Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

WCS reports Deauth Attack but not destined for our network

Hi all,

So our WCS has been reporting Deauth floods (not bcast deauth) for a while. I attended the location and found that the source of the attack was a known rouge AP and then destination was apple laptop client.

In essense, nothing to do with our infrastructure, it looks like a rouge ap (or AP on another network) containing a particular client.

Why does the WCS pick this up as a deauth flood as it is not destined for one of our APs?

Can I stop the WCS from reporting this? Ie, configure the WCS to only report deauth floods that are directed at our APs?

Is this normal behaviour due to the fact that wireless is csma/ca?

Many thx,

Ken

1 REPLY
Silver

Re: WCS reports Deauth Attack but not destined for our network

Follow the URL for the WCS for running reports and configuration :

http://www.cisco.com/en/US/docs/wireless/wcs/4.2/configuration/guide/wcsreps.html

199
Views
0
Helpful
1
Replies
CreatePlease to create content