AP Spoof Event Log Details

[amy27601]

Hello,

I'm troubleshooting AP Spoof Air Marshal alerts that periodically show up. Could someone help me read the details of the alert? Is the dst MAC the MAC address of the device that is spoofing the SSID? The bssid and src mac addresses are the AP that logged the event.

vap: 1, bssid: 0A:8D:CB:70:38:A0, src: 0A:8D:CB:70:38:A0  « hide 

dst	C2:3F:9B:AC:BD:BC
radio	1
band	5
channel	40
rssi	35
fc_type	0
fc_subtype	13

[Inderdeep · Accepted solution]

@amy27601 : Check Air Marshal Containment below 

https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal 

[amy27601]

Thank you @Inderdeep