Can anyone help me understand what "Excessive Probe Frames detected" means?

Question

I am seeing many APs in a SWAN implementation generating the following errors. Clients seem to be getting disconnected regularly... Can anyone give me a guess as to what this means? The location where this is happening is a bit light on access points, but has ample radio coverage. A site survey and walkthrough was performed. Radio parameters were generated through site survey wizard... Thanks!
Excessive Deauthentication Frames from STA:00-11-20-ee-af-3e [Frames:63,Interval:500ms],
Excessive Deauthentication Frames in Channel:64 [Frames:97,Interval:500ms],
Excessive Disassociation Frames from STA:00-13-ce-35-29-25 [Frames:77,Interval:500ms],
Excessive Disassociation Frames in Channel:64 [Frames:95,Interval:500ms],
Excessive Probe Frames detected from STA:00-11-24-c8-cb-d1 [Frames:72,Interval:500ms],
Excessive Probe Frames detected in Channel:11 [Frames:75,Interval:500ms]

Answer 1

In medium-size wireless systems, 70+ in a half second may not by unusual.
Managment frames cover all sorts of status polls, beacons & the like.
If you're looking for good references, O'Reilly has a "Definitive Guide to 802.11" that's pretty good.
I also have & use the Planet3 CWNA/CWSP/CWAP certification study books, published by Osborne. They're excellent study guides for the wireless stuff, and also make pretty good references.
(CWNA - Certified Wireless Network Administrator, CWSP - Security Professional, CWAP - Analysis Professional)
If you're gathering tools, a wireless "sniffer" can also be a Very Good Thing.
AirMagnet is (by my understanding) a "cadallac" system, and pretty expensive (~$5000.00)
WildPackets "EtherPeek" for wireless also appers to be an excellet system (but it's also ~US$ 2500 or so).
I use Tamosoft's "CommView" for wireless. It's a very good basic analyzer; it doesn't have all the bells & whistles, but definately gets the job done.
Full retail it's ~US$500.00.
If you mention that you are studying for CWAP, there's usually a good discount (~$300.00 for the full package).
You can also get a one-year license for ~$200.00.
You can put in all of your systems with aliases (MAC and/or IP) for rapid ID and see which system is sending what (and log it). It can also show you other interfering or malicious traffic.
It's hard to make an evaluation without actually seeing the traffic and the source/destination info.
It could be something as simple as bad drivers, it could be something much more complex ... no way to tell unless you can see what's actually happening.
The probe frames can be someone gathering information about your system, or it could just be a bunch of clients trying to associate.
What kind of authentication do you use (if any)?
Good Luck
Scott