Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Traffic from Guest Controller to Internet on Port No 2006

Hello Team;

                  We are seeing some traffic from the Guest Controller IP to internet sourced from port number 2006 to different destinations. Could you please share your thoughts?

Thanks & Regards

Sreejith R

6 REPLIES
Hall of Fame Super Silver

Re: Traffic from Guest Controller to Internet on Port No 2006

The WLC doesn't use TCP or UDP port 2006. I would lookup what services might be using those ports.

http://www.corrupteddatarecovery.com/Port/2006tcp-Port-Type-invokator-invokator.asp

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
Hall of Fame Super Silver

Re: Traffic from Guest Controller to Internet on Port No 2006

2006/tcp invokator
2006/udp raidcc

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
New Member

Re: Traffic from Guest Controller to Internet on Port No 2006

The WLC management ip address is trying to access different public ip addresses and the traffic is sourced from 2006

Couldn't find much information regarding this



Sent from Cisco Technical Support iPhone App

Hall of Fame Super Silver

Re: Traffic from Guest Controller to Internet on Port No 2006

You sure it's the WLC or is it maybe another machine spoofing the WLC IP.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
New Member

Re: Traffic from Guest Controller to Internet on Port No 2006

Confirmed, we are seeing the same thing.
But at the exact same moment we are seeing attempted changes to our WLC's

Small sample, but we are this attempt over multiple WLC's at varing times.

claRadiusWlanIdx = 1

claRadiusPortNum = 1812

claRadiusAddress = 49.55.50.4​6

claRadiusAddressType = 1

snmpTrapOID = CISCO-LWAP​P-AAA-MIB:c​iscoLwappA​AARadiusSe​rverWlanAc​tivated

sysUpTime = 62 days 6 hours 31 minutes 38.00 seconds

2013-12-08 22:17:46

23.53.151.91

172.16.80.41

invokator (2006 TCP)TCP83.00 p846.25 Kb
22013-11-29 11:40:16

172.16.80.41

23.53.151.91

invokator (2006 TCP)TCP1.00 p416.00 b
32013-11-29 11:40:16

172.16.80.41

23.53.151.91

invokator (2006 TCP)TCP1.00 p416.00 b
42013-11-29 11:40:16

172.16.80.41

23.53.151.91

invokator (2006 TCP)TCP1.00 p416.00 b
52013-11-29 11:40:16

23.53.151.91

172.16.80.41

invokator (2006 TCP)TCP1.00 p320.00 b
62013-11-29 11:40:16

23.53.151.91

172.16.80.41

invokator (2006 TCP)TCP1.00 p320.00 b
72013-11-29 11:40:16

23.53.151.91

172.16.80.41

invokator (2006 TCP)TCP1.00 p320.00 b

Unable to track down the source packets atm

New Member

Traffic from Guest Controller to Internet on Port No 2006

We are actually seeing the same SNMP Trap messages on our controllers as well. They seem to correspond to a SYSLOG message of the same type but failing to our actual internal AAA servers.

The clients that are timing out all see to be mobile devices in nature: Motolora, Apple, Samsung, RIM, and even our spectralink (polycom handheld)

773
Views
0
Helpful
6
Replies