disassoc frames

  • 1
  • Question
  • Updated 2 years ago
We are seeing lots alerts like the following with regards to disassoc frames from alot of our APs:

Device *********: [wifi]: L2 DoS: interface wifi0(citcoap) station 90b6:86af:c4fd: receiving disassoc frames exceed 120 PPM

Event

Event Type:                        L2DoS

Trap Type:                           Threshold Crossing

Device ID:                            E01C4136EA80

Device Name:                    *********

Time:                                     04-13-2016 17:16:31

Message:                            [wifi]: L2 DoS: interface wifi0(citcoap) station 90b6:86af:c4fd: receiving disassoc frames exceed 120 PPM.

What would be the best practice to resolve these ?

Thanks in advance
Photo of Steve

Steve

  • 5 Posts
  • 0 Reply Likes

Posted 2 years ago

  • 1
Photo of Erik Gunnarsson

Erik Gunnarsson

  • 38 Posts
  • 6 Reply Likes
Start by try to figure out what kind of device 90b6:86af:c4fd is.
Is it a device with WIPS misconfigured or is it a legit client behaving strange?
If it's a legit device, try update the NIC drivers,
Photo of Steve

Steve

  • 5 Posts
  • 0 Reply Likes
Thanks, found the device and all good now