cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7225
Views
38
Helpful
12
Replies

AES-CCMP TSC replay was detected

ney25
Explorer
Explorer

Hi NetPro,

anyone know the below error msg stand for ?

AES-CCMP TSC replay was detected on a packet (TSC 0x1C07) received from 001b.7709.0301.

your reply will be highly appreciated.

regards,

Jackal

12 Replies 12

gmarogi
Contributor
Contributor

This is similar to a replay attack. AES-CCMP TSC replay was indicated on a frame( a frame with the same TSC(Sequence number). A replay of the AES-CCMP TSC in a received packet almost indicates an active attack.

To understand and proceed further, where do you see this error message?. I mean in which device you are seeing this message?

Hi Gmarogi,

this error msg was detected from my Access Point.

your reply will be highly apprecited.

thanks,

Jackal

sulenbalber
Beginner
Beginner

I have the same issue

Could be a client wireless driver bug or also a bug in the AP firmware.

Hi all I have the same fault, I could solve it somehow

Client 88b1.1109.xxxx had 1 TKIP TSC replays

Cisco Aireonet 1260

Do you still use TKIP/RC4 encryption under radio interfaces?

If so I would remove it and only use AES 

 

HTH

Rasika

O_H
Beginner
Beginner

Was this resolved already by anyone? I have the same issue on 3602I APs with many of these messages:
%DOT11-4-CCMP_REPLAY: Client xxxx.xxxx.xxxx had 7 AES-CCMP TSC replays
%DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth xxxx.xxxx.xxxx

Hello everyone! 

I'm having a similar problem, I've attached the logs that were extracted from the Access Point model: AIR-CAP3702E-Z-K9

%DOT11-4-CCMP_REPLAY: Client 001a.3fc4.67af had 14 AES-CCMP TSC replays

Please, has anyone fixed it this problem or to solve this problem?
Thank you very much! 

I did a search online for "%DOT11-4-CCMP_REPLAY: Client AES-CCMP TSC replays" and the results had folks upgrade.  My suggestion is you try to upgrade or downgrade and see, or review some of the post online to see what others have done.  

-Scott
*** Please rate helpful posts ***

I upgraded yesterday, and still see these messages... also some issues with clients disconnects in the area where the AP is.

ammahend
Collaborator
Collaborator

You may be hitting this bug CSCur62548, if it’s causing performance issues open a TAC case. 

-hope this helps-

I checked this bug already, but it says it only affects PSK SSIDs not 802.1x. My affected SSID is 802.1x.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers