Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IPS/MARS message help

We are seeing a simalr message as stated below. It seems to be coming from our Cisco AP. What could be causing this and is it a false positive?

192.168.x.x/0 --> 192.168.x.x/0 N/A ARP Reply-to-Broadcast,NR-7102/0,Time:1192307707,Risk Rating:30,VLAN:x

1 REPLY
Gold

Re: IPS/MARS message help

There are products that use ARP broadcasts as a component of heartbeat/failover...so yes, you may see false positives for this signature. Cisco ASA is one example of many. Enable the trigger packet and you should be able to track down the "offending" device.

153
Views
5
Helpful
1
Replies
CreatePlease to create content