In an environment with some 50 350 and 1200 APs and a new WLSE 2.0, I find myself scratching my head over this one: a device has popped up in my list of associations- no IP address- but the network map from any AP calls it a bridge, shows up in the association table as a repeater. MAC can't traced either through the WLSE or ARP tables on the network, yet it is clearly be seen by some AP or it wouldn't be on the list. Any one know how to tell which AP this thing is getting it's radio signal from, or how to get more info about it? Point is, if it makes the network map, seems like the device that got wind of it should be able to be identified.
Don't know what rev. your AP's are at but, if you haven't checked into this you might want to take a look. Upon the loss of the ethernet (backbone)connection your AP's radio can be configured to do 1 of 4 options, No Action, Shut the Radio off, Restrict to SSID or Switch to Repeater Mode. I believe the Switch to Repeater Mode is the default. This is defined under the ethernet hardware area of the AP. Not sure if this could help or not or why the AP wouldn't retain it's IP address.
Transferring Crash file from standby: Login to the Active WLC in HA.
From CLI: (Cisco Controller) >transfer upload datatype crash (Cisco
Controller) >transfer upload filename (Cisco
Controller) >transfer upload mode tftp (Cisco Controller) >transfer
This is the start of a display filter cross reference between Wireshark
and OmniPeek. The 1st installment is a table of advanced filters. More
filters will be added as time allows. It is a living doc, so check back
for changes every so often Please feel f...