10-09-2020 01:24 AM - edited 07-05-2021 12:37 PM
Hi there
We are seing a very large amount of IDS 'Broadcast Probe flood' critical alarms in Cisco Prime.
The alarms are coming from different sites, different Access Points and from different mac adresses, which makes me believe that they are false alarms.
It was when we upgraded to WLC version 8.10.130 that we saw an increase in these alarms.
I'm wondering if we maybe have the wrong settings for the alarm. currently it is the default setting.
Thanks in advance
10-13-2020 02:43 AM
I'm not having that issue, I've upgraded last week to 8.10.130.0.
Do you also have an MSE in use?
I also have that signature enabled and with default values.
Can you check if you maybe have a very high load of broadcasts in the WLC management vlan?
10-14-2020 01:36 AM - edited 10-14-2020 01:37 AM
No, we dont use MSE.
I dont see an increase in broadcast on the management vlan after the update.
I currently have the signature disabled else it spams the alarms too much.
01-23-2023 07:09 AM
Did anyone ever find the cause for this? Bug?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide