Security, WIDS/WIPS and Aruba ECS

Reply
Occasional Contributor II
Posts: 53
Registered: ‎07-26-2010

Unusual goings on in Client Monitoring

Hi all,

I've don't recall seeing behaviour like this before, can anyone explain it and would it seem to be legitimate or malicious?

The unusual things to me are the "HOPOPT" protocol and the 1/26 and 1/27 under IP address.
Guru Elite
Posts: 20,784
Registered: ‎03-29-2007

Re: Unusual goings on in Client Monitoring

That is an IPv6 protocol: http://en.wikipedia.org/wiki/List_of_IP_protocol_numbers

The destination is a physical port, like fastethernet 1/26


Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Occasional Contributor II
Posts: 53
Registered: ‎07-26-2010

Re: Unusual goings on in Client Monitoring

Thanks cjoseph, that would make sense then. I haven't had any dealings with v6 yet but i'll have to set asside some time to do so.

I've since seen reference to physical ports in the hundreds, we don't have anything with port numbers that high, for example one particular user has 1/421 and 1/422?
Guru Elite
Posts: 20,784
Registered: ‎03-29-2007

Re: Unusual goings on in Client Monitoring

Please open a case on the high port numbers.


Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Occasional Contributor II
Posts: 53
Registered: ‎07-26-2010

Re: Unusual goings on in Client Monitoring

Will do!

Support are going to love me! :(
Search Airheads
Showing results for 
Search instead for 
Did you mean: