Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

AP Impersonation

We've previously had problems with AP impersonation alarms but they seem to have stopped a couple of months ago. However, yesterday it started up again yesterday on another AP. This one is in our building instead of 30 min away by car so this time it's easier to experiment.

The message is as follows:

AP Impersonation of MAC '64:d8:14:37:ed:b1' using source MAC  '00:23:6c:75:8f:e7' is detected by authenticated AP 'Ekonomi_4' on  '802.11b/g' radio and Slot ID '0'.

How do I find out who/what is the source of the impersonation?

The people seated in the same area as the AP are working with salaries etc and the average technical knowledge is rather basic. Not the first ones I would suspect of attacking our network but they do have laptops and smartphones.

Everyone's tags (4)
3 REPLIES
Hall of Fame Super Silver

Re: AP Impersonation

Here is a support doc you can look at

https://supportforums.cisco.com/docs/DOC-3666

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
Community Member

Re: AP Impersonation

We're running 7.0.116.0 and the bugs mentioned in that document are  supposed to have been fixed in 4.x. It doesn't seem likely that we're  experiencing those bugs. The answer we got the last time was that likely  culprit was a laptop in the vicinity where networking card disagreed  with the AP (I'm not sure if I believe that since we tried exchanging  the original AP for a new one but the problem stayed).

If there is a real attack, how do I find out who is responsible?

Hall of Fame Super Silver

Re: AP Impersonation

You have the Mac address in the log, so you would need to try to track down that Mac address. If its a client device acting bad, then search for that Mac on the client list and see what APs are hearing that device and then go out there and try to find it with a wireless tool. It's probable a device acting up.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
690
Views
0
Helpful
3
Replies
CreatePlease to create content