MFP Anomaly help

[scottwilliamson]

Hi Folks,

I just spotted this on our WCS6.0

MFP Anomaly Detected - 3,461 'Invalid MIC' violation(s) have originated from the AP with BSS '00:16:9d:44:65:d0'. This was detected by the radio with Slot ID '0' of the AP with MAC '00:19:aa:f5:5b:a0' when observing 'Probe Response, Beacon, and Deauthentication' frames.

3,461 seems like far too much - is this an attack? What should I do?

The message reads "originated from the AP", I've id'd the AP in WCS - are one of our APs acting up?

What is going on?

Thanks

Scott

[Lucien Avramov]

This is a problem on the controller, the WCS is just reporting what the controller says in this case.

There are quite a few bugs on this depending the code of WLC you have:

4.2:

CSCsq87439 "MFP Anomaly Detected - 'Invalid MIC' violation(s)" messages seen on WLC

5.0,5.1 and 5.2:

CSCsl59308 EW: Many 'MFP Anomaly Detected' alarms being reported

[scottwilliamson]

Hi Lucien,

I'm running version 6.0 on the WLCs and WCS.

Can you tell me how I troubleshoot this, please? is it a false positive or an attack?

Regards

Scott