Mr34 packet flood issues

[jabellas]

Hi all,

I have been having occasional problems where end users complain about being shut out of wireless for 30 seconds or more, when I look at the logs I see pages and pages like this:

Sep 5 19:03:40		Single device packet flood	radio: 0, state: end, alarm_id: 41810  more »
Sep 5 19:03:40		Single device packet flood	radio: 0, state: end, alarm_id: 41809  more »
Sep 5 19:03:33		Single device packet flood	packet: beacon, device: 8A:15:04:FA:B4:82, radio: 0  more »
Sep 5 19:03:27		Single device packet flood	packet: beacon, device: F8:E4:FB:E2:BA:1D, radio: 0  more »
Sep 5 19:03:00		Single device packet flood	radio: 0, state: end, alarm_id: 41808  more »
Sep 5 19:02:55		Single device packet flood	packet: beacon, device: 72:C2:46:14:BF:37, radio: 0  more »
Sep 5 19:02:50		AP / client flood	radio: 0, state: end, alarm_id: 41807  more »
Sep 5 19:02:40		AP / client flood	packet: beacon, radio: 0, bssid: 8A:15:04:FA:B4:82  more »
Sep 5 19:02:40		Single device packet flood	radio: 0, state: end, alarm_id: 41806  « hide reason timer_expired
Sep 5 19:02:30		Single device packet flood	packet: probe_resp, device: 10:05:01:B7:78:A8, radio: 0  more »
Sep 5 19:02:20		Single device packet flood	radio: 0, state: end, alarm_id: 41805  « hide reason timer_expired

lasts 30 minutes to an hour, seems localized to a specific A/P goes away as mysteriously as it started. 

Any thoughts, support was no help

[PhilipDAth]

You aren't using any third party repeaters are you?

What are these devices listed as causing a packet flood?

8A:15:04:FA:B4:82

F8:E4:FB:E2:BA:1D

72:C2:46:14:BF:37

[jabellas]

---

@PhilipDAth wrote:

You aren't using any third party repeaters are you?

What are these devices listed as causing a packet flood?

8A:15:04:FA:B4:82

F8:E4:FB:E2:BA:1D

72:C2:46:14:BF:37

---

No, only Meraki M34's.

No idea, none of the mac addresses show up as associated devices. And many others show up.

[PhilipDAth]

If none of those devices show up then they may be flooding on another WiFi network that is not yours.  I would also take a look at Air Marshall and Wireless Health.

It sounds like you might not have enough RF spectrum in the area.  If you have 2.4Ghz enabled I would try disabling it.  5Ghz has a lot more spectrum available.

You could putting in an extra AP in the area to reduce the impact.

[jabellas]

Air Marshall does not show any of these events, only these at another AP:

• Configure
• Rogue SSIDs 2
• Other SSIDs 2645
• Spoofs 0
• Malicious broadcasts 0
• Packet floods 2

2 packet floodsseen

for the last week

Type Last seen First seen Seen by Device type Packet type

Multi-source packet flood	5 days ago	7 days ago	MR34- New Open Space (0 dB)	multiple	Probe response
Single-source packet flood	5 days ago	1 week ago	MR34- New Open Space (0 dB)	7C:9A:54:01:5E:A2

but as you have guessed and can see we are in a very dense urban area - air marshal reports 264 SSID's though only one of the AP's seems to be overutilizing the channels but it is not the one having the problems:

MR34- New Open Space	1,40	35% - fair	5% - very low
MR34- Rafters Bullpen	1,60	35% - fair	3% - very low
MR34-Annex	6,149	43% - fair	13% - low
MR34-Main Conference Room	11,140	26% - low	1% - very low
MR34-Mezzanine	11,108	22% - low	21% - low
MR34-Rafters	11,44	60% - high

We used to have some legacy 2.4ghz devices but I will try turning 2.4ghz off for now. 

One last question, could it be a hardware issue with that AP?

Thanks for the quick response.

[PhilipDAth · Accepted solution]

Your 2.4Ghz spectrum on some of those access points seems very busy and could easily be causing you issues.

I would also try giving the AP a power cycle, just in case it has gotten into a suck state.

But my guess is this is not a hardware issue.  It is an issue with clients not under your control.

[jabellas]

Thanks, I am now figuring out the RF Profiles, will try disabling 2.4 and seeing what happens

[VDNETWORK]

We also have the same symptom where client is also affecting.

This is purely Meraki BUG where TAC is extremely clueless on what it is..  

Even with issue state its very strange that they never bothered to deep dive and capture the real issue. 

TAC informed that the issue can be due to full power in 2.4Ghz and forced us to remove the static power and change it to auto.  We informed that the settings were done as per the site survey with Ekahu however, Meraki TAC engineer never listens..  

Anyway I have upgraded the firmware to 26.1 Beta and the single packet flood is not listing. 

[jabellas]

Thanks for the info.  I will try to upgrade to the beta version.

[VDNETWORK]

Unfortunately, this is triggering again. We do have MR42, MR53 in the same network with no packet floods. However, MR34 is still triggering which is pointing to be a pure MR34 SW bug.

[Kidcooley]

Hi,

I'm having the same issue and I do have a couple of third party aps on the networ, fortinet aps. How could that cause an issue?