Can anyone help me understand what "Excessive Probe Frames detected" means?

[tmoffett]

I am seeing many APs in a SWAN implementation generating the following errors. Clients seem to be getting disconnected regularly... Can anyone give me a guess as to what this means? The location where this is happening is a bit light on access points, but has ample radio coverage. A site survey and walkthrough was performed. Radio parameters were generated through site survey wizard... Thanks!

Excessive Deauthentication Frames from STA:00-11-20-ee-af-3e [Frames:63,Interval:500ms],

Excessive Deauthentication Frames in Channel:64 [Frames:97,Interval:500ms],

Excessive Disassociation Frames from STA:00-13-ce-35-29-25 [Frames:77,Interval:500ms],

Excessive Disassociation Frames in Channel:64 [Frames:95,Interval:500ms],

Excessive Probe Frames detected from STA:00-11-24-c8-cb-d1 [Frames:72,Interval:500ms],

Excessive Probe Frames detected in Channel:11 [Frames:75,Interval:500ms]

[scottmac]

It looks like someone has you tagged as a 'Rogue' and is shutting you down.

Anyone else in your neighborhood using high-end wireless? The WLSE and LWAP comtrollers can do this too (as part of their Rogue mitigation).

Other than that, it could be a DOS attack, or an attempt to insert a "man-in-the-middle" ... by killing the connection from your clients to your AP(s), an attacker can bring up an AP that your clients can associate with to catch / monitor / mutilate the traffic which is relayed to the legitimate AP.

Bring up something like NetStumbler (or a real wireless "sniffer" .... TamoSoft CommView is a pretty good deal www.tamosoft.com).

Check it out and let us know.

Good Luck

Scott

[tmoffett]

I am 99% sure that these are all clients within the network, owned by the district.

Most of the offenders are Apple products, others are Intel, based upon the MAC vendor lookups I have done.

Any other ideas as to why I would see this behavior?

I am sure it's not another management system doing this.

BTW: I am assuming that ~70+ management frames per 500ms is far out of spec?

Thanks a million. I am having a difficult time locating any good reading that touches on this...

[scottmac]

In medium-size wireless systems, 70+ in a half second may not by unusual.

Managment frames cover all sorts of status polls, beacons & the like.

If you're looking for good references, O'Reilly has a "Definitive Guide to 802.11" that's pretty good.

I also have & use the Planet3 CWNA/CWSP/CWAP certification study books, published by Osborne. They're excellent study guides for the wireless stuff, and also make pretty good references.

(CWNA - Certified Wireless Network Administrator, CWSP - Security Professional, CWAP - Analysis Professional)

If you're gathering tools, a wireless "sniffer" can also be a Very Good Thing.

AirMagnet is (by my understanding) a "cadallac" system, and pretty expensive (~$5000.00)

WildPackets "EtherPeek" for wireless also appers to be an excellet system (but it's also ~US$ 2500 or so).

I use Tamosoft's "CommView" for wireless. It's a very good basic analyzer; it doesn't have all the bells & whistles, but definately gets the job done.

Full retail it's ~US$500.00.

If you mention that you are studying for CWAP, there's usually a good discount (~$300.00 for the full package).

You can also get a one-year license for ~$200.00.

You can put in all of your systems with aliases (MAC and/or IP) for rapid ID and see which system is sending what (and log it). It can also show you other interfering or malicious traffic.

It's hard to make an evaluation without actually seeing the traffic and the source/destination info.

It could be something as simple as bad drivers, it could be something much more complex ... no way to tell unless you can see what's actually happening.

The probe frames can be someone gathering information about your system, or it could just be a bunch of clients trying to associate.

What kind of authentication do you use (if any)?

Good Luck

Scott

[tmoffett]

Thanks for the reply.

There are 3 SSIDs, one is open no encryption, another open/WEP (I know it stinks), and another with LEAP for 7920 phones.

Seems as if clients all just seem to get dropped at once and then the customer calls me...

The client to AP ratio is pretty large. Somewhere around 20-30 clients per AP, traffic can be heavy at times.

Do you think the voice QoS on the APs could be an issue with a high density of busy wireless clients?

Thanks!

Tim