Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Site Wireless Problem

Dears,

I would visiting some site today and all the users who are attached to AP 1242 is facing problem being disconnected from SSID and having to reauthenticate , i thought that this might be due to Rogue APs that are sending Deauthentication packets the clients specially when i saw the logs below so i thought to share this and double check with you guyz and wat steps should i follow to locate this AP or how to prevent this attack.Thanks.....

Note : the logs shows that WLC was rebooted and it was me just not to think that it keeps crashing or anything , the WLC is stable.

APs : 1242

WLC : 4400 Series

Log

System Time

Trap

0

Sun Jan 19 12:36:15 2014

Interference Profile Updated to Pass for Base Radio MAC:   00:3a:98:7d:98:50 and slotNo: 0

1

Sun Jan 19 12:33:15 2014

Interference Profile Failed for Base Radio MAC:   00:3a:98:7d:98:50 and slotNo: 0

2

Sun Jan 19 12:18:09 2014

Rogue AP : 00:13:10:4b:59:ae detected on Base Radio MAC :   00:3a:98:7d:86:d0 Interface no:0(802.11b/g) with RSSI: -128 and SNR: 83

3

Sun Jan 19 12:13:05 2014

AP Disassociated. Base Radio MAC:00:3a:98:7d:a8:50

4

Sun Jan 19 12:13:05 2014

AP's Interface:1(802.11a) Operation State Down: Base Radio   MAC:00:3a:98:7d:a8:50 Cause=Max Retrasmission

5

Sun Jan 19 12:13:05 2014

AP's Interface:0(802.11b) Operation State Down: Base Radio   MAC:00:3a:98:7d:a8:50 Cause=Max Retrasmission

6

Sun Jan 19 12:07:52 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d324, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

7

Sun Jan 19 12:02:55 2014

Interference Profile Updated to Pass for Base Radio MAC:   00:3a:98:7d:99:70 and slotNo: 0

8

Sun Jan 19 11:57:54 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac, Detecting   AP Name: AP68ef.bdc2.d324, Radio Type: 802.11b/g, Preced: 5, Hits: 30,   Channel: 11, srcMac: D0:B3:3F:9A:80:35

9

Sun Jan 19 11:50:59 2014

Coverage hole cleared for Base Radio MAC: 00:3a:98:7d:99:70   and slotNo: 0

10

Sun Jan 19 11:50:55 2014

Interference Profile Failed for Base Radio MAC:   00:3a:98:7d:99:70 and slotNo: 0

11

Sun Jan 19 11:47:59 2014

Coverage Hole Detected for AP AP68ef.bdc2.d324 whose Base   Radio MAC is 00:3a:98:7d:99:70. Number of Failing Clients 1

12

Sun Jan 19 11:12:10 2014

Channel changed for Base Radio MAC: 00:3a:98:7d:86:d0 on   802.11b/g radio. Old Channel: 11. New Channel: 1. Why: Interference. Energy   before/after change: -42/-57. Noise before/after change: -81/-82.   Interference before/after change: -42/-57.

13

Sun Jan 19 11:04:33 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:9d:f0

14

Sun Jan 19 11:02:54 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:a8:50

15

Sun Jan 19 10:59:36 2014

AP Disassociated. Base Radio MAC:00:3a:98:7d:a8:50

16

Sun Jan 19 10:59:36 2014

AP's Interface:1(802.11a) Operation State Down: Base Radio   MAC:00:3a:98:7d:a8:50 Cause=Max Retrasmission

17

Sun Jan 19 10:59:36 2014

AP's Interface:0(802.11b) Operation State Down: Base Radio   MAC:00:3a:98:7d:a8:50 Cause=Max Retrasmission

18

Sun Jan 19 10:45:28 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d07a, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

19

Sun Jan 19 10:41:52 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bde3.25ba, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

20

Sun Jan 19 10:41:52 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.25ba, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

21

Sun Jan 19 10:41:09 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d336, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

22

Sun Jan 19 10:41:09 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.266e, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

23

Sun Jan 19 10:41:08 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.24d8, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

24

Sun Jan 19 10:38:57 2014

Interference Profile Updated to Pass for Base Radio MAC:   00:3a:98:7d:9a:00 and slotNo: 0

25

Sun Jan 19 10:35:57 2014

Interference Profile Failed for Base Radio MAC:   00:3a:98:7d:9a:00 and slotNo: 0

26

Sun Jan 19 10:35:30 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d07a, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 11, srcMac: BC:3B:AF:7E:FD:D3

27

Sun Jan 19 10:31:54 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bde3.25ba, Radio Type: 802.11b/g, Preced: 5, Hits:   50, Channel: 1, srcMac: D0:B3:3F:9A:80:35

28

Sun Jan 19 10:31:54 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.25ba, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 1, srcMac: D0:B3:3F:9A:80:35

29

Sun Jan 19 10:31:10 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.266e, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 11, srcMac: BC:3B:AF:7E:FD:D3

30

Sun Jan 19 10:31:10 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.24d8, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 11, srcMac: BC:3B:AF:7E:FD:D3

31

Sun Jan 19 10:31:10 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d336, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 11, srcMac: BC:3B:AF:7E:FD:D3

32

Sun Jan 19 10:23:50 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d324, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

33

Sun Jan 19 10:23:50 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bde3.26d8, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

34

Sun Jan 19 10:23:50 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.26d8, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

35

Sun Jan 19 10:13:51 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bde3.26d8, Radio Type: 802.11b/g, Preced: 5, Hits:   50, Channel: 1, srcMac: D0:B3:3F:9A:80:35

36

Sun Jan 19 10:13:51 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d324, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 11, srcMac: D0:B3:3F:9A:80:35

37

Sun Jan 19 10:13:50 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.26d8, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 1, srcMac: D0:B3:3F:9A:80:35

38

Sun Jan 19 10:01:06 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bdc2.d324, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

39

Sun Jan 19 10:01:06 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d324, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

40

Sun Jan 19 10:00:16 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.25ba, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

41

Sun Jan 19 09:51:07 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bdc2.d324, Radio Type: 802.11b/g, Preced: 5, Hits:   50, Channel: 11, srcMac: D0:B3:3F:9A:80:35

42

Sun Jan 19 09:51:06 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d324, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 11, srcMac: D0:B3:3F:9A:80:35

43

Sun Jan 19 09:50:18 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.25ba, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 1, srcMac: D0:B3:3F:9A:80:35

44

Sun Jan 19 09:13:17 2014

Load Profile Updated to Pass for Base Radio MAC:   00:3a:98:7d:99:20 and slotNo: 0

45

Sun Jan 19 09:12:17 2014

Load Profile Failed for Base Radio MAC: 00:3a:98:7d:99:20 and   slotNo: 0

46

Sun Jan 19 09:11:17 2014

Channel changed for Base Radio MAC: 00:3a:98:7d:99:20 on   802.11b/g radio. Old Channel: 6. New Channel: 1. Why: Interference. Energy   before/after change: -64/-74. Noise before/after change: -80/-82.   Interference before/after change: -64/-94.

47

Sun Jan 19 09:06:07 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bde3.2f2a, Radio Type: 802.11b/g, Preced: 5, Channel:   1

48

Sun Jan 19 09:06:07 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.2f2a, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

49

Sun Jan 19 09:05:40 2014

AP Disassociated. Base Radio MAC:00:3a:98:7d:9d:f0

50

Sun Jan 19 09:05:40 2014

AP's Interface:1(802.11a) Operation State Down: Base Radio   MAC:00:3a:98:7d:9d:f0 Cause=Heartbeat Timeout

51

Sun Jan 19 09:05:40 2014

AP's Interface:0(802.11b) Operation State Down: Base Radio   MAC:00:3a:98:7d:9d:f0 Cause=Heartbeat Timeout

52

Sun Jan 19 09:00:58 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d048, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

53

Sun Jan 19 08:56:07 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bde3.2f2a, Radio Type: 802.11b/g, Preced: 5, Hits:   50, Channel: 1, srcMac: D0:B3:3F:C3:0E:D3

54

Sun Jan 19 08:54:20 2014

Coverage hole cleared for Base Radio MAC: 00:3a:98:7d:ad:a0   and slotNo: 0

55

Sun Jan 19 08:53:08 2014

Load Profile Updated to Pass for Base Radio MAC:   00:3a:98:7d:99:20 and slotNo: 0

56

Sun Jan 19 08:52:08 2014

Load Profile Failed for Base Radio MAC: 00:3a:98:7d:99:20 and   slotNo: 0

57

Sun Jan 19 08:51:20 2014

Coverage Hole Detected for AP AP68ef.bde3.25ac whose Base   Radio MAC is 00:3a:98:7d:ad:a0. Number of Failing Clients 1

58

Sun Jan 19 08:51:19 2014

Interference Profile Updated to Pass for Base Radio MAC:   00:3a:98:7d:f9:50 and slotNo: 0

59

Sun Jan 19 08:51:08 2014

Channel changed for Base Radio MAC: 00:3a:98:7d:99:20 on   802.11b/g radio. Old Channel: 1. New Channel: 6. Why: Interference. Energy   before/after change: -68/-79. Noise before/after change: -82/-80.   Interference before/after change: -69/-99.

60

Sun Jan 19 08:51:08 2014

Channel changed for Base Radio MAC: 00:3a:98:7d:a8:50 on   802.11b/g radio. Old Channel: 11. New Channel: 1. Why: none. Energy   before/after change: -76/-82. Noise before/after change: -81/-82.   Interference before/after change: -117/-118.

61

Sun Jan 19 08:51:08 2014

Channel changed for Base Radio MAC: 00:3a:98:7d:b7:60 on   802.11b/g radio. Old Channel: 11. New Channel: 1. Why: none. Energy   before/after change: -77/-82. Noise before/after change: -81/-82. Interference   before/after change: -117/-118.

62

Sun Jan 19 08:51:04 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.25ba, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

63

Sun Jan 19 08:51:00 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d048, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 1, srcMac: 00:3A:98:7D:F9:50

64

Sun Jan 19 08:51:00 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.2f2a, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 1, srcMac: D0:B3:3F:C3:0E:D3

65

Sun Jan 19 08:50:20 2014

Rogue : 00:25:00:ff:94:73 removed from Base Radio MAC :   00:3a:98:7d:a0:a0 Interface no:0(802.11b/g)

66

Sun Jan 19 08:48:19 2014

Interference Profile Failed for Base Radio MAC:   00:3a:98:7d:f9:50 and slotNo: 0

67

Sun Jan 19 08:41:05 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.25ba, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 1, srcMac: D0:B3:3F:9A:80:35

68

Sun Jan 19 08:30:20 2014

Rogue AP : 00:25:00:ff:94:73 detected on Base Radio MAC :   00:3a:98:7d:a0:a0 Interface no:0(802.11b/g) with RSSI: -85 and SNR: 10

69

Sun Jan 19 08:30:09 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d320, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

70

Sun Jan 19 08:30:09 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d048, Radio Type: 802.11b/g, Preced: 5,   Channel: 1

71

Sun Jan 19 08:26:31 2014

Rogue AP : 00:23:69:79:83:1a detected on Base Radio MAC :   00:3a:98:75:6c:40 Interface no:0(802.11b/g) with RSSI: -89 and SNR: 8

72

Sun Jan 19 08:26:29 2014

Rogue AP : 64:66:b3:8b:a3:40 detected on Base Radio MAC :   00:3a:98:7d:a1:50 Interface no:0(802.11b/g) with RSSI: -86 and SNR: 7

73

Sun Jan 19 08:26:29 2014

Rogue AP : 64:66:b3:8b:a3:40 detected on Base Radio MAC : 00:3a:98:7d:b7:60   Interface no:0(802.11b/g) with RSSI: -87 and SNR: 5

74

Sun Jan 19 08:20:11 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d048, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 1, srcMac: 00:3A:98:7D:F9:50

75

Sun Jan 19 08:20:11 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bdc2.d320, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 1, srcMac: 00:3A:98:7D:F9:50

76

Sun Jan 19 08:06:49 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bde3.2654, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

77

Sun Jan 19 08:06:49 2014

IDS Signature attack cleared. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.2654, Radio Type: 802.11b/g, Preced: 5,   Channel: 11

78

Sun Jan 19 08:01:59 2014

Rogue AP : 00:24:c3:f8:2b:30 detected on Base Radio MAC :   00:3a:98:7d:94:60 Interface no:0(802.11b/g) with RSSI: -87 and SNR: 11

79

Sun Jan 19 08:00:20 2014

Rogue AP : 00:26:44:2a:31:e9 detected on Base Radio MAC :   00:3a:98:7d:99:20 Interface no:0(802.11b/g) with RSSI: -83 and SNR: 16

80

Sun Jan 19 08:00:20 2014

Rogue AP : 00:26:44:2a:31:e9 detected on Base Radio MAC :   00:3a:98:7d:b2:f0 Interface no:0(802.11b/g) with RSSI: -56 and SNR: 43

81

Sun Jan 19 08:00:20 2014

Rogue AP : 00:26:44:2a:31:e9 detected on Base Radio MAC :   00:3a:98:7d:ab:30 Interface no:0(802.11b/g) with RSSI: -95 and SNR: 0

82

Sun Jan 19 08:00:20 2014

Rogue AP : 00:26:44:2a:31:e9 detected on Base Radio MAC :   00:3a:98:7d:f9:50 Interface no:0(802.11b/g) with RSSI: -56 and SNR: 41

83

Sun Jan 19 08:00:20 2014

Rogue AP : 00:26:44:2a:31:e9 detected on Base Radio MAC :   00:3a:98:7d:a6:d0 Interface no:0(802.11b/g) with RSSI: -87 and SNR: 11

84

Sun Jan 19 08:00:20 2014

Rogue AP : 00:26:44:2a:31:e9 detected on Base Radio MAC :   00:3a:98:7d:b3:a0 Interface no:0(802.11b/g) with RSSI: -72 and SNR: 27

85

Sun Jan 19 07:59:58 2014

Rogue AP : 00:13:10:4b:59:ae detected on Base Radio MAC :   00:3a:98:7d:a8:50 Interface no:0(802.11b/g) with RSSI: -81 and SNR: 17

86

Sun Jan 19 07:59:58 2014

Rogue AP : 00:13:10:4b:59:ae detected on Base Radio MAC :   00:3a:98:7d:86:d0 Interface no:0(802.11b/g) with RSSI: -128 and SNR: 85

87

Sun Jan 19 07:59:29 2014

Rogue AP : 00:13:10:4b:59:9c detected on Base Radio MAC :   00:3a:98:7d:9d:f0 Interface no:0(802.11b/g) with RSSI: -87 and SNR: 7

88

Sun Jan 19 07:59:29 2014

Rogue AP : 00:13:10:4b:59:9c detected on Base Radio MAC :   00:3a:98:75:6c:40 Interface no:0(802.11b/g) with RSSI: -62 and SNR: 30

89

Sun Jan 19 07:59:29 2014

Rogue AP : 00:13:10:4b:59:9c detected on Base Radio MAC :   00:3a:98:7d:a7:a0 Interface no:0(802.11b/g) with RSSI: -83 and SNR: 11

90

Sun Jan 19 07:56:50 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-signature,   Detecting AP Name: AP68ef.bde3.2654, Radio Type: 802.11b/g, Preced: 5, Hits:   50, Channel: 11, srcMac: D0:B3:3F:C3:0E:D3

91

Sun Jan 19 07:56:49 2014

IDS Signature attack detected. Signature Type: Standard, Name:   Auth flood, Description: Authentication Request flood, Track: per-Mac,   Detecting AP Name: AP68ef.bde3.2654, Radio Type: 802.11b/g, Preced: 5, Hits:   30, Channel: 11, srcMac: D0:B3:3F:C3:0E:D3

92

Sun Jan 19 07:54:20 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:a0:a0

93

Sun Jan 19 07:54:19 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:83:b0

94

Sun Jan 19 07:54:19 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:b2:f0

95

Sun Jan 19 07:54:19 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:ab:30

96

Sun Jan 19 07:54:19 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:ad:a0

97

Sun Jan 19 07:54:19 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:a8:50

98

Sun Jan 19 07:54:18 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:f9:50

99

Sun Jan 19 07:54:18 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:a6:d0

100

Sun Jan 19 07:54:18 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:b3:a0

101

Sun Jan 19 07:54:18 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:98:50

102

Sun Jan 19 07:54:15 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:a1:50

103

Sun Jan 19 07:54:10 2014

AP Associated. Base Radio MAC: 00:3a:98:75:6a:d0

104

Sun Jan 19 07:54:10 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:9d:f0

105

Sun Jan 19 07:53:59 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:9a:00

106

Sun Jan 19 07:53:58 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:82:20

107

Sun Jan 19 07:53:58 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:99:70

108

Sun Jan 19 07:53:58 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:8f:a0

109

Sun Jan 19 07:53:57 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:86:d0

110

Sun Jan 19 07:53:53 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:99:20

111

Sun Jan 19 07:53:30 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:a8:20

112

Sun Jan 19 07:53:30 2014

AP Associated. Base Radio MAC: 00:3a:98:75:6c:40

113

Sun Jan 19 07:53:28 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:b7:60

114

Sun Jan 19 07:53:27 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:a7:a0

115

Sun Jan 19 07:53:01 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:ae:10

116

Sun Jan 19 07:53:01 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:82:90

117

Sun Jan 19 07:52:58 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:9a:50

118

Sun Jan 19 07:52:57 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:94:60

119

Sun Jan 19 07:52:57 2014

AP Associated. Base Radio MAC: 00:3a:98:7d:b6:e0

120

Sun Jan 19 07:51:36 2014

Controller time base status - Controller is out of sync with   the central timebase.

121

Sun Jan 19 07:51:29 2014

Link Up: Slot: 0 Port: 2

122

Sun Jan 19 07:51:29 2014

Link Up: Slot: 0 Port: 1

123

Sun Jan 19 07:50:52 2014

Cold Start:


  • Getting Started with Wireless
2 ACCEPTED SOLUTIONS

Accepted Solutions
VIP Purple

Site Wireless Problem

HI Maro,





19 12:33:15 2014

Interference Profile Failed for Base Radio MAC:   00:3a:98:7d:98:50 and slotNo: 0

2



In general the Interference Profile message occurs when the noise or interference in the area of an AP has risen over the threshold value. This value can be configured in Wireless > 802.11a/n | 802.11b/g/n > RRM > General

44

Sun Jan 19 09:13:17 2014

Load Profile Updated to Pass for Base Radio MAC:   00:3a:98:7d:99:20 and slotNo: 0

45



Load profile has to so with the number of clients per radio. Though this is just a warning message, it doesn't kick clients off when they are over the limit.

12

Sun Jan 19 11:12:10 2014

Channel changed for Base Radio MAC: 00:3a:98:7d:86:d0 on   802.11b/g radio. Old Channel: 11. New Channel: 1. Why: Interference. Energy   before/after change: -42/-57. Noise before/after change: -81/-82.   Interference before/after change: -42/-57.

13


Channel changes is a hard drop to clients.You need to change the RRM value to a high value to prevent this. I usually will set it to 24 hours after RRM settles down. it looks like the AP is changing channel due to a too high interference on channels and the client is consequently being disassociated. You may for example wanna look into your RF spectrum to check whether you have other APs creating co-channel interference.

You mst find the rouge APs and clients in your network and remove them.

Regards

Hall of Fame Super Silver

Re: Site Wireless Problem

The best thing is to go onsite:) also take a look at the clients and their configuration and drivers. I have seen devices that are bad send de-auth's also. Locate the area where the complaints are by asking the users and use a tool to see or find the rouge if that is the issue. I would also look at the access point by Telnet or SSH to see if it has enough memory in flash. Crash files can take up a lot of space and cause issue. Clean these files out of the access point also and continue your testing. Good luck with your troubleshooting, hopefully it's something simple.

Sent from Cisco Technical Support iPhone App

Thanks, Scott *****Help out other by using the rating system and marking answered questions as "Answered"*****
6 REPLIES
VIP Purple

Site Wireless Problem

HI Maro,





19 12:33:15 2014

Interference Profile Failed for Base Radio MAC:   00:3a:98:7d:98:50 and slotNo: 0

2



In general the Interference Profile message occurs when the noise or interference in the area of an AP has risen over the threshold value. This value can be configured in Wireless > 802.11a/n | 802.11b/g/n > RRM > General

44

Sun Jan 19 09:13:17 2014

Load Profile Updated to Pass for Base Radio MAC:   00:3a:98:7d:99:20 and slotNo: 0

45



Load profile has to so with the number of clients per radio. Though this is just a warning message, it doesn't kick clients off when they are over the limit.

12

Sun Jan 19 11:12:10 2014

Channel changed for Base Radio MAC: 00:3a:98:7d:86:d0 on   802.11b/g radio. Old Channel: 11. New Channel: 1. Why: Interference. Energy   before/after change: -42/-57. Noise before/after change: -81/-82.   Interference before/after change: -42/-57.

13


Channel changes is a hard drop to clients.You need to change the RRM value to a high value to prevent this. I usually will set it to 24 hours after RRM settles down. it looks like the AP is changing channel due to a too high interference on channels and the client is consequently being disassociated. You may for example wanna look into your RF spectrum to check whether you have other APs creating co-channel interference.

You mst find the rouge APs and clients in your network and remove them.

Regards

Hall of Fame Super Silver

Re: Site Wireless Problem

The best thing is to go onsite:) also take a look at the clients and their configuration and drivers. I have seen devices that are bad send de-auth's also. Locate the area where the complaints are by asking the users and use a tool to see or find the rouge if that is the issue. I would also look at the access point by Telnet or SSH to see if it has enough memory in flash. Crash files can take up a lot of space and cause issue. Clean these files out of the access point also and continue your testing. Good luck with your troubleshooting, hopefully it's something simple.

Sent from Cisco Technical Support iPhone App

Thanks, Scott *****Help out other by using the rating system and marking answered questions as "Answered"*****
New Member

Site Wireless Problem

so

Wireless > 802.11a/n | 802.11b/g/n > RRM > General > then should i change

Channel Scan Interval or

Neighbor Packet Frequency

Hall of Fame Super Silver

Site Wireless Problem

I would not change that.  What I would change is the DCA and set that to 24 hours. 

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

Thanks, Scott *****Help out other by using the rating system and marking answered questions as "Answered"*****
Hall of Fame Super Silver

Site Wireless Problem

I would also monitor the number of clients on these access point as if you notice that a certain number of clients cause issues, then that would mean that a work around would be to add more AP's to help with the load.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

Thanks, Scott *****Help out other by using the rating system and marking answered questions as "Answered"*****
Hall of Fame Super Silver

Site Wireless Problem

You can take some base lines also by providing a show run-config when the wireless is at its peak and when its late in the evening.  This can help up see how the environment really is as that info provide a lot of useful data.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

Thanks, Scott *****Help out other by using the rating system and marking answered questions as "Answered"*****
901
Views
0
Helpful
6
Replies