cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1149
Views
0
Helpful
3
Replies

Large amount of IDS 'Broadcast Probe flood' on WLC 8.10.130

Janne K.
Level 1
Level 1

Hi there

 

We are seing a very large amount of IDS 'Broadcast Probe flood' critical alarms in Cisco Prime.
The alarms are coming from different sites, different Access Points and from different mac adresses, which makes me believe that they are false alarms.

 

It was when we upgraded to WLC version 8.10.130 that we saw an increase in these alarms.

 

I'm wondering if we maybe have the wrong settings for the alarm. currently it is the default setting.

 

Thanks in advance

3 Replies 3

patoberli
VIP Alumni
VIP Alumni

I'm not having that issue, I've upgraded last week to 8.10.130.0.

Do you also have an MSE in use?

 

I also have that signature enabled and with default values. 

Can you check if you maybe have a very high load of broadcasts in the WLC management vlan?

No, we dont use MSE.

I dont see an increase in broadcast on the management vlan after the update.

I currently have the signature disabled else it spams the alarms too much.

 

 

pannick
Level 1
Level 1

Did anyone ever find the cause for this? Bug?

Review Cisco Networking for a $25 gift card