topic Re: MFP Anomaly help in Wireless

MFP Anomaly help

scottwilliamson — Sun, 04 Jul 2021 00:59:20 GMT

Hi Folks,

I just spotted this on our WCS6.0

MFP Anomaly Detected - 3,461 'Invalid MIC' violation(s) have originated from the AP with BSS '00:16:9d:44:65:d0'. This was detected by the radio with Slot ID '0' of the AP with MAC '00:19:aa:f5:5b:a0' when observing 'Probe Response, Beacon, and Deauthentication' frames.

3,461 seems like far too much - is this an attack? What should I do?

The message reads "originated from the AP", I've id'd the AP in WCS - are one of our APs acting up?

What is going on?

Thanks

Scott

Re: MFP Anomaly help

Lucien Avramov — Fri, 28 Aug 2009 07:25:12 GMT

This is a problem on the controller, the WCS is just reporting what the controller says in this case.

There are quite a few bugs on this depending the code of WLC you have:

4.2:

CSCsq87439 "MFP Anomaly Detected - 'Invalid MIC' violation(s)" messages seen on WLC

5.0,5.1 and 5.2:

CSCsl59308 EW: Many 'MFP Anomaly Detected' alarms being reported

Re: MFP Anomaly help

scottwilliamson — Mon, 14 Sep 2009 12:28:52 GMT

Hi Lucien,

I'm running version 6.0 on the WLCs and WCS.

Can you tell me how I troubleshoot this, please? is it a false positive or an attack?

Regards

Scott