AIR-CT5508-K9 - DTL-4-ARP_ORPHANPKT_DETECTED logs flooding

[vishalyadav0312]

Hi Community,

I was wondering if someone could help to fix/stop these logs which is flooding the WLC ? These orphan packet logs are overloading my syslog server as well, also seems these are non impacting but I am looking out for some help is anyone could suggest a way to stop these logs.

*dtlArpTask: May 14 09:06:40.604: %DTL-4-ARP_ORPHANPKT_DETECTED: [PA]dtl_net.c:3113 STA(Target MAC Address) [XX:XX:XX:XX:XX:X, 0.0.0.0] ARP (op ARP REQUEST) received with invalid SPA(Source IP Address) xx.xxx.xx.xxx/TPA(Destination IP Address) xx.xxx.x.x

*dtlArpTask: May 14 09:06:35.224: %DTL-4-ARP_ORPHANPKT_DETECTED: [PA]dtl_net.c:3113 STA(Target MAC Address) [XX:XX:XX:XX:XX:X, 0.0.0.0] ARP (op ARP REQUEST) received with invalid SPA(Source IP Address) xx.xxx.xx.xxx/TPA(Destination IP Address) xx.xxx.x.x

*dtlArpTask: May 14 09:06:34.654: %DTL-4-ARP_ORPHANPKT_DETECTED: [PA]dtl_net.c:3113 STA(Target MAC Address) [XX:XX:XX:XX:XX:X, 0.0.0.0] ARP (op ARP REQUEST) received with invalid SPA(Source IP Address) xx.xxx.xx.xxx/TPA(Destination IP Address) xx.xxx.x.x

*dtlArpTask: May 14 09:06:34.225: %DTL-4-ARP_ORPHANPKT_DETECTED: [PA]dtl_net.c:3113 STA(Target MAC Address) [XX:XX:XX:XX:XX:X, 0.0.0.0] ARP (op ARP REQUEST) received with invalid SPA(Source IP Address) xx.xxx.xx.xxx/TPA(Destination IP Address) xx.xxx.x.x

(WLC) >

[Rich R]

What version of software are you using? (hint - it should be 8.5.182.11 - link below)

See also https://community.cisco.com/t5/wireless/dtl-4-arp-orphanpkt-detected-dtl-net-c-3055-sta-target-mac/td-p/3820077 about Fast SSID Switching

[vishalyadav0312]

The device is running on 8.5.160.0 and Fast SSID switching is enabled.

(WLC) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 8.5.160.0

[Rich R]

Upgrade to 8.5.182.11.

If you still see the issue then enable client debugs for an affected client and use the debug analyzer (link below).

[marce1000]

        - FYI : https://community.cisco.com/t5/wireless/orphan-packet/m-p/1976521#M211808
  Also upgrade the controller software version according to : https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html

 M.

[vishalyadav0312]

I checked the software upgrade part.. the WLC is on the latest OS already. Also the fast SSID is enabled and on other WLCs it is disabled and we are seeing Orphan Packet logs even on both. One more thing I was looking is that some clients are not authenticated and some of them are authenticated then too for both of them we have orphan packet logs. These logs are for the users connected on the Guest WLAN. I checked all other community posts already before creating this one others didn't help me. Can anyone assist further please ?

[Rich R]

> the WLC is on the latest OS already
8.5.160.0 (which is what you said it is running above) is NOT the latest version!
The latest version is 8.5.182.11.