1. Home
  2. Cisco Systems
  3. Error messages coming from WLC

Error messages coming from WLC

We have several WLCs (mostly 4402s) at several remote sites. A number of them have been showing the same strange messages? They seem to be functional for the most part. Are these cause to be alarmed? How would I go about tracking down the cause of these? I'm especially interested in the first one...it's the one that started me looking into this.

Thanks!

From 'Show Log' on switch to which WLC is connected:

Nov 4 12:34:58.049: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 2 times)Packet received with invalid source MAC address (3B:95:45:6B:00:1E) on port Gi1/1 in vlan 1

Traps:

Decrypt errors occurred for client 00:13:e8:81:1a:a1 using WPA key on

802.11b/g interface of AP 00:1d:71:e2:a6:40

Radar signals have been detected on channel 116 by 802.11a radio with MAC: 00:1d:71:e2:a6:40 and slot 1

Channel changed for Base Radio MAC: 00:21:d8:92:7e:e0 on 802.11b/g radio. Old Channel: 1. New Channel: 11. Why: Interference. Energy before/after change: -54/-82. Noise before/after change: -82/-82. Interference before/after change: -54/-118

IDS Signature attack detected. Signature Type: Standard, Name: NULL probe resp 1, Description: NULL Probe Response - Zero length SSID element, Track: per-Mac, Detecting AP Name: 12-c11-ap8M, Radio Type:

802.11b/g, Preced: 2, Hits: 1, Channel: 11, srcMac: 00:17:FA:04:2D:CD
Reply to
pfisterfarm
Loading thread data ...

WLC's send lots of messages (both traps and logs). You can turn off the traps that you don't want to see under the SNMP configuration. The log message is because the interface received a multicast packet, and you probably don't have multicast enabled on the WLC. Nothing to worry about.

Reply to
Thrill5

Was the multicast packet coming from the WLC or going to it? Any way to tell what that packet might have been from?

Thanks!

Reply to
pfisterfarm

It was received by the device that logged the message. You need to track the multicast mac address on you switch network. I really wouldn't worry about it.

Was the multicast packet coming from the WLC or going to it? Any way to tell what that packet might have been from?

Thanks!

Reply to
Thrill5

Sounds good... how about the IDS signature attack message? I can't find too much in searching for that... what might that be?

Thanks!

Reply to
pfisterfarm

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.