Network Management

Reply
RMC
Occasional Contributor I
Posts: 6
Registered: ‎07-18-2016

Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

Hi All

Again whilst investigating Airwave alerts I saw a huge number of Detect Malformed Frame-Large Duration from 02:00:00:00:00:00, about 10 000 a day, what are these and can they be ignored?  

I've read the follwoing regarding changes in Android 6, though don't quite see how that correlates.

  • To provide users with greater data protection, starting in this release, Android removes programmatic access to the device’s local hardware identifier for apps using the Wi-Fi and Bluetooth APIs. The WifiInfo.getMacAddress() and the BluetoothAdapter.getAddress() methods now return a constant value of 02:00:00:00:00:00.

Any light would be greatly appreciated.

 

Thanks

 

Mark

Guru Elite
Posts: 20,410
Registered: ‎03-29-2007

Re: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

Feel free to uncheck "detect-malformed-large-duration" in the IDS dos profile.  There could be a problem with the combination of detection and that android device.



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

RMC
Occasional Contributor I
Posts: 6
Registered: ‎07-18-2016

Re: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

Thanks Colin.  I'll go ahead and ignore it.

RMC
Occasional Contributor I
Posts: 6
Registered: ‎07-18-2016

Re: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

Hi Colin

 

I should have added that Airwave also reports Malformed Frame Large Duration attacks from MAC addresses other than 02:00:00:00:00:00 however these are considerably less in count.  Is it still safe to turn off?

Many thanks

 

Mark

Guru Elite
Posts: 20,410
Registered: ‎03-29-2007

Re: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

What version of ArubaOS



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

RMC
Occasional Contributor I
Posts: 6
Registered: ‎07-18-2016

Re: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

It's AOS 6.4.4.8, AMP is 8.2.0.2

Occasional Contributor I
Posts: 7
Registered: ‎08-15-2016

Re: Detect Malformed Frame-Large Duration from MAC 02:00:00:00:00:00

We have the same problem in our environment, with a packet capture I can see that a device(s) using this MAC address is requesting 29000 ms of airtime, which is an eternity. Anyway to correct this?

Search Airheads
Showing results for 
Search instead for 
Did you mean: