More likely, this is another example of a false-positive generated by the wireless IDS.
From discussions with Cisco TAC it would appear that there are a number of client behaviors that vary from wireless client to wireless client.
At times, while not actual attacks (in the sense that someone is attempting to attack your network), the RF traffic generated by these clients will match some of the pre-programmed criteria in the Wireless IDS signature file - resulting in a false positive.
The values in the signature file can be adjusted. For example, you might want to adjust some of the parameters so that more of these messages need to happen in the same time frame before they are considered an alarm, etc.
However, you will want to be careful so as not to adjust the values in such a way that the alarm is effectively disabled.
If your experience is like ours, questions to Cisco TAC (even their tier 3 personnel) regarding how to tune this signature file without accidentally disabling an alarm will result in an awkward silence at the other end of the phone - as they do not appear to have any idea as to how to tweak the file.
Also, as pointed out in the forum in other posts, there does not appear to be any meaningful documentation pertainint to what these alarms are (their actual potential security threat, etc.) as well as what might cause them (intentionally and accidentally).
To date, I have been unable to find any meaningful published documentation, urban legend, or colorful anectdote providing guidance as to how an administrator might "tune" these parameters without breaking the system.
Currently, the best (i.e.: lease sparse) form of documentation is in the comments section of the signature file itself.
I hope this helps...
John
(please remember to rate helpful posts)
