Wireless Access

Reply
New Contributor
Posts: 1
Registered: ‎12-18-2013

Disconnect Station Attack: An AP detected a disconnect attack of client

We operate 2 x Aruba7220 (master & local) controllers running AOS 6.4.3.2 and deployed AP105/135/205 APs in various spaces.  Lately, an increasing number of clients are being constantly kicked off our reliable and secure Production-SSID to a slow and open Guest-SSID.  A closer inspection of the logs show a <WARN> of Disconnect Station Attack: An AP detected a disconnect attack of client.  Additional Info: Avg-Deauth-Disassoc-PktRate(pps):1.4; Interval(sec):10.  We use IDS default profile with IDS DoS default setting including  enabled Detect Disconnect Station Attack.  How best can we correct this situation?  

Guru Elite
Posts: 21,279
Registered: ‎03-29-2007

Re: Disconnect Station Attack: An AP detected a disconnect attack of client

You probably need to get at the root of your issue.  The Disconnect station attack can be subject to false positives.  We need to look at the RF to see what environments your clients are in and how your network is configured.



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Frequent Contributor I
Posts: 87
Registered: ‎10-19-2015

Re: Disconnect Station Attack: An AP detected a disconnect attack of client

Hello,

 

Where do I go to look for this log?

Guru Elite
Posts: 21,279
Registered: ‎03-29-2007

Re: Disconnect Station Attack: An AP detected a disconnect attack of client

If you don't have the RF protect license, you won't see the message.  http://www.arubanetworks.com/products/security/wireless-intrusion-protection/



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Search Airheads
Showing results for 
Search instead for 
Did you mean: