topic does anyone ever see this warning : "AP 80211 DOS mgmt flood" and how to resolve this? in To Be Moved

does anyone ever see this warning : "AP 80211 DOS mgmt flood" and how to resolve this?

nuno_pimentel — Thu, 22 Oct 2015 10:31:36 GMT

does anyone ever see this warning : "AP 80211 DOS mgmt flood" and how to resolve this?

Re: does anyone ever see this warning : "AP 80211 DOS mgmt flood" and how to resolve this?

monnat_systems — Thu, 22 Oct 2015 15:31:58 GMT

where you are seeing this message? is it standalone AP or ZD controller SCG/Vscg and which version?

Re: does anyone ever see this warning : "AP 80211 DOS mgmt flood" and how to resolve this?

nuno_pimentel — Sat, 24 Oct 2015 21:18:04 GMT

in the alarmist of flexmaster, but it's from a ZD3000

Re: does anyone ever see this warning : "AP 80211 DOS mgmt flood" and how to resolve this?

saurabh_bhatnag — Mon, 27 Dec 2021 05:53:13 GMT

Management frames can be manipulated to create various types of DoS attacks. Two common management frame attacks include:

/Spoofed disconnect attach: This occurs when an attacker sends a series of “disassociate” commands to all wireless clients within a BSS. These commands cause all clients to disconnect. When disconnected, the wireless clients immediately try to re-associate, which creates a burst of traffic. The attacker continues sending disassociate frames and the cycle repeats itself.

CTS flood: This occurs when an attacker takes advantage of the CSMA/CA contention method to monopolize the bandwidth and deny all other wireless clients access to the AP. To accomplish this, the attacker repeatedly floods the BSS with Clear to Send (CTS) frames to a bogus STA. All other wireless clients sharing the RF medium receive the CTS and withhold their transmissions until the attacker stops transmitting the CTS frames.

If you are notcing these alerts regularly, yo ucan consider enabling MFP (802.11w) on your controller / controller less deployment. Along with that, there will be predefine values (threshold) and config with respect to IDS.