Network Management

last person joined: yesterday 

Keep an informative eye on your network with HPE Aruba Networking network management solutions
Back to discussions
Expand all | Collapse all

Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

This thread has been viewed 2 times

  • 1.  Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

    Posted Oct 31, 2016 01:48 PM

    Hi All

    Again whilst investigating Airwave alerts I saw a huge number of Detect Malformed Frame-Large Duration from 02:00:00:00:00:00, about 10 000 a day, what are these and can they be ignored?  

    I've read the follwoing regarding changes in Android 6, though don't quite see how that correlates.

    • To provide users with greater data protection, starting in this release, Android removes programmatic access to the device’s local hardware identifier for apps using the Wi-Fi and Bluetooth APIs. The WifiInfo.getMacAddress() and the BluetoothAdapter.getAddress() methods now return a constant value of 02:00:00:00:00:00.

    Any light would be greatly appreciated.

     

    Thanks

     

    Mark



  • 2.  RE: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00
    Best Answer

    EMPLOYEE
    Posted Oct 31, 2016 02:46 PM

    Feel free to uncheck "detect-malformed-large-duration" in the IDS dos profile.  There could be a problem with the combination of detection and that android device.



  • 3.  RE: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

    Posted Nov 01, 2016 05:29 AM

    Thanks Colin.  I'll go ahead and ignore it.



  • 4.  RE: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

    Posted Nov 01, 2016 10:14 AM

    Hi Colin

     

    I should have added that Airwave also reports Malformed Frame Large Duration attacks from MAC addresses other than 02:00:00:00:00:00 however these are considerably less in count.  Is it still safe to turn off?

    Many thanks

     

    Mark



  • 5.  RE: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

    EMPLOYEE
    Posted Nov 01, 2016 10:51 AM

    What version of ArubaOS



  • 6.  RE: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

    Posted Nov 01, 2016 11:06 AM

    It's AOS 6.4.4.8, AMP is 8.2.0.2



  • 7.  RE: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

    Posted Feb 15, 2017 09:54 AM

    We have the same problem in our environment, with a packet capture I can see that a device(s) using this MAC address is requesting 29000 ms of airtime, which is an eternity. Anyway to correct this?