Wireless Access

Reply
New Contributor

Disconnect Station Attack: An AP detected a disconnect attack of client

We operate 2 x Aruba7220 (master & local) controllers running AOS 6.4.3.2 and deployed AP105/135/205 APs in various spaces.  Lately, an increasing number of clients are being constantly kicked off our reliable and secure Production-SSID to a slow and open Guest-SSID.  A closer inspection of the logs show a <WARN> of Disconnect Station Attack: An AP detected a disconnect attack of client.  Additional Info: Avg-Deauth-Disassoc-PktRate(pps):1.4; Interval(sec):10.  We use IDS default profile with IDS DoS default setting including  enabled Detect Disconnect Station Attack.  How best can we correct this situation?  

Guru Elite

Re: Disconnect Station Attack: An AP detected a disconnect attack of client

You probably need to get at the root of your issue.  The Disconnect station attack can be subject to false positives.  We need to look at the RF to see what environments your clients are in and how your network is configured.


*Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba Networks or Hewlett Packard Enterprise.*
ArubaOS 8.3 User Guide
InstantOS 8.3 User Guide
Airheads Knowledgebase
Airheads Learning Videos
Frequent Contributor I

Re: Disconnect Station Attack: An AP detected a disconnect attack of client

Hello,

 

Where do I go to look for this log?

Guru Elite

Re: Disconnect Station Attack: An AP detected a disconnect attack of client

If you don't have the RF protect license, you won't see the message.  http://www.arubanetworks.com/products/security/wireless-intrusion-protection/


*Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba Networks or Hewlett Packard Enterprise.*
ArubaOS 8.3 User Guide
InstantOS 8.3 User Guide
Airheads Knowledgebase
Airheads Learning Videos
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: