Cisco 3850 logging……

[jing zhang]

why?

Feb 25 09:18:51: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3859.f9e6.55da (AuditSessionID: 0a41c864530bef55000001a5) was added to exclusion list. Reason: IP address theft 

Feb 25 09:18:51: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:18:56: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:01: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:03: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3c77.e692.60af (AuditSessionID: 0a41c864530bee700000018d) was added to exclusion list. Reason: IP address theft 

Feb 25 09:19:06: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:11: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:16: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:17: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 0024.d6a8.ff6a (AuditSessionID: 0a41c864530bef240000019f) was added to exclusion list. Reason: IP address theft 

Feb 25 09:19:21: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:27: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:32: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:37: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:42: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:47: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:52: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:57: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:02: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:06: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 74e5.432d.b5a9 (AuditSessionID: 0a41c864530befc4000001ac) was added to exclusion list. Reason: IP address theft 

Feb 25 09:20:07: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:12: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:17: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:22: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:27: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:28: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3859.f9e6.55da (AuditSessionID: 0a41c864530befd5000001af) was added to exclusion list. Reason: IP address theft 

Feb 25 09:20:32: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:37: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:42: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:47: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:18:51: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3859.f9e6.55da (AuditSessionID: 0a41c864530bef55000001a5) was added to exclusion list. Reason: IP address theft 

Feb 25 09:18:51: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:18:56: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:01: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:03: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3c77.e692.60af (AuditSessionID: 0a41c864530bee700000018d) was added to exclusion list. Reason: IP address theft 

Feb 25 09:19:06: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:11: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:16: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:17: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 0024.d6a8.ff6a (AuditSessionID: 0a41c864530bef240000019f) was added to exclusion list. Reason: IP address theft 

Feb 25 09:19:21: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:27: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:32: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:37: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:42: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:47: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:52: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:19:57: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:02: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:06: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 74e5.432d.b5a9 (AuditSessionID: 0a41c864530befc4000001ac) was added to exclusion list. Reason: IP address theft 

Feb 25 09:20:07: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:12: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:17: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:22: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:27: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:28: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 3859.f9e6.55da (AuditSessionID: 0a41c864530befd5000001af) was added to exclusion list. Reason: IP address theft 

Feb 25 09:20:32: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:37: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:42: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

Feb 25 09:20:47: %WCDB-3-WCDB_IP_CONFLICT: IP theft found!! The wired client-0024.d705.0621 source-IP SNOOPING tries to steal the IP 10.65.8.165 of the wireless host-0026.b968.b39b source-ARP

[Carl Edwards]

Getting same errors?  Anybody?

[Saurav Lodh]

Please have a look

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/b_sec_3se_3850_cg_chapter_01101.html

[mcooley]

I'm having the same issue. We're using Cisco 3850 (WS-C3850-48P  IOS v03.03.04SE) as WLC. 

Basically a wireless client looses their connection to the SSID, then this pops up in the log. They're unable to rejoin immediately, but can soon after. It seems to happen to some users frequently while others not often. 

I read the article but fail to make a connection how that applies to my situation or what I should do to fix it. Any help or advise would be greatly appreciated. 

Nov  7 13:23:28.108 CST: *%APF-4-ADD_TO_BLACKLIST_REASON: 1 wcm:  Client 7c7a.91c6.151f 

(AuditSessionID: 0a0afc02545d0b840000d3b7) was added to exclusion list. Reason: IP address 

theft  

[Rasika Nayanajith]

Disable client exclusion under WLAN & see if that helps

HTH

Rasika

**** Pls rate all useful responses ****

[mcooley]

Would you mind sharing the command for that?

[Rasika Nayanajith · Accepted solution]

Hi

Try it like this , repalce ABC with your WLAN name

wlan ABC
 shut
 no exclusionlist
 no shutdown

HTH

Rasika

**** Pls rate all useful responses ***

[Remy Ouaini]

Hi,

I have a similar case in which Wireless and Wired users are using the same vlan and  I am experiencing some problems with it  (conflict, dhcp ...) and  receiving the log: %WCDB-3-WCDB_IP_CONFLICT: The host xxxx.xxxx.xxxx source-ARP on Interface Capwap2 is using the IP 10.x.x.x of the host yyyy.yyyy.yyyy source-ARP on Interface Capwap1

I already have the no exculsion list configured under the wlan.

Any idea on the reason behind it?

[Rasika Nayanajith]

Split wired & wireless users into two seperate vlans & enable DHCP snooping for wireless user vlan.

That is the recommended way

HTH

Rasika

[Alcides Miguel]

Hi Rasika,

Please help, regarding snooping the feature should be enabled on core switch or in WLC it self?

I'm also receiving the error: %WCDB-3-WCDB_IP_CONFLICT on my WLC 5760 and users are experiencing very solw network expirience and I don't if it's related.

Hope ear back from you soon.

Regards,

Alcides

[Rasika Nayanajith]

It should be on your WLC-5760 for wireless user vlans.

Are you using 5760 in converged access setup or as traditional central wireless controller ?

HTH

Rasika

[Alcides Miguel]

Hi Rasika,

It's a traditional WLC setup.

I'm trying to find the blackhole because sometimes users are facing slow network acess when they are using the wireless conncetion.

Please advice where should I start looking.

Regards,

AM

[lubkenmsd]

I just wanted to say thanks to Manan - adding the no exclusionlist to my networks resolved about a dozen device connectivity issues. Thanks!

[Rasika Nayanajith]

Good to hear that.. yes that feature causing more bad user experience. 

Rasika

[Carl Edwards]

Can I ask what the problem was here, getting the same.

Thanks