平时经常遇到手机一开始连接正常但是用了一段时间比如用了2天iphone会提示无法加入网络。重启iPhone无法恢复修改iPhone私有Wi-Fi地址(更换一个MAC地址)后立即恢复终端 iphone8 iphone15pro ipad9代都遇到过。无线设置: 关闭双频合一5GHZ 149信道 80MHZ 加密方式WPA2/WPA3混合固件版本TL-XDR5480易展Turbo版 1.0.46 Build 251121 Rel.51162抓包发现失败时iPhone8持续发送WPA3 SAE Commit认证请求tshark -r debug-01.cap -Y wlan.addr ca:a5:3e:4e:bd:47 └─# tshark -r debug-01.cap -Y wlan.fc.type_subtype in {0x0000, 0x0001, 0x000a, 0x000b, 0x000c} || eapol Running as user root and group root. This could be dangerous. 172 9.117803 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN1083, FN0, Flags........ 221 10.117926 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN1084, FN0, Flags........ 252 11.118445 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN1085, FN0, Flags........ 263 12.118627 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN1086, FN0, Flags........ 281 13.306160 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN3905, FN0, Flags........ 311 14.306508 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN3906, FN0, Flags........ 320 15.306614 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN3907, FN0, Flags........ 327 16.306629 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN3908, FN0, Flags........ 369 23.068550 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN3559, FN0, Flags........ 372 24.068452 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN3560, FN0, Flags........ 395 25.068732 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN3561, FN0, Flags........ 452 26.069101 Apple_4e:bd:47 → TpLinkTechno_a8:70:bf 802.11 128 Authentication, SN3562, FN0, Flags........ ┌──(root㉿kali)-[/home/kali] └─#┌──(root㉿kali)-[/home/kali] └─# tshark -r debug-01.cap -Y frame.number 172 -V Running as user root and group root. This could be dangerous. Frame 172: Packet, 128 bytes on wire (1024 bits), 128 bytes captured (1024 bits) Encapsulation type: IEEE 802.11 Wireless LAN (20) Arrival Time: Aug 3, 2026 15:56:12.129792000 UTC UTC Arrival Time: Aug 3, 2026 15:56:12.129792000 UTC Epoch Arrival Time: 1785772572.129792000 [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 22.581000 milliseconds] [Time since reference or first frame: 9.117803000 seconds] Frame Number: 172 Frame Length: 128 bytes (1024 bits) Capture Length: 128 bytes (1024 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: wlan] Character encoding: ASCII (0) IEEE 802.11 Authentication, Flags: ........ Type/Subtype: Authentication (0x000b) Frame Control Field: 0xb000 .... ..00 Version: 0 .... 00.. Type: Management frame (0) 1011 .... Subtype: 11 Flags: 0x00 .... ..00 DS status: Not leaving DS or network is operating in AD-HOC mode (To DS: 0 From DS: 0) (0x0) .... .0.. More Fragments: This is the last fragment .... 0... Retry: Frame is not being retransmitted ...0 .... PWR MGT: STA will stay up ..0. .... More Data: No data buffered .0.. .... Protected flag: Data is not protected 0... .... HTC/Order flag: Not strictly ordered .000 0000 0011 1100 Duration: 60 microseconds Receiver address: TpLinkTechno_a8:70:bf (f8:6f:b0:a8:70:bf) .... ..0. .... .... .... .... LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... IG bit: Individual address (unicast) Destination address: TpLinkTechno_a8:70:bf (f8:6f:b0:a8:70:bf) .... ..0. .... .... .... .... LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... IG bit: Individual address (unicast) Transmitter address: Apple_4e:bd:47 (c0:a5:3e:4e:bd:47) .... ..0. .... .... .... .... LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... IG bit: Individual address (unicast) Source address: Apple_4e:bd:47 (c0:a5:3e:4e:bd:47) .... ..0. .... .... .... .... LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... IG bit: Individual address (unicast) BSS Id: TpLinkTechno_a8:70:bf (f8:6f:b0:a8:70:bf) .... ..0. .... .... .... .... LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... IG bit: Individual address (unicast) .... .... .... 0000 Fragment number: 0 0100 0011 1011 .... Sequence number: 1083 [WLAN Flags: ........] IEEE 802.11 Wireless Management Fixed parameters (104 bytes) Authentication Algorithm: Simultaneous Authentication of Equals (SAE) (3) Authentication SEQ: 0x0001 Status code: Successful (0x0000) SAE Message Type: Commit (1) Group Id: 256-bit random ECP group (19) Scalar: 65913c740176dfc6121118ee5676fd87f6c155fc2ac5e640ed682d82e9c8d2fc Finite Field Element: 21f1187582cfd2b7ca85884b982e53f31b4b48c32046e7a5fb6e85ba0145197ce3912f50df200cbb8af7dd35aea65b62f0d60bde75086d26b6442d8f1a29c8a6 ┌──(root㉿kali)-[/home/kali] └─#抓包中未发现5480回复对应的SAE Commit/Confirm帧。可能的原因WPA2/WPA3混合模式下AP侧WPA3 SAE认证状态机或相关缓存释放异常导致该STA MAC后续SAE认证流程无法继续。解决方法由于TPLINK 没有提供 WPA2 Only 或 WPA3 Only 模式所以妥协的方案使用WPA-PSK / WPA2-PSK 混合模式。(我自己是更换了其他支持 WPA2 Only 和 WPA3 Only 的无线路由器)。关于TP-LINK 这样设计的缺点可能是TP的产品经理以为WPA2/WPA3 混合模式是完美的觉得这样既能兼顾新旧设备又能防止小白用户因误选纯WPA3导致老设备连不上而产生退货。但忽略了无线驱动在混合模式下的极高复杂度(必须同时维护PSK与SAE两套独立的认证状态机以及不同AKM的PMKSA 缓存逻辑)——为了照顾极少数设备的兼容性反而引入了大量的状态机 Bug最终破坏了绝大多数设备在纯 WPA3 下本该有的稳定性。从极简工程与减少驱动 Bug 的角度来看更合理的界面加密选项其实只需保留 3 种1. WPA2-PSK (AES) 默认模式兼容性最好适合 2006年至今绝大多数 Wi-Fi 设备 包括大量旧款智能家居设备IoT摄像头、扫地机器人、打印机等。 2. WPA3-SAE 新一代个人无线安全标准2019年至今的新款主流设备普遍支持 提供更强的密码安全保护。 3. Open 无密码开放网络适用于访客或公共访问场景。要99.999%的兼容性安全 选择WPA2-PSK(AES)家里没有老设备想要更安全的选择WPA3-SAE。