Large amount of IDS 'Broadcast Probe flood' on WLC 8.10.130

[Janne K.]

Hi there

We are seing a very large amount of IDS 'Broadcast Probe flood' critical alarms in Cisco Prime.
The alarms are coming from different sites, different Access Points and from different mac adresses, which makes me believe that they are false alarms.

It was when we upgraded to WLC version 8.10.130 that we saw an increase in these alarms.

I'm wondering if we maybe have the wrong settings for the alarm. currently it is the default setting.

Thanks in advance

[patoberli]

I'm not having that issue, I've upgraded last week to 8.10.130.0.

Do you also have an MSE in use?

I also have that signature enabled and with default values. 

Can you check if you maybe have a very high load of broadcasts in the WLC management vlan?

[Janne K.]

No, we dont use MSE.

I dont see an increase in broadcast on the management vlan after the update.

I currently have the signature disabled else it spams the alarms too much.

[pannick]

Did anyone ever find the cause for this? Bug?