We have several WLCs (mostly 4402s) at several remote sites. A number of them have been showing the same strange messages? They seem to be functional for the most part. Are these cause to be alarmed? How would I go about tracking down the cause of these? I'm especially interested in the first one...it's the one that started me looking into this.
From 'Show Log' on switch to which WLC is connected:
Nov 4 12:34:58.049: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 2 times)Packet received with invalid source MAC address (3B:95:45:6B:00:1E) on port Gi1/1 in vlan 1
Decrypt errors occurred for client 00:13:e8:81:1a:a1 using WPA key on 802.11b/g interface of AP 00:1d:71:e2:a6:40
Radar signals have been detected on channel 116 by 802.11a radio with MAC: 00:1d:71:e2:a6:40 and slot 1
Channel changed for Base Radio MAC: 00:21:d8:92:7e:e0 on 802.11b/g radio. Old Channel: 1. New Channel: 11. Why: Interference. Energy before/after change: -54/-82. Noise before/after change: -82/-82. Interference before/after change: -54/-118
IDS Disassociation Flood attacks against valid clients are sometimes reported where the attacker's MAC address is that of an AP joined to that controller.
When a client is associated to the AP but stops communicating because of card removal, roaming out of range, etc. to the AP, the AP will wait until the idle timeout. Once the idle timeout is reached, the AP sends that client a disassociate frame. When the client does not acknowledge the disassociate frame, the AP retransmits the frame numerous times (around 60 frames). The IDS subsystem of the controller hears these retransmits and alerts with this message.
This bug is resolved in version 126.96.36.199. Upgrade your Controller version to this version in order to overcome this alert message against valid clients and APs.
This is a good description of the cause of this error message. I always see these messages and ignore them. Now I at least have an idea of what may be causing them. The only thing that I am confused about is that I am running 4.1.185 on my WLC's. So either the bug was not fixed in this release or I am dealing with another issue. Thoughts?