WLAN Controller Message

[Faisal Shabbir]

Hi FREINDS,

I am consistly receiving following message on one of my WLAN controller, please could you tell me the severity level and solution of the following message:

IDS Signature attack cleared. Signature Type: Standard, Name: NULL probe  resp 1, Description: NULL Probe Response - Zero length SSID element,  Track: per-Mac, Detecting AP Name: KU-GF-I2-W03, Radio Type: 802.11b/g,   Preced: 2, Channel: 11

Thanks & Regards,

Faysal

[George Stefanick · Accepted solution]

The null signature alarm is really nothing. I disabled this alarm on my wlcs.

Device can send different types of probe request. For example they ca. Send a direct probe request from your laptop to an ap. they can send broadcasted probe request from your laptop to everyone. And some device are programmed to send null probe reuest. Often if you run net stumbler that program sends null probes.

Some manufactures, not Cisco gear though, when they see a null probe request will respond with their hidden (non broadcasted) ssids.

These alerts are informing you that a device(s) are sending nulls ..

I hope this helps..



Sent from Cisco Technical Support iPhone App

Sent from Cisco Technical Support iPhone App

[Faisal Shabbir]

Many Thanks George

[lisacoody]

George and Faisal -

I'm getting the same messages and would like to know how to disable them. Is that done on the controller (instead of on WCS)? Is this the correct place - Managment > SNMP > Trap Controls > Security ?

Thanks,

Lisa

[David Watkins]

You could use WCS to make the change I would think, but you need to remove this from the WLC so it is not forwarded/reported to WCS.

Fromt he GUI.

SECURITY > Wireless Protection Policies > Standard Signatures

You will see your list of pre-configured standard signatures.  You can find the one in question regarding Null Probe Responses and disable that standard signature.

[lisacoody]

Thank you, David! I very much appreciate your fast response.