i have a "AIR-LAP1252G-E-K9" on a 4400 wlc access point connected to a switch port with port security which is causing violation alerts because of two mac addresses reported other than the original mac address, i checked the switch room and found it connected directly to the patch panel which connects to the AP on the ceiling , so physical tempering is ruled out , also the access point doesn't go down when the violation happen ?? why would a access point show multiple mac addresses?
