Please help me understand the output from this "show dot11 associations"...

[tmoffett]

Here's the output from a show dot11 association: The output shows that access points seem to be registering with other access points and leasing ip addresses on the data network. The SSID that is associated to is WEP encrypted only.

Can anyone explain what might be happening?

bms-ap#sh dot11 ass

802.11 Client Stations on Dot11Radio0:

SSID [PCSDDATA] :

MAC Address IP address Device Name Parent State

0012.f0ef.7b2f 10.x.y.z 4800-radio bms-ap self Assoc

SSID [PCSDGUEST] :

MAC Address IP address Device Name Parent State

000e.353e.957c 10.x.y.z unknown - self Assoc

0030.6511.a8e7 10.x.y.z unknown - self Assoc

bms-ap#

[wififofum]

Hi,

I am seeing this too on 12.3.4-JA code APs. Looks like it happens every 15 seconds or so.

May be a EAP/WDS health-check? Do you use WLSE?

I have a TAC case open on this - I'll let you know.

Bruce Johnson

[tmoffett]

Yes, we're running 12.3(4)JA and using WLSE 2.12.

Please let me know what you find...

Thanks!

Tim M.

[tmoffett]

I thought that maybe it was some sort of radio monitoring activity, but the weird thing is, a packet capture shows the associated ip address doing NB name queries as well as other IP communications to non WLSE/WDS devices...

Please keep me posted!

[wififofum]

Hey,

Its likely this is a real client that the AP is using its own name to identify. Do you know what kind of cards you use, client supplicant (802.1x) software?

I see these cleints as using a "4500-Radio," with CCX v3, and WMM support. Not many other than Cisco cards.

Thanks,

--Bruce Johnson

[tmoffett]

These associations show up as "4800-Radio" with a MAC address of the AP's dot11 subinterface that corresponds with the SSID, which is WEP encrypted.

I was beginning to think this is some sort MAC address spoofing... Another interesting thing... If I change the AP's hostname, the "client" disassociates and reassociates to the new hostname.

The client supplicant is Windows XP wireless zero configuration. The laptops are R30 and T50, I believe, both with an integrated Intel wireless adapter.

Tim