%LWAPP-3-REPLAY_ERR <--> replay attack

[Rosa Ladeira]

Controllers have been receiving :

*spamReceiveTask: May 23 12:26:05.149: %LWAPP-3-REPLAY_ERR: spam_lrad.c:25502 Received replay error on slot 0, WLAN ID 1, count 1 from AP mac-address

Manual says:

Error Message    %LWAPP-3-REPLAY_ERR: Received replay error on slot [dec], WLAN ID
[dec], count [dec] from AP [hex]:[hex]:[hex]:[hex]:[hex]:[hex]

Explanation    The controller has received a replay error on the specified AP and WLAN.

Recommended Action    Check if there is a replay attack in the network.

Question:

How can I check if there is a replay attack in the controllers ?

AIR-WLC2112-K9 and AIR-WLC2106-K9

Can I also check in APs ?

AIR-LAP1131AG-A-K9  and AIR-LAP1131AG-A-K9 

[Sandeep Choudhary]

Hi,

Please check this post. may be it helps.

https://supportforums.cisco.com/discussion/11156266/users-getting-dropped-sessions-wireless

Regards

[Rosa Ladeira]

This answer refers to a windows bug.

But why Cisco recommended action is check if there is a replay attack in the network ?

[slilley]

Same problem here...WiSM2 running 8.0.120.0.  Googling resulted in no hits.  Just trying to understand what it is, and if I should be concerned.

Regards,
Steve