Single device packet flood on MR42

[akrammeraki]

Hello all,

I have a four AP MR42  conected fine , but today i had  a cut on SSID , when i researched after on  event log for access point  i  detected this :

Single device packet flood

radio: 2, state: end, alarm_id: 20  « hide reason received_packet

and 

Auto RF channel change

Channel changed to improve network performance  « hide New_Channel 52/80 Old_Channel 52/80 Radio 2

Auto Tx power change

Tx power increased  « hide Old_Power 8 New_Power 18 Radio 2

I would like to know what is that  mean ? and how to solve this problem ?

Best regards

[ww]

The first one is related to air Marshal: maybe the air marshal  page itself give some additional info? https://documentation.meraki.com/MR/Monitoring_and_Reporting/Common_Wireless_Event_Log_Messages#Air_...

2 and 3 is meraki autorf doing its job to optimize  you network. 

https://documentation.meraki.com/MR/Monitoring_and_Reporting/Location_Analytics/Meraki_Auto_RF%3A__W...

[akrammeraki]

thank you for your reply ,

the air marshal  page itself give some additional info? 

it show me this image , attached below.

that is mean a attack (rxternal or internal ) from the device type ?

Best regards

[ww]

• Single or multiple device packet flood - Denotes that an AP has detected that single or multiple client(s) have attempted to flood the wireless environment with a type of packet. These message can indicate a malicious attack or temporary, client-based misbehavior. 

If its one of your clients maybe the client is somewhere stuck on the authentication proces and keeps trying?  If its a unknown  client it could be some kind of attack.

But im just guessing here..