L2DoS, receiving deauth frames exceed 120 PPM warning

  • 1
  • Question
  • Updated 5 years ago
  • Answered
In less than a half an hour, I received three email warnings about a L2DoS issue on one of my AP350s. Here's it is:


Event Type: L2DoS
Trap Type: Threshold Crossing
Device ID: 08EA443Bxxxx
Device Name: Kitchen
Time: 09-10-2013 13:25:16
Message: [wifi]: L2 DoS: interface wifi0(Guest) station 08ea:4438:xxxx: receiving deauth frames exceed 120 PPM.

Does this mean that device sending deauth frames is another one of my Aerohive APs, as the MACs both begin with 08EA44?

I don't have any mitigation options turned on.
Photo of Joel


  • 9 Posts
  • 0 Reply Likes
  • confused

Posted 5 years ago

  • 1
Photo of Andrew MacTaggart

Andrew MacTaggart, Champ

  • 483 Posts
  • 86 Reply Likes

Device ID: 08EA443Bxxxx
this is your mgt0 interface Mac Address

station 08ea:4438:xxxx:
would seem to be your wireless interface on the same AP

you can verify by doing a show interface from cli

Some smart phones are known to send a flood of deauths

So who was in the kitchen with the pipe?