Controller Based WLANs

In Events, what does the ?IDS: Disconnect Station Attack? alert mean?

by on ‎07-05-2014 07:58 AM

Product and Software: This article applies to all Aruba controllers and ArubaOS versions.

In Events, the "IDS: Disconnect Station Attack" alerts are not valid and are caused by a new sequence number generation mechanism implemented for the newer Aruba APs, and this is triggering the false positives.

This feature has been disabled in ArubaOS 3.4 and engineering is fixing this in ArubaOS 3.5.

To turn off these alerts, issue the following commands:

#ids dos-profile default

#no detect-disconnect-sta

 

ids-event.jpg

Comments

i"m running AOS 6.4.4.3 and am getting this event as well

i got it when i disconnected from the rogue AP

Search Airheads
Showing results for 
Search instead for 
Did you mean: 
Is this a frequent problem?

Request an official Aruba knowledge base article to be written by our experts.