https://community.cisco.com/t5/wireless/root-causing-the-source-of-quot-ids-auth-flood-signature-attacks/m-p/3392610#M207668 <P>Hello Experts,&nbsp;</P> <P>&nbsp;</P> <P>I have a network of over 100 APs with WLC running code 8.6.</P> <P>Every day consistently I tend to see&nbsp;"IDS 'Auth flood' Signature attacks" through different APs.&nbsp;</P> <P>Would not want to ignore it for long.&nbsp;</P> <P>What are the possible reason for this alarm to get triggered? What are the false positives and the means to root cause the exact reason of this alarm?</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IDS auth flood signature attacks.png" style="width: 999px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/12609i104F7CBD3FC8AA43/image-size/large?v=v2&amp;px=999" role="button" title="IDS auth flood signature attacks.png" alt="IDS auth flood signature attacks.png" /></span></P> Mon, 05 Jul 2021 15:42:02 GMT Muhammed Adnan 2021-07-05T15:42:02Z https://community.cisco.com/t5/wireless/root-causing-the-source-of-quot-ids-auth-flood-signature-attacks/m-p/3392610#M207668 <P>Hello Experts,&nbsp;</P> <P>&nbsp;</P> <P>I have a network of over 100 APs with WLC running code 8.6.</P> <P>Every day consistently I tend to see&nbsp;"IDS 'Auth flood' Signature attacks" through different APs.&nbsp;</P> <P>Would not want to ignore it for long.&nbsp;</P> <P>What are the possible reason for this alarm to get triggered? What are the false positives and the means to root cause the exact reason of this alarm?</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IDS auth flood signature attacks.png" style="width: 999px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/12609i104F7CBD3FC8AA43/image-size/large?v=v2&amp;px=999" role="button" title="IDS auth flood signature attacks.png" alt="IDS auth flood signature attacks.png" /></span></P> Mon, 05 Jul 2021 15:42:02 GMT https://community.cisco.com/t5/wireless/root-causing-the-source-of-quot-ids-auth-flood-signature-attacks/m-p/3392610#M207668 Muhammed Adnan 2021-07-05T15:42:02Z https://community.cisco.com/t5/wireless/root-causing-the-source-of-quot-ids-auth-flood-signature-attacks/m-p/4285962#M226013 <P>No reply to this for a long time, but I wanted to share that I have the same issue and we have 5000 APs... You can imagine the amount of alerts we get, right? <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span>&nbsp;</P><P>I hope they find a solution to this, as I've seen other people with the same post on here...</P> Thu, 04 Feb 2021 10:26:31 GMT https://community.cisco.com/t5/wireless/root-causing-the-source-of-quot-ids-auth-flood-signature-attacks/m-p/4285962#M226013 EmanuilSvetlinski14973 2021-02-04T10:26:31Z