topic The WLC version is : 8.0.140 in Wireless

AP Radios Flapping on 2 GHz

happy.nidjo — Mon, 05 Jul 2021 14:29:41 GMT

Hello,

I have many access points that have their radios (2.4 GHz) flapping, below the logs from the AP:

*Aug 3 14:45:36.947: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:5 Channel:6
*Aug 3 14:45:37.955: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:5 Channel:6
*Aug 3 18:29:44.271: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 3 18:29:44.279: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 3 18:29:45.271: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 3 18:29:45.303: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 3 18:29:46.303: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 3 18:30:00.531: %CLEANAIR-6-STATE: Slot 0 down
*Aug 3 18:30:17.887: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 3 19:30:02.543: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 3 19:30:02.551: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 3 19:30:03.563: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 3 19:30:03.747: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 3 19:30:04.747: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 3 19:30:19.011: %CLEANAIR-6-STATE: Slot 0 down
*Aug 3 19:30:35.999: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 3 19:56:02.383: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:5 Channel:11 Source MAC:5425.ea45.a782
*Aug 3 20:16:02.975: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:5 Channel:11
*Aug 3 20:30:17.739: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 3 20:30:17.747: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 3 20:30:18.739: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 3 20:30:18.771: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 3 20:30:19.771: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 3 20:30:32.155: %CLEANAIR-6-STATE: Slot 0 down
*Aug 3 20:30:49.231: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 4 05:37:57.827: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 4 05:37:57.835: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 4 05:37:58.827: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 4 05:37:58.859: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 4 05:37:59.859: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 4 05:38:13.887: %CLEANAIR-6-STATE: Slot 0 down
*Aug 4 05:38:30.491: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 4 11:20:36.407: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:5 Channel:11 Source MAC:44c3.4650.87c5
*Aug 4 11:40:36.975: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:5 Channel:11
*Aug 4 13:40:29.075: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 4 13:40:29.083: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 4 13:40:30.075: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 4 13:40:30.107: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 4 13:40:31.107: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 4 13:40:44.671: %CLEANAIR-6-STATE: Slot 0 down
*Aug 4 13:41:01.683: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 4 14:40:55.387: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 4 14:40:55.587: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 4 14:40:56.403: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 4 14:40:56.875: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 4 14:40:57.875: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 4 14:41:08.459: %CLEANAIR-6-STATE: Slot 0 down
*Aug 4 14:41:25.411: %CLEANAIR-6-STATE: Slot 0 enabled

I do some troubleshooting and i get the reset code : 62 ==> Radio channel set. Reset while setting channel from Control and Provisioning of Wireless Access Points (CAPWAP).

AP-ES-F00-02#show controllers dot11Radio 0 | i reset

Jammer Radio resets: 0
Radio PCI resets:0
Last radio reset code: 62
Radio resets - total:138 retries:0 failed:0

http://www.cisco.com/c/en/us/support/docs/wireless/aironet-3700-series/117869-technote-ap-00.html

Can anyone help to figure out the cause ?? i have my CCNA Wireless but it does not help me here lol 🙂

Best regards,

Mohammed

Based on the log, I can see

Rasika Nayanajith — Fri, 04 Aug 2017 20:53:07 GMT

Based on the log, I can see alert regarding some sort of RF attack.

Aug 3 14:45:36.947: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:5 Channel:6
*Aug 3 14:45:37.955: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:5 Channel:6
*Aug 3 18:29:44.271: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 3 18:29:44.279: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset

Pls check every time you see something simiar prior to radio get reset.

HTH

Rasika

This can be caused by buggy

patoberli — Mon, 07 Aug 2017 12:22:50 GMT

This can be caused by buggy software. Which version is installed on the AP? Some older versions had various bugs which could cause a radio to reset.

See here for the current recommended versions: https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-TAC-Recommended-AireOS.html

Hello Rasika,

happy.nidjo — Mon, 07 Aug 2017 12:44:01 GMT

Hello Rasika,

this time, there is nothing before the channel reset as you can see below:

*Aug 5 07:46:23.279: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 5 07:46:24.275: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 5 07:46:24.299: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 5 07:46:25.299: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 5 07:46:36.751: %CLEANAIR-6-STATE: Slot 0 down
*Aug 5 07:46:53.771: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 5 11:47:35.971: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 5 11:47:35.979: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 5 11:47:36.971: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 5 11:47:37.019: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 5 11:47:38.019: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 5 11:47:52.419: %CLEANAIR-6-STATE: Slot 0 down
*Aug 5 11:48:09.811: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 5 17:49:25.115: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 5 17:49:25.315: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 5 17:49:26.131: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 5 17:49:26.547: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 5 17:49:27.547: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 5 17:49:40.723: %CLEANAIR-6-STATE: Slot 0 down
*Aug 5 17:49:57.579: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 5 20:50:19.631: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 5 20:50:19.635: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 5 20:50:20.639: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 5 20:50:20.659: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 5 20:50:21.659: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 5 20:50:35.467: %CLEANAIR-6-STATE: Slot 0 down
*Aug 5 20:50:53.163: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 6 13:50:54.915: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth a099.9bd5.2d4a
*Aug 6 19:00:12.539: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Aug 6 19:00:12.739: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Aug 6 19:00:13.559: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Aug 6 19:00:13.615: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Aug 6 19:00:14.615: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Aug 6 19:00:28.823: %CLEANAIR-6-STATE: Slot 0 down
*Aug 6 19:00:46.139: %CLEANAIR-6-STATE: Slot 0 enabled
*Aug 6 19:29:18.767: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:9 Channel:1 Source MAC:2cc5.d318.41d8
*Aug 6 19:49:19.951: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:9 Channel:1
*Aug 6 19:54:34.711: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:5 Channel:1 Source MAC:5848.22ea.d130
*Aug 6 20:04:53.231: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:9 Channel:1 Source MAC:2cc5.d318.41d8
*Aug 6 20:21:36.971: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:5 Channel:1
*Aug 6 20:23:31.955: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:9 Channel:1 Source MAC:2cc5.d318.41d8
*Aug 6 20:43:44.627: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:9 Channel:1
*Aug 6 20:45:15.395: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:9 Channel:1
*Aug 6 22:26:19.343: %WIDS-4-SIG_ALARM: Attack is detected on Sig:Standard Id:5 Channel:1 Source MAC:0008.2216.1bfc
*Aug 6 22:46:26.811: %WIDS-6-SIG_ALARM_OFF: Attack is cleared on Sig:Standard Id:5 Channel:1

Thanks in advance,

Mohammed

Thanks Patoberli,

happy.nidjo — Mon, 07 Aug 2017 12:51:38 GMT

Thanks Patoberli,

From the document, cisco recommends the latest 8.2 release due to CSCus83638 bug (AP 5Ghz Radio Beaconing but not accepting Client Assoc.), but here, it's a 2.4 GHz issue.

Mohammed

True, but if you check the

patoberli — Mon, 07 Aug 2017 13:14:12 GMT

True, but if you check the list of fixed bugs, there are some others which could cause this (see the release notes of the newer versions).

Which version do you currently have installed?

The WLC version is : 8.0.140

happy.nidjo — Mon, 07 Aug 2017 13:30:15 GMT

The WLC version is : 8.0.140.0

Thanks,

Mohammed

Ok, that's not a bad release,

patoberli — Mon, 07 Aug 2017 14:39:05 GMT

Ok, that's not a bad release, unless you use x7xx or x8xx models. I would suggest to upgrade to the latest 8.2.160.0 release and hope it's better, or open a TAC. Your radio is probably crashing.

There are some bugs in various software releases and various ap models, it's sadly a bit complicated to search with software version:

https://bst.cloudapps.cisco.com/bugsearch/search?kw=radio crash ap&pf=prdNm&sb=anfr&mDt=1