ARP Reply-to-Broadcast

Unanswered Question
Oct 13th, 2007

I have a 2106 running 4.0.179.0 code with 6 1131 access points. 4 of those access points are located in our main office and are in our wireless VLAN. I have an IPS sensor monitoring that VLAN and I am seeing this message:

192.168.x.x/0 --> 192.168.x.x/0 N/A ARP Reply-to-Broadcast,NR-7102/0,Time:1192307707,Risk Rating:30,VLAN:x

The address is the one of the access point. Does anyone know why the access point would generate a ARP reply to broadcast with his IP address as the source and destination?

Thank you,

James

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
ivillegas Thu, 10/18/2007 - 14:24

As far as I know access point doesnt broadcast itself for any of the service. This probabaly indicates a security threat . Check for this.

p-allen Sun, 11/25/2007 - 09:17

we are seeing the same thing with the arp reply to broadcast in MARS and some of our cisco AP's. Does anybody have any ideas?

Actions

This Discussion

 

 

Trending Topics: Other Wireless Mobility

client could not be authenticated
Network Analysis Module (NAM) Products
Cisco 6500 nam
reason 440 driver failure
Cisco password cracker
Cisco Wireless mode