Cisco Community
English
Register
Welcome Cisco Designated VIP 2021 Class in the 10th Year Anniversary of the Program -- CHECK THE LIST
Register
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
3410
Views
15
Helpful
16
Replies
Highlighted
jing zhang
Beginner
Beginner
‎02-24-2014 05:36 PM
‎02-24-2014 05:36 PM

Cisco 3850 logging……

why?

Feb 25 09:18:51: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3859.f9e6.55da (AuditSessionID: 0a41c864530bef55000001a5) was added to exclusion list. Reason: IP address theft 

Feb 25 09:18:51: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:18:56: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:01: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:03: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3c77.e692.60af (AuditSessionID: 0a41c864530bee700000018d) was added to exclusion list. Reason: IP address theft 

Feb 25 09:19:06: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:11: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:16: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:17: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 0024.d6a8.ff6a (AuditSessionID: 0a41c864530bef240000019f) was added to exclusion list. Reason: IP address theft 

Feb 25 09:19:21: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:27: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:32: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:37: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:42: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:47: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:52: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:57: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:02: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:06: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 74e5.432d.b5a9 (AuditSessionID: 0a41c864530befc4000001ac) was added to exclusion list. Reason: IP address theft 

Feb 25 09:20:07: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:12: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:17: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:22: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:27: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:28: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3859.f9e6.55da (AuditSessionID: 0a41c864530befd5000001af) was added to exclusion list. Reason: IP address theft 

Feb 25 09:20:32: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:37: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:42: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:47: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:18:51: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3859.f9e6.55da (AuditSessionID: 0a41c864530bef55000001a5) was added to exclusion list. Reason: IP address theft 

Feb 25 09:18:51: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:18:56: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:01: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:03: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3c77.e692.60af (AuditSessionID: 0a41c864530bee700000018d) was added to exclusion list. Reason: IP address theft 

Feb 25 09:19:06: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:11: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:16: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:17: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 0024.d6a8.ff6a (AuditSessionID: 0a41c864530bef240000019f) was added to exclusion list. Reason: IP address theft 

Feb 25 09:19:21: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:27: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:32: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:37: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:42: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:47: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:52: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:57: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:02: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:06: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 74e5.432d.b5a9 (AuditSessionID: 0a41c864530befc4000001ac) was added to exclusion list. Reason: IP address theft 

Feb 25 09:20:07: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:12: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:17: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:22: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:27: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:28: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3859.f9e6.55da (AuditSessionID: 0a41c864530befd5000001af) was added to exclusion list. Reason: IP address theft 

Feb 25 09:20:32: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:37: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:42: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:47: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Labels:
1 person had this problem
0 Helpful
Reply
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Rasika Nayanajith
VIP Mentor VIP Mentor
VIP Mentor
In response to mcooley
‎11-07-2014 03:11 PM
‎11-07-2014 03:11 PM

Hi

Try it like this , repalce ABC with your WLAN name

wlan ABC
 shut
 no exclusionlist
 no shutdown

HTH

Rasika

**** Pls rate all useful responses ***

View solution in original post

Reply
16 REPLIES 16
Highlighted
Carl Edwards
Beginner
Beginner
‎02-27-2014 01:52 AM
‎02-27-2014 01:52 AM

Getting same errors?  Anybody?

0 Helpful
Reply
Highlighted
Saurav Lodh
Rising star
Rising star
‎03-06-2014 02:11 AM
‎03-06-2014 02:11 AM

Please have a look

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/b_sec_3se_3850_cg_chapter_01101.html

0 Helpful
Reply
Highlighted
mcooley
Beginner
Beginner
In response to Saurav Lodh
‎11-07-2014 02:27 PM
‎11-07-2014 02:27 PM

I'm having the same issue. We're using Cisco 3850 (WS-C3850-48P  IOS v03.03.04SE) as WLC. 

 

Basically a wireless client looses their connection to the SSID, then this pops up in the log. They're unable to rejoin immediately, but can soon after. It seems to happen to some users frequently while others not often. 

 

I read the article but fail to make a connection how that applies to my situation or what I should do to fix it. Any help or advise would be greatly appreciated. 

 

Nov  7 13:23:28.108 CST: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 7c7a.91c6.151f 

(AuditSessionID: 0a0afc02545d0b840000d3b7) was added to exclusion list. Reason: IP address 

theft  

0 Helpful
Reply
Highlighted
Rasika Nayanajith
VIP Mentor VIP Mentor
VIP Mentor
In response to mcooley
‎11-07-2014 02:32 PM
‎11-07-2014 02:32 PM

Disable client exclusion under WLAN & see if that helps

HTH

Rasika

**** Pls rate all useful responses ****

Reply
Highlighted
mcooley
Beginner
Beginner
In response to Rasika Nayanajith
‎11-07-2014 02:52 PM
‎11-07-2014 02:52 PM

Would you mind sharing the command for that?

0 Helpful
Reply
Highlighted
Rasika Nayanajith
VIP Mentor VIP Mentor
VIP Mentor
In response to mcooley
‎11-07-2014 03:11 PM
‎11-07-2014 03:11 PM

Hi

Try it like this , repalce ABC with your WLAN name

wlan ABC
 shut
 no exclusionlist
 no shutdown

HTH

Rasika

**** Pls rate all useful responses ***

View solution in original post

Reply
Highlighted
Remy Ouaini
Beginner
Beginner
In response to Rasika Nayanajith
‎04-22-2015 06:31 AM
‎04-22-2015 06:31 AM

Hi,

 

I have a similar case in which Wireless and Wired users are using the same vlan and  I am experiencing some problems with it  (conflict, dhcp ...) and  receiving the log: %WCDB-3-WCDB_IP_CONFLICT: The host xxxx.xxxx.xxxx source-ARP on Interface Capwap2 is using the IP 10.x.x.x of the host yyyy.yyyy.yyyy source-ARP on Interface Capwap1

 

I already have the no exculsion list configured under the wlan.

Any idea on the reason behind it?

 

 

0 Helpful
Reply
Highlighted
Rasika Nayanajith
VIP Mentor VIP Mentor
VIP Mentor
In response to Remy Ouaini
‎04-22-2015 04:28 PM
‎04-22-2015 04:28 PM

Split wired & wireless users into two seperate vlans & enable DHCP snooping for wireless user vlan.

That is the recommended way

 

HTH

Rasika

0 Helpful
Reply
Highlighted
Alcides Miguel
Beginner
Beginner
In response to Rasika Nayanajith
‎11-27-2015 02:29 AM
‎11-27-2015 02:29 AM

Hi Rasika,

Please help, regarding snooping the feature should be enabled on core switch or in WLC it self?

I'm also receiving the error: %WCDB-3-WCDB_IP_CONFLICT on my WLC 5760 and users are experiencing very solw network expirience and I don't if it's related.

Hope ear back from you soon.

Regards,

Alcides

0 Helpful
Reply
Highlighted
Rasika Nayanajith
VIP Mentor VIP Mentor
VIP Mentor
In response to Alcides Miguel
‎11-27-2015 10:59 AM
‎11-27-2015 10:59 AM

It should be on your WLC-5760 for wireless user vlans.

Are you using 5760 in converged access setup or as traditional central wireless controller ?

HTH

Rasika

0 Helpful
Reply
Highlighted
Alcides Miguel
Beginner
Beginner
In response to Rasika Nayanajith
‎11-30-2015 08:20 AM
‎11-30-2015 08:20 AM

Hi Rasika,

It's a traditional WLC setup.

I'm trying to find the blackhole because sometimes users are facing slow network acess when they are using the wireless conncetion.

Please advice where should I start looking.

Regards,

AM

0 Helpful
Reply
Highlighted
lubkenmsd
Beginner
Beginner
In response to Rasika Nayanajith
‎04-27-2015 02:03 PM
‎04-27-2015 02:03 PM

I just wanted to say thanks to Manan - adding the no exclusionlist to my networks resolved about a dozen device connectivity issues. Thanks!

0 Helpful
Reply
Highlighted
Rasika Nayanajith
VIP Mentor VIP Mentor
VIP Mentor
In response to lubkenmsd
‎04-27-2015 02:14 PM
‎04-27-2015 02:14 PM

Good to hear that.. yes that feature causing more bad user experience. 

Rasika

0 Helpful
Reply
Highlighted
Carl Edwards
Beginner
Beginner
‎08-06-2014 07:01 AM
‎08-06-2014 07:01 AM

Can I ask what the problem was here, getting the same.

 

Thanks

0 Helpful
Reply
Latest Contents
How to manually connect a Cisco WLC to Cisco DNA Center for ...
Created by Richard Jang on 01-14-2021 05:50 PM
0
15
0
15
Table of Contents Table of ContentsOverviewConnecting a Catalyst 9800 WLC to Cisco DNA Center ManuallyConnecting an AireOS WLC to Cisco DNA Center ManuallyCisco DNA Center Assurance Deployment Guide References   Overview The purpose of this document... view more
IOS-XE PSK Blog
Created by SAY on 12-03-2020 07:33 AM
1
5
1
5
Securing devices without 802.1X   PSK (Pre-Shared-Key) WLAN is widely used for consumer & enterprise IoT onboarding as most of IoT device doesn’t support 802.1X. While PSK WLAN provides an easy way to onboard IoT, it also introduces challenges as... view more
Lightweight AP - Fail to create CAPWAP/LWAPP connection due ...
Created by timsmith on 12-02-2020 01:19 PM
39
55
39
55
Problem Description: Due to the certificate expiration, any new Control and Provisioning of Wireless Access Points (CAPWAP) or Light Weight Access Point Protocol (LWAPP) connection will fail to establish. The main feature that is affected will be the Acce... view more
Cisco WiFi Overkill for Homes
Created by quelopera58 on 11-23-2020 10:10 AM
3
5
3
5
Looking to provide wifi overkill in my home. It's two story with a basement. I am thinking two aironet 1600's. What do you think?Let me know if there is some other model I should be looking at.
Wireless Config Analyzer Express v 0.5.7
Created by Javier Contreras on 11-18-2020 08:00 AM
3
15
3
15
Where to download Attached files on this post Alternatively, cloud version (only summaries) General information: New implementation for the WLC Config Analyzer. it is a new re-write of the application, with clean up and improved checks Support for IOS... view more
Content for Community-Ad