"Fake AP or other attack may be in progress." WCS 4.1.83

Question

Hello.
I am receiving this critical alarm usually 1-3 times a day and it doesn't make any sense. I was hoping someone here could let me know if this is a legit problem or just another convenient "cosmetic bug" (There seem to be alot of those with 4.1).
The full message is:
"Fake AP or other attack may be in progress. Rogue AP count on system 'xxx.xxx.xxx.xxx' has exceeded the security warning threshold of '625'."
(IP address above was purposely hidden)
There are, as of typing this, 200 rogue APs reported by both controllers (combined, one has 110 the other 90). This alarm is still 'active' in WCS. Even if there were "fake ap"s, wouldn't the controllers report them as rogues into their count?
Thanks for any input,
Jeff

Answer 1

Jeff:
I can relate to what you are saying about the so-called "cosmetic" or "feature request" status of these bugs.
TAC keeps bouncing us back to sales - who bounces us back to TAC... but I digress.
Back to your issue:
That sure is a lot of rogue APs!
One key is to determine if there really are 200 physical access points out there or if someone is out there "spoofing" multiple APs.
Do you think that these are real APs? Have you tried locating them (using the "High Resolution Map" drop down in the rogue AP detail screen) to see if a large number of these aps are in the same location or found by the same AP? If so, that may indicate that this is a spoofed attack going on.
Are you sure that your controllers are in the same mobility group? If not, I believe that one controller will see the other controller's APs as rogue (even though they are not).
Another observation, if the rogue APs you are seeing utilize the "virtual mac" (like Cisco), one physical AP can have multiple virtual mac addresses (one for each SSID with separate sets for 802.11b/g and 802.11a). That means that one physical AP could appear to be as many as 16 or even 32 APs (in the case of AireSpace LWAPS) if both bands are lit up and all SSIDs are lit up as well. One way to help identify this is to note that if you sort the radio mac addresses, you will note that the there will be blocks of APs with identical mac addreses except for the last character which might be nearly sequential.
For example, what appears to five APs is really the same AP with different SSIDs assigned to it:
01:02:03:04:05:00
01:02:03:04:05:01
01:02:03:04:05:03
01:02:03:04:05:02
01:02:03:04:05:04
Have you categorized at least some of these as "Known External" (assuming, of course, that they are)? I am wonding if that would help the system ignore some or not...
Please refer to the following link:
http://www.cisco.com/en/US/docs/wireless/wcs/4.0/configuration/guide/wcsevent.html
The following condition is referenced:
AP_MAX_ROGUE_COUNT_EXCEEDED
Field Description
MIB Name
bsnApMaxRogueCountExceeded.
WCS Message
Fake AP or other attack may be in progress. Rogue AP count on AP with MAC address ''{0}'' associated with Switch ''{2}'' has exceeded the security warning threshold of ''{1}''.
Symptoms
The number of rogues detected by a switch (controller) exceeds the internal threshold.
WCS Severity
Critical.
Probable Causes
?There may be too many rogue access points in the network.
?A fake access point attack may be in progress.
Recommended Actions
Identify the source of the rogue access points.
========================
As an aside,
We have asked Cisco for documentation of these various "attacks" as well as for some valid values for the IDS signature file in order to be able to "tune" some of these better as well.
- John