L2 DoS: interface wifi0.1 station receiving probe req frames exceed 1200 PPM

  • 1
  • Question
  • Updated 3 years ago
  • Answered
Getting a ton of messages this morning about this MAC address, which is a Nook device. I want to make sure I am reading this right. These messages indicate that Nook device is receiving probe req frames from an AP other than mine? Unfortunately most of the APs at this site are legacy AP20 and don't support remote packet capture, and involving on-site resources would be a pain.

Event Type:        L2DoS
Trap Type:        Threshold Crossing
Device ID:        00197700xxxx
Device Name:    [ access point X ]
Time:            01-22-2015 07:21:14
Message:        [wifi]: L2 DoS: interface wifi0.1 station 58:67:1a:47:58:d6: receiving probe req frames exceed 1200 PPM.
Photo of JimmyBoJingle

JimmyBoJingle

  • 9 Posts
  • 3 Reply Likes

Posted 3 years ago

  • 1
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
No, it's saying that your Nook device is sending these probe request frames and that the Aerohive AP is receiving them at at rate that exceeds 1200 PPM.

It suggests that the driver is experiencing pathological failure in the Nook. A reboot and a check for software updates is always the best initial response to this.

Any site using AP20s should probably upgrade by now! (But you already know that! :)
(Edited)
Photo of JimmyBoJingle

JimmyBoJingle

  • 9 Posts
  • 3 Reply Likes
Nick,

Thanks for the quick reply! I got lucky and the guy with the Nook is an employee. He had the device on, but not associated with any networks. Apparently the thing goes nuts trying to figure out networks nearby when it's not associated to any.

He joined it to our guest network and those alerts stopped. He mentioned its really old and there are no more software updates for it unfortunately.

One day we will get to upgrade all these AP20s :)