MFP Anomaly help

Unanswered Question
Aug 27th, 2009

Hi Folks,

I just spotted this on our WCS6.0

MFP Anomaly Detected - 3,461 'Invalid MIC' violation(s) have originated from the AP with BSS '00:16:9d:44:65:d0'. This was detected by the radio with Slot ID '0' of the AP with MAC '00:19:aa:f5:5b:a0' when observing 'Probe Response, Beacon, and Deauthentication' frames.

3,461 seems like far too much - is this an attack? What should I do?

The message reads "originated from the AP", I've id'd the AP in WCS - are one of our APs acting up?

What is going on?



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Lucien Avramov Fri, 08/28/2009 - 00:25

This is a problem on the controller, the WCS is just reporting what the controller says in this case.

There are quite a few bugs on this depending the code of WLC you have:


CSCsq87439 "MFP Anomaly Detected - 'Invalid MIC' violation(s)" messages seen on WLC

5.0,5.1 and 5.2:

CSCsl59308 EW: Many 'MFP Anomaly Detected' alarms being reported

scottwilliamson Mon, 09/14/2009 - 05:28

Hi Lucien,

I'm running version 6.0 on the WLCs and WCS.

Can you tell me how I troubleshoot this, please? is it a false positive or an attack?




This Discussion



Trending Topics - Security & Network