Signature attack ???

Unanswered Question
Sep 16th, 2010

The wireless network use 2100 controller run 4.2.205.0 and 1242G APs.

In 2100 controller's trap log :

103 Thu Sep 16 14:49:19 2010 IDS Signature attack cleared. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-Mac, Detecting AP Name: AP9caf.ca01.c890, Radio Type: 802.11b/g, Preced: 5, Channel: 11
104 Thu Sep 16 14:49:05 2010 IDS Signature attack cleared. Signature Type: Standard, Name: Deauth flood, Description: Deauthentication flood, Track: per-Mac, Detecting AP Name: AP9caf.ca01.c870, Radio Type: 802.11b/g, Preced: 9, Channel: 1
105 Thu Sep 16 14:48:15 2010 IDS Signature attack cleared. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-signature, Detecting AP Name: AP9caf.ca01.c890, Radio Type: 802.11b/g, Preced: 5, Channel: 11

109 Thu Sep 16 14:31:49 2010 IDS Signature attack detected. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-signature, Detecting AP Name: AP9caf.ca01.c890, Radio Type: 802.11b/g, Preced: 5, Hits: 50, Channel: 11, srcMac: 00:1C:BF:7D:49:3F 
110 Thu Sep 16 14:31:23 2010 IDS Signature attack detected. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-Mac, Detecting AP Name: AP9caf.ca01.c890, Radio Type: 802.11b/g, Preced: 5, Hits: 30, Channel: 11, srcMac: 00:1C:BF:7D:49:3F

Does someone really want to attack my wireless network?

Thanks!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Leo Laohoo Thu, 09/16/2010 - 20:13

Could be.  Your AP is detecting an Intel Wireless NIC flooding de-authenticate messages.  Your best bet is to track this machine down or contain it.

Actions

This Discussion

 

 

Trending Topics - Security & Network