Single device packet flood on MR42

akrammeraki
Getting noticed

Single device packet flood on MR42

Hello all,

 

I have a four AP MR42  conected fine , but today i had  a cut on SSID , when i researched after on  event log for access point  i  detected this :

 

Single device packet floodradio: 2, state: end, alarm_id: 20  « hide
reasonreceived_packet

 

and 

 

Auto RF channel changeChannel changed to improve network performance  « hide
New_Channel52/80
Old_Channel52/80
Radio2

 

Auto Tx power changeTx power increased  « hide
Old_Power8
New_Power18
Radio

2

 

I would like to know what is that  mean ? and how to solve this problem ?

 

Best regards

 

 

 

 

3 REPLIES 3
ww
Kind of a big deal
Kind of a big deal

The first one is related to air Marshal: maybe the air marshal  page itself give some additional info? https://documentation.meraki.com/MR/Monitoring_and_Reporting/Common_Wireless_Event_Log_Messages#Air_...

 

2 and 3 is meraki autorf doing its job to optimize  you network. 

https://documentation.meraki.com/MR/Monitoring_and_Reporting/Location_Analytics/Meraki_Auto_RF%3A__W...

akrammeraki
Getting noticed

thank you for your reply ,

 

the air marshal  page itself give some additional info? 

 

it show me this image , attached below.

 

flood.jpg

that is mean a attack (rxternal or internal ) from the device type ?

 

Best regards

 

 
 
 
 

 

 

 

 
 

 

ww
Kind of a big deal
Kind of a big deal

 

  • Single or multiple device packet flood - Denotes that an AP has detected that single or multiple client(s) have attempted to flood the wireless environment with a type of packet. These message can indicate a malicious attack or temporary, client-based misbehavior. 

 

If its one of your clients maybe the client is somewhere stuck on the authentication proces and keeps trying?  If its a unknown  client it could be some kind of attack.

But im just guessing here.. 

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels