Deauthentication frame is a frame sent by the AP or mobile client to completely terminate a connection with the Wi-Fi network.
It is a notification, which doesn’t have to be acknowledged.
According to the standard there are specified multiple reason codes, which are obviously seen during frames analysis. Some of the vendors include the information for the reason codes in logging module of wireless controllers/access points.
The complete list of reason codes is available in the 802.11 Standard 2012 in a table 8-36. It might be found here or here.
Few examples with explanations:
Reason code 2 – Previous authentication not valid
The mobile client was associated to the WLAN network on 2.4 GHz radio that has been shut down eventually.
This code also relates to any configuration change related to WLAN, QoS. radio settings.
Reason code 3 – Station has left ESS
The mobile client left the WLAN network.
Reason code 6 – Class 2 frame from non-authenticated client
The mobile client sent a Null data frame without previous authentication/association.
Reason code 7 – Class 3 frame from non-associated client
Data frame was received before association.
Reason code 15 – 4-Way Handshake timeout
The mobile client was configured with the improper pre-shared key.
