Error messages coming from WLC

Discussion in 'Cisco' started by pfisterfarm, Nov 10, 2008.

  1. pfisterfarm

    pfisterfarm Guest

    We have several WLCs (mostly 4402s) at several remote sites. A number
    of them have been showing the same strange messages? They seem to be
    functional for the most part. Are these cause to be alarmed? How would
    I go about tracking down the cause of these? I'm especially interested
    in the first one...it's the one that started me looking into this.

    Thanks!

    From 'Show Log' on switch to which WLC is connected:

    Nov 4 12:34:58.049: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET:
    (Suppressed 2 times)Packet received with invalid source MAC address
    (3B:95:45:6B:00:1E) on port Gi1/1 in vlan 1

    Traps:

    Decrypt errors occurred for client 00:13:e8:81:1a:a1 using WPA key on
    802.11b/g interface of AP 00:1d:71:e2:a6:40

    Radar signals have been detected on channel 116 by 802.11a radio with
    MAC: 00:1d:71:e2:a6:40 and slot 1

    Channel changed for Base Radio MAC: 00:21:d8:92:7e:e0 on 802.11b/g
    radio. Old Channel: 1. New Channel: 11. Why: Interference. Energy
    before/after change: -54/-82. Noise before/after change: -82/-82.
    Interference before/after change: -54/-118

    IDS Signature attack detected. Signature Type: Standard, Name: NULL
    probe resp 1, Description: NULL Probe Response - Zero length SSID
    element, Track: per-Mac, Detecting AP Name: 12-c11-ap8M, Radio Type:
    802.11b/g, Preced: 2, Hits: 1, Channel: 11, srcMac: 00:17:FA:04:2D:CD
    pfisterfarm, Nov 10, 2008
    #1
    1. Advertising

  2. pfisterfarm

    Thrill5 Guest

    WLC's send lots of messages (both traps and logs). You can turn off the
    traps that you don't want to see under the SNMP configuration.
    The log message is because the interface received a multicast packet, and
    you probably don't have multicast enabled on the WLC. Nothing to worry
    about.



    "pfisterfarm" <> wrote in message
    news:...
    > We have several WLCs (mostly 4402s) at several remote sites. A number
    > of them have been showing the same strange messages? They seem to be
    > functional for the most part. Are these cause to be alarmed? How would
    > I go about tracking down the cause of these? I'm especially interested
    > in the first one...it's the one that started me looking into this.
    >
    > Thanks!
    >
    > From 'Show Log' on switch to which WLC is connected:
    >
    > Nov 4 12:34:58.049: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET:
    > (Suppressed 2 times)Packet received with invalid source MAC address
    > (3B:95:45:6B:00:1E) on port Gi1/1 in vlan 1
    >
    > Traps:
    >
    > Decrypt errors occurred for client 00:13:e8:81:1a:a1 using WPA key on
    > 802.11b/g interface of AP 00:1d:71:e2:a6:40
    >
    > Radar signals have been detected on channel 116 by 802.11a radio with
    > MAC: 00:1d:71:e2:a6:40 and slot 1
    >
    > Channel changed for Base Radio MAC: 00:21:d8:92:7e:e0 on 802.11b/g
    > radio. Old Channel: 1. New Channel: 11. Why: Interference. Energy
    > before/after change: -54/-82. Noise before/after change: -82/-82.
    > Interference before/after change: -54/-118
    >
    > IDS Signature attack detected. Signature Type: Standard, Name: NULL
    > probe resp 1, Description: NULL Probe Response - Zero length SSID
    > element, Track: per-Mac, Detecting AP Name: 12-c11-ap8M, Radio Type:
    > 802.11b/g, Preced: 2, Hits: 1, Channel: 11, srcMac: 00:17:FA:04:2D:CD
    >
    Thrill5, Nov 11, 2008
    #2
    1. Advertising

  3. pfisterfarm

    pfisterfarm Guest

    On Nov 11, 4:00 am, "Thrill5" <> wrote:
    > The log message is because the interface received a multicast packet, and
    > you probably don't have multicast enabled on the WLC.  


    Was the multicast packet coming from the WLC or going to it? Any way
    to tell what that packet might have been from?

    Thanks!
    pfisterfarm, Nov 12, 2008
    #3
  4. pfisterfarm

    Thrill5 Guest

    It was received by the device that logged the message. You need to track
    the multicast mac address on you switch network. I really wouldn't worry
    about it.


    "pfisterfarm" <> wrote in message
    news:...
    On Nov 11, 4:00 am, "Thrill5" <> wrote:
    > The log message is because the interface received a multicast packet, and
    > you probably don't have multicast enabled on the WLC.


    Was the multicast packet coming from the WLC or going to it? Any way
    to tell what that packet might have been from?

    Thanks!
    Thrill5, Nov 13, 2008
    #4
  5. pfisterfarm

    pfisterfarm Guest

    On Nov 12, 11:39 pm, "Thrill5" <> wrote:
    > It was received by the device that logged the message.  You need to track
    > the multicast mac address on you switch network.  I really wouldn't worry
    > about it.


    Sounds good... how about the IDS signature attack message? I can't
    find too much in searching for that... what might that be?

    Thanks!
    pfisterfarm, Nov 13, 2008
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Replies:
    1
    Views:
    7,262
    Aaron Leonard
    Jun 2, 2006
  2. Comwood
    Replies:
    8
    Views:
    893
    Aaron Leonard
    Jun 15, 2006
  3. Replies:
    8
    Views:
    4,486
    ...Ty
    Dec 19, 2006
  4. Andy

    WLC 2006

    Andy, May 5, 2007, in forum: Cisco
    Replies:
    2
    Views:
    440
  5. b_rizza
    Replies:
    0
    Views:
    4,493
    b_rizza
    May 21, 2010
Loading...

Share This Page