How to avoid false alarms? #508
-
|
I see false alarms (UNEXPECTED_CHANNEL_BEACON, UNEXPECTED_CHANNEL_PROBERESP) which are based on a single frame. Is it possible to generate alarms only at a higher number of frames? Or doesn't this make sense? I see false alarms (BEACON_RATE_ANOMALY) for spikes for peaks that occur very rarely. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment
-
|
Hi, the reason for this is most likely that your access point is performing some sort of operation on those channels and only with very few frames. Sometimes APs do this to contact devices on other channels to direct them to their active channels. I understand that this is causing false alarms and can make those alarm types fairly useless. I've created an issue/feature request: #509 This sounds like a small addition but would actually include a significant change to the alerting engine. I agree that it's an important issue and that it should be implemented, but it won't make it into v1.2.0 yet. Thanks, |
Beta Was this translation helpful? Give feedback.
Hi,
the reason for this is most likely that your access point is performing some sort of operation on those channels and only with very few frames. Sometimes APs do this to contact devices on other channels to direct them to their active channels.
I understand that this is causing false alarms and can make those alarm types fairly useless. I've created an issue/feature request: #509
This sounds like a small addition but would actually include a significant change to the alerting engine. I agree that it's an important issue and that it should be implemented, but it won't make it into v1.2.0 yet.
Thanks,
Lennart