AP Impersonation of MAC

[Michael Thornton]

Occasionally WCS will throw the following error:

   AP Impersonation of MAC 'Redacted' using source MAC  'Redacted' is detected by authenticated AP 'Redacted' on  '802.11b/g' radio and Slot ID '0'.

We are running version 7.0.172.0  and the only thing I can find about this error indicated that I should check the controller. When I look on the controller I do not see the error in the syslog. Does anyone have an idea of what could be causing this error?

[Stephen Rodriguez]

Generally, this error indicates the WLC is detecting a device that is spoofing a known MAC address.  take a look at

http://www.cisco.com/en/US/products/ps6305/products_tech_note09186a00806f070a.shtml#APIMP

This is a bit older, but gives some informatio on the error.

HTH,

Steve

[Michael Thornton]

I checked the APs primary controller and did not see the error indicated anywhere in the logs. I even checked the secondary and tertiary controllers to no avail.

[George Stefanick]

Ive chased this same error and I am 99.9% certain this is a bug, just my 2 cents. I know there is no way I have another device taking the MAC of one of my APs. Even after hours of L2 captures, nothing ...

I opened a TAC last year and got the anwser Steve gave you.. I dont buy Cisco kool-aid on that one...

[Michael Thornton]

I think it might be a bug as well.