topic Authentication flood attack in Wireless

Authentication flood attack

dszendol — Sun, 04 Jul 2021 08:13:08 GMT

Hello

I am receiving on my WLC alarm form IDS about "authentication flood attack"

"IDS Signature attack detected. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-signature, Detecting AP Name: AP-xxx, Radio Type: 802.11b/g, Preced: 5, Hits: 500, Channel: 11, srcMac: xxxx"

I put that MAC into disabled clients database but I am still receiving that alarm.

How it is possible. I could understand if it was "deauthentication flood attack" as we can do nothing with that.

regards

Darek

Authentication flood attack

Sandeep Choudhary — Wed, 06 Nov 2013 08:03:39 GMT

HI,

Use this:

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008063e5d0.shtml

Regards

Authentication flood attack

dszendol — Wed, 06 Nov 2013 17:08:08 GMT

Hello

Thank You for that. I will analyse it ASAP.

I forgot that station first must to authenticate and then can associate not opposite. So blocking the MAC will not protect us against authentication flood.

regards

Darek