I agree with Ricky Beam. You'll have to get a packet capture of the Firewall to see if you are receiving responses for a spoofed broadcast request not made by the SonicWall. Only then would we see if a Smurf / Fraggle attack is happening.
I would check performance statistics and logs on the AP's (wireless) and the SonicWall Firewll. I'd get SNMP setup to look at bandwidth utilization. Start ruling things out.
- What does your bandwidth utilization look like on the SonicWall when users report the time they experienced this issue? What's the SonicWall's bandwidth capability? Does the utilization supersede the capability?
- If you suspect a Smurf/Fraggle DDoS attack, configure the SonicWall to not respond to ICMP requests or broadcasts. Look in logs and packet captures to find the bogus broadcast replies.
- Configure SonicWall to not forward packets directed to a broadcast addresses.
- SNMP of SonicWall, look at CPU/RAM utilization. When it is high, is traffic being dropped?
- Setup Splunk free version to start capturing logs and have a look at what is happening.