Welcome to Cisco Support Community. We would love to have your feedback.
For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.
We are seeing some traffic from the Guest Controller IP to internet sourced from port number 2006 to different destinations. Could you please share your thoughts?
Thanks & Regards
The WLC doesn't use TCP or UDP port 2006. I would lookup what services might be using those ports.http://www.corrupteddatarecovery.com/Port/2006tcp-Port-Type-invokator-invokator.aspSent from Cisco Technical Support iPhone App
2006/tcp invokator2006/udp raidccSent from Cisco Technical Support iPhone App
The WLC management ip address is trying to access different public ip addresses and the traffic is sourced from 2006Couldn't find much information regarding thisSent from Cisco Technical Support iPhone App
You sure it's the WLC or is it maybe another machine spoofing the WLC IP.Sent from Cisco Technical Support iPhone App
Confirmed, we are seeing the same thing.But at the exact same moment we are seeing attempted changes to our WLC's
Small sample, but we are this attempt over multiple WLC's at varing times.
claRadiusWlanIdx = 1
claRadiusPortNum = 1812
claRadiusAddress = 22.214.171.124
claRadiusAddressType = 1
snmpTrapOID = CISCO-LWAPP-AAA-MIB:ciscoLwappAAARadiusServerWlanActivated
sysUpTime = 62 days 6 hours 31 minutes 38.00 seconds
Unable to track down the source packets atm
We are actually seeing the same SNMP Trap messages on our controllers as well. They seem to correspond to a SYSLOG message of the same type but failing to our actual internal AAA servers.
The clients that are timing out all see to be mobile devices in nature: Motolora, Apple, Samsung, RIM, and even our spectralink (polycom handheld)