TL-XDR5480 WPA2/WPA3混合模式存在WPA3 SAE认证异常

平时经常遇到手机一开始连接正常，但是用了一段时间，比如用了2天，iphone会提示无法加入网络。

重启iPhone无法恢复

修改iPhone私有Wi-Fi地址(更换一个MAC地址)后立即恢复

终端 iphone8 iphone15pro ipad9代都遇到过。

无线设置: 关闭双频合一，5GHZ 149信道 80MHZ 加密方式：WPA2/WPA3混合

固件版本：TL-XDR5480易展Turbo版 1.0.46 Build 251121 Rel.51162

抓包发现失败时，iPhone8持续发送WPA3 SAE Commit认证请求：

tshark -r debug-01.cap -Y "wlan.addr == ca:a5:3e:4e:bd:47"

└─# tshark -r debug-01.cap -Y "wlan.fc.type_subtype in {0x0000, 0x0001, 0x000a, 0x000b, 0x000c} || eapol"
Running as user "root" and group "root". This could be dangerous.
  172    9.117803 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=1083, FN=0, Flags=........
  221   10.117926 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=1084, FN=0, Flags=........
  252   11.118445 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=1085, FN=0, Flags=........
  263   12.118627 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=1086, FN=0, Flags=........
  281   13.306160 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=3905, FN=0, Flags=........
  311   14.306508 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=3906, FN=0, Flags=........
  320   15.306614 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=3907, FN=0, Flags=........
  327   16.306629 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=3908, FN=0, Flags=........
  369   23.068550 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=3559, FN=0, Flags=........
  372   24.068452 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=3560, FN=0, Flags=........
  395   25.068732 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=3561, FN=0, Flags=........
  452   26.069101 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN=3562, FN=0, Flags=........
                                                                                                                         
┌──(root㉿kali)-[/home/kali]
└─#

┌──(root㉿kali)-[/home/kali]
└─# tshark -r debug-01.cap -Y "frame.number == 172" -V
Running as user "root" and group "root". This could be dangerous.
Frame 172: Packet, 128 bytes on wire (1024 bits), 128 bytes captured (1024 bits)
    Encapsulation type: IEEE 802.11 Wireless LAN (20)
    Arrival Time: Aug  3, 2026 15:56:12.129792000 UTC
    UTC Arrival Time: Aug  3, 2026 15:56:12.129792000 UTC
    Epoch Arrival Time: 1785772572.129792000
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 22.581000 milliseconds]
    [Time since reference or first frame: 9.117803000 seconds]
    Frame Number: 172
    Frame Length: 128 bytes (1024 bits)
    Capture Length: 128 bytes (1024 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: wlan]
    Character encoding: ASCII (0)
IEEE 802.11 Authentication, Flags: ........
    Type/Subtype: Authentication (0x000b)
    Frame Control Field: 0xb000
        .... ..00 = Version: 0
        .... 00.. = Type: Management frame (0)
        1011 .... = Subtype: 11
        Flags: 0x00
            .... ..00 = DS status: Not leaving DS or network is operating in AD-HOC mode (To DS: 0 From DS: 0) (0x0)
            .... .0.. = More Fragments: This is the last fragment
            .... 0... = Retry: Frame is not being retransmitted
            ...0 .... = PWR MGT: STA will stay up
            ..0. .... = More Data: No data buffered
            .0.. .... = Protected flag: Data is not protected
            0... .... = +HTC/Order flag: Not strictly ordered
    .000 0000 0011 1100 = Duration: 60 microseconds
    Receiver address: TpLinkTechno_a8:70:bf (f8:6f:b0:a8:70:bf)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Destination address: TpLinkTechno_a8:70:bf (f8:6f:b0:a8:70:bf)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Transmitter address: Apple_4e:bd:47 (c0:a5:3e:4e:bd:47)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source address: Apple_4e:bd:47 (c0:a5:3e:4e:bd:47)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    BSS Id: TpLinkTechno_a8:70:bf (f8:6f:b0:a8:70:bf)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    .... .... .... 0000 = Fragment number: 0
    0100 0011 1011 .... = Sequence number: 1083
    [WLAN Flags: ........]
IEEE 802.11 Wireless Management
    Fixed parameters (104 bytes)
        Authentication Algorithm: Simultaneous Authentication of Equals (SAE) (3)
        Authentication SEQ: 0x0001
        Status code: Successful (0x0000)
        SAE Message Type: Commit (1)
        Group Id: 256-bit random ECP group (19)
        Scalar: 65913c740176dfc6121118ee5676fd87f6c155fc2ac5e640ed682d82e9c8d2fc
        Finite Field Element: 21f1187582cfd2b7ca85884b982e53f31b4b48c32046e7a5fb6e85ba0145197ce3912f50df200cbb8af7dd35aea65b62f0d60bde75086d26b6442d8f1a29c8a6

                                                                                                                         
┌──(root㉿kali)-[/home/kali]
└─#

抓包中未发现5480回复对应的SAE Commit/Confirm帧。

可能的原因：

WPA2/WPA3混合模式下，AP侧WPA3 SAE认证状态机或相关缓存释放异常，导致该STA MAC后续SAE认证流程无法继续。

解决方法：

由于TPLINK 没有提供 WPA2 Only 或 WPA3 Only 模式，

所以妥协的方案，使用WPA-PSK / WPA2-PSK 混合模式。(我自己是更换了其他支持 WPA2 Only 和 WPA3 Only 的无线路由器)。

关于TP-LINK 这样设计的缺点：

可能是TP的产品经理以为WPA2/WPA3 混合模式是完美的，觉得这样既能兼顾新旧设备，又能防止小白用户因误选纯WPA3导致老设备连不上而产生退货。但忽略了无线驱动在混合模式下的极高复杂度(必须同时维护PSK与SAE两套独立的认证状态机，以及不同AKM的PMKSA 缓存逻辑)------为了照顾极少数设备的兼容性，反而引入了大量的状态机 Bug，最终破坏了绝大多数设备在纯 WPA3 下本该有的稳定性。

从极简工程与减少驱动 Bug 的角度来看，更合理的界面加密选项其实只需保留 3 种：

1. WPA2-PSK (AES)

   默认模式，兼容性最好，适合 2006年至今绝大多数 Wi-Fi 设备，
   包括大量旧款智能家居设备（IoT摄像头、扫地机器人、打印机等）。

2. WPA3-SAE

   新一代个人无线安全标准，2019年至今的新款主流设备普遍支持，
   提供更强的密码安全保护。

3. Open

   无密码开放网络，适用于访客或公共访问场景。

要99.999%的兼容性+安全 选择WPA2-PSK(AES)，家里没有老设备，想要更安全的选择WPA3-SAE。