• 802.1X Dictionary Attack: A node is generating multiple login attempts by using common words found in a dictionary.

• ARP Request Storm: A high count of ARP requests are flooding the network.

• Broadcast Storm: A sustained level of all stations broadcast packets (the destination physical address consists of all 1s) has met or exceeded the threshold.

• Multicast Storm: A sustained level of multicast (the broadcast bit in the destination physical address is set to 1) packets has met or exceeded the threshold.

• Severe Broadcast Storm: A sustained level of all stations broadcast packets (the destination physical address consists of all 1s) has met or exceeded the threshold. Severe Multicast Storm

• Severe Multicast Storm: A sustained level of multicast packets has met or exceeded the threshold (the broadcast bit in the destination physical address is set to 1).

• Spanning Tree Topology Change: The actively forwarding bridge (or switch) port for this segment has changed.

• EAP Authentication Failure: Using the 802.1x framework to carry EAP requests and responses (such as Cisco LEAP), an authenticator cannot authenticate the client.

• Gratuitous ARP: A gratuitous ARP packet is either an ARP reply which is not a response to an ARP request or to which no reply is expected.