topic IPS/MARS message help in Network Security https://community.cisco.com/t5/network-security/ips-mars-message-help/m-p/882428#M85227 <P>We are seeing a simalr message as stated below. It seems to be coming from our Cisco AP. What could be causing this and is it a false positive?</P><P></P><P>192.168.x.x/0 --&gt; 192.168.x.x/0 N/A ARP Reply-to-Broadcast,NR-7102/0,Time:1192307707,Risk Rating:30,VLAN:x </P><P></P> Sun, 10 Mar 2019 10:52:55 GMT p-allen 2019-03-10T10:52:55Z IPS/MARS message help https://community.cisco.com/t5/network-security/ips-mars-message-help/m-p/882428#M85227 <P>We are seeing a simalr message as stated below. It seems to be coming from our Cisco AP. What could be causing this and is it a false positive?</P><P></P><P>192.168.x.x/0 --&gt; 192.168.x.x/0 N/A ARP Reply-to-Broadcast,NR-7102/0,Time:1192307707,Risk Rating:30,VLAN:x </P><P></P> Sun, 10 Mar 2019 10:52:55 GMT https://community.cisco.com/t5/network-security/ips-mars-message-help/m-p/882428#M85227 p-allen 2019-03-10T10:52:55Z Re: IPS/MARS message help https://community.cisco.com/t5/network-security/ips-mars-message-help/m-p/882429#M85231 <HTML><HEAD></HEAD><BODY><P>There are products that use ARP broadcasts as a component of heartbeat/failover...so yes, you may see false positives for this signature. Cisco ASA is one example of many. Enable the trigger packet and you should be able to track down the "offending" device.</P></BODY></HTML> Mon, 26 Nov 2007 14:32:29 GMT https://community.cisco.com/t5/network-security/ips-mars-message-help/m-p/882429#M85231 mhellman 2007-11-26T14:32:29Z