topic Re: AES-CCMP TSC replay was detected in Wireless

AES-CCMP TSC replay was detected

ney25 — Sat, 03 Jul 2021 21:41:22 GMT

Hi NetPro,

anyone know the below error msg stand for ?

AES-CCMP TSC replay was detected on a packet (TSC 0x1C07) received from 001b.7709.0301.

your reply will be highly appreciated.

regards,

Jackal

Re: AES-CCMP TSC replay was detected

gmarogi — Wed, 03 Oct 2007 20:47:00 GMT

This is similar to a replay attack. AES-CCMP TSC replay was indicated on a frame( a frame with the same TSC(Sequence number). A replay of the AES-CCMP TSC in a received packet almost indicates an active attack.

To understand and proceed further, where do you see this error message?. I mean in which device you are seeing this message?

Re: AES-CCMP TSC replay was detected

ney25 — Wed, 03 Oct 2007 23:30:07 GMT

Hi Gmarogi,

this error msg was detected from my Access Point.

your reply will be highly apprecited.

thanks,

Jackal

Re: AES-CCMP TSC replay was detected

sulenbalber — Mon, 03 Feb 2020 18:23:01 GMT

I have the same issue

Re: AES-CCMP TSC replay was detected

patoberli — Tue, 04 Feb 2020 14:29:11 GMT

Could be a client wireless driver bug or also a bug in the AP firmware.

Re: AES-CCMP TSC replay was detected

Wil78 — Tue, 30 Jun 2020 14:49:48 GMT

Hi all I have the same fault, I could solve it somehow

Client 88b1.1109.xxxx had 1 TKIP TSC replays

Cisco Aireonet 1260

Re: AES-CCMP TSC replay was detected

Rasika Nayanajith — Tue, 30 Jun 2020 18:21:24 GMT

Do you still use TKIP/RC4 encryption under radio interfaces?

If so I would remove it and only use AES

HTH

Rasika

Re: AES-CCMP TSC replay was detected

O_H — Fri, 11 Feb 2022 13:12:30 GMT

Was this resolved already by anyone? I have the same issue on 3602I APs with many of these messages:
%DOT11-4-CCMP_REPLAY: Client xxxx.xxxx.xxxx had 7 AES-CCMP TSC replays
%DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth xxxx.xxxx.xxxx

Re: AES-CCMP TSC replay was detected

Ricardo Matias Aires — Fri, 04 Mar 2022 19:50:20 GMT

Hello everyone!

I'm having a similar problem, I've attached the logs that were extracted from the Access Point model: AIR-CAP3702E-Z-K9.

%DOT11-4-CCMP_REPLAY: Client 001a.3fc4.67af had 14 AES-CCMP TSC replays

Please, has anyone fixed it this problem or to solve this problem?
Thank you very much!

Re: AES-CCMP TSC replay was detected

Scott Fella — Fri, 04 Mar 2022 19:59:53 GMT

I did a search online for "%DOT11-4-CCMP_REPLAY: Client AES-CCMP TSC replays" and the results had folks upgrade. My suggestion is you try to upgrade or downgrade and see, or review some of the post online to see what others have done.

Re: AES-CCMP TSC replay was detected

O_H — Tue, 08 Mar 2022 12:03:31 GMT

I upgraded yesterday, and still see these messages... also some issues with clients disconnects in the area where the AP is.

Re: AES-CCMP TSC replay was detected

Ambuj M — Tue, 08 Mar 2022 13:27:43 GMT

You may be hitting this bug CSCur62548, if it’s causing performance issues open a TAC case.

Re: AES-CCMP TSC replay was detected

O_H — Tue, 08 Mar 2022 15:04:57 GMT

I checked this bug already, but it says it only affects PSK SSIDs not 802.1x. My affected SSID is 802.1x.

Re: AES-CCMP TSC replay was detected

Vincent Lê — Fri, 11 Nov 2022 13:15:42 GMT

Hi had the same issue on both APs AIR-CAP3702E-A-K9 and AIR-CAP3702I-A-K9 running image ap3g2-k9w7-xx.153-3.JPK2.

The client's mac address is Apple TVHD. The interface BVI is configured on mgmt native VLAN, and Apple TV is connected to another tag VLAN.

%DOT11-4-CCMP_REPLAY: Client XXXX.XXXX.XXXX had 2 AES-CCMP TSC replays