Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > Error messages coming from WLC

Reply
Thread Tools

Error messages coming from WLC

 
 
pfisterfarm
Guest
Posts: n/a
 
      11-10-2008
We have several WLCs (mostly 4402s) at several remote sites. A number
of them have been showing the same strange messages? They seem to be
functional for the most part. Are these cause to be alarmed? How would
I go about tracking down the cause of these? I'm especially interested
in the first one...it's the one that started me looking into this.

Thanks!

From 'Show Log' on switch to which WLC is connected:

Nov 4 12:34:58.049: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET:
(Suppressed 2 times)Packet received with invalid source MAC address
(3B:95:45:6B:00:1E) on port Gi1/1 in vlan 1

Traps:

Decrypt errors occurred for client 00:13:e8:81:1a:a1 using WPA key on
802.11b/g interface of AP 00:1d:71:e2:a6:40

Radar signals have been detected on channel 116 by 802.11a radio with
MAC: 00:1d:71:e2:a6:40 and slot 1

Channel changed for Base Radio MAC: 00:21:d8:92:7e:e0 on 802.11b/g
radio. Old Channel: 1. New Channel: 11. Why: Interference. Energy
before/after change: -54/-82. Noise before/after change: -82/-82.
Interference before/after change: -54/-118

IDS Signature attack detected. Signature Type: Standard, Name: NULL
probe resp 1, Description: NULL Probe Response - Zero length SSID
element, Track: per-Mac, Detecting AP Name: 12-c11-ap8M, Radio Type:
802.11b/g, Preced: 2, Hits: 1, Channel: 11, srcMac: 00:17:FA:04:2D:CD

 
Reply With Quote
 
 
 
 
Thrill5
Guest
Posts: n/a
 
      11-11-2008
WLC's send lots of messages (both traps and logs). You can turn off the
traps that you don't want to see under the SNMP configuration.
The log message is because the interface received a multicast packet, and
you probably don't have multicast enabled on the WLC. Nothing to worry
about.



"pfisterfarm" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> We have several WLCs (mostly 4402s) at several remote sites. A number
> of them have been showing the same strange messages? They seem to be
> functional for the most part. Are these cause to be alarmed? How would
> I go about tracking down the cause of these? I'm especially interested
> in the first one...it's the one that started me looking into this.
>
> Thanks!
>
> From 'Show Log' on switch to which WLC is connected:
>
> Nov 4 12:34:58.049: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET:
> (Suppressed 2 times)Packet received with invalid source MAC address
> (3B:95:45:6B:00:1E) on port Gi1/1 in vlan 1
>
> Traps:
>
> Decrypt errors occurred for client 00:13:e8:81:1a:a1 using WPA key on
> 802.11b/g interface of AP 00:1d:71:e2:a6:40
>
> Radar signals have been detected on channel 116 by 802.11a radio with
> MAC: 00:1d:71:e2:a6:40 and slot 1
>
> Channel changed for Base Radio MAC: 00:21:d8:92:7e:e0 on 802.11b/g
> radio. Old Channel: 1. New Channel: 11. Why: Interference. Energy
> before/after change: -54/-82. Noise before/after change: -82/-82.
> Interference before/after change: -54/-118
>
> IDS Signature attack detected. Signature Type: Standard, Name: NULL
> probe resp 1, Description: NULL Probe Response - Zero length SSID
> element, Track: per-Mac, Detecting AP Name: 12-c11-ap8M, Radio Type:
> 802.11b/g, Preced: 2, Hits: 1, Channel: 11, srcMac: 00:17:FA:04:2D:CD
>



 
Reply With Quote
 
 
 
 
pfisterfarm
Guest
Posts: n/a
 
      11-12-2008
On Nov 11, 4:00*am, "Thrill5" <(E-Mail Removed)> wrote:
> The log message is because the interface received a multicast packet, and
> you probably don't have multicast enabled on the WLC. *


Was the multicast packet coming from the WLC or going to it? Any way
to tell what that packet might have been from?

Thanks!
 
Reply With Quote
 
Thrill5
Guest
Posts: n/a
 
      11-13-2008
It was received by the device that logged the message. You need to track
the multicast mac address on you switch network. I really wouldn't worry
about it.


"pfisterfarm" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
On Nov 11, 4:00 am, "Thrill5" <(E-Mail Removed)> wrote:
> The log message is because the interface received a multicast packet, and
> you probably don't have multicast enabled on the WLC.


Was the multicast packet coming from the WLC or going to it? Any way
to tell what that packet might have been from?

Thanks!


 
Reply With Quote
 
pfisterfarm
Guest
Posts: n/a
 
      11-13-2008
On Nov 12, 11:39*pm, "Thrill5" <(E-Mail Removed)> wrote:
> It was received by the device that logged the message. *You need to track
> the multicast mac address on you switch network. *I really wouldn't worry
> about it.


Sounds good... how about the IDS signature attack message? I can't
find too much in searching for that... what might that be?

Thanks!
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Cisco WLC (WPA-TKIP) & iPad's - WPA MIC Error b_rizza Cisco 0 05-21-2010 05:52 AM
Help with WLC 4400 DHCP dempsey.bill@gmail.com Cisco 8 12-19-2006 11:29 PM
4112 WLC / Cisco 1000 Series - IP Conflict Comwood Cisco 8 06-15-2006 01:03 AM
2006 WLC - Radius\Active Directory Authentication Bruzer79@gmail.com Cisco 1 06-02-2006 10:45 PM
PyCon is Coming! PyCon is Coming! Steve Holden Python 0 01-05-2006 11:53 AM



Advertisments