Re: Does a AP get blacklisted if it fails auth too many times?

Hi Bryce,

On 2/26/25 10:12 AM, Bryce Johnson wrote:
> On Wed, Feb 26, 2025 at 11:00 AM James Prestwood <[email protected]> wrote:
>> Hi Bryce,
>>
>> On 2/26/25 8:13 AM, Bryce Johnson wrote:
>>> I have an embedded linux device with silabs wf200 chipset with IWD
>>> 3.2.  I got logs remotely after the fact so I didn't get to debug this
>>> one in person.
>>>
>>> Every now and then wifi will drop off and usually reconnected.  On
>>> this particular one it disconnected, tried to reconnect, failed, and
>>> then never tried again.
>>>
>>> <snip>
>>>
>>>
>>> Is there some blacklist that occurs with enough failures?  This device
>>> ended up sitting like this for a couple hours before it got restarted
>>> - after the restart IWD immediately reconnected to the AP.
>> In IWD we have a few special status/reason codes that won't cause an AP
>> to be blacklisted, but an auth timeout will blacklist an AP. You will
>> generally see this log [1] if there were APs seen but they were all
>> blacklisted.
>>
>> The original reason for the blacklisting was a use case where a specific
>> AP is "broken" and repeatedly fails to allow a connection. We wanted to
>> exponentially increase the blacklist time for every failure so a client
>> would avoid connection disruptions. It really depends on your use case,
>> but I also work with headless devices and we control the networks. When
>> there is some failure that would normally trigger a blacklist, I'm
>> fairly confident this is a transient issue and isn't a "broken" AP (this
>> obviously isn't a guarantee though). So in my configuration I've
>> actually lowered the maximum blacklist timeout to something like 2-5
>> seconds to prevent repeated failures from blacklisting the AP for
>> extended periods of time.
>>
>> [1]
>> https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/src/station.c#n286
> Thanks James!  I'll check that out.  For also headless device use
> case, we are never moving and only provisioned to one AP.  So we'd
> like to try as hard as possible to stay connected to the AP.

Ah yes in that case I'd set the blacklist timeout to something like 1 
second. I just looked and the blacklist code needs some work tbh. You 
can't disable it, and I don't see any checks to ensure the maximum 
blacklist timeout isn't lower than the initial... so I'll fix this up.

>
>>> <snip>
>>>
>>> Thanks
>>> Bryce
>>>