cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Single device packet flood on MR42

Highlighted
Getting noticed

Single device packet flood on MR42

Hello all,

 

I have a four AP MR42  conected fine , but today i had  a cut on SSID , when i researched after on  event log for access point  i  detected this :

 

Single device packet floodradio: 2, state: end, alarm_id: 20  « hide
reasonreceived_packet

 

and 

 

Auto RF channel changeChannel changed to improve network performance  « hide
New_Channel52/80
Old_Channel52/80
Radio2

 

Auto Tx power changeTx power increased  « hide
Old_Power8
New_Power18
Radio

2

 

I would like to know what is that  mean ? and how to solve this problem ?

 

Best regards

 

 

 

 

3 REPLIES 3
Kind of a big deal
Kind of a big deal

Re: Single device packet flood on MR42

The first one is related to air Marshal: maybe the air marshal  page itself give some additional info? https://documentation.meraki.com/MR/Monitoring_and_Reporting/Common_Wireless_Event_Log_Messages#Air_...

 

2 and 3 is meraki autorf doing its job to optimize  you network. 

https://documentation.meraki.com/MR/Monitoring_and_Reporting/Location_Analytics/Meraki_Auto_RF%3A__W...

Highlighted
Getting noticed

Re: Single device packet flood on MR42

thank you for your reply ,

 

the air marshal  page itself give some additional info? 

 

it show me this image , attached below.

 

flood.jpg

that is mean a attack (rxternal or internal ) from the device type ?

 

Best regards

 

 
 
 
 

 

 

 

 
 

 

Highlighted
Kind of a big deal
Kind of a big deal

Re: Single device packet flood on MR42

 

  • Single or multiple device packet flood - Denotes that an AP has detected that single or multiple client(s) have attempted to flood the wireless environment with a type of packet. These message can indicate a malicious attack or temporary, client-based misbehavior. 

 

If its one of your clients maybe the client is somewhere stuck on the authentication proces and keeps trying?  If its a unknown  client it could be some kind of attack.

But im just guessing here.. 

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.