AP/Client Flood, Single device packet flood

JED2021 — Tue, 03 Jan 2023 21:56:37 GMT

The MAC addresses reported are all non registered.

Worked with support for a Packet capture and was led to believe it was a ring doorbell.

Asked the co tenant to turn off the door bell.

Issue exists still.

Has anyone seen this similar issue?

Jan 3 13:45:07	FN285-WAP2	AP / client flood	radio: 1, state: end, alarm_id: 6318 more »
Jan 3 13:45:00	FN285-WAP2	AP / client flood	packet: beacon, radio: 1, bssid: E2:CB:AC:90:4B:26 more »
Jan 3 13:44:57	FN285-WAP2	AP / client flood	radio: 1, state: end, alarm_id: 6317 more »
Jan 3 13:44:49	FN285-WAP2	AP / client flood	packet: probe_resp, radio: 1, bssid: EA:CB:AC:90:4B:26 more »
Jan 3 13:44:27	FN285-WAP2	Single device packet flood	radio: 1, state: end, alarm_id: 6316 more »
Jan 3 13:44:27	FN285-WAP2	AP / client flood	radio: 1, state: end, alarm_id: 6315 more »
Jan 3 13:44:26	FN285-WAP2	Single device packet flood	packet: probe_resp, device: EA:CB:AC:90:4B:26, radio: 1 more »
Jan 3 13:44:19	FN285-WAP2	AP / client flood	packet: beacon, radio: 1, bssid: 0A:8D:CB:71:42:DE more »

Re: AP/Client Flood, Single device packet flood

Brash — Tue, 03 Jan 2023 22:25:13 GMT

There's no way you can really confirm whether the devices are flooding maliciously or not without tracking them down.
It could be anything from poorly designed IOT devices to bad drivers, or someone attempting a malicious attack.

Do you have any AP's on the same network or broadcasting the same SSID that are not part of this Meraki dashboard?
Is it always the same AP that's detecting it? If so, could be worth giving it a reboot.

A few threads that provide some more information and other people's experience:
Packet floods detected by AirMarshal - The Meraki Community
Solved: Mr34 packet flood issues - The Meraki Community
Air Marshal - Cisco Meraki

topic Re: AP/Client Flood, Single device packet flood in Wireless

AP/Client Flood, Single device packet flood

Re: AP/Client Flood, Single device packet flood