WIPS alerts

[Jeff_Roberts]

I've enabled WIPS on several APs & their controller. I enabled all alerts available in the WIPS policy I created.
I'm receiving many "excessive scanning" alerts from numerous devices but I can't find any information about this situation. What is "excessive scanning"? Does it pose a threat?
Is there any best practice document available for setting up/maintaining WING WIPS?

Thanks!
Jeff

[Sukhdeep_Singh_]

Jeff,

When you enabled the events, you must have configured some thresholds. Check the WIPS Events --> Excessive tab. The Event is triggered when the sensor finds a certain number of probe requests within a certain time interval (say Y). Both these fields are configurable and the default number is 30 scans for one client. So if you configure the time interval (Y) to 1 minute, then it is easy to trigger the event.

Please check what values are configured. For these events, you can configure thresholds depending upon how aggressive detection you want.

regards,
Sukhdeep