topic Re: I get a lot of these email notifications "Device: [screen]: wifi0.1: ICMP flood was detected from station...." How do I resolve this? in Aerohive Migrated Content

I get a lot of these email notifications "Device: [screen]: wifi0.1: ICMP flood was detected from station...." How do I resolve this?

mcdonaghc — Mon, 10 Jun 2019 19:41:16 GMT

I get a lot of these email notifications "Device: [screen]: wifi0.1: ICMP flood was detected from station...." How do I resolve this?

Re: I get a lot of these email notifications "Device: [screen]: wifi0.1: ICMP flood was detected from station...." How do I resolve this?

samantha_lynn — Mon, 10 Jun 2019 20:16:38 GMT

The station that is referenced in the message, is that an AP or a client device? You might want to run a packet capture to see if you have any clients flooding the network as well.

Re: I get a lot of these email notifications "Device: [screen]: wifi0.1: ICMP flood was detected from station...." How do I resolve this?

mcdonaghc — Tue, 11 Jun 2019 00:46:39 GMT

Typically its a client device...most often a mobile phone.

Re: I get a lot of these email notifications "Device: [screen]: wifi0.1: ICMP flood was detected from station...." How do I resolve this?

samantha_lynn — Tue, 11 Jun 2019 03:36:33 GMT

It sounds like that client device is sending out a large amount of ICMP traffic. I would recommend a packet capture so you can see every clients traffic levels and compare to see if this client is causing issues. If you can tell me which HiveManager platform you are using, I can suggest a guide on how to run the packet capture. Then if you want to send that packet capture to me along with the MAC address of the client device indicated in those alerts, I can take a look and let you know what we see.

This guide will walk you through how to determine which HiveManager you are using, for reference: https://thehivecommunity.aerohive.com/s/article/Which-HiveManager-Platform-am-I-using