Skip to main content
Version: 1.1.x

BEACON_RATE_ANOMALY

Summary#

One of our networks is sending beacon frames in a higher frequency than expected. This could indicate that an attacker is spoofing one of our access points and that their additional beacon frames are leading to this increase.

The beacon rate and configured threshold (if configured - see Network Monitoring) is shown on the network details page:

Screenshot

A sharp increase in beacon frames will likely also show on the total frame throughput chart on the overview page:

Screenshot

Possible False Positives#

  • The beacon frequency threshold is a manual nzyme config and might be set to a wrong value.
  • A legitimate access point might have decided to increase the beacon rate. Try to adapt the beacon frequency threshold accordingly.

Notes#

See Also#