Traffic from Guest Controller to Internet on Port No 2006

[sreejith_r]

Hello Team;

                  We are seeing some traffic from the Guest Controller IP to internet sourced from port number 2006 to different destinations. Could you please share your thoughts?

Thanks & Regards

Sreejith R

[Scott Fella]

The WLC doesn't use TCP or UDP port 2006. I would lookup what services might be using those ports.

http://www.corrupteddatarecovery.com/Port/2006tcp-Port-Type-invokator-invokator.asp

Sent from Cisco Technical Support iPhone App

[packitcheck]

Hi,

We have the same issue as Sreejith R. 

The link does not work anymore: http://www.corrupteddatarecovery.com/Port/2006tcp-Port-Type-invokator-invokator.asp.

Is there a command or some other link to get insight in or troubleshoot the issue?

TIA,

Shaam 

[Scott Fella]

2006/tcp invokator
2006/udp raidcc

Sent from Cisco Technical Support iPhone App

[sreejith_r]

The WLC management ip address is trying to access different public ip addresses and the traffic is sourced from 2006

Couldn't find much information regarding this



Sent from Cisco Technical Support iPhone App

[Scott Fella]

You sure it's the WLC or is it maybe another machine spoofing the WLC IP.

Sent from Cisco Technical Support iPhone App

[Cameron Sach]

Confirmed, we are seeing the same thing.
But at the exact same moment we are seeing attempted changes to our WLC's

Small sample, but we are this attempt over multiple WLC's at varing times.

claRadiusWlanIdx = 1

claRadiusPortNum = 1812

claRadiusAddress = 49.55.50.4​6

claRadiusAddressType = 1

snmpTrapOID = CISCO-LWAP​P-AAA-MIB:c​iscoLwappA​AARadiusSe​rverWlanAc​tivated

sysUpTime = 62 days 6 hours 31 minutes 38.00 seconds

2013-12-08 22:17:46	23.53.151.91	172.16.80.41	invokator (2006 TCP)	TCP	83.00 p	846.25 Kb
2	2013-11-29 11:40:16	172.16.80.41	23.53.151.91	invokator (2006 TCP)	TCP	1.00 p	416.00 b
3	2013-11-29 11:40:16	172.16.80.41	23.53.151.91	invokator (2006 TCP)	TCP	1.00 p	416.00 b
4	2013-11-29 11:40:16	172.16.80.41	23.53.151.91	invokator (2006 TCP)	TCP	1.00 p	416.00 b
5	2013-11-29 11:40:16	23.53.151.91	172.16.80.41	invokator (2006 TCP)	TCP	1.00 p	320.00 b
6	2013-11-29 11:40:16	23.53.151.91	172.16.80.41	invokator (2006 TCP)	TCP	1.00 p	320.00 b
7	2013-11-29 11:40:16	23.53.151.91	172.16.80.41	invokator (2006 TCP)	TCP	1.00 p	320.00 b

Unable to track down the source packets atm

[IT Services]

We are actually seeing the same SNMP Trap messages on our controllers as well. They seem to correspond to a SYSLOG message of the same type but failing to our actual internal AAA servers.

The clients that are timing out all see to be mobile devices in nature: Motolora, Apple, Samsung, RIM, and even our spectralink (polycom handheld)