AES-CCMP TSC replay was detected

[ney25]

Hi NetPro,

anyone know the below error msg stand for ?

AES-CCMP TSC replay was detected on a packet (TSC 0x1C07) received from 001b.7709.0301.

your reply will be highly appreciated.

regards,

Jackal

[gmarogi]

This is similar to a replay attack. AES-CCMP TSC replay was indicated on a frame( a frame with the same TSC(Sequence number). A replay of the AES-CCMP TSC in a received packet almost indicates an active attack.

To understand and proceed further, where do you see this error message?. I mean in which device you are seeing this message?

[ney25]

Hi Gmarogi,

this error msg was detected from my Access Point.

your reply will be highly apprecited.

thanks,

Jackal

[sulenbalber]

I have the same issue

[patoberli]

Could be a client wireless driver bug or also a bug in the AP firmware.

[Wil78]

Hi all I have the same fault, I could solve it somehow

Client 88b1.1109.xxxx had 1 TKIP TSC replays

Cisco Aireonet 1260

[Rasika Nayanajith]

Do you still use TKIP/RC4 encryption under radio interfaces?

If so I would remove it and only use AES 

HTH

Rasika

[O_H]

Was this resolved already by anyone? I have the same issue on 3602I APs with many of these messages:
%DOT11-4-CCMP_REPLAY: Client xxxx.xxxx.xxxx had 7 AES-CCMP TSC replays
%DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth xxxx.xxxx.xxxx

[Ricardo Matias Aires]

Hello everyone! 

I'm having a similar problem, I've attached the logs that were extracted from the Access Point model: AIR-CAP3702E-Z-K9. 

%DOT11-4-CCMP_REPLAY: Client 001a.3fc4.67af had 14 AES-CCMP TSC replays

Please, has anyone fixed it this problem or to solve this problem?
Thank you very much! 

[Scott Fella]

I did a search online for "%DOT11-4-CCMP_REPLAY: Client AES-CCMP TSC replays" and the results had folks upgrade.  My suggestion is you try to upgrade or downgrade and see, or review some of the post online to see what others have done.  

[O_H]

I upgraded yesterday, and still see these messages... also some issues with clients disconnects in the area where the AP is.

[Vincent Lê]

Hi had the same issue on both APs AIR-CAP3702E-A-K9 and AIR-CAP3702I-A-K9 running image ap3g2-k9w7-xx.153-3.JPK2.

The client's mac address is Apple TVHD. The interface BVI is configured on mgmt native VLAN, and Apple TV is connected to another tag VLAN.

%DOT11-4-CCMP_REPLAY: Client XXXX.XXXX.XXXX had 2 AES-CCMP TSC replays

[ammahend]

You may be hitting this bug CSCur62548, if it’s causing performance issues open a TAC case. 

[O_H]

I checked this bug already, but it says it only affects PSK SSIDs not 802.1x. My affected SSID is 802.1x.