Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Users might experience few discrepancies in Search results. We are working on this on our side. We apologize for the inconvenience it may have caused.
New Member

WCS - many alerts "Spoofed Mac address detected"

Hello,

We have deployed WCS-PLUS, with MSE and Wips access points.

The system sends many alerts ""Spoofed Mac address detected", but when we investigate, they are not tryinf to spoof devices, it's only devices which automatically try to connect to broadcasted SSID or try to connect to SSID they know...

Is this a bug, or is there an explanation ?

Thanks to you,

Regards,

1 REPLY
New Member

WCS - many alerts "Spoofed Mac address detected"

Hello,

It seems that these alerts are generated by the WCS and not the WLC.

It seems too that as there are many wireless devices with wireless card on, but not associated, from the same vendor (intel, apple), the wcs is seeing different devices with same OUI (thats' normal).

"The spoofed MAC Address may not have contained a valid OUI assigned by the IEEE and could have been randomly generated by a potential attacker probing for SSIDs in use."

Someone has an idea ?

Thanks to you,

regards,

826
Views
0
Helpful
1
Replies
CreatePlease to create content