We have about 900 rx packets a second but only about 70 tx packets, something is just killing the network, the torch shows icmp protocol with src address of 0.0.0.0 and dest address to whomevers ip and just constantly going 400kbps, can’t figure it out, please help!
Tried blocking all icmp traffic, still really not helping, anyone have any suggestions on what to do?
Someone i´ts attacking your network… do you have a bridge or just doing nat?
I have seen some weird traffic lately? It was not opening many connections but the verosiy of new connections spawning is crazy. Try a connection limit per second. I think there has been a spate of zombie attacks and us wisps just get the same problems as the servers they are attacking.
Are you on the receiving end of someone’s DoS shaft? 
Try disconnecting the mac address that is causing this and work from there.
If it’s random mac addresses do sniffer dumps with a second AP on same channel. Nothing is hidden so that it can’t be revealed.