Cisco Clean Air - Wifi Invalid Channel, ClusterID, DevID

[techuserid]

I have about 50 2800 AP's in our building.  On one of these AP;s I recently set the 2.4GHz radio to Monitor mode.  Almost immediately, clean air detected interference on 5GHz listed as Wifi Inv. Channel.  In addition, we also have a newly installed Cisco Prime appliance which of course received the trap for this and flags it as a critical security issue. 

After the initial panic of suspecting some sort of malicious activity and research of the issue, I have since changed several other 2.4GHz radios in the building to monitor mode and sure enough all of them detect interference on 5GHz all with the Wifi Inv Channel.  These radios are in different locations in the building and are not within range of each other.

The interference is intermittent.  It appears that the interference is "moving" so to speak.  The affected channels are most of the time 140 and 144 however, sometimes channel 100,153,157 etc are also affected.  

I do not believe that the cause is malicious.

My questions are this:

1. What devices can possibly be causing an invalid channel detection on the 5GHz spectrum?  

2. What is the ClusterID when viewing interference devices?  If the cluster ID is the same for multiple detections does this mean that it is all the same device or is it a like device?

3. What is the DevID when viewing interference devices?  Is this the ID of the actual interference device?  

[Haydn Andrews]

Some info on the WIFI Invalid:

WiFi invalid message means that the APs have detected some RF interferer devices transmitting on some shifted central frequency. For example, we have 1 - 13 channels on 2.4 GHz, imaging some device transmitting on channel 6.5 (in between 6 and 7), that will be invalid channel, which is simply detected by the Spectrum Expert of our ClearAir.

In your case its detecting this on the 5GHz. Its more than likely either a faulty device or a non-wifi device operating in the 5 GHz spectrum like a DECT Phone

Now is this a threat? Well if users in the areas that it is being affected then would tend to believe it might be.

The only way you are going to actually find the device is to use a spectrum analyzer and hunt it down.

Im not sure where you are seeing the ClusterID and DevID as I do not see them on my Prime appliance for a WIFI Invalid Channel. Can you share a screenshot, and what version of PI you running.

[techuserid]

Screen shot shows what I see in WLC web console, when going to Monitor>Cisco CleanAir> 802.11a/n/ac>Interference Devices/

DevID and clusterID are shown.  In this example, the clusterID of the top two detection are the same, but the Device ID is different.  I am not sure what exactly this is telling me.  The top 2 detections in the screen shot are both detected on the same AP.  I am not quite clear on how the Cisco documentation explains these to fields.  

Users have experienced no issues that I am aware of.  I have tested connectivity and usability of the AP;s that are detecting the Invalid channels without issue.  Unfortunately, i do not currently have a spectrum analyzer. 

If these were DECT phones I would expect they would be detected and shown as DECT phones as it appears cleanair can detect and display as such.  We have several DECT phones that are occasionally detected and displayed as such on the 2.4GHz spectrum throughout the building.

I have tried searching but cant quite find a listing of devices that may be using or broadcasting on the 5GHz spectrum. 2.4GHz is easy to find this info (microwaves, phones, microphones, etc. etc.)  This tells me not much uses 5GHz other than wireless clients and apparently radar.