Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Signature attack ???

The wireless network use 2100 controller run 4.2.205.0 and 1242G APs.

In 2100 controller's trap log :

103 Thu Sep 16 14:49:19 2010 IDS Signature attack cleared. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-Mac, Detecting AP Name: AP9caf.ca01.c890, Radio Type: 802.11b/g, Preced: 5, Channel: 11
104 Thu Sep 16 14:49:05 2010 IDS Signature attack cleared. Signature Type: Standard, Name: Deauth flood, Description: Deauthentication flood, Track: per-Mac, Detecting AP Name: AP9caf.ca01.c870, Radio Type: 802.11b/g, Preced: 9, Channel: 1
105 Thu Sep 16 14:48:15 2010 IDS Signature attack cleared. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-signature, Detecting AP Name: AP9caf.ca01.c890, Radio Type: 802.11b/g, Preced: 5, Channel: 11

109 Thu Sep 16 14:31:49 2010 IDS Signature attack detected. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-signature, Detecting AP Name: AP9caf.ca01.c890, Radio Type: 802.11b/g, Preced: 5, Hits: 50, Channel: 11, srcMac: 00:1C:BF:7D:49:3F 
110 Thu Sep 16 14:31:23 2010 IDS Signature attack detected. Signature Type: Standard, Name: Auth flood, Description: Authentication Request flood, Track: per-Mac, Detecting AP Name: AP9caf.ca01.c890, Radio Type: 802.11b/g, Preced: 5, Hits: 30, Channel: 11, srcMac: 00:1C:BF:7D:49:3F

Does someone really want to attack my wireless network?

Thanks!

1 REPLY
Hall of Fame Super Gold

Re: Signature attack ???

Could be.  Your AP is detecting an Intel Wireless NIC flooding de-authenticate messages.  Your best bet is to track this machine down or contain it.

2929
Views
0
Helpful
1
Replies
CreatePlease to create content