SCALANCE W788-2PRO: Resolving Class 3 Frame Disassociation Logs

1. Problem Description: Decoding the Log Entry

When monitoring a Siemens SCALANCE W788-2PRO industrial access point, the following line frequently appears in the local log file or syslog stream:

The log entry breaks down into four functional fields that must be parsed together to reach a valid root-cause hypothesis:

2. IEEE 802.11 Reason Code 7 — Class 3 Frame from Non-Associated STA

The text "class 3 frame received from non-assoc" corresponds to IEEE 802.11 reason code 7 (0x0007). The full list of standard disassociation/deauthentication reason codes published in IEEE Std 802.11-2007 §7.3.1.7 (and reaffirmed in later revisions) is summarized below:

A Class 3 frame in 802.11 nomenclature is a data MSDU (including null data and QoS data subtypes). When the AP's controller function receives such a frame and the source MAC is not present in the BSSID's association table, the standard mandates that the AP disassociate that MAC to keep the BSS state machine consistent. The W788-2PRO firmware maps this into the human-readable string shown above and logs it with the offending client MAC.

3. SCALANCE W788-2PRO Architecture and Where the Event Originates

The W788-2PRO is a member of the SCALANCE W788-2xx family. Per the official SCALANCE W788 Operating Instructions (entry ID 83678141), the following functional blocks interact with reason-code 7 events:

The log line "WLAN 2 VAP 0" indicates that the event was generated by radio interface index 2 and the first VAP bound to that radio. On a single-radio W788-1PRO this is reported as WLAN 1 VAP 0; the same interpretation applies.

4. Root-Cause Taxonomy

From field data, the message is produced by one of four root causes. Each must be ruled in or out before any firmware change is attempted.

4.1 Client Misconfiguration (Most Common in Brownfield Installations)

A SCALANCE W746-1PRO or third-party client presents frames on the wrong SSID, the wrong BSSID, or before completing the 4-way handshake. From the W788-2PRO's perspective the client is "not associated" even though the W746 believes the link is up. Verify on the W746:

• SSID string matches exactly (case-sensitive, no leading/trailing whitespace)
• Security mode matches (WPA2-PSK vs. WPA2-Enterprise / iAUTH)
• Passphrase / RADIUS shared secret matches
• Channel list intersects the AP's operating channel

4.2 Auto Find Adopt MAC Conflict

The W788-2PRO supports a function called Auto Find Adopt MAC, documented in the W788 operating instructions §5.7.4.3. The feature is intended for single-client, single-AP topologies and is not compatible with multi-node iLAN/iWLAN installations. When enabled in a topology with more than one client, the AP will periodically scan for the "adopted" MAC and may disassociate the actual client when it detects a frame from a foreign MAC that it cannot resolve through its bridging table.

4.3 Spoofed Disassociation / Deauthentication Frames

Public research has shown that injecting 802.11 management frames with spoofed source addresses can force an AP to terminate a legitimate session. The relevant attack primitives are:

• A spoofed Deauthentication with Source = AP MAC breaks the client's state machine
• A spoofed Disassociation with Source = Client MAC breaks the AP's state machine

If the W788-2PRO generates a reason-7 event for a client that has not actually transmitted data, the AP itself is being spoofed. Enable 802.11w Protected Management Frames (PMF) on the VAP and the matching W746 client profile; PMF signs management frames with the negotiated key, making spoofed frames uncrackable to the AP's state machine.

4.4 RF Co-Channel or Adjacent-Channel Interference

When two W788-2PRO APs or an AP and a foreign Wi-Fi device share or overlap channels, the W788 radio may decode a frame from the wrong BSS and attribute it to the local BSS. This produces reason-7 entries even though no genuine client misbehaviour occurred. Verify that the channel plan of every W788 in the cell follows a non-overlapping assignment (1 / 6 / 11 in 2.4 GHz; non-DFS channels preferred in 5 GHz where radar events are a concern).

5. Diagnostic Procedure

Follow this sequence before changing any configuration. Each step produces an artifact that can be attached to a Siemens Support Request (SSR).

5.1 Step 1 — Time Synchronization

An NTP server must be reachable so that AP and W746 logs share a common time base. Without it, the W788-2PRO clock drifts (typical drift 1–3 seconds per day on a cold-start unit), making root-cause correlation impossible. Configure NTP via Web-Based Management (WBM) under System > Time or via the CLI:

5.2 Step 2 — Capture Full Log Tables from Both Devices

Export the diagnostic buffer from the W788-2PRO and from every W746-1PRO that is associated with it. On the AP, navigate to Information > Log Tables > System Log and save the CSV. On the client, repeat on Information > Log Tables > WLAN Log. Look for any of the following paired patterns:

• W788 logs reason 7 → W746 logs "Deauthentication received" or "Disassociation received" within 1 second
• W788 logs reason 7 → no entry on W746 → suspect spoofing (the client never sent the offending frame)
• W788 logs reason 7 → W746 logs "Authentication rejected, wrong key" → suspect key mismatch

5.3 Step 3 — Channel and Power Survey

Use a spectrum analyser or the W788-2PRO's own spectrum-analysis iFeature to log noise floor and interferer duty cycle for at least 24 hours. Adjacent-channel interference from a foreign 802.11 source produces reason-7 events at intervals matching the interferer's beacon period.

5.4 Step 4 — Configuration Snapshot

Save the running configuration (CLI: show running-config; WBM: System > Save Configuration) and compare it against the known-good baseline. Pay particular attention to:

• vap 0 ssid <name> — must match the W746 profile exactly
• vap 0 security wpa2-psk key <value> — same on both sides
• auto-find-adopt-mac — must be disabled in multi-node cells
• max-clients-per-vap — must be ≥ the number of attached W746s

6. Resolution Matrix

7. Hardening the W788-2PRO Against Future Reason-7 Events

Once the immediate log spam is resolved, apply the following preventive measures, derived from the SCALANCE W family operating instructions and the industrial WiFi best-practice body of work:

1. Enable Protected Management Frames (802.11w) on every VAP. PMF signs disassociation and deauthentication frames, neutralising the spoofing vector. The W746-1PRO supports PMF from firmware V1.3 onward.
2. Use WPA2-Enterprise with iAUTH / RADIUS instead of PSK for any cell with more than two clients. Per-client keys remove the "one PSK, many clients" amplification risk.
3. Lock the cell to a single SSID per VAP. Multiple SSIDs on one radio increase the probability of cross-VAP frame delivery, which is the most common legitimate trigger of reason 7.
4. Disable Auto Find Adopt MAC in any cell where > 1 client is reachable. This is documented in the W788 manual §5.7.4.3 and is a hard requirement for the multi-client iWLAN topology.
5. Set an explicit maximum client count per VAP that matches the engineering design, so the AP never enters the "full BSS" state where new associations are rejected with reason 5 (which can be misread as reason 7 in truncated logs).
6. Deploy an NTP server for the entire cell. Without a shared time base, log correlation between W788 and W746 is unreliable.
7. Document the channel plan and revalidate it annually; environmental changes (new neighbour WiFi, new machinery, new cable trays) are the leading cause of late-life reason-7 events.

8. Verification Procedure

After the corrective change, validate that the fix is durable:

1. Clear the W788-2PRO log buffer (Information > Log Tables > Clear) and the W746-1PRO log buffer.
2. Force a reassociation by cycling the W746 radio (CLI: wlan 1 radio off / wlan 1 radio on) or by toggling power on the affected segment.
3. Run the cell under normal PLC traffic for at least 4 hours (one shift minimum).
4. Export the log again and confirm: zero reason-7 events for the affected MAC; W746 association uptime equals the test duration; no client-side "Deauth received" events.
5. If the event reappears, attach the 4-hour log CSV, the running configuration, the channel-survey capture, and a small network drawing (SSID, BSSID, channel, security mode, MAC of every node) to a Siemens Support Request.

9. Related Log Strings to Recognise

The W788-2PRO emits a small family of similar events. Misreading them leads to wasted troubleshooting time. The most common ones to recognise on sight:

10. When to Escalate to Siemens Support

Open a Siemens Support Request when any of the following is true after applying the diagnostic procedure:

• Reason 7 events persist with PMF enabled, RADIUS mutual authentication in use, and a clean channel plan
• The log shows reason 7 events for MAC addresses that are not present in the cell (pure spoofing) and the cell cannot be physically secured
• The W788-2PRO firmware is older than V2.0 on the affected radio and a firmware upgrade is required to expose PMF or RWlan iFeatures
• The reason 7 events correlate with PLC scan-time jitter or PROFINET IRT cycle violations, indicating deeper real-time impact

Attach the following artifacts to the request:

• Full configuration export (encrypted ZIP is acceptable when secrets are present)
• 24-hour log CSV from the W788-2PRO and from every affected W746-1PRO
• Channel-survey capture
• Topology drawing showing AP, clients, SSIDs, channels, and the PLCs they bridge
• Output of show version, show running-config, and show wlan 2 client

11. Quick Reference: Log Entry Decoded

12. FAQ