05-14-2024 02:16 AM
Hi Community,
I was wondering if someone could help to fix/stop these logs which is flooding the WLC ? These orphan packet logs are overloading my syslog server as well, also seems these are non impacting but I am looking out for some help is anyone could suggest a way to stop these logs.
*dtlArpTask: May 14 09:06:40.604: %DTL-4-ARP_ORPHANPKT_DETECTED: [PA]dtl_net.c:3113 STA(Target MAC Address) [XX:XX:XX:XX:XX:X, 0.0.0.0] ARP (op ARP REQUEST) received with invalid SPA(Source IP Address) xx.xxx.xx.xxx/TPA(Destination IP Address) xx.xxx.x.x
*dtlArpTask: May 14 09:06:35.224: %DTL-4-ARP_ORPHANPKT_DETECTED: [PA]dtl_net.c:3113 STA(Target MAC Address) [XX:XX:XX:XX:XX:X, 0.0.0.0] ARP (op ARP REQUEST) received with invalid SPA(Source IP Address) xx.xxx.xx.xxx/TPA(Destination IP Address) xx.xxx.x.x
*dtlArpTask: May 14 09:06:34.654: %DTL-4-ARP_ORPHANPKT_DETECTED: [PA]dtl_net.c:3113 STA(Target MAC Address) [XX:XX:XX:XX:XX:X, 0.0.0.0] ARP (op ARP REQUEST) received with invalid SPA(Source IP Address) xx.xxx.xx.xxx/TPA(Destination IP Address) xx.xxx.x.x
*dtlArpTask: May 14 09:06:34.225: %DTL-4-ARP_ORPHANPKT_DETECTED: [PA]dtl_net.c:3113 STA(Target MAC Address) [XX:XX:XX:XX:XX:X, 0.0.0.0] ARP (op ARP REQUEST) received with invalid SPA(Source IP Address) xx.xxx.xx.xxx/TPA(Destination IP Address) xx.xxx.x.x
(WLC) >
05-14-2024 05:45 AM
What version of software are you using? (hint - it should be 8.5.182.11 - link below)
See also https://community.cisco.com/t5/wireless/dtl-4-arp-orphanpkt-detected-dtl-net-c-3055-sta-target-mac/td-p/3820077 about Fast SSID Switching
05-14-2024 05:57 AM
The device is running on 8.5.160.0 and Fast SSID switching is enabled.
(WLC) >show sysinfo
Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 8.5.160.0
05-14-2024 06:22 AM
Upgrade to 8.5.182.11.
If you still see the issue then enable client debugs for an affected client and use the debug analyzer (link below).
05-14-2024 06:12 AM
- FYI : https://community.cisco.com/t5/wireless/orphan-packet/m-p/1976521#M211808
Also upgrade the controller software version according to : https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html
M.
05-24-2024 02:12 AM
I checked the software upgrade part.. the WLC is on the latest OS already. Also the fast SSID is enabled and on other WLCs it is disabled and we are seeing Orphan Packet logs even on both. One more thing I was looking is that some clients are not authenticated and some of them are authenticated then too for both of them we have orphan packet logs. These logs are for the users connected on the Guest WLAN. I checked all other community posts already before creating this one others didn't help me. Can anyone assist further please ?
05-24-2024 02:33 AM
> the WLC is on the latest OS already
8.5.160.0 (which is what you said it is running above) is NOT the latest version!
The latest version is 8.5.182.11.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide