Hosted based wifi hotspot works, but BSSID keeps changing - rPi 4, Raspian

Question

Admittedly, I'm torn between posting this in SuperUser or ServerFault, so opinions of where this should go are welcome.

I have a hotspot set up on my Raspberry Pi 4, running Raspian. I used hostapd to set it up, following the guide from the Pi Foundation's website as I hadn't done anything like that before.

The network technically works, and if I get another device to connect fast enough, it accepts the Passphrase and connects, however every few minutes the connected devices all disconnect, and if I try to reconnect with the saved passphrase on them, I get a "Incorrect Passphrase" error. If I delete the saved network record on any given device, it connects with the same passphrase, and then disconnects a short while later again.

I thought it could be signal strength, but running NetSpot on a Notebook even further away from the Pi shows great signal strength.

Then I noticed something in Netspot. The network was suddenly listed a second time, and the first listing showed as no longer being in range. The only difference I could find: the second network had a different BSSID. The longer I left Netspot scanning, the more copies of the network turn up with new BSSIDs, and the previous networks show as out of range.

I tried setting the BSSID explicitly in my hostapd config, which makes it take longer the change BSSID the first time, but after that first change, it goes back to the 2-3 minute frequency.

I am honestly out of my depth here at this point, I typically just work on Ethernet networks (I have a well wired home so beyond my router's network for my phone, why wouldn't I go wired?).

Any pointers to find the cause would be amazing. I'm generally pretty comfortable with the Bash terminal.

(Why a wifi hotspot I hear you ask, since there is a working router here anyway? The Pi is running my HomeAssistant instance, and I want to pop smart home devices I don't trust to be connected to the internet on the Pi's hotspot and have HomeAssistant control them, such as my aircon, that does not use TLS for it's commands and sends the login username and password in plaintext back and forward on every command, and my TV, which allows app remote control that is better than the physical remote, but is unlikely ever to get a security update because, well, smart TVs)

hostapd.conf:

driver=nl80211
ssid=AtextSSID
bssid=TheMACAddressOfMyPi'sWifiInterface
hw_mode=g
channel=11
ieee80211n=1
wmm_enabled=0
macaddr_acl=1
accept_mac_file=/etc/hostapd/hostapd.accept
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=AnAcceptablePassphrase
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

My hostapd.accept file just has the MAC addresses of all the devices I intend to connect to it, each on it's own line, with no spaces or commas. Turning off the MAC ACL option and removing the accept file line does not change the network behaviour.

(There is at least one person in my apartment building who will playfully mess with you if you stuff up the security of your wifi network, so MAC address filtering seemed sensible since it will be rather rare that new devices will be added to the network, and they will never just be once off connections)

Edit 1:

Screenshot of Netspot's network list, after running the networks for 7 minutes. The greyed out networks are no longer detected.

So I was slightly wrong, the first "network" BSSID stays up for 60 seconds after the second one appears, and then shuts down, like clockwork.

This is synced with the time, interestingly. Here I started hostapd at 12:17, the second BSSID appears at 12:29, and the first disappears at 12:30. For a sanity check, I waited through 12:35, and put a clock up with seconds just to check. At exactly 12:34, BSSID 3 appears, and at exactly 12:35 BSSID 2 disappears.

I'm sitting watching hostapd's logs and the system log now, will post anything that seems related

Edit 2: Well this timing seems less exact in the logs: Pastebin

Seems to be change being actioned by NetworkManager. Any idea how I track down what is telling it to do that?

Answer 1

It is hard to get an idea what's wrong, with the information we get only step by step reading between the lines. You are using a HomeAssistent we still not know what it is. You have a wired uplink to your internet router but no bridge on the RasPi. There is also an access point running. It seems you are using NetworkManager. This all is far away from a default network setup that is known to work out of the box. As far as I see you are mixing up four network setups:

1. default Raspbian settings with dhcpcd
2. hostapd and dnsmasq for the access point
3. NetworkManager
4. networking of the HomeAssistent

This cannot work. NetworkManager isn't supported by Raspbian and known on this site to make a lot of trouble. It seems that it is fighting against the access point setup. Maybe it is used by the HomeAssistent? First try to make your RasPi running without the HomeAssistent and without NetworkManager. Then you should decide what network environment to use. Using NetworkManager is the worst decision. If you cannot get the HomeAssistent to work with the selected network environment because it occupy networking without alternative you may consider to use another RasPi for it, or use a more flexible HomeAssistent.