Can anyone help me understand what "Excessive Probe Frames detected" means?
I am seeing many APs in a SWAN implementation generating the following errors. Clients seem to be getting disconnected regularly... Can anyone give me a guess as to what this means? The location where this is happening is a bit light on access points, but has ample radio coverage. A site survey and walkthrough was performed. Radio parameters were generated through site survey wizard... Thanks!
Excessive Deauthentication Frames from STA:00-11-20-ee-af-3e [Frames:63,Interval:500ms],
Excessive Deauthentication Frames in Channel:64 [Frames:97,Interval:500ms],
Excessive Disassociation Frames from STA:00-13-ce-35-29-25 [Frames:77,Interval:500ms],
Excessive Disassociation Frames in Channel:64 [Frames:95,Interval:500ms],
Excessive Probe Frames detected from STA:00-11-24-c8-cb-d1 [Frames:72,Interval:500ms],
Excessive Probe Frames detected in Channel:11 [Frames:75,Interval:500ms]
Re: Can anyone help me understand what "Excessive Probe Frames d
It looks like someone has you tagged as a 'Rogue' and is shutting you down.
Anyone else in your neighborhood using high-end wireless? The WLSE and LWAP comtrollers can do this too (as part of their Rogue mitigation).
Other than that, it could be a DOS attack, or an attempt to insert a "man-in-the-middle" ... by killing the connection from your clients to your AP(s), an attacker can bring up an AP that your clients can associate with to catch / monitor / mutilate the traffic which is relayed to the legitimate AP.
Bring up something like NetStumbler (or a real wireless "sniffer" .... TamoSoft CommView is a pretty good deal www.tamosoft.com).
Transferring Crash file from standby: Login to the Active WLC in HA.
From CLI: (Cisco Controller) >transfer upload datatype crash (Cisco
Controller) >transfer upload filename (Cisco
Controller) >transfer upload mode tftp (Cisco Controller) >transfer
This is the start of a display filter cross reference between Wireshark
and OmniPeek. The 1st installment is a table of advanced filters. More
filters will be added as time allows. It is a living doc, so check back
for changes every so often Please feel f...