHz slot-time capability.	Legacy interop.
27	Association denied - HT features	STA lacks required HT support.	AP set to HT-required (greenfield/N-only).
30	Association rejected temporarily	Try again after comeback time.	SEEN WITH PMF: AP in SA-Query with that MAC - client must wait Association Comeback (TIE type 3). Also used by steering.
31	Robust mgmt frame policy violation	PMF policy mismatch.	MFPR/MFPC conflict - e.g. client no-PMF on WPA3 (PMF required) network.
32	Unspecified QoS failure	Generic QoS.	-
33	Denied - insufficient bandwidth (QAP)	Admission control full.	Voice/TSPEC admission (WMM-AC) limit reached.
34	Denied - poor channel conditions	AP judged link too weak.	Some vendors reject weak clients (RSSI-based assoc rejection).
35	Denied - not a QoS STA	QoS BSS requires QoS support.	-
37	Request declined	Peer refused (generic).	Common in ADDBA rejects - sender falls back to non-aggregated.
38	Invalid parameters	Request parameters invalid.	ADDBA with unsupported buffer size, bad TSPEC values.
40	Invalid information element	Malformed IE.	Fuzzed/buggy client IEs; interop bugs between chipset vendors.
41	Invalid group cipher	Group cipher mismatch.	RSN IE mismatch - e.g. client offers TKIP group on CCMP-only BSS.
42	Invalid pairwise cipher	Pairwise cipher mismatch.	WPA3-SAE requires CCMP - client offering TKIP rejected here.
43	Invalid AKMP	AKM mismatch.	Client PSK vs AP 802.1X, missing SAE AKM (8; 24 = SAE-EXT-KEY) etc. Check RSN sheet AKM table.
44	Unsupported RSN IE version	RSN version ≠ 1.	Corrupt or nonstandard RSN IE.
45	Invalid RSN IE capabilities	RSN Capabilities field invalid.	Often PMF bit combinations (MFPR=1 with MFPC=0 is illegal).
46	Cipher suite rejected by security policy	Policy denies offered cipher.	WPA3-Enterprise 192-bit mode rejecting non-GCMP-256 suites.
53	Invalid PMKID	PMKID not found/expired.	PMK caching / OKC / FT failures - client cached a PMKID the AP no longer has. Watch after controller failover.
76	Anti-clogging token required	SAE DoS protection engaged.	NORMAL under SAE load/attack: client must repeat commit echoing token. Frequent = possible DragonDrain-style flood.
77	Finite cyclic group not supported	SAE group rejected.	Client offered SAE group AP disabled (19 = P-256 is the universal default).
82	Rejected with suggested BSS transition	Steering rejection + hint.	AP says "go to my neighbor" - pairs with a BTM candidate list (11v).
126	SAE Hash-to-Element required	H2E-only BSS.	6 GHz WPA3: hunting-and-pecking commit rejected; client must use H2E (see RSNXE bit 4).

REASON CODES - IEEE 802.11-2020 Table 9-49 | Carried in Deauth / Disassoc | Wireshark: wlan.fixed.reason_code32 rows#

Code	Name (spec)	Meaning	Escalation Engineer Notes / Common Root Cause
1	Unspecified reason	Generic.	Vendor catch-all - correlate with AP syslog.
2	Previous authentication no longer valid	Auth state expired/invalid.	Very common in roam/rekey races and after controller HA events.
3	Deauth - STA leaving (or has left) BSS	Sender is leaving.	Normal client-initiated disconnect (Wi-Fi off, roam away).
4	Disassociated due to inactivity	Idle timeout.	AP pruned a silent client - check idle-timeout vs sleepy IoT devices.
5	Disassociated - AP unable to handle all STAs	Overload shed.	Load-based disconnect; also seen during AP radar moves in some vendors.
6	Class 2 frame from nonauthenticated STA	Protocol state violation.	STA sent auth-required frame while AP considers it unauthenticated → classic sign of state mismatch after roam; triggers client full reconnect.
7	Class 3 frame from nonassociated STA	Protocol state violation.	Data from a STA the AP no longer knows - the #1 escalation reason code. Causes: AP reboot, roam race, deauth missed by client, controller failover.
8	Disassoc - STA leaving BSS (roam)	Sender roaming away.	Normal roam signal.
9	STA requesting (re)assoc not authenticated	Assoc before auth.	State machine violation - see STA State Machine sheet.
10	Power Capability unacceptable	11h power mismatch.	-
11	Supported Channels unacceptable	11h channel support mismatch.	Client can't do required DFS channels.
13	Invalid information element	Malformed IE in handshake.	-
14	Message integrity code (MIC) failure	EAPOL/frame MIC wrong.	Wrong PSK is the classic cause (M2 MIC fails). Two TKIP MIC failures in 60 s historically triggered countermeasures.
15	4-Way Handshake timeout	M2 or M4 never arrived.	THE wrong-password signature (AP deauths with 15 after M1 retries). Also weak RSSI at cell edge, or client stalls (power save bug).
16	Group Key Handshake timeout	GTK rekey unanswered.	Sleepy clients missing group rekey - tune GTK interval / check client power save.
17	IE differs between (Re)Assoc and 4-way M3	RSN IE mismatch M3 vs assoc.	Downgrade-attack protection tripping - or AP config changed mid-handshake. Includes RSNXE mismatch (H2E bit!).
18	Invalid group cipher	-	See status 41 analog.
19	Invalid pairwise cipher	-	-
20	Invalid AKMP	-	-
21	Unsupported RSN IE version	-	-
22	Invalid RSN IE capabilities	-	-
23	IEEE 802.1X authentication failed	EAP failure.	RADIUS reject: bad credentials, expired cert, policy mismatch. Correlate with RADIUS Access-Reject.
24	Cipher suite rejected - security policy	-	-
32	Disassociated for unspecified QoS reason	QoS teardown.	-
33	Disassociated - QAP lacks bandwidth	Admission control revoke.	-
34	Disassociated - excessive missing ACKs	Link quality shed.	AP gave up on unreliable client (interference / range).
35	Disassociated - TXOP exceeded	QoS policy violation.	-
36	Requested STA leaving / reset	Peer leaving.	-
39	Requested STA requires setup first	Mechanism not established.	E.g. data on TID with torn-down BA session.
45	Peer link cancelled / PeerKey mismatch	Mesh/TDLS teardown.	-
46	Authorized access limit reached	Policy limit.	-
47	External service requirements	Network-side policy.	-

Tip#

Direction matters: a Deauth FROM the client (TA=client) with reason 3/8 is normal behavior; a Deauth TO the client with 2/6/7/15 is where troubleshooting starts. Spoofed deauth floods show reason 7 at high rate without PMF.

Status & Reason Codes

STATUS CODES - IEEE 802.11-2020 Table 9-50 | Returned in Auth / Assoc / Action responses | Wireshark: wlan.fixed.status_code34 rows#

REASON CODES - IEEE 802.11-2020 Table 9-49 | Carried in Deauth / Disassoc | Wireshark: wlan.fixed.reason_code32 rows#

Tip#

Related pages