cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
916
Views
0
Helpful
6
Replies
Highlighted
Beginner

Traffic from Guest Controller to Internet on Port No 2006

Hello Team;

                  We are seeing some traffic from the Guest Controller IP to internet sourced from port number 2006 to different destinations. Could you please share your thoughts?

Thanks & Regards

Sreejith R

6 REPLIES 6
Highlighted
Hall of Fame Master

Re: Traffic from Guest Controller to Internet on Port No 2006

The WLC doesn't use TCP or UDP port 2006. I would lookup what services might be using those ports.

http://www.corrupteddatarecovery.com/Port/2006tcp-Port-Type-invokator-invokator.asp

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
Highlighted
Hall of Fame Master

Re: Traffic from Guest Controller to Internet on Port No 2006

2006/tcp invokator
2006/udp raidcc

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
Highlighted
Beginner

Re: Traffic from Guest Controller to Internet on Port No 2006

The WLC management ip address is trying to access different public ip addresses and the traffic is sourced from 2006

Couldn't find much information regarding this



Sent from Cisco Technical Support iPhone App

Highlighted
Hall of Fame Master

Re: Traffic from Guest Controller to Internet on Port No 2006

You sure it's the WLC or is it maybe another machine spoofing the WLC IP.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***
Highlighted
Beginner

Re: Traffic from Guest Controller to Internet on Port No 2006

Confirmed, we are seeing the same thing.
But at the exact same moment we are seeing attempted changes to our WLC's

Small sample, but we are this attempt over multiple WLC's at varing times.

claRadiusWlanIdx = 1

claRadiusPortNum = 1812

claRadiusAddress = 49.55.50.4​6

claRadiusAddressType = 1

snmpTrapOID = CISCO-LWAP​P-AAA-MIB:c​iscoLwappA​AARadiusSe​rverWlanAc​tivated

sysUpTime = 62 days 6 hours 31 minutes 38.00 seconds

2013-12-08 22:17:46

23.53.151.91

172.16.80.41

invokator (2006 TCP)TCP83.00 p846.25 Kb
22013-11-29 11:40:16

172.16.80.41

23.53.151.91

invokator (2006 TCP)TCP1.00 p416.00 b
32013-11-29 11:40:16

172.16.80.41

23.53.151.91

invokator (2006 TCP)TCP1.00 p416.00 b
42013-11-29 11:40:16

172.16.80.41

23.53.151.91

invokator (2006 TCP)TCP1.00 p416.00 b
52013-11-29 11:40:16

23.53.151.91

172.16.80.41

invokator (2006 TCP)TCP1.00 p320.00 b
62013-11-29 11:40:16

23.53.151.91

172.16.80.41

invokator (2006 TCP)TCP1.00 p320.00 b
72013-11-29 11:40:16

23.53.151.91

172.16.80.41

invokator (2006 TCP)TCP1.00 p320.00 b

Unable to track down the source packets atm

Beginner

Traffic from Guest Controller to Internet on Port No 2006

We are actually seeing the same SNMP Trap messages on our controllers as well. They seem to correspond to a SYSLOG message of the same type but failing to our actual internal AAA servers.

The clients that are timing out all see to be mobile devices in nature: Motolora, Apple, Samsung, RIM, and even our spectralink (polycom handheld)

CreatePlease to create content
Content for Community-Ad