In Events, what does the ?IDS: Disconnect Station Attack? alert mean?

Aruba Employee

Product and Software: This article applies to all Aruba controllers and ArubaOS versions.

In Events, the "IDS: Disconnect Station Attack" alerts are not valid and are caused by a new sequence number generation mechanism implemented for the newer Aruba APs, and this is triggering the false positives.

This feature has been disabled in ArubaOS 3.4 and engineering is fixing this in ArubaOS 3.5.

To turn off these alerts, issue the following commands:

#ids dos-profile default

#no detect-disconnect-sta

 

ids-event.jpg

Version history
Revision #:
1 of 1
Last update:
‎07-05-2014 07:58 AM
Updated by:
 
Labels (1)
Contributors
Comments

i"m running AOS 6.4.4.3 and am getting this event as well

i got it when i disconnected from the rogue AP

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: 
Is this a frequent problem?

Request an official Aruba knowledge base article to be written by our experts.