May 29 00:00:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 00:00:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:02:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:02:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:04:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:04:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:06:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:06:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:06:15 stm[958]: <501068> |AP PR-ResHorizons-AP128@10.173.1.14 stm| Source: d4:4b:5e:8c:cf:90 Failed AP 10.173.1.14-00:1a:1e:63:cc:21-PR-ResHorizons-AP128 Multicast Encryption Mismatch May 29 00:06:15 stm[958]: <501068> |AP PR-ResLobby-AP129@10.173.1.19 stm| Source: d4:4b:5e:8c:cf:90 Failed AP 10.173.1.19-00:1a:1e:63:cf:21-PR-ResLobby-AP129 Multicast Encryption Mismatch May 29 00:06:22 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 00:06:22 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 00:06:22 stm[958]: <501068> |AP PR-ResHorizons-AP128@10.173.1.14 stm| Source: d4:4b:5e:8c:cf:90 Failed AP 10.173.1.14-00:1a:1e:63:cc:21-PR-ResHorizons-AP128 Multicast Encryption Mismatch May 29 00:06:22 stm[958]: <501068> |AP PR-ResLobby-AP129@10.173.1.19 stm| Source: d4:4b:5e:8c:cf:90 Failed AP 10.173.1.19-00:1a:1e:63:cf:21-PR-ResLobby-AP129 Multicast Encryption Mismatch May 29 00:07:59 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 00:07:59 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 00:08:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:08:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:09:32 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 00:09:32 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 00:10:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:10:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:12:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:12:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:14:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:14:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:16:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:16:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:17:18 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 00:17:18 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 00:17:37 sapd[1341]: <127000> |AP PR-E112-AP31@10.21.180.12 sapd| |ids-ap| AP(00:1a:1e:63:98:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 00:17:37 sapd[1341]: <127000> |AP PR-E112-AP31@10.21.180.12 sapd| |ids-ap| AP(00:1a:1e:63:98:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 00:18:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:18:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:19:44 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 00:19:44 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 00:19:44 sapd[956]: <127000> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 00:19:44 sapd[956]: <127000> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 00:20:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:20:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:22:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:22:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:24:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:24:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:26:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:26:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:26:29 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 00:26:29 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 00:27:08 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 00:27:08 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 00:28:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:28:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:30:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:30:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:32:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:32:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:34:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:34:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:34:46 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 00:34:46 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 00:36:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:36:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:36:06 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 00:36:06 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 00:37:05 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 00:37:05 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 00:38:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:38:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:38:15 sapd[956]: <127000> |AP PR-E314-49@10.21.33.137 sapd| |ids-ap| AP(00:1a:1e:63:d2:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 00:38:15 sapd[956]: <127000> |AP PR-E314-49@10.21.33.137 sapd| |ids-ap| AP(00:1a:1e:63:d2:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 00:40:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:40:03 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:42:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:42:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:44:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:44:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:46:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:46:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:46:37 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 00:46:37 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 00:47:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 00:47:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 00:47:52 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 00:47:52 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 00:48:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:48:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:49:45 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 00:49:45 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 00:50:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:50:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:50:17 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 00:50:17 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 00:52:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:52:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:54:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:54:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:54:14 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 00:54:14 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 00:56:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:56:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:58:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 00:58:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:00:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:00:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:02:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:02:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:04:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:04:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:04:48 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 01:04:48 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 01:05:41 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 01:05:41 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 01:06:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:06:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:06:07 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.23.73.2). May 29 01:06:07 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.23.73.2). May 29 01:06:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 01:06:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 01:07:26 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 01:07:26 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 01:08:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:08:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:10:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:10:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:11:28 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 01:11:28 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 01:12:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:12:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:14:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:14:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:16:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:16:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:18:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:18:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:19:44 sapd[589]: <127000> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 01:19:44 sapd[589]: <127000> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 01:19:49 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 01:19:49 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 01:20:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:20:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:22:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:22:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:24:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:24:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:24:14 sapd[956]: <127000> |AP PR-D318-AP39@10.21.33.16 sapd| |ids-ap| AP(00:1a:1e:61:99:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 01:24:14 sapd[956]: <127000> |AP PR-D318-AP39@10.21.33.16 sapd| |ids-ap| AP(00:1a:1e:61:99:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 01:26:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:26:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:26:09 sapd[599]: <127000> |AP PR-C306-AP9@10.21.180.13 sapd| |ids-ap| AP(00:1a:1e:63:c0:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 01:26:09 sapd[599]: <127000> |AP PR-C306-AP9@10.21.180.13 sapd| |ids-ap| AP(00:1a:1e:63:c0:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 01:26:51 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 01:26:51 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 01:27:35 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 01:27:35 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 01:28:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:28:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:30:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:30:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:32:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:32:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:33:22 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 01:33:22 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 01:34:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:34:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:34:53 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 01:34:53 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 01:36:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:36:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:38:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:38:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:38:26 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 01:38:26 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 01:38:37 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 01:38:37 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 01:40:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:40:04 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:42:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:42:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:44:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:44:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:46:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:46:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:46:59 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 01:46:59 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 01:47:34 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 01:47:34 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 01:47:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 01:47:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 01:48:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:48:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:50:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:50:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:51:57 sapd[610]: <127000> |AP PR-A360-AP155@10.28.35.12 sapd| |ids-ap| AP(00:24:6c:b6:f2:40): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 01:51:57 sapd[610]: <127000> |AP PR-A360-AP155@10.28.35.12 sapd| |ids-ap| AP(00:24:6c:b6:f2:40): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 01:52:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:52:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:54:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:54:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:56:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:56:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:58:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:58:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 01:59:56 sapd[610]: <127000> |AP PR-A161-AP167@10.28.7.14 sapd| |ids-ap| AP(00:24:6c:b6:e8:60): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 01:59:56 sapd[610]: <127000> |AP PR-A161-AP167@10.28.7.14 sapd| |ids-ap| AP(00:24:6c:b6:e8:60): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 02:00:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:00:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:00:58 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:00:58 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:02:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:02:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:02:43 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:02:43 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:04:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:04:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:06:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:06:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:07:06 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 02:07:06 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 02:07:52 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:d1:61 doing 802.1x May 29 02:07:52 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:d1:61 doing 802.1x May 29 02:08:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:08:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:10:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:10:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:10:40 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 02:10:40 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 02:11:46 sapd[1341]: <127000> |AP PR-E112-AP31@10.21.180.12 sapd| |ids-ap| AP(00:1a:1e:63:98:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:11:46 sapd[1341]: <127000> |AP PR-E112-AP31@10.21.180.12 sapd| |ids-ap| AP(00:1a:1e:63:98:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:12:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:12:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:14:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:14:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:16:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:16:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:18:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:18:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:20:03 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 02:20:03 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 02:20:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:20:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:20:25 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:20:25 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:21:25 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 02:21:25 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 02:22:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:22:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:24:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:24:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:26:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:26:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:27:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 02:27:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 02:28:01 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 02:28:01 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 02:28:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:28:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:30:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:30:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:32:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:32:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:34:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:34:05 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:34:45 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 02:34:45 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 02:36:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:36:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:37:46 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:37:46 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 02:38:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:38:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:40:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:40:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:42:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:42:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:44:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:44:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:44:06 sapd[988]: <127000> |AP PR-P110-AP19@10.21.31.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 02:44:06 sapd[988]: <127000> |AP PR-P110-AP19@10.21.31.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 02:46:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:46:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:47:20 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 02:47:20 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 02:48:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:48:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:48:10 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 02:48:10 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 02:49:48 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 02:49:48 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 02:50:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:50:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:50:26 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 02:50:26 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 02:51:02 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 02:51:02 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 02:52:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:52:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:54:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:54:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:55:32 sapd[956]: <127000> |AP PR-E316-AP24@10.20.70.162 sapd| |ids-ap| AP(00:1a:1e:63:c3:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 02:55:32 sapd[956]: <127000> |AP PR-E316-AP24@10.20.70.162 sapd| |ids-ap| AP(00:1a:1e:63:c3:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 02:56:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:56:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:58:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 02:58:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:00:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:00:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:02:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:02:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:04:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:04:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:04:30 sapd[610]: <404069> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:20: ARM Channel Interference Trigger new 6-343 old 1-408 new_rra 6/6 TCI 59 May 29 03:04:32 sapd[603]: <404074> |AP PR-E120-AP59@10.21.42.11 sapd| AM 00:1a:1e:63:d0:80: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 11/7 May 29 03:05:01 sapd[610]: <404050> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:20: ARM C 6 PER 0 MER 2 FRR 91 50-30 May 29 03:05:02 sapd[610]: <404065> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:20: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 03:05:50 sapd[610]: <404074> |AP PR-L110-AP236@10.26.17.120 sapd| AM 00:24:6c:20:50:10: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 03:06:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:06:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:06:11 sapd[916]: <404097> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 161-157/7 May 29 03:06:18 sapd[612]: <404097> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 161-157/7 May 29 03:06:19 sapd[610]: <404098> |AP PR-L102-AP256@10.26.30.120 sapd| AM 00:24:6c:20:57:28: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 40-36/7 May 29 03:06:32 sapd[610]: <404098> |AP PR-L109-AP235@10.26.17.122 sapd| AM 00:24:6c:20:50:88: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 40-36/7 May 29 03:06:56 sapd[610]: <404085> |AP PR-L102-AP241@10.26.19.126 sapd| AM 00:24:6c:20:56:78: ARM HT Channel Interference Trigger new 157-161/156 old 36/40-206 new_rra 157/161-6 TCI 10 May 29 03:07:27 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 03:07:27 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 03:08:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:08:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:08:19 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 03:08:19 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 03:08:30 sapd[610]: <404098> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:58: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 03:08:37 sapd[605]: <404069> |AP PR-A146-AP329@10.28.64.126 sapd| AM 00:24:6c:d2:50:80: ARM Channel Interference Trigger new 11-178 old 1-205 new_rra 11/6 TCI 28 May 29 03:09:42 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 03:09:42 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 03:09:53 sapd[956]: <127000> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 03:09:53 sapd[956]: <127000> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 03:10:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:10:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:10:58 sapd[610]: <404097> |AP PR-L102-AP256@10.26.30.120 sapd| AM 00:24:6c:20:57:28: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 40-36/8 May 29 03:12:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:12:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:12:07 sapd[916]: <404069> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM Channel Interference Trigger new 6-266 old 11-293 new_rra 6/6 TCI 47 May 29 03:12:16 sapd[956]: <404075> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 03:12:41 sapd[916]: <404097> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 03:13:22 sapd[610]: <404097> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:58: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 149-153/8 May 29 03:14:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:14:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:14:08 sapd[1017]: <404069> |AP PR-D114-AP67@10.21.21.23 sapd| AM 00:1a:1e:63:c9:20: ARM Channel Interference Trigger new 6-81 old 11-112 new_rra 6/6 TCI 12 May 29 03:14:12 sapd[612]: <404097> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 03:14:25 sapd[610]: <404097> |AP PR-L105-AP231@10.26.16.122 sapd| AM 00:24:6c:20:51:78: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 36-40/7 May 29 03:14:48 sapd[605]: <404069> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:a0: ARM Channel Interference Trigger new 1-186 old 11-233 new_rra 1/6 TCI 31 May 29 03:16:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:16:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:16:26 sapd[603]: <404093> |AP PR-C316-AP136@10.21.180.18 sapd| AM 00:1a:1e:63:bf:90: ARM HT Empty Channel Trigger new 44-48/0/0 old 157-161/7/0 new_rra 44-48/7 May 29 03:17:54 sapd[610]: <404098> |AP PR-L102-AP256@10.26.30.120 sapd| AM 00:24:6c:20:57:28: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 40-36/7 May 29 03:18:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:18:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:19:54 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-245 old 1-288 new_rra 6/6 TCI 36 May 29 03:20:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:20:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:20:23 sapd[603]: <404074> |AP PR-D122-AP65@10.21.21.37 sapd| AM 00:1a:1e:63:cb:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 03:20:24 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 3 FRR 88 50-30 May 29 03:20:25 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 03:20:39 sapd[589]: <404074> |AP PR-B323-AP36@10.21.13.61 sapd| AM 00:1a:1e:63:90:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 03:22:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:22:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:22:27 sapd[610]: <404097> |AP PR-L105-AP231@10.26.16.122 sapd| AM 00:24:6c:20:51:78: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 36-40/8 May 29 03:22:36 sapd[916]: <404050> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM C 6 PER 0 MER 5 FRR 92 50-30 May 29 03:22:37 sapd[916]: <404065> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 03:23:36 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 03:23:36 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 03:24:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:24:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:25:42 sapd[956]: <404074> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 03:26:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:26:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:27:34 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 03:27:34 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 03:28:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:28:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:28:28 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 03:28:28 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 03:29:14 sapd[605]: <404069> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:a0: ARM Channel Interference Trigger new 11-208 old 1-234 new_rra 11/6 TCI 29 May 29 03:29:27 sapd[610]: <404097> |AP PR-L109-AP235@10.26.17.122 sapd| AM 00:24:6c:20:50:88: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 40-36/8 May 29 03:29:46 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-260 old 1-290 new_rra 6/6 TCI 36 May 29 03:30:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:30:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:31:32 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 2 FRR 88 50-30 May 29 03:31:33 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 03:31:39 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 03:31:39 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 03:32:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:32:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:33:02 sapd[610]: <404097> |AP PR-L102-AP256@10.26.30.120 sapd| AM 00:24:6c:20:57:28: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 40-36/8 May 29 03:33:14 sapd[589]: <404097> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 149-153/7 May 29 03:34:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:34:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:35:05 sapd[610]: <404093> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Empty Channel Trigger new 44-48/0/0 old 157-161/0/1 new_rra 44-48/8 May 29 03:36:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:36:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:36:41 sapd[1643]: <404085> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c8: ARM HT Channel Interference Trigger new 153-149/62 old 48/44-91 new_rra 153/149-8 TCI 10 May 29 03:37:01 sapd[956]: <404075> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 03:38:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:38:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:38:08 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 03:38:08 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 03:38:59 sapd[610]: <404098> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 157-161/7 May 29 03:39:18 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-246 old 1-277 new_rra 6/6 TCI 36 May 29 03:39:33 sapd[610]: <404098> |AP PR-L102-AP256@10.26.30.120 sapd| AM 00:24:6c:20:57:28: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 40-36/7 May 29 03:39:49 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 0 FRR 88 50-30 May 29 03:39:50 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 03:39:53 sapd[605]: <404069> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:a0: ARM Channel Interference Trigger new 1-190 old 11-239 new_rra 1/6 TCI 31 May 29 03:40:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:40:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:40:08 sapd[604]: <404074> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 03:40:46 sapd[610]: <404085> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Channel Interference Trigger new 157-161/13 old 44/48-46 new_rra 157/161-8 TCI 10 May 29 03:42:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:42:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:42:13 sapd[2011]: <404097> |AP PR-G200-AP300@10.28.88.16 sapd| AM 00:0b:86:77:30:58: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 48-44/7 May 29 03:42:39 sapd[956]: <404074> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 03:43:19 sapd[916]: <404098> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 03:43:49 sapd[610]: <404098> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 03:44:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:44:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:45:20 sapd[604]: <404075> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 03:45:57 sapd[610]: <404097> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 157-161/8 May 29 03:46:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:46:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:47:13 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-243 old 1-289 new_rra 6/6 TCI 31 May 29 03:47:42 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 03:47:42 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 03:47:44 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 0 FRR 88 50-30 May 29 03:47:45 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 03:48:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:48:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:48:36 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:d1:61 doing 802.1x May 29 03:48:36 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:d1:61 doing 802.1x May 29 03:48:52 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 03:48:52 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 03:49:42 sapd[2011]: <404097> |AP PR-G200-AP300@10.28.88.16 sapd| AM 00:0b:86:77:30:58: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 03:49:45 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 03:49:49 sapd[956]: <404075> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 03:50:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:50:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:50:37 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 03:51:18 sapd[603]: <404085> |AP PR-C316-AP136@10.21.180.18 sapd| AM 00:1a:1e:63:bf:90: ARM HT Channel Interference Trigger new 157-161/9 old 44/48-40 new_rra 157/161-7 TCI 10 May 29 03:51:55 sapd[610]: <404097> |AP PR-L102-AP256@10.26.30.120 sapd| AM 00:24:6c:20:57:28: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 40-36/8 May 29 03:52:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:52:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:52:29 sapd[589]: <404075> |AP PR-B323-AP36@10.21.13.61 sapd| AM 00:1a:1e:63:90:60: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 1/6 May 29 03:52:55 sapd[610]: <404085> |AP PR-L111-AP243@10.26.19.122 sapd| AM 00:24:6c:20:48:08: ARM HT Channel Interference Trigger new 161-157/180 old 40/36-208 new_rra 161/157-6 TCI 10 May 29 03:54:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:54:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:54:18 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-229 old 11-326 new_rra 6/6 TCI 34 May 29 03:54:48 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 1 FRR 93 50-30 May 29 03:54:49 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 03:56:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:56:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:57:22 sapd[603]: <404069> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM Channel Interference Trigger new 1-72 old 11-99 new_rra 1/6 TCI 10 May 29 03:57:31 sapd[604]: <404074> |AP PR-IWC12-AP6@10.21.12.20 sapd| AM 00:1a:1e:63:c3:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 03:57:54 sapd[610]: <404085> |AP PR-L102-AP241@10.26.19.126 sapd| AM 00:24:6c:20:56:78: ARM HT Channel Interference Trigger new 36-40/156 old 157/161-204 new_rra 36/40-6 TCI 10 May 29 03:58:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:58:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 03:59:43 sapd[610]: <404085> |AP PR-L320-AP224@10.26.37.121 sapd| AM 00:24:6c:20:4d:38: ARM HT Channel Interference Trigger new 153-149/60 old 161/157-90 new_rra 153/149-8 TCI 10 May 29 04:00:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:00:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:01:56 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:01:56 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:02:03 sapd[605]: <404069> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:a0: ARM Channel Interference Trigger new 11-173 old 1-222 new_rra 11/6 TCI 28 May 29 04:02:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:02:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:02:24 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-233 old 1-277 new_rra 6/6 TCI 35 May 29 04:03:05 sapd[916]: <404098> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 04:04:06 sapd[610]: <404097> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 04:04:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:04:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:04:46 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 04:04:46 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 04:05:00 sapd[610]: <404098> |AP PR-L105-AP231@10.26.16.122 sapd| AM 00:24:6c:20:51:78: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 36-40/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 04:05:04 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 2 FRR 91 50-30 May 29 04:05:05 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 04:05:22 sapd[612]: <404098> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM - HT decreasing power cov-index 12/1 tx-power 8 new_rra 161-157/6 May 29 04:06:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:06:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:07:49 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 04:07:49 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 04:08:02 sapd[603]: <404069> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM Channel Interference Trigger new 11-98 old 1-128 new_rra 11/6 TCI 15 May 29 04:08:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:08:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:08:45 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 04:08:45 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 04:10:00 sapd[605]: <404069> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:a0: ARM Channel Interference Trigger new 1-196 old 11-239 new_rra 1/6 TCI 32 May 29 04:10:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:10:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:10:12 sapd[610]: <404093> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Empty Channel Trigger new 44-48/0/0 old 157-161/0/1 new_rra 44-48/8 May 29 04:10:43 sapd[635]: <127000> |AP PR-C203-AP44@10.21.20.10 sapd| |ids-ap| AP(00:1a:1e:63:d8:00): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 04:10:43 sapd[635]: <127000> |AP PR-C203-AP44@10.21.20.10 sapd| |ids-ap| AP(00:1a:1e:63:d8:00): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 04:11:57 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-243 old 1-288 new_rra 6/6 TCI 36 May 29 04:12:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:12:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:12:35 sapd[956]: <127000> |AP PR-P104-AP18@10.21.180.15 sapd| |ids-ap| AP(00:1a:1e:63:c0:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:12:35 sapd[956]: <127000> |AP PR-P104-AP18@10.21.180.15 sapd| |ids-ap| AP(00:1a:1e:63:c0:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 04:12:51 sapd[956]: <404074> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 04:13:12 sapd[603]: <404093> |AP PR-C316-AP136@10.21.180.18 sapd| AM 00:1a:1e:63:bf:90: ARM HT Empty Channel Trigger new 44-48/0/0 old 157-161/8/0 new_rra 44-48/7 May 29 04:14:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:14:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:15:12 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 1 FRR 90 50-30 May 29 04:15:13 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 04:15:25 sapd[634]: <404097> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:f0: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 May 29 04:15:36 sapd[610]: <404085> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Channel Interference Trigger new 157-161/10 old 44/48-45 new_rra 157/161-8 TCI 10 May 29 04:16:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:16:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:17:23 sapd[956]: <404075> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 04:17:45 sapd[610]: <404098> |AP PR-L105-AP231@10.26.16.122 sapd| AM 00:24:6c:20:51:78: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 36-40/6 May 29 04:18:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:18:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:18:56 sapd[603]: <404085> |AP PR-C316-AP136@10.21.180.18 sapd| AM 00:1a:1e:63:bf:90: ARM HT Channel Interference Trigger new 161-157/14 old 44/48-42 new_rra 161/157-7 TCI 10 May 29 04:19:16 sapd[610]: <404098> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:48: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 36-40/7 May 29 04:19:50 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 04:19:50 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 04:20:04 sapd[610]: <404098> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 04:20:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:20:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:20:25 sapd[603]: <127000> |AP PR-C316-AP136@10.21.180.18 sapd| |ids-ap| AP(00:1a:1e:63:bf:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:20:25 sapd[603]: <127000> |AP PR-C316-AP136@10.21.180.18 sapd| |ids-ap| AP(00:1a:1e:63:bf:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 04:21:15 sapd[610]: <404097> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 36-40/7 May 29 04:22:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:22:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:23:04 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-236 old 1-299 new_rra 6/6 TCI 38 May 29 04:23:25 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:23:25 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:23:34 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 1 FRR 91 50-30 May 29 04:23:35 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 04:24:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:24:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:26:03 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 04:26:03 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 04:26:05 sapd[610]: <404098> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:48: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 36-40/6 May 29 04:26:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:26:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:26:27 sapd[605]: <404069> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:a0: ARM Channel Interference Trigger new 11-192 old 1-246 new_rra 11/6 TCI 28 May 29 04:27:53 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 04:27:56 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 04:27:56 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 04:28:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:28:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:28:44 sapd[610]: <404097> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 36-40/8 May 29 04:28:54 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 04:28:54 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 04:29:04 sapd[916]: <404098> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 04:29:25 sapd[956]: <404074> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 04:29:45 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-240 old 1-278 new_rra 6/6 TCI 35 May 29 04:30:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:30:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:30:27 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:30:27 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:30:32 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 3 FRR 92 50-30 May 29 04:30:33 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 04:32:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:32:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:34:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:34:07 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:34:13 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 1/6 May 29 04:35:15 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 04:35:20 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-237 old 1-285 new_rra 6/6 TCI 36 May 29 04:35:54 sapd[610]: <404075> |AP PR-A298-AP193@10.28.66.120 sapd| AM 00:24:6c:20:38:b0: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 6/6 May 29 04:36:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:36:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:37:04 sapd[956]: <404075> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 04:37:28 sapd[610]: <404074> |AP PR-L220-AP205@10.26.27.122 sapd| AM 00:24:6c:b6:e6:d0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 04:38:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:38:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 04:38:31 sapd[1341]: <127000> |AP PR-IWC31-AP15@10.20.28.20 sapd| |ids-ap| AP(00:1a:1e:63:98:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:38:31 sapd[1341]: <127000> |AP PR-IWC31-AP15@10.20.28.20 sapd| |ids-ap| AP(00:1a:1e:63:98:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:38:39 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 3 FRR 87 50-30 May 29 04:38:40 sapd[604]: <127000> |AP PR-IWC43-AP16@10.21.43.10 sapd| |ids-ap| AP(00:1a:1e:63:c0:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:38:40 sapd[604]: <127000> |AP PR-IWC43-AP16@10.21.43.10 sapd| |ids-ap| AP(00:1a:1e:63:c0:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:38:40 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 04:40:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:40:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:40:56 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:40:56 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:41:44 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:41:44 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 04:42:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:42:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:42:48 sapd[634]: <404069> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:e0: ARM Channel Interference Trigger new 6-329 old 1-357 new_rra 6/6 TCI 53 May 29 04:43:16 sapd[956]: <404074> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 04:43:19 sapd[610]: <404074> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b0: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 04:43:20 sapd[1641]: <404050> |AP PR-G104-AP293@10.28.88.15 sapd| AM 00:0b:86:77:3c:80: ARM C 11 PER 0 MER 51 FRR 72 50-30 May 29 04:43:21 sapd[1641]: <404065> |AP PR-G104-AP293@10.28.88.15 sapd| AM 00:0b:86:77:3c:80: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 04:43:29 sapd[634]: <404050> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:e0: ARM C 6 PER 0 MER 4 FRR 89 50-30 May 29 04:43:30 sapd[634]: <404065> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:e0: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 04:43:58 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:43:58 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:44:04 sapd[1641]: <404074> |AP PR-G104-AP293@10.28.88.15 sapd| AM 00:0b:86:77:3c:80: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 04:44:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:44:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:44:56 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:44:56 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:45:30 sapd[1641]: <404085> |AP PR-DGYM-AP306@10.28.89.18 sapd| AM 00:0b:86:77:31:c8: ARM HT Channel Interference Trigger new 48-44/68 old 161/157-101 new_rra 48/44-7 TCI 10 May 29 04:46:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:46:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:46:25 sapd[1641]: <404098> |AP PR-DGYM-AP306@10.28.89.18 sapd| AM 00:0b:86:77:31:c8: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 48-44/6 May 29 04:48:03 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 04:48:03 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 04:48:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:48:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:48:59 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-233 old 1-288 new_rra 6/6 TCI 36 May 29 04:49:03 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 04:49:03 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 04:50:02 sapd[610]: <404074> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b0: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 6/8 May 29 04:50:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:50:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:51:03 sapd[2011]: <404098> |AP PR-G200-AP300@10.28.88.16 sapd| AM 00:0b:86:77:30:58: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 48-44/7 May 29 04:51:06 sapd[605]: <404069> |AP PR-A146-AP329@10.28.64.126 sapd| AM 00:24:6c:d2:50:80: ARM Channel Interference Trigger new 1-178 old 11-229 new_rra 1/6 TCI 31 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 04:51:10 sapd[1641]: <404074> |AP PR-G104-AP293@10.28.88.15 sapd| AM 00:0b:86:77:3c:80: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 04:51:38 sapd[2192]: <404097> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 04:52:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:52:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:52:10 sapd[610]: <404093> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Empty Channel Trigger new 44-48/0/0 old 157-161/0/1 new_rra 44-48/8 May 29 04:52:22 sapd[610]: <404098> |AP PR-L207-AP212@10.26.30.122 sapd| AM 00:24:6c:20:55:58: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 48-44/7 May 29 04:53:02 sapd[605]: <404097> |AP PR-A146-AP329@10.28.64.126 sapd| AM 00:24:6c:d2:50:90: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 161-157/7 May 29 04:53:26 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 1 FRR 90 50-30 May 29 04:53:27 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 04:54:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:54:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:56:00 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 04:56:00 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 04:56:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:56:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:56:19 sapd[610]: <404098> |AP PR-A111-AP157@10.28.13.12 sapd| AM 00:24:6c:b6:f3:38: ARM - HT decreasing power cov-index 8/5 tx-power 8 new_rra 36-40/6 May 29 04:57:15 sapd[589]: <127000> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:57:15 sapd[589]: <127000> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 04:57:36 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-243 old 1-293 new_rra 6/6 TCI 37 May 29 04:57:53 sapd[610]: <404085> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM HT Channel Interference Trigger new 161-157/40 old 48/44-74 new_rra 161/157-8 TCI 10 May 29 04:58:00 sapd[610]: <404075> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b0: ARM - decreasing power cov-index 8/5 tx-power 8 new_rra 6/6 May 29 04:58:03 authmgr[1871]: <522027> |authmgr| MAC=a4:d1:d2:4a:e8:c0 IP=10.24.10.0 IP Spoof from MAC=d8:30:62:97:c3:2b role=authenticated/(null) May 29 04:58:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 04:58:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 04:58:52 sapd[956]: <404074> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 05:00:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:00:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:00:17 sapd[610]: <404098> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 05:00:51 sapd[956]: <404075> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 05:01:04 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 2 FRR 91 50-30 May 29 05:01:05 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 05:01:29 sapd[610]: <404075> |AP PR-L220-AP205@10.26.27.122 sapd| AM 00:24:6c:b6:e6:d0: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 1/6 May 29 05:01:31 sapd[610]: <404098> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 161-157/7 May 29 05:02:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:02:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:03:54 sapd[610]: <404074> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 05:04:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:04:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:04:44 sapd[610]: <404085> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Channel Interference Trigger new 161-157/12 old 44/48-47 new_rra 161/157-8 TCI 10 May 29 05:04:45 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 05:04:47 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 05:04:47 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 05:05:01 sapd[610]: <404098> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 05:05:54 sapd[610]: <404098> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM - HT decreasing power cov-index 14/0 tx-power 8 new_rra 161-157/6 May 29 05:06:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:06:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:07:16 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-240 old 1-284 new_rra 6/6 TCI 38 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 05:07:27 sapd[604]: <404075> |AP PR-IWC12-AP6@10.21.12.20 sapd| AM 00:1a:1e:63:c3:60: ARM - decreasing power cov-index 7/6 tx-power 7 new_rra 1/6 May 29 05:08:07 sapd[2011]: <404098> |AP PR-G200-AP300@10.28.88.16 sapd| AM 00:0b:86:77:30:58: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 48-44/6 May 29 05:08:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:08:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:08:10 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 05:08:10 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 05:08:44 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 2 FRR 89 50-30 May 29 05:08:45 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 05:09:08 sapd[610]: <404098> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM - HT decreasing power cov-index 16/0 tx-power 7 new_rra 161-157/6 May 29 05:09:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:d1:61 doing 802.1x May 29 05:09:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:d1:61 doing 802.1x May 29 05:09:35 sapd[610]: <404097> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:88: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 157-161/7 May 29 05:09:50 sapd[934]: <404069> |AP PR-C211-AP287@10.21.12.22 sapd| AM 00:24:6c:29:4b:f0: ARM Channel Interference Trigger new 1-84 old 11-112 new_rra 1/6 TCI 10 May 29 05:10:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:10:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:11:05 sapd[600]: <404074> |AP PR-e229-AP42@10.21.42.24 sapd| AM 00:1a:1e:63:cf:60: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 05:11:34 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 05:11:34 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 05:12:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:12:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:12:16 sapd[610]: <404085> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM HT Channel Interference Trigger new 48-44/21 old 161/157-83 new_rra 48/44-6 TCI 10 May 29 05:13:28 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-240 old 1-290 new_rra 6/6 TCI 37 May 29 05:13:58 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 1 FRR 90 50-30 May 29 05:13:59 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 05:14:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:14:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:14:19 sapd[610]: <404050> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:30: ARM C 6 PER 0 MER 3 FRR 100 50-30 May 29 05:14:20 sapd[610]: <404065> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:30: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 05:14:25 sapd[610]: <404074> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 05:14:40 sapd[612]: <404085> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM HT Channel Interference Trigger new 40-36/94 old 161/157-120 new_rra 40/36-6 TCI 10 May 29 05:15:58 sapd[600]: <404069> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: ARM Channel Interference Trigger new 11-159 old 1-190 new_rra 11/6 TCI 26 May 29 05:16:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:16:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:16:32 sapd[610]: <404097> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 48-44/7 May 29 05:16:48 sapd[610]: <404097> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 05:17:03 sapd[589]: <404098> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 149-153/6 May 29 05:17:57 sapd[610]: <404085> |AP PR-L320-AP224@10.26.37.121 sapd| AM 00:24:6c:20:4d:38: ARM HT Channel Interference Trigger new 44-48/61 old 153/149-88 new_rra 44/48-8 TCI 10 May 29 05:18:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:18:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:18:12 sapd[600]: <404075> |AP PR-e229-AP42@10.21.42.24 sapd| AM 00:1a:1e:63:cf:60: ARM - decreasing power cov-index 11/2 tx-power 7 new_rra 6/6 May 29 05:18:42 sapd[610]: <404069> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:30: ARM Channel Interference Trigger new 6-149 old 11-188 new_rra 6/6 TCI 23 May 29 05:19:37 sapd[610]: <404097> |AP PR-L111-AP243@10.26.19.122 sapd| AM 00:24:6c:20:48:08: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 161-157/7 May 29 05:19:55 sapd[589]: <404085> |AP PR-C211s7-AP53@10.21.12.17 sapd| AM 00:1a:1e:63:c9:70: ARM HT Channel Interference Trigger new 48-44/56 old 149/153-82 new_rra 48/44-7 TCI 10 May 29 05:20:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:20:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:20:11 sapd[610]: <404085> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Channel Interference Trigger new 153-149/20 old 161/157-49 new_rra 153/149-6 TCI 10 May 29 05:20:14 sapd[604]: <404074> |AP PR-IWC12-AP6@10.21.12.20 sapd| AM 00:1a:1e:63:c3:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 05:20:32 sapd[916]: <404069> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM Channel Interference Trigger new 6-258 old 11-289 new_rra 6/6 TCI 46 May 29 05:20:41 sapd[604]: <404074> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 05:21:03 sapd[610]: <404075> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 05:21:05 sapd[600]: <404069> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: ARM Channel Interference Trigger new 1-178 old 11-214 new_rra 1/6 TCI 27 May 29 05:22:05 sapd[610]: <404085> |AP PR-L102-AP241@10.26.19.126 sapd| AM 00:24:6c:20:56:78: ARM HT Channel Interference Trigger new 157-161/146 old 36/40-205 new_rra 157/161-6 TCI 10 May 29 05:22:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:22:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:23:13 sapd[610]: <404097> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 153-149/7 May 29 05:24:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:24:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:26:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:26:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:26:59 sapd[916]: <404098> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 161-157/6 May 29 05:27:06 sapd[610]: <404097> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 05:27:34 sapd[610]: <404098> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 05:27:42 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-261 old 1-294 new_rra 6/6 TCI 38 May 29 05:27:44 sapd[916]: <404050> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM C 6 PER 0 MER 1 FRR 92 50-30 May 29 05:27:45 sapd[916]: <404065> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 05:27:53 sapd[589]: <404074> |AP PR-B323-AP36@10.21.13.61 sapd| AM 00:1a:1e:63:90:60: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 1/7 May 29 05:28:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:28:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:28:17 sapd[610]: <404097> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 153-149/8 May 29 05:28:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 05:28:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 05:28:42 sapd[600]: <404074> |AP PR-G119-AP4@10.21.180.10 sapd| AM 00:1a:1e:63:c5:a0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 05:28:44 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 3 FRR 87 50-30 May 29 05:28:45 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 05:29:25 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:d1:61 doing 802.1x May 29 05:29:25 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:d1:61 doing 802.1x May 29 05:29:48 sapd[610]: <404074> |AP PR-A298-AP193@10.28.66.120 sapd| AM 00:24:6c:20:38:b0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 05:30:04 sapd[610]: <404097> |AP PR-L111-AP243@10.26.19.122 sapd| AM 00:24:6c:20:48:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 05:30:06 sapd[610]: <404097> |AP PR-L105-AP231@10.26.16.122 sapd| AM 00:24:6c:20:51:78: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 36-40/7 May 29 05:30:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:30:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:32:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:32:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:32:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station c8:f7:33:c5:81:4f 00:1a:1e:63:d0:e2 May 29 05:32:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station c8:f7:33:c5:81:4f 00:1a:1e:63:d0:e2 May 29 05:32:35 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station c8:f7:33:c5:81:4f 00:1a:1e:63:d0:f1 doing 802.1x May 29 05:32:35 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station c8:f7:33:c5:81:4f 00:1a:1e:63:d0:f1 doing 802.1x May 29 05:34:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:34:08 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:34:29 sapd[916]: <404069> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM Channel Interference Trigger new 6-259 old 11-292 new_rra 6/6 TCI 46 May 29 05:36:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:36:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:36:10 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 05:36:10 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 05:36:19 sapd[589]: <404097> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 149-153/7 May 29 05:36:54 sapd[916]: <404050> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM C 6 PER 0 MER 2 FRR 97 50-30 May 29 05:36:55 sapd[916]: <404065> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 05:37:25 sapd[610]: <404097> |AP PR-L105-AP231@10.26.16.122 sapd| AM 00:24:6c:20:51:78: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 36-40/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 05:38:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:38:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:39:43 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 05:39:43 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 05:40:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:40:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:40:22 sapd[956]: <127000> |AP PR-E316-AP24@10.20.70.162 sapd| |ids-ap| AP(00:1a:1e:63:c3:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 05:40:22 sapd[956]: <127000> |AP PR-E316-AP24@10.20.70.162 sapd| |ids-ap| AP(00:1a:1e:63:c3:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 05:40:27 sapd[610]: <404074> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 05:40:44 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 05:42:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:42:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:42:24 sapd[604]: <127000> |AP PR-IWC43-AP16@10.21.43.10 sapd| |ids-ap| AP(00:1a:1e:63:c0:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 05:42:24 sapd[604]: <127000> |AP PR-IWC43-AP16@10.21.43.10 sapd| |ids-ap| AP(00:1a:1e:63:c0:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 05:44:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:44:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:44:17 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-234 old 1-282 new_rra 6/6 TCI 37 May 29 05:44:25 sapd[600]: <404069> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: ARM Channel Interference Trigger new 11-174 old 1-202 new_rra 11/6 TCI 27 May 29 05:44:51 sapd[610]: <404098> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 05:45:10 sapd[610]: <404075> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 05:46:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:46:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 05:46:30 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 1 FRR 90 50-30 May 29 05:46:31 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 05:47:39 sapd[589]: <404098> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 149-153/6 May 29 05:48:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:48:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:48:25 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 05:48:25 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 05:49:34 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 05:49:34 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 05:49:36 sapd[919]: <404074> |AP PR-Bookstore-AP283@10.21.12.10 sapd| AM 00:24:6c:29:4d:30: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 05:49:41 sapd[603]: <404075> |AP PR-C316-AP136@10.21.180.18 sapd| AM 00:1a:1e:63:bf:80: ARM - decreasing power cov-index 11/3 tx-power 7 new_rra 11/6 May 29 05:50:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:50:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:51:35 sapd[610]: <404075> |AP PR-L110-AP236@10.26.17.120 sapd| AM 00:24:6c:20:50:10: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 11/6 May 29 05:52:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:52:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:52:27 sapd[610]: <404074> |AP PR-A280-AP183@10.28.16.120 sapd| AM 00:24:6c:b6:fa:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 05:52:29 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-242 old 1-276 new_rra 6/6 TCI 38 May 29 05:54:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:54:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:54:29 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 1 FRR 88 50-30 May 29 05:54:30 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 05:56:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:56:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:56:14 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 05:57:04 sapd[610]: <404074> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 05:57:39 sapd[610]: <404075> |AP PR-A298-AP193@10.28.66.120 sapd| AM 00:24:6c:20:38:b0: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 6/6 May 29 05:57:58 sapd[956]: <404075> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - decreasing power cov-index 13/1 tx-power 7 new_rra 6/6 May 29 05:58:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 05:58:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:00:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:00:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:01:02 sapd[610]: <404074> |AP PR-L110-AP236@10.26.17.120 sapd| AM 00:24:6c:20:50:10: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 06:01:50 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-245 old 1-284 new_rra 6/6 TCI 39 May 29 06:02:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:02:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:02:59 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 0 FRR 89 50-30 May 29 06:03:00 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 06:03:17 sapd[956]: <127102> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:88:80:9d) on channel 6. May 29 06:03:24 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:88:80:9d) on channel 6. May 29 06:03:24 sapd[589]: <127102> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:88:80:9d) on channel 6. May 29 06:04:06 sapd[610]: <404098> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 06:04:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:04:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:04:49 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.23.73.2). May 29 06:04:49 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.23.73.2). May 29 06:04:49 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:04:49 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 06:04:51 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 06:04:51 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 06:05:01 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 58:91:cf:5a:e0:6a 00:1a:1e:63:c3:82 May 29 06:05:01 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 58:91:cf:5a:e0:6a 00:1a:1e:63:c3:82 May 29 06:05:01 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 58:91:cf:5a:e0:6a 00:1a:1e:63:c3:81 doing 802.1x May 29 06:05:01 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 58:91:cf:5a:e0:6a 00:1a:1e:63:c3:81 doing 802.1x May 29 06:05:07 sapd[1641]: <404075> |AP PR-G104-AP293@10.28.88.15 sapd| AM 00:0b:86:77:3c:80: ARM - decreasing power cov-index 8/5 tx-power 8 new_rra 6/6 May 29 06:05:22 sapd[610]: <404075> |AP PR-L110-AP236@10.26.17.120 sapd| AM 00:24:6c:20:50:10: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 11/6 May 29 06:05:34 sapd[610]: <127000> |AP PR-A356-A149@10.28.34.12 sapd| |ids-ap| AP(00:24:6c:b6:ef:b0): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:05:34 sapd[610]: <127000> |AP PR-A356-A149@10.28.34.12 sapd| |ids-ap| AP(00:24:6c:b6:ef:b0): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:05:35 sapd[589]: <404069> |AP PR-Cafe2-AP7@10.21.11.21 sapd| AM 00:1a:1e:63:c5:e0: ARM Channel Interference Trigger new 6-173 old 11-205 new_rra 6/6 TCI 26 May 29 06:06:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:06:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:06:52 sapd[604]: <404075> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 06:07:22 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 06:07:22 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 06:07:31 sapd[610]: <404093> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Empty Channel Trigger new 44-48/0/0 old 153-149/0/1 new_rra 44-48/8 May 29 06:08:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:08:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:08:11 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-241 old 1-284 new_rra 6/6 TCI 37 May 29 06:08:32 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:08:32 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 06:08:38 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 58:91:cf:5a:e3:62 00:1a:1e:63:c3:80 May 29 06:08:38 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 58:91:cf:5a:e3:62 00:1a:1e:63:c3:80 May 29 06:08:38 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 58:91:cf:5a:e3:62 00:1a:1e:63:c3:81 doing 802.1x May 29 06:08:38 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 58:91:cf:5a:e3:62 00:1a:1e:63:c3:81 doing 802.1x May 29 06:08:46 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 58:91:cf:5a:e3:62 00:1a:1e:63:c3:80 May 29 06:08:46 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 58:91:cf:5a:e3:62 00:1a:1e:63:c3:80 May 29 06:08:46 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 58:91:cf:5a:e3:62 00:1a:1e:63:c3:81 doing 802.1x May 29 06:08:46 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 58:91:cf:5a:e3:62 00:1a:1e:63:c3:81 doing 802.1x May 29 06:08:48 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:08:48 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:08:53 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station c8:f7:33:47:9e:33 00:1a:1e:63:c3:92 May 29 06:08:53 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station c8:f7:33:47:9e:33 00:1a:1e:63:c3:92 May 29 06:08:53 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station c8:f7:33:47:9e:33 00:1a:1e:63:c3:91 doing 802.1x May 29 06:08:53 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station c8:f7:33:47:9e:33 00:1a:1e:63:c3:91 doing 802.1x May 29 06:09:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 06:09:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:96:81 doing 802.1x May 29 06:10:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:10:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:10:32 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 2 FRR 88 50-30 May 29 06:10:33 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 06:10:38 sapd[610]: <404075> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 06:10:49 sapd[610]: <404050> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:30: ARM C 6 PER 0 MER 3 FRR 94 50-30 May 29 06:10:50 sapd[610]: <404065> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:30: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:12:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:12:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:12:11 sapd[604]: <404074> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 06:12:22 sapd[610]: <404085> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:28: ARM HT Channel Interference Trigger new 161-157/8 old 44/48-47 new_rra 161/157-8 TCI 10 May 29 06:13:35 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:13:35 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:14:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:14:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:14:21 sapd[931]: <404075> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:20: ARM - decreasing power cov-index 9/13 tx-power 6 new_rra 6/42 May 29 06:14:21 sapd[931]: <404404> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:20: AP to APM : Too much coverage on channel 6 coverage 22 tx-power 6 May 29 06:14:22 sapd[589]: <404075> |AP PR-B318-AP135@10.21.30.67 sapd| AM 00:1a:1e:63:ca:40: ARM - decreasing power cov-index 17/1 tx-power 6 new_rra 6/42 May 29 06:14:22 sapd[589]: <404404> |AP PR-B318-AP135@10.21.30.67 sapd| AM 00:1a:1e:63:ca:40: AP to APM : Too much coverage on channel 6 coverage 18 tx-power 6 May 29 06:14:23 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:3d:31 doing 802.1x May 29 06:14:23 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:3d:31 doing 802.1x May 29 06:14:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station host/PR-LRC-LOAN44.cencol.ca 5c:ac:4c:7d:e2:b5 00:24:6c:20:3d:31, deauthenticating the station May 29 06:14:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station host/PR-LRC-LOAN44.cencol.ca 5c:ac:4c:7d:e2:b5 00:24:6c:20:3d:31, deauthenticating the station May 29 06:14:25 KERNEL(PR-B318-AP135@10.21.30.67): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:14:25 KERNEL(PR-L334-AP225@10.26.33.125): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:14:30 sapd[610]: <404075> |AP PR-A280-AP183@10.28.16.120 sapd| AM 00:24:6c:b6:fa:60: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 1/6 May 29 06:14:36 sapd[610]: <404075> |AP PR-L228-AP210@10.26.28.121 sapd| AM 00:24:6c:b6:e9:e0: ARM - decreasing power cov-index 23/3 tx-power 6 new_rra 1/42 May 29 06:14:36 sapd[610]: <404404> |AP PR-L228-AP210@10.26.28.121 sapd| AM 00:24:6c:b6:e9:e0: AP to APM : Too much coverage on channel 1 coverage 26 tx-power 6 May 29 06:14:38 KERNEL(PR-L228-AP210@10.26.28.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:14:42 sapd[610]: <404075> |AP PR-L424-AP229@10.26.44.11 sapd| AM 00:24:6c:20:4d:00: ARM - decreasing power cov-index 6/8 tx-power 6 new_rra 11/42 May 29 06:14:42 sapd[610]: <404404> |AP PR-L424-AP229@10.26.44.11 sapd| AM 00:24:6c:20:4d:00: AP to APM : Too much coverage on channel 11 coverage 14 tx-power 6 May 29 06:14:44 KERNEL(PR-L424-AP229@10.26.44.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:14:44 sapd[1641]: <404075> |AP PR-G209-AP303@10.28.89.10 sapd| AM 00:0b:86:77:2f:e0: ARM - decreasing power cov-index 21/1 tx-power 6 new_rra 6/42 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:14:44 sapd[1641]: <404404> |AP PR-G209-AP303@10.28.89.10 sapd| AM 00:0b:86:77:2f:e0: AP to APM : Too much coverage on channel 6 coverage 22 tx-power 6 May 29 06:14:46 KERNEL(PR-G209-AP303@10.28.89.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:14:46 sapd[916]: <404075> |AP PR-A272C-AP194@10.28.66.27 sapd| AM 00:24:6c:20:3e:d0: ARM - decreasing power cov-index 22/8 tx-power 6 new_rra 11/42 May 29 06:14:46 sapd[916]: <404404> |AP PR-A272C-AP194@10.28.66.27 sapd| AM 00:24:6c:20:3e:d0: AP to APM : Too much coverage on channel 11 coverage 30 tx-power 6 May 29 06:14:47 KERNEL(PR-A272C-AP194@10.28.66.27): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:14:52 sapd[956]: <404075> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - decreasing power cov-index 13/1 tx-power 6 new_rra 6/42 May 29 06:14:52 sapd[956]: <404404> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: AP to APM : Too much coverage on channel 6 coverage 14 tx-power 6 May 29 06:14:53 KERNEL(PR-D318-AP48@10.21.33.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:14:58 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:14:58 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:15:02 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:15:02 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:15:03 sapd[610]: <404075> |AP PR-A161-AP167@10.28.7.14 sapd| AM 00:24:6c:b6:e8:60: ARM - decreasing power cov-index 15/6 tx-power 6 new_rra 6/42 May 29 06:15:03 sapd[610]: <404404> |AP PR-A161-AP167@10.28.7.14 sapd| AM 00:24:6c:b6:e8:60: AP to APM : Too much coverage on channel 6 coverage 21 tx-power 6 May 29 06:15:03 sapd[985]: <404075> |AP PR-D314-AP70@10.21.23.73 sapd| AM 00:1a:1e:63:ca:00: ARM - decreasing power cov-index 17/5 tx-power 6 new_rra 1/42 May 29 06:15:03 sapd[985]: <404404> |AP PR-D314-AP70@10.21.23.73 sapd| AM 00:1a:1e:63:ca:00: AP to APM : Too much coverage on channel 1 coverage 22 tx-power 6 May 29 06:15:04 KERNEL(PR-A161-AP167@10.28.7.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:15:04 KERNEL(PR-D314-AP70@10.21.23.73): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:15:07 sapd[1726]: <404075> |AP PR-SCrm2-AP8@10.20.60.17 sapd| AM 00:1a:1e:63:c4:80: ARM - decreasing power cov-index 18/0 tx-power 6 new_rra 11/42 May 29 06:15:07 sapd[1726]: <404404> |AP PR-SCrm2-AP8@10.20.60.17 sapd| AM 00:1a:1e:63:c4:80: AP to APM : Too much coverage on channel 11 coverage 18 tx-power 6 May 29 06:15:08 KERNEL(PR-SCrm2-AP8@10.20.60.17): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:15:21 sapd[916]: <404075> |AP PR-A355-AP151@10.28.46.10 sapd| AM 00:24:6c:b6:f3:70: ARM - decreasing power cov-index 10/5 tx-power 6 new_rra 11/42 May 29 06:15:21 sapd[916]: <404404> |AP PR-A355-AP151@10.28.46.10 sapd| AM 00:24:6c:b6:f3:70: AP to APM : Too much coverage on channel 11 coverage 15 tx-power 6 May 29 06:15:22 KERNEL(PR-A355-AP151@10.28.46.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:15:24 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:15:24 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:15:35 sapd[610]: <404075> |AP PR-A115-AP160@10.28.12.11 sapd| AM 00:24:6c:b6:f3:20: ARM - decreasing power cov-index 48/3 tx-power 6 new_rra 11/42 May 29 06:15:35 sapd[610]: <404404> |AP PR-A115-AP160@10.28.12.11 sapd| AM 00:24:6c:b6:f3:20: AP to APM : Too much coverage on channel 11 coverage 51 tx-power 6 May 29 06:15:36 KERNEL(PR-A115-AP160@10.28.12.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:15:40 sapd[610]: <404097> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:88: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 157-161/8 May 29 06:15:41 sapd[610]: <404075> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:40: ARM - decreasing power cov-index 19/8 tx-power 6 new_rra 11/42 May 29 06:15:41 sapd[610]: <404404> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:40: AP to APM : Too much coverage on channel 11 coverage 27 tx-power 6 May 29 06:15:42 KERNEL(PR-L127-AP245@10.26.29.124): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:15:45 sapd[610]: <404075> |AP PR-L109-AP235@10.26.17.122 sapd| AM 00:24:6c:20:50:80: ARM - decreasing power cov-index 16/7 tx-power 6 new_rra 11/42 May 29 06:15:45 sapd[610]: <404404> |AP PR-L109-AP235@10.26.17.122 sapd| AM 00:24:6c:20:50:80: AP to APM : Too much coverage on channel 11 coverage 23 tx-power 6 May 29 06:15:46 KERNEL(PR-L109-AP235@10.26.17.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:15:48 sapd[916]: <404075> |AP PR-A236-AP180@10.28.21.135 sapd| AM 00:24:6c:b6:f7:c0: ARM - decreasing power cov-index 21/8 tx-power 6 new_rra 11/42 May 29 06:15:48 sapd[916]: <404404> |AP PR-A236-AP180@10.28.21.135 sapd| AM 00:24:6c:b6:f7:c0: AP to APM : Too much coverage on channel 11 coverage 29 tx-power 6 May 29 06:15:49 KERNEL(PR-A236-AP180@10.28.21.135): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:15:52 sapd[589]: <404069> |AP PR-Cafe2-AP7@10.21.11.21 sapd| AM 00:1a:1e:63:c5:e0: ARM Channel Interference Trigger new 11-172 old 6-201 new_rra 11/6 TCI 25 May 29 06:16:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:16:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:16:33 sapd[600]: <404075> |AP PR-e229-AP42@10.21.42.24 sapd| AM 00:1a:1e:63:cf:60: ARM - decreasing power cov-index 10/1 tx-power 6 new_rra 6/42 May 29 06:16:33 sapd[600]: <404404> |AP PR-e229-AP42@10.21.42.24 sapd| AM 00:1a:1e:63:cf:60: AP to APM : Too much coverage on channel 6 coverage 11 tx-power 6 May 29 06:16:34 KERNEL(PR-e229-AP42@10.21.42.24): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:16:53 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:16:53 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:17:49 sapd[610]: <127000> |AP PR-A120A-AP166@10.28.13.14 sapd| |ids-ap| AP(00:24:6c:b6:e8:30): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:17:49 sapd[610]: <127000> |AP PR-A120A-AP166@10.28.13.14 sapd| |ids-ap| AP(00:24:6c:b6:e8:30): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:18:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:18:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:18:20 sapd[956]: <404075> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: ARM - decreasing power cov-index 10/2 tx-power 6 new_rra 11/42 May 29 06:18:20 sapd[956]: <404404> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: AP to APM : Too much coverage on channel 11 coverage 12 tx-power 6 May 29 06:18:21 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:18:26 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:18:26 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:18:45 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:18:45 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:18:48 sapd[589]: <404075> |AP PR-B115-AP28@10.21.11.19 sapd| AM 00:1a:1e:63:c3:c0: ARM - decreasing power cov-index 10/3 tx-power 6 new_rra 6/42 May 29 06:18:48 sapd[589]: <404404> |AP PR-B115-AP28@10.21.11.19 sapd| AM 00:1a:1e:63:c3:c0: AP to APM : Too much coverage on channel 6 coverage 13 tx-power 6 May 29 06:18:49 KERNEL(PR-B115-AP28@10.21.11.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:16 sapd[1017]: <404075> |AP PR-D114-AP67@10.21.21.23 sapd| AM 00:1a:1e:63:c9:20: ARM - decreasing power cov-index 13/0 tx-power 6 new_rra 6/42 May 29 06:19:16 sapd[1017]: <404404> |AP PR-D114-AP67@10.21.21.23 sapd| AM 00:1a:1e:63:c9:20: AP to APM : Too much coverage on channel 6 coverage 13 tx-power 6 May 29 06:19:17 KERNEL(PR-D114-AP67@10.21.21.23): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:25 sapd[1017]: <127000> |AP PR-D114-AP67@10.21.21.23 sapd| |ids-ap| AP(00:1a:1e:63:c9:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:19:25 sapd[1017]: <127000> |AP PR-D114-AP67@10.21.21.23 sapd| |ids-ap| AP(00:1a:1e:63:c9:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:19:28 KERNEL(PR-A115-AP160@10.28.12.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-A161-AP167@10.28.7.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-A236-AP180@10.28.21.135): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-A272C-AP194@10.28.66.27): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-A355-AP151@10.28.46.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-B115-AP28@10.21.11.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-B318-AP135@10.21.30.67): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-D114-AP67@10.21.21.23): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-D314-AP70@10.21.23.73): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-D318-AP48@10.21.33.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-G209-AP303@10.28.89.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-L109-AP235@10.26.17.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-L127-AP245@10.26.29.124): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-L228-AP210@10.26.28.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-L334-AP225@10.26.33.125): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-L424-AP229@10.26.44.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-SCrm2-AP8@10.20.60.17): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:28 KERNEL(PR-e229-AP42@10.21.42.24): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A115-AP160@10.28.12.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A115-AP160@10.28.12.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A161-AP167@10.28.7.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A161-AP167@10.28.7.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A236-AP180@10.28.21.135): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A236-AP180@10.28.21.135): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A272C-AP194@10.28.66.27): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A272C-AP194@10.28.66.27): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A355-AP151@10.28.46.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-A355-AP151@10.28.46.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B115-AP28@10.21.11.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B115-AP28@10.21.11.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B115-AP28@10.21.11.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B115-AP28@10.21.11.19): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B115-AP28@10.21.11.19): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B318-AP135@10.21.30.67): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B318-AP135@10.21.30.67): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B318-AP135@10.21.30.67): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B318-AP135@10.21.30.67): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-B318-AP135@10.21.30.67): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-D114-AP67@10.21.21.23): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-D114-AP67@10.21.21.23): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-D314-AP70@10.21.23.73): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-D314-AP70@10.21.23.73): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-D318-AP48@10.21.33.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-D318-AP48@10.21.33.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-G209-AP303@10.28.89.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-G209-AP303@10.28.89.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L109-AP235@10.26.17.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L109-AP235@10.26.17.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L127-AP245@10.26.29.124): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L127-AP245@10.26.29.124): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L228-AP210@10.26.28.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L228-AP210@10.26.28.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L228-AP210@10.26.28.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L228-AP210@10.26.28.121): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L228-AP210@10.26.28.121): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L334-AP225@10.26.33.125): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L334-AP225@10.26.33.125): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L334-AP225@10.26.33.125): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L334-AP225@10.26.33.125): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L424-AP229@10.26.44.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-L424-AP229@10.26.44.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-SCrm2-AP8@10.20.60.17): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-SCrm2-AP8@10.20.60.17): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-e229-AP42@10.21.42.24): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:29 KERNEL(PR-e229-AP42@10.21.42.24): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-A115-AP160@10.28.12.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-A115-AP160@10.28.12.11): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-A115-AP160@10.28.12.11): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-D114-AP67@10.21.21.23): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-D314-AP70@10.21.23.73): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-D314-AP70@10.21.23.73): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-L127-AP245@10.26.29.124): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-L127-AP245@10.26.29.124): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-L127-AP245@10.26.29.124): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-L334-AP225@10.26.33.125): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-L424-AP229@10.26.44.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-L424-AP229@10.26.44.11): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-L424-AP229@10.26.44.11): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:30 KERNEL(PR-SCrm2-AP8@10.20.60.17): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:30 sapd[1017]: <404099> |AP PR-D114-AP67@10.21.21.23 sapd| AM 00:1a:1e:63:c9:20: Tx Hang: Driver reset radio to 20 MHz mode 6-0 May 29 06:19:30 sapd[1726]: <404099> |AP PR-SCrm2-AP8@10.20.60.17 sapd| AM 00:1a:1e:63:c4:80: Tx Hang: Driver reset radio to 20 MHz mode 11-0 May 29 06:19:30 sapd[589]: <404073> |AP PR-B115-AP28@10.21.11.19 sapd| AM 00:1a:1e:63:c3:c0: ARM - too little power increasing... cov-index 0/4 tx-power 0 new_rra 6/6 May 29 06:19:30 sapd[589]: <404073> |AP PR-B318-AP135@10.21.30.67 sapd| AM 00:1a:1e:63:ca:40: ARM - too little power increasing... cov-index 0/1 tx-power 0 new_rra 6/6 May 29 06:19:30 sapd[610]: <404073> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:40: ARM - too little power increasing... cov-index 0/8 tx-power 0 new_rra 11/6 May 29 06:19:30 sapd[610]: <404073> |AP PR-L228-AP210@10.26.28.121 sapd| AM 00:24:6c:b6:e9:e0: ARM - too little power increasing... cov-index 0/3 tx-power 0 new_rra 1/6 May 29 06:19:30 sapd[610]: <404073> |AP PR-L424-AP229@10.26.44.11 sapd| AM 00:24:6c:20:4d:00: ARM - too little power increasing... cov-index 0/8 tx-power 0 new_rra 11/6 May 29 06:19:30 sapd[931]: <404073> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:20: ARM - too little power increasing... cov-index 0/12 tx-power 0 new_rra 6/6 May 29 06:19:30 sapd[956]: <404099> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: Tx Hang: Driver reset radio to 20 MHz mode 6-0 May 29 06:19:30 sapd[956]: <404099> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: Tx Hang: Driver reset radio to 20 MHz mode 11-0 May 29 06:19:30 sapd[985]: <404099> |AP PR-D314-AP70@10.21.23.73 sapd| AM 00:1a:1e:63:ca:00: Tx Hang: Driver reset radio to 20 MHz mode 1-0 May 29 06:19:31 KERNEL(PR-A272C-AP194@10.28.66.27): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-A272C-AP194@10.28.66.27): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-A272C-AP194@10.28.66.27): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-A355-AP151@10.28.46.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-A355-AP151@10.28.46.10): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-A355-AP151@10.28.46.10): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-D114-AP67@10.21.21.23): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-D114-AP67@10.21.21.23): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-D314-AP70@10.21.23.73): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-D318-AP48@10.21.33.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-D318-AP48@10.21.33.14): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-D318-AP48@10.21.33.14): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-L109-AP235@10.26.17.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-L109-AP235@10.26.17.122): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:31 KERNEL(PR-SCrm2-AP8@10.20.60.17): vap aruba101 vlan is 0. discovering tunnel vlan --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:19:31 sapd[1017]: <404073> |AP PR-D114-AP67@10.21.21.23 sapd| AM 00:1a:1e:63:c9:20: ARM - too little power increasing... cov-index 5/1 tx-power 5 new_rra 6/6 May 29 06:19:31 sapd[1726]: <404073> |AP PR-SCrm2-AP8@10.20.60.17 sapd| AM 00:1a:1e:63:c4:80: ARM - too little power increasing... cov-index 5/0 tx-power 5 new_rra 11/6 May 29 06:19:31 sapd[610]: <404073> |AP PR-A115-AP160@10.28.12.11 sapd| AM 00:24:6c:b6:f3:20: ARM - too little power increasing... cov-index 0/3 tx-power 0 new_rra 11/6 May 29 06:19:31 sapd[610]: <404073> |AP PR-L109-AP235@10.26.17.122 sapd| AM 00:24:6c:20:50:80: ARM - too little power increasing... cov-index 0/7 tx-power 0 new_rra 11/6 May 29 06:19:31 sapd[610]: <404073> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:40: ARM - too little power increasing... cov-index 0/8 tx-power 0 new_rra 11/6 May 29 06:19:31 sapd[916]: <404073> |AP PR-A272C-AP194@10.28.66.27 sapd| AM 00:24:6c:20:3e:d0: ARM - too little power increasing... cov-index 0/8 tx-power 0 new_rra 11/6 May 29 06:19:31 sapd[916]: <404073> |AP PR-A355-AP151@10.28.46.10 sapd| AM 00:24:6c:b6:f3:70: ARM - too little power increasing... cov-index 0/5 tx-power 0 new_rra 11/6 May 29 06:19:31 sapd[956]: <404073> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - too little power increasing... cov-index 5/1 tx-power 5 new_rra 6/6 May 29 06:19:31 sapd[956]: <404073> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: ARM - too little power increasing... cov-index 5/2 tx-power 5 new_rra 11/6 May 29 06:19:31 sapd[985]: <404073> |AP PR-D314-AP70@10.21.23.73 sapd| AM 00:1a:1e:63:ca:00: ARM - too little power increasing... cov-index 5/5 tx-power 5 new_rra 1/6 May 29 06:19:32 KERNEL(PR-A161-AP167@10.28.7.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:32 KERNEL(PR-A161-AP167@10.28.7.14): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:32 KERNEL(PR-A161-AP167@10.28.7.14): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:32 KERNEL(PR-A236-AP180@10.28.21.135): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:32 KERNEL(PR-A236-AP180@10.28.21.135): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:32 KERNEL(PR-A236-AP180@10.28.21.135): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:32 KERNEL(PR-G209-AP303@10.28.89.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:32 KERNEL(PR-L109-AP235@10.26.17.122): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:32 KERNEL(PR-e229-AP42@10.21.42.24): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:19:32 sapd[1641]: <404073> |AP PR-G209-AP303@10.28.89.10 sapd| AM 00:0b:86:77:2f:e0: ARM - too little power increasing... cov-index 15/1 tx-power 0 new_rra 6/6 May 29 06:19:32 sapd[600]: <404073> |AP PR-e229-AP42@10.21.42.24 sapd| AM 00:1a:1e:63:cf:60: ARM - too little power increasing... cov-index 3/1 tx-power 0 new_rra 6/6 May 29 06:19:32 sapd[610]: <404073> |AP PR-A161-AP167@10.28.7.14 sapd| AM 00:24:6c:b6:e8:60: ARM - too little power increasing... cov-index 9/6 tx-power 0 new_rra 6/6 May 29 06:19:32 sapd[610]: <404073> |AP PR-L109-AP235@10.26.17.122 sapd| AM 00:24:6c:20:50:80: ARM - too little power increasing... cov-index 6/7 tx-power 0 new_rra 11/6 May 29 06:19:32 sapd[916]: <404073> |AP PR-A236-AP180@10.28.21.135 sapd| AM 00:24:6c:b6:f7:c0: ARM - too little power increasing... cov-index 16/8 tx-power 0 new_rra 11/6 May 29 06:19:32 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:19:32 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:19:32 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:19:32 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:19:33 KERNEL(PR-e229-AP42@10.21.42.24): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:33 sapd[610]: <404073> |AP PR-A161-AP167@10.28.7.14 sapd| AM 00:24:6c:b6:e8:60: ARM - too little power increasing... cov-index 9/6 tx-power 0 new_rra 6/6 May 29 06:19:34 KERNEL(PR-SCrm2-AP8@10.20.60.17): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:34 KERNEL(PR-e229-AP42@10.21.42.24): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:35 KERNEL(PR-G209-AP303@10.28.89.10): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:19:35 KERNEL(PR-G209-AP303@10.28.89.10): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:19:56 sapd[610]: <404069> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:30: ARM Channel Interference Trigger new 6-145 old 11-189 new_rra 6/6 TCI 23 May 29 06:20:08 sapd[2011]: <404075> |AP PR-DGYM-AP308@10.28.88.18 sapd| AM 00:0b:86:77:3d:00: ARM - decreasing power cov-index 18/1 tx-power 6 new_rra 1/42 May 29 06:20:08 sapd[2011]: <404404> |AP PR-DGYM-AP308@10.28.88.18 sapd| AM 00:0b:86:77:3d:00: AP to APM : Too much coverage on channel 1 coverage 19 tx-power 6 May 29 06:20:08 sapd[610]: <404075> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:30: ARM - decreasing power cov-index 11/15 tx-power 6 new_rra 1/42 May 29 06:20:08 sapd[610]: <404404> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:30: AP to APM : Too much coverage on channel 1 coverage 26 tx-power 6 May 29 06:20:09 KERNEL(PR-DGYM-AP308@10.28.88.18): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:20:10 KERNEL(PR-L406-AP254@10.26.40.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:20:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:20:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:20:10 sapd[610]: <404074> |AP PR-A298-AP193@10.28.66.120 sapd| AM 00:24:6c:20:38:b0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 06:20:13 sapd[610]: <404075> |AP PR-A187-AP174@10.28.5.120 sapd| AM 00:24:6c:b6:fe:00: ARM - decreasing power cov-index 16/1 tx-power 6 new_rra 6/42 May 29 06:20:13 sapd[610]: <404404> |AP PR-A187-AP174@10.28.5.120 sapd| AM 00:24:6c:b6:fe:00: AP to APM : Too much coverage on channel 6 coverage 17 tx-power 6 May 29 06:20:14 KERNEL(PR-A187-AP174@10.28.5.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:20:17 sapd[916]: <404098> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 06:20:17 sapd[931]: <404075> |AP PR-A350-AP152@10.28.35.13 sapd| AM 00:24:6c:b6:f3:10: ARM - decreasing power cov-index 9/7 tx-power 6 new_rra 1/42 May 29 06:20:17 sapd[931]: <404404> |AP PR-A350-AP152@10.28.35.13 sapd| AM 00:24:6c:b6:f3:10: AP to APM : Too much coverage on channel 1 coverage 16 tx-power 6 May 29 06:20:18 KERNEL(PR-A350-AP152@10.28.35.13): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:20:18 sapd[603]: <404075> |AP PR-D305-AP61@10.21.23.138 sapd| AM 00:1a:1e:63:ca:20: ARM - decreasing power cov-index 10/4 tx-power 6 new_rra 1/42 May 29 06:20:18 sapd[603]: <404404> |AP PR-D305-AP61@10.21.23.138 sapd| AM 00:1a:1e:63:ca:20: AP to APM : Too much coverage on channel 1 coverage 14 tx-power 6 May 29 06:20:19 KERNEL(PR-D305-AP61@10.21.23.138): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:20:22 sapd[916]: <404075> |AP PR-L127-AP248@10.26.29.125 sapd| AM 00:24:6c:20:55:c0: ARM - decreasing power cov-index 10/11 tx-power 6 new_rra 1/42 May 29 06:20:22 sapd[916]: <404404> |AP PR-L127-AP248@10.26.29.125 sapd| AM 00:24:6c:20:55:c0: AP to APM : Too much coverage on channel 1 coverage 21 tx-power 6 May 29 06:20:24 KERNEL(PR-L127-AP248@10.26.29.125): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:20:28 sapd[916]: <404075> |AP PR-L223-AP206@10.26.27.121 sapd| AM 00:24:6c:b6:e9:80: ARM - decreasing power cov-index 15/11 tx-power 6 new_rra 11/42 May 29 06:20:28 sapd[916]: <404404> |AP PR-L223-AP206@10.26.27.121 sapd| AM 00:24:6c:b6:e9:80: AP to APM : Too much coverage on channel 11 coverage 26 tx-power 6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:20:29 KERNEL(PR-L223-AP206@10.26.27.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:20:33 sapd[610]: <404075> |AP PR-L111-AP243@10.26.19.122 sapd| AM 00:24:6c:20:48:00: ARM - decreasing power cov-index 45/3 tx-power 6 new_rra 11/42 May 29 06:20:33 sapd[610]: <404404> |AP PR-L111-AP243@10.26.19.122 sapd| AM 00:24:6c:20:48:00: AP to APM : Too much coverage on channel 11 coverage 48 tx-power 6 May 29 06:20:34 KERNEL(PR-L111-AP243@10.26.19.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:20:34 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:20:34 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:20:55 sapd[916]: <404069> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Channel Interference Trigger new 6-240 old 1-287 new_rra 6/6 TCI 38 May 29 06:20:56 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:20:56 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:20:59 sapd[916]: <127000> |AP PR-A355-AP151@10.28.46.10 sapd| |ids-ap| AP(00:24:6c:b6:f3:70): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:20:59 sapd[916]: <127000> |AP PR-A355-AP151@10.28.46.10 sapd| |ids-ap| AP(00:24:6c:b6:f3:70): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:21:02 sapd[2093]: <404075> |AP PR-SCo-AP55@10.20.60.19 sapd| AM 00:1a:1e:63:cf:40: ARM - decreasing power cov-index 11/1 tx-power 6 new_rra 1/42 May 29 06:21:02 sapd[2093]: <404404> |AP PR-SCo-AP55@10.20.60.19 sapd| AM 00:1a:1e:63:cf:40: AP to APM : Too much coverage on channel 1 coverage 12 tx-power 6 May 29 06:21:03 KERNEL(PR-SCo-AP55@10.20.60.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:21:25 sapd[610]: <404075> |AP PR-L444-AP252@10.26.42.121 sapd| AM 00:24:6c:20:57:50: ARM - decreasing power cov-index 16/8 tx-power 6 new_rra 11/42 May 29 06:21:25 sapd[610]: <404404> |AP PR-L444-AP252@10.26.42.121 sapd| AM 00:24:6c:20:57:50: AP to APM : Too much coverage on channel 11 coverage 24 tx-power 6 May 29 06:21:26 KERNEL(PR-L444-AP252@10.26.42.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:21:36 sapd[916]: <404050> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM C 6 PER 0 MER 3 FRR 91 50-30 May 29 06:21:37 sapd[916]: <404065> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 06:21:43 sapd[600]: <404075> |AP PR-C306s6-AP38@10.21.30.12 sapd| AM 00:1a:1e:63:97:e0: ARM - decreasing power cov-index 10/3 tx-power 6 new_rra 6/42 May 29 06:21:43 sapd[600]: <404404> |AP PR-C306s6-AP38@10.21.30.12 sapd| AM 00:1a:1e:63:97:e0: AP to APM : Too much coverage on channel 6 coverage 13 tx-power 6 May 29 06:21:45 KERNEL(PR-C306s6-AP38@10.21.30.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:21:46 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:21:46 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:21:48 sapd[2011]: <404075> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: ARM - decreasing power cov-index 14/1 tx-power 6 new_rra 1/42 May 29 06:21:48 sapd[2011]: <404404> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: AP to APM : Too much coverage on channel 1 coverage 15 tx-power 6 May 29 06:21:49 KERNEL(PR-G207-AP302@10.28.88.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:22:02 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:22:02 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:22:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:22:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:22:32 sapd[610]: <404075> |AP PR-A113-AP159@10.28.12.10 sapd| AM 00:24:6c:b6:f4:60: ARM - decreasing power cov-index 31/6 tx-power 6 new_rra 11/42 May 29 06:22:32 sapd[610]: <404404> |AP PR-A113-AP159@10.28.12.10 sapd| AM 00:24:6c:b6:f4:60: AP to APM : Too much coverage on channel 11 coverage 37 tx-power 6 May 29 06:22:33 KERNEL(PR-A113-AP159@10.28.12.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:22:53 sapd[603]: <404075> |AP PR-C306ab-AP35@10.21.23.39 sapd| AM 00:1a:1e:63:97:60: ARM - decreasing power cov-index 27/2 tx-power 6 new_rra 11/42 May 29 06:22:53 sapd[603]: <404404> |AP PR-C306ab-AP35@10.21.23.39 sapd| AM 00:1a:1e:63:97:60: AP to APM : Too much coverage on channel 11 coverage 29 tx-power 6 May 29 06:22:54 KERNEL(PR-C306ab-AP35@10.21.23.39): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:23:00 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:23:00 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:23:00 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:23:00 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:23:06 sapd[600]: <404075> |AP PR-IWC42-AP17@10.21.42.99 sapd| AM 00:1a:1e:63:c0:80: ARM - decreasing power cov-index 18/0 tx-power 6 new_rra 11/42 May 29 06:23:06 sapd[600]: <404404> |AP PR-IWC42-AP17@10.21.42.99 sapd| AM 00:1a:1e:63:c0:80: AP to APM : Too much coverage on channel 11 coverage 18 tx-power 6 May 29 06:23:07 KERNEL(PR-IWC42-AP17@10.21.42.99): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:23:09 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:23:09 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:23:34 sapd[602]: <404075> |AP PR-A150-AP330@10.28.64.121 sapd| AM 00:1a:1e:13:cd:20: ARM - decreasing power cov-index 10/2 tx-power 6 new_rra 6/42 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:23:34 sapd[602]: <404404> |AP PR-A150-AP330@10.28.64.121 sapd| AM 00:1a:1e:13:cd:20: AP to APM : Too much coverage on channel 6 coverage 12 tx-power 6 May 29 06:23:36 KERNEL(PR-A150-AP330@10.28.64.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:24:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:24:09 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:24:34 sapd[603]: <404075> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: ARM - decreasing power cov-index 11/4 tx-power 6 new_rra 11/42 May 29 06:24:34 sapd[603]: <404404> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: AP to APM : Too much coverage on channel 11 coverage 15 tx-power 6 May 29 06:24:36 KERNEL(PR-D319-AP10@10.21.23.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:24:38 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:24:38 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:24:41 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:24:41 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:24:47 sapd[589]: <404075> |AP PR-B111-AP37@10.21.11.23 sapd| AM 00:1a:1e:63:95:a0: ARM - decreasing power cov-index 11/1 tx-power 6 new_rra 1/42 May 29 06:24:47 sapd[589]: <404404> |AP PR-B111-AP37@10.21.11.23 sapd| AM 00:1a:1e:63:95:a0: AP to APM : Too much coverage on channel 1 coverage 12 tx-power 6 May 29 06:24:48 KERNEL(PR-B111-AP37@10.21.11.23): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:24:58 sapd[916]: <404075> |AP PR-L216-AP200@10.26.26.10 sapd| AM 00:24:6c:20:3f:00: ARM - decreasing power cov-index 24/2 tx-power 6 new_rra 6/42 May 29 06:24:58 sapd[916]: <404404> |AP PR-L216-AP200@10.26.26.10 sapd| AM 00:24:6c:20:3f:00: AP to APM : Too much coverage on channel 6 coverage 26 tx-power 6 May 29 06:25:00 KERNEL(PR-L216-AP200@10.26.26.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:25:06 sapd[916]: <404075> |AP PR-A272C-AP194@10.28.66.27 sapd| AM 00:24:6c:20:3e:d0: ARM - decreasing power cov-index 22/7 tx-power 6 new_rra 11/42 May 29 06:25:06 sapd[916]: <404404> |AP PR-A272C-AP194@10.28.66.27 sapd| AM 00:24:6c:20:3e:d0: AP to APM : Too much coverage on channel 11 coverage 29 tx-power 6 May 29 06:25:07 KERNEL(PR-A272C-AP194@10.28.66.27): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:25:11 sapd[610]: <404075> |AP PR-L127-AP249@10.26.29.11 sapd| AM 00:24:6c:20:46:20: ARM - decreasing power cov-index 10/4 tx-power 6 new_rra 6/42 May 29 06:25:11 sapd[610]: <404404> |AP PR-L127-AP249@10.26.29.11 sapd| AM 00:24:6c:20:46:20: AP to APM : Too much coverage on channel 6 coverage 14 tx-power 6 May 29 06:25:12 KERNEL(PR-L127-AP249@10.26.29.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:25:20 sapd[610]: <404075> |AP PR-L109-AP235@10.26.17.122 sapd| AM 00:24:6c:20:50:80: ARM - decreasing power cov-index 12/3 tx-power 6 new_rra 11/42 May 29 06:25:20 sapd[610]: <404404> |AP PR-L109-AP235@10.26.17.122 sapd| AM 00:24:6c:20:50:80: AP to APM : Too much coverage on channel 11 coverage 15 tx-power 6 May 29 06:25:21 KERNEL(PR-L109-AP235@10.26.17.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:25:54 sapd[916]: <404075> |AP PR-L208A-AP214@10.26.24.12 sapd| AM 00:24:6c:20:52:90: ARM - decreasing power cov-index 6/8 tx-power 6 new_rra 11/42 May 29 06:25:54 sapd[916]: <404404> |AP PR-L208A-AP214@10.26.24.12 sapd| AM 00:24:6c:20:52:90: AP to APM : Too much coverage on channel 11 coverage 14 tx-power 6 May 29 06:25:55 sapd[610]: <404075> |AP PR-A181-AP170@10.28.2.11 sapd| AM 00:24:6c:b6:e7:b0: ARM - decreasing power cov-index 22/2 tx-power 6 new_rra 11/42 May 29 06:25:55 sapd[610]: <404404> |AP PR-A181-AP170@10.28.2.11 sapd| AM 00:24:6c:b6:e7:b0: AP to APM : Too much coverage on channel 11 coverage 24 tx-power 6 May 29 06:25:56 KERNEL(PR-L208A-AP214@10.26.24.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:25:57 KERNEL(PR-A181-AP170@10.28.2.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:26:00 webui[1735]: USER: mikem has logged in from 199.212.60.107. May 29 06:26:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:26:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:26:24 sapd[610]: <404075> |AP PR-L420-AP228@10.26.44.120 sapd| AM 00:24:6c:20:4f:10: ARM - decreasing power cov-index 19/5 tx-power 6 new_rra 6/42 May 29 06:26:24 sapd[610]: <404404> |AP PR-L420-AP228@10.26.44.120 sapd| AM 00:24:6c:20:4f:10: AP to APM : Too much coverage on channel 6 coverage 24 tx-power 6 May 29 06:26:25 KERNEL(PR-L420-AP228@10.26.44.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:26:30 sapd[1641]: <404075> |AP PR-DGYM-AP304@10.28.89.19 sapd| AM 00:0b:86:77:31:10: ARM - decreasing power cov-index 21/1 tx-power 6 new_rra 11/42 May 29 06:26:30 sapd[1641]: <404404> |AP PR-DGYM-AP304@10.28.89.19 sapd| AM 00:0b:86:77:31:10: AP to APM : Too much coverage on channel 11 coverage 22 tx-power 6 May 29 06:26:32 KERNEL(PR-DGYM-AP304@10.28.89.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:26:49 sapd[610]: <127000> |AP PR-A161-AP167@10.28.7.14 sapd| |ids-ap| AP(00:24:6c:b6:e8:60): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:26:49 sapd[610]: <127000> |AP PR-A161-AP167@10.28.7.14 sapd| |ids-ap| AP(00:24:6c:b6:e8:60): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:27:02 sapd[635]: <404075> |AP PR-IWC21-AP14@10.20.19.10 sapd| AM 00:1a:1e:63:c1:c0: ARM - decreasing power cov-index 10/2 tx-power 6 new_rra 1/42 May 29 06:27:02 sapd[635]: <404404> |AP PR-IWC21-AP14@10.20.19.10 sapd| AM 00:1a:1e:63:c1:c0: AP to APM : Too much coverage on channel 1 coverage 12 tx-power 6 May 29 06:27:04 KERNEL(PR-IWC21-AP14@10.20.19.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:27:11 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:27:11 sapd[956]: <127000> |AP PR-D318-AP48@10.21.33.14 sapd| |ids-ap| AP(00:1a:1e:63:d2:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:27:27 sapd[635]: <127000> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.20.19.2). May 29 06:27:27 sapd[635]: <127000> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.20.19.2). May 29 06:27:30 sapd[610]: <404075> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:20: ARM - decreasing power cov-index 6/8 tx-power 6 new_rra 11/42 May 29 06:27:30 sapd[610]: <404404> |AP PR-L317-AP223@10.26.37.11 sapd| AM 00:24:6c:20:3a:20: AP to APM : Too much coverage on channel 11 coverage 14 tx-power 6 May 29 06:27:31 KERNEL(PR-L317-AP223@10.26.37.11): vap aruba100 vlan is 0. discovering tunnel vlan --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:27:41 sapd[610]: <404075> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:50: ARM - decreasing power cov-index 14/4 tx-power 6 new_rra 1/42 May 29 06:27:41 sapd[610]: <404404> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:50: AP to APM : Too much coverage on channel 1 coverage 18 tx-power 6 May 29 06:27:42 KERNEL(PR-L119-AP244@10.26.18.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:27:57 sapd[610]: <404075> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:90: ARM - decreasing power cov-index 30/3 tx-power 6 new_rra 6/42 May 29 06:27:57 sapd[610]: <404404> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:90: AP to APM : Too much coverage on channel 6 coverage 33 tx-power 6 May 29 06:27:57 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 06:27:59 KERNEL(PR-A117-AP161@10.28.10.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:28:02 sapd[610]: <404075> |AP PR-L220-AP205@10.26.27.122 sapd| AM 00:24:6c:b6:e6:d0: ARM - decreasing power cov-index 9/3 tx-power 6 new_rra 1/42 May 29 06:28:02 sapd[610]: <404404> |AP PR-L220-AP205@10.26.27.122 sapd| AM 00:24:6c:b6:e6:d0: AP to APM : Too much coverage on channel 1 coverage 12 tx-power 6 May 29 06:28:04 KERNEL(PR-L220-AP205@10.26.27.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:28:05 sapd[916]: <404075> |AP PR-A334A-AP150@10.28.35.11 sapd| AM 00:24:6c:b6:e8:20: ARM - decreasing power cov-index 9/5 tx-power 6 new_rra 1/42 May 29 06:28:05 sapd[916]: <404404> |AP PR-A334A-AP150@10.28.35.11 sapd| AM 00:24:6c:b6:e8:20: AP to APM : Too much coverage on channel 1 coverage 14 tx-power 6 May 29 06:28:06 KERNEL(PR-A334A-AP150@10.28.35.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:28:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:28:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:28:39 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 06:28:39 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 06:28:44 sapd[1726]: <404075> |AP PR-SCstore-AP33@10.20.60.11 sapd| AM 00:1a:1e:63:96:80: ARM - decreasing power cov-index 11/1 tx-power 6 new_rra 11/42 May 29 06:28:44 sapd[1726]: <404404> |AP PR-SCstore-AP33@10.20.60.11 sapd| AM 00:1a:1e:63:96:80: AP to APM : Too much coverage on channel 11 coverage 12 tx-power 6 May 29 06:28:45 KERNEL(PR-SCstore-AP33@10.20.60.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:28:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:28:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:28:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:28:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:28:59 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:28:59 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:28:59 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:28:59 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:29:00 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:29:00 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:29:00 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:29:00 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f2 May 29 06:29:07 sapd[605]: <404075> |AP PR-A148-AP326@10.28.64.122 sapd| AM 00:1a:1e:90:74:60: ARM - decreasing power cov-index 19/3 tx-power 6 new_rra 6/42 May 29 06:29:07 sapd[605]: <404404> |AP PR-A148-AP326@10.28.64.122 sapd| AM 00:1a:1e:90:74:60: AP to APM : Too much coverage on channel 6 coverage 22 tx-power 6 May 29 06:29:09 KERNEL(PR-A148-AP326@10.28.64.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:29:11 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f1 doing 802.1x May 29 06:29:11 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f1 doing 802.1x May 29 06:29:11 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/WSANNER-LAPTOP.corp.ccsos.com 08:11:96:05:ee:5c from server msradius01. May 29 06:29:11 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/WSANNER-LAPTOP.corp.ccsos.com 08:11:96:05:ee:5c from server msradius01. May 29 06:29:21 sapd[1271]: <404075> |AP PR-G124-AP295@10.28.88.14 sapd| AM 00:0b:86:77:33:d0: ARM - decreasing power cov-index 13/0 tx-power 6 new_rra 6/42 May 29 06:29:21 sapd[1271]: <404404> |AP PR-G124-AP295@10.28.88.14 sapd| AM 00:0b:86:77:33:d0: AP to APM : Too much coverage on channel 6 coverage 13 tx-power 6 May 29 06:29:23 KERNEL(PR-G124-AP295@10.28.88.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:29:23 sapd[916]: <404075> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: ARM - decreasing power cov-index 44/7 tx-power 6 new_rra 1/42 May 29 06:29:23 sapd[916]: <404404> |AP PR-A324-AP145@10.28.34.14 sapd| AM 00:24:6c:b6:f0:00: AP to APM : Too much coverage on channel 1 coverage 51 tx-power 6 May 29 06:29:25 KERNEL(PR-A324-AP145@10.28.34.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:29:25 sapd[1726]: <404075> |AP PR-D212-AP50@10.21.32.10 sapd| AM 00:1a:1e:63:d3:00: ARM - decreasing power cov-index 19/2 tx-power 6 new_rra 1/42 May 29 06:29:25 sapd[1726]: <404404> |AP PR-D212-AP50@10.21.32.10 sapd| AM 00:1a:1e:63:d3:00: AP to APM : Too much coverage on channel 1 coverage 21 tx-power 6 May 29 06:29:25 sapd[956]: <404075> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: ARM - decreasing power cov-index 10/1 tx-power 6 new_rra 11/42 May 29 06:29:25 sapd[956]: <404404> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: AP to APM : Too much coverage on channel 11 coverage 11 tx-power 6 May 29 06:29:26 KERNEL(PR-D212-AP50@10.21.32.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:29:26 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:29:28 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:29:28 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:29:32 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f1 doing 802.1x May 29 06:29:32 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 08:11:96:05:ee:5c 00:1a:1e:63:c8:f1 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:29:33 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:29:33 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:29:37 sapd[1726]: <127000> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:29:37 sapd[1726]: <127000> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:29:52 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 06:29:52 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 06:29:54 sapd[919]: <404074> |AP PR-Bookstore-AP283@10.21.12.10 sapd| AM 00:24:6c:29:4d:30: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 06:30:08 sapd[610]: <404075> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:40: ARM - decreasing power cov-index 18/7 tx-power 6 new_rra 11/42 May 29 06:30:08 sapd[610]: <404404> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:40: AP to APM : Too much coverage on channel 11 coverage 25 tx-power 6 May 29 06:30:09 KERNEL(PR-L127-AP245@10.26.29.124): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:30:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:30:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:30:21 sapd[600]: <404075> |AP PR-e229-AP42@10.21.42.24 sapd| AM 00:1a:1e:63:cf:60: ARM - decreasing power cov-index 10/1 tx-power 6 new_rra 6/42 May 29 06:30:21 sapd[600]: <404404> |AP PR-e229-AP42@10.21.42.24 sapd| AM 00:1a:1e:63:cf:60: AP to APM : Too much coverage on channel 6 coverage 11 tx-power 6 May 29 06:30:22 KERNEL(PR-e229-AP42@10.21.42.24): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:30:36 sapd[589]: <404075> |AP PR-B318-AP135@10.21.30.67 sapd| AM 00:1a:1e:63:ca:40: ARM - decreasing power cov-index 17/1 tx-power 6 new_rra 6/42 May 29 06:30:36 sapd[589]: <404404> |AP PR-B318-AP135@10.21.30.67 sapd| AM 00:1a:1e:63:ca:40: AP to APM : Too much coverage on channel 6 coverage 18 tx-power 6 May 29 06:30:37 KERNEL(PR-B318-AP135@10.21.30.67): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:30:48 sapd[916]: <404075> |AP PR-L107-AP233@10.26.16.120 sapd| AM 00:24:6c:20:4f:b0: ARM - decreasing power cov-index 9/14 tx-power 6 new_rra 11/42 May 29 06:30:48 sapd[916]: <404404> |AP PR-L107-AP233@10.26.16.120 sapd| AM 00:24:6c:20:4f:b0: AP to APM : Too much coverage on channel 11 coverage 23 tx-power 6 May 29 06:30:49 KERNEL(PR-L107-AP233@10.26.16.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:30:51 sapd[600]: <404075> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: ARM - decreasing power cov-index 27/4 tx-power 6 new_rra 11/42 May 29 06:30:51 sapd[600]: <404404> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: AP to APM : Too much coverage on channel 11 coverage 31 tx-power 6 May 29 06:30:52 KERNEL(PR-C306A-AP23@10.21.180.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:30:52 sapd[600]: <311020> |AP PR-C306A-AP23@10.21.180.19 sapd| An internal system error has occurred at file sapd_sysctl.c function sapd_sysctl_read_param line 56 error Error opening /proc/sys/net/aruba_asap/aruba100/bw_stats : No such file or directory. --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:30:52 sapd[600]: <311020> |AP PR-C306A-AP23@10.21.180.19 sapd| An internal system error has occurred at file sapd_sysctl.c function sapd_sysctl_read_param line 56 error Error opening /proc/sys/net/aruba_asap/aruba100/bw_stats : No such file or directory. May 29 06:30:59 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:30:59 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:31:00 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:31:00 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:31:00 sapd[610]: <404075> |AP PR-A360-AP155@10.28.35.12 sapd| AM 00:24:6c:b6:f2:40: ARM - decreasing power cov-index 27/1 tx-power 6 new_rra 11/42 May 29 06:31:00 sapd[610]: <404404> |AP PR-A360-AP155@10.28.35.12 sapd| AM 00:24:6c:b6:f2:40: AP to APM : Too much coverage on channel 11 coverage 28 tx-power 6 May 29 06:31:01 KERNEL(PR-A360-AP155@10.28.35.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:31:17 webui[1735]: USER:mikem@199.212.60.107 COMMAND: -- command executed successfully May 29 06:32:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:32:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:32:12 sapd[916]: <404075> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:10: ARM - decreasing power cov-index 12/8 tx-power 6 new_rra 11/42 May 29 06:32:12 sapd[916]: <404404> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:10: AP to APM : Too much coverage on channel 11 coverage 20 tx-power 6 May 29 06:32:13 KERNEL(PR-L215-AP201@10.26.25.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:32:18 webui[1735]: USER:mikem@199.212.60.107 COMMAND: -- command executed successfully May 29 06:32:30 sapd[985]: <404075> |AP PR-D314-AP70@10.21.23.73 sapd| AM 00:1a:1e:63:ca:00: ARM - decreasing power cov-index 12/5 tx-power 6 new_rra 1/42 May 29 06:32:30 sapd[985]: <404404> |AP PR-D314-AP70@10.21.23.73 sapd| AM 00:1a:1e:63:ca:00: AP to APM : Too much coverage on channel 1 coverage 17 tx-power 6 May 29 06:32:32 KERNEL(PR-D314-AP70@10.21.23.73): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:32:32 sapd[610]: <404075> |AP PR-L403-AP251@10.26.42.12 sapd| AM 00:24:6c:20:4b:40: ARM - decreasing power cov-index 13/17 tx-power 6 new_rra 11/42 May 29 06:32:32 sapd[610]: <404404> |AP PR-L403-AP251@10.26.42.12 sapd| AM 00:24:6c:20:4b:40: AP to APM : Too much coverage on channel 11 coverage 30 tx-power 6 May 29 06:32:33 KERNEL(PR-L403-AP251@10.26.42.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:32:57 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:32:57 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:33:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:33:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:35 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:35 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:36 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:36 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:37 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:37 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:21:5c:77:7c:01 00:24:6c:20:52:e2 May 29 06:33:50 sapd[610]: <404075> |AP PR-A115-AP160@10.28.12.11 sapd| AM 00:24:6c:b6:f3:20: ARM - decreasing power cov-index 35/1 tx-power 6 new_rra 11/42 May 29 06:33:50 sapd[610]: <404404> |AP PR-A115-AP160@10.28.12.11 sapd| AM 00:24:6c:b6:f3:20: AP to APM : Too much coverage on channel 11 coverage 36 tx-power 6 May 29 06:33:51 sapd[919]: <404050> |AP PR-L114-AP292@10.26.19.16 sapd| AM 00:24:6c:29:4a:90: ARM C 11 PER 0 MER 66 FRR 0 50-30 May 29 06:33:52 KERNEL(PR-A115-AP160@10.28.12.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:33:52 sapd[919]: <404065> |AP PR-L114-AP292@10.26.19.16 sapd| AM 00:24:6c:29:4a:90: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 06:34:02 sapd[610]: <404075> |AP PR-A161-AP167@10.28.7.14 sapd| AM 00:24:6c:b6:e8:60: ARM - decreasing power cov-index 19/8 tx-power 6 new_rra 6/42 May 29 06:34:02 sapd[610]: <404404> |AP PR-A161-AP167@10.28.7.14 sapd| AM 00:24:6c:b6:e8:60: AP to APM : Too much coverage on channel 6 coverage 27 tx-power 6 May 29 06:34:03 KERNEL(PR-A161-AP167@10.28.7.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:34:03 sapd[931]: <404075> |AP PR-L307-AP220@10.26.34.123 sapd| AM 00:24:6c:20:53:50: ARM - decreasing power cov-index 15/6 tx-power 6 new_rra 6/42 May 29 06:34:03 sapd[931]: <404404> |AP PR-L307-AP220@10.26.34.123 sapd| AM 00:24:6c:20:53:50: AP to APM : Too much coverage on channel 6 coverage 21 tx-power 6 May 29 06:34:04 KERNEL(PR-L307-AP220@10.26.34.123): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:34:08 sapd[919]: <404075> |AP PR-L114-AP292@10.26.19.16 sapd| AM 00:24:6c:29:4a:90: ARM - decreasing power cov-index 6/17 tx-power 6 new_rra 6/42 May 29 06:34:08 sapd[919]: <404404> |AP PR-L114-AP292@10.26.19.16 sapd| AM 00:24:6c:29:4a:90: AP to APM : Too much coverage on channel 6 coverage 23 tx-power 6 May 29 06:34:10 KERNEL(PR-L114-AP292@10.26.19.16): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:34:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:34:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:34:14 sapd[2043]: <404075> |AP PR-DGYM-AP307@10.28.89.12 sapd| AM 00:0b:86:77:2f:40: ARM - decreasing power cov-index 26/1 tx-power 6 new_rra 11/42 May 29 06:34:14 sapd[2043]: <404404> |AP PR-DGYM-AP307@10.28.89.12 sapd| AM 00:0b:86:77:2f:40: AP to APM : Too much coverage on channel 11 coverage 27 tx-power 6 May 29 06:34:15 KERNEL(PR-DGYM-AP307@10.28.89.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:34:15 sapd[916]: <404098> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 06:34:41 sapd[634]: <404098> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:f0: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 149-153/6 May 29 06:34:45 sapd[931]: <404075> |AP PR-A239-AP177@10.28.21.133 sapd| AM 00:24:6c:b6:fb:f0: ARM - decreasing power cov-index 6/7 tx-power 6 new_rra 1/42 May 29 06:34:45 sapd[931]: <404404> |AP PR-A239-AP177@10.28.21.133 sapd| AM 00:24:6c:b6:fb:f0: AP to APM : Too much coverage on channel 1 coverage 13 tx-power 6 May 29 06:34:46 KERNEL(PR-A239-AP177@10.28.21.133): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:34:52 sapd[956]: <404063> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: ARM Channel Band Trigger new 11-1/1 old 0-0/0 new_rra 11/6 May 29 06:34:52 sapd[956]: <404405> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: Coverage hole: APM converting to AP on channel 11 coverage 1 6 May 29 06:34:53 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:34:54 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:34:54 KERNEL(PR-E322-AP25@10.21.33.134): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:34:56 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:34:56 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 06:34:56 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:34:56 sapd[956]: <127000> |AP PR-E322-AP25@10.21.33.134 sapd| |ids-ap| AP(00:1a:1e:63:c2:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 06:35:06 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:52:41 doing 802.1x May 29 06:35:06 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:52:41 doing 802.1x May 29 06:35:13 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:35:13 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:35:35 sapd[610]: <404075> |AP PR-A298-AP193@10.28.66.120 sapd| AM 00:24:6c:20:38:b0: ARM - decreasing power cov-index 7/6 tx-power 7 new_rra 6/6 May 29 06:35:55 sapd[610]: <404075> |AP PR-A365-AP156@10.28.33.12 sapd| AM 00:24:6c:b6:f2:a0: ARM - decreasing power cov-index 6/7 tx-power 6 new_rra 1/42 May 29 06:35:55 sapd[610]: <404404> |AP PR-A365-AP156@10.28.33.12 sapd| AM 00:24:6c:b6:f2:a0: AP to APM : Too much coverage on channel 1 coverage 13 tx-power 6 May 29 06:35:57 KERNEL(PR-A365-AP156@10.28.33.12): vap aruba100 vlan is 0. discovering tunnel vlan --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:35:59 sapd[956]: <127000> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 06:35:59 sapd[956]: <127000> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 06:36:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:36:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:36:47 sapd[919]: <404075> |AP PR-B212-AP284@10.21.12.11 sapd| AM 00:24:6c:29:4a:70: ARM - decreasing power cov-index 11/13 tx-power 6 new_rra 1/42 May 29 06:36:47 sapd[919]: <404404> |AP PR-B212-AP284@10.21.12.11 sapd| AM 00:24:6c:29:4a:70: AP to APM : Too much coverage on channel 1 coverage 24 tx-power 6 May 29 06:36:48 sapd[1711]: <404075> |AP PR-E220-AP58@10.21.32.159 sapd| AM 00:1a:1e:63:d0:20: ARM - decreasing power cov-index 11/0 tx-power 6 new_rra 1/42 May 29 06:36:48 sapd[1711]: <404404> |AP PR-E220-AP58@10.21.32.159 sapd| AM 00:1a:1e:63:d0:20: AP to APM : Too much coverage on channel 1 coverage 11 tx-power 6 May 29 06:36:49 KERNEL(PR-B212-AP284@10.21.12.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:36:49 KERNEL(PR-E220-AP58@10.21.32.159): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:36:53 sapd[605]: <404075> |AP PR-A146-AP329@10.28.64.126 sapd| AM 00:24:6c:d2:50:80: ARM - decreasing power cov-index 25/7 tx-power 6 new_rra 1/42 May 29 06:36:53 sapd[605]: <404404> |AP PR-A146-AP329@10.28.64.126 sapd| AM 00:24:6c:d2:50:80: AP to APM : Too much coverage on channel 1 coverage 32 tx-power 6 May 29 06:36:55 KERNEL(PR-A146-AP329@10.28.64.126): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:37:05 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.12 IP Spoof from MAC=60:fa:cd:2e:6d:10 role=authenticated/(null) May 29 06:37:14 sapd[610]: <404075> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f0: ARM - decreasing power cov-index 24/5 tx-power 6 new_rra 1/42 May 29 06:37:14 sapd[610]: <404404> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f0: AP to APM : Too much coverage on channel 1 coverage 29 tx-power 6 May 29 06:37:15 sapd[916]: <404075> |AP PR-L127-AP247@10.26.29.123 sapd| AM 00:24:6c:20:54:10: ARM - decreasing power cov-index 30/11 tx-power 6 new_rra 11/42 May 29 06:37:15 sapd[916]: <404404> |AP PR-L127-AP247@10.26.29.123 sapd| AM 00:24:6c:20:54:10: AP to APM : Too much coverage on channel 11 coverage 41 tx-power 6 May 29 06:37:16 KERNEL(PR-L106-AP232@10.26.16.123): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:37:17 KERNEL(PR-L127-AP247@10.26.29.123): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:37:39 sapd[610]: <404075> |AP PR-A291-AP185@10.28.16.121 sapd| AM 00:24:6c:b6:f5:10: ARM - decreasing power cov-index 11/7 tx-power 6 new_rra 6/42 May 29 06:37:39 sapd[610]: <404404> |AP PR-A291-AP185@10.28.16.121 sapd| AM 00:24:6c:b6:f5:10: AP to APM : Too much coverage on channel 6 coverage 18 tx-power 6 May 29 06:37:41 KERNEL(PR-A291-AP185@10.28.16.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:37:46 sapd[1017]: <127000> |AP PR-D114-AP67@10.21.21.23 sapd| |ids-ap| AP(00:1a:1e:63:c9:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:37:46 sapd[1017]: <127000> |AP PR-D114-AP67@10.21.21.23 sapd| |ids-ap| AP(00:1a:1e:63:c9:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:38:01 sapd[610]: <404075> |AP PR-L219-AP204@10.26.26.122 sapd| AM 00:24:6c:b6:ea:30: ARM - decreasing power cov-index 23/4 tx-power 6 new_rra 6/42 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:38:01 sapd[610]: <404404> |AP PR-L219-AP204@10.26.26.122 sapd| AM 00:24:6c:b6:ea:30: AP to APM : Too much coverage on channel 6 coverage 27 tx-power 6 May 29 06:38:02 KERNEL(PR-L219-AP204@10.26.26.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:38:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:38:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:38:28 sapd[610]: <404074> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 06:38:30 sapd[1341]: <404075> |AP PR-D312-AP22@10.21.180.14 sapd| AM 00:1a:1e:63:c2:80: ARM - decreasing power cov-index 19/2 tx-power 6 new_rra 6/42 May 29 06:38:30 sapd[1341]: <404404> |AP PR-D312-AP22@10.21.180.14 sapd| AM 00:1a:1e:63:c2:80: AP to APM : Too much coverage on channel 6 coverage 21 tx-power 6 May 29 06:38:32 KERNEL(PR-D312-AP22@10.21.180.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:38:37 sapd[1341]: <127000> |AP PR-D312-AP22@10.21.180.14 sapd| |ids-ap| AP(00:1a:1e:63:c2:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:38:37 sapd[1341]: <127000> |AP PR-D312-AP22@10.21.180.14 sapd| |ids-ap| AP(00:1a:1e:63:c2:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:38:37 sapd[1341]: <127000> |AP PR-D312-AP22@10.21.180.14 sapd| |ids-ap| AP(00:1a:1e:63:c2:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:38:37 sapd[1341]: <127000> |AP PR-D312-AP22@10.21.180.14 sapd| |ids-ap| AP(00:1a:1e:63:c2:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:38:46 sapd[589]: <404075> |AP PR-Cafe2-AP7@10.21.11.21 sapd| AM 00:1a:1e:63:c5:e0: ARM - decreasing power cov-index 22/5 tx-power 6 new_rra 11/42 May 29 06:38:46 sapd[589]: <404404> |AP PR-Cafe2-AP7@10.21.11.21 sapd| AM 00:1a:1e:63:c5:e0: AP to APM : Too much coverage on channel 11 coverage 27 tx-power 6 May 29 06:38:48 KERNEL(PR-Cafe2-AP7@10.21.11.21): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:38:50 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:38:50 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:38:50 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 06:38:50 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 06:38:51 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:38:51 sapd[589]: <127000> |AP PR-Cafe2-AP7@10.21.11.21 sapd| |ids-ap| AP(00:1a:1e:63:c5:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:38:56 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:39:03 sapd[916]: <404075> |AP PR-A340-AP147@10.28.39.12 sapd| AM 00:24:6c:b6:ef:20: ARM - decreasing power cov-index 6/6 tx-power 6 new_rra 6/42 May 29 06:39:03 sapd[916]: <404404> |AP PR-A340-AP147@10.28.39.12 sapd| AM 00:24:6c:b6:ef:20: AP to APM : Too much coverage on channel 6 coverage 12 tx-power 6 May 29 06:39:04 KERNEL(PR-A340-AP147@10.28.39.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:39:33 sapd[610]: <404075> |AP PR-L320-AP224@10.26.37.121 sapd| AM 00:24:6c:20:4d:30: ARM - decreasing power cov-index 13/17 tx-power 6 new_rra 11/42 May 29 06:39:33 sapd[610]: <404404> |AP PR-L320-AP224@10.26.37.121 sapd| AM 00:24:6c:20:4d:30: AP to APM : Too much coverage on channel 11 coverage 30 tx-power 6 May 29 06:39:35 KERNEL(PR-L320-AP224@10.26.37.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:40:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:40:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:40:11 sapd[1726]: <404063> |AP PR-SCstore-AP33@10.20.60.11 sapd| AM 00:1a:1e:63:96:80: ARM Channel Band Trigger new 1-3/1 old 0-0/0 new_rra 1/7 May 29 06:40:11 sapd[1726]: <404405> |AP PR-SCstore-AP33@10.20.60.11 sapd| AM 00:1a:1e:63:96:80: Coverage hole: APM converting to AP on channel 1 coverage 3 7 May 29 06:40:12 KERNEL(PR-SCstore-AP33@10.20.60.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:40:12 sapd[635]: <404063> |AP PR-IWC21-AP14@10.20.19.10 sapd| AM 00:1a:1e:63:c1:c0: ARM Channel Band Trigger new 1-3/1 old 0-0/0 new_rra 1/7 May 29 06:40:12 sapd[635]: <404405> |AP PR-IWC21-AP14@10.20.19.10 sapd| AM 00:1a:1e:63:c1:c0: Coverage hole: APM converting to AP on channel 1 coverage 3 7 May 29 06:40:13 KERNEL(PR-IWC21-AP14@10.20.19.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:40:13 KERNEL(PR-SCstore-AP33@10.20.60.11): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:40:13 KERNEL(PR-SCstore-AP33@10.20.60.11): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:40:14 KERNEL(PR-IWC21-AP14@10.20.19.10): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:40:14 KERNEL(PR-IWC21-AP14@10.20.19.10): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:40:31 sapd[610]: <404075> |AP PR-L424-AP229@10.26.44.11 sapd| AM 00:24:6c:20:4d:00: ARM - decreasing power cov-index 6/7 tx-power 6 new_rra 11/42 May 29 06:40:31 sapd[610]: <404404> |AP PR-L424-AP229@10.26.44.11 sapd| AM 00:24:6c:20:4d:00: AP to APM : Too much coverage on channel 11 coverage 13 tx-power 6 May 29 06:40:33 KERNEL(PR-L424-AP229@10.26.44.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:40:42 sapd[916]: <404075> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: ARM - decreasing power cov-index 43/5 tx-power 6 new_rra 11/42 May 29 06:40:42 sapd[916]: <404404> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:70: AP to APM : Too much coverage on channel 11 coverage 48 tx-power 6 May 29 06:40:43 KERNEL(PR-A310-AP142@10.28.39.13): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:40:43 sapd[1708]: <404075> |AP PR-SChall-AP34@10.20.60.13 sapd| AM 00:1a:1e:63:96:20: ARM - decreasing power cov-index 10/1 tx-power 6 new_rra 6/42 May 29 06:40:43 sapd[1708]: <404404> |AP PR-SChall-AP34@10.20.60.13 sapd| AM 00:1a:1e:63:96:20: AP to APM : Too much coverage on channel 6 coverage 11 tx-power 6 May 29 06:40:45 KERNEL(PR-SChall-AP34@10.20.60.13): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:40:45 sapd[610]: <404075> |AP PR-L110-AP236@10.26.17.120 sapd| AM 00:24:6c:20:50:10: ARM - decreasing power cov-index 6/5 tx-power 6 new_rra 11/42 May 29 06:40:45 sapd[610]: <404404> |AP PR-L110-AP236@10.26.17.120 sapd| AM 00:24:6c:20:50:10: AP to APM : Too much coverage on channel 11 coverage 11 tx-power 6 May 29 06:40:46 KERNEL(PR-L110-AP236@10.26.17.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:40:48 sapd[610]: <404075> |AP PR-A212A-AP195@10.28.67.121 sapd| AM 00:24:6c:20:3e:80: ARM - decreasing power cov-index 42/5 tx-power 6 new_rra 1/42 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:40:48 sapd[610]: <404404> |AP PR-A212A-AP195@10.28.67.121 sapd| AM 00:24:6c:20:3e:80: AP to APM : Too much coverage on channel 1 coverage 47 tx-power 6 May 29 06:40:49 KERNEL(PR-A212A-AP195@10.28.67.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:40:49 sapd[2011]: <404075> |AP PR-G206-AP301@10.28.88.11 sapd| AM 00:0b:86:77:30:c0: ARM - decreasing power cov-index 22/6 tx-power 6 new_rra 1/42 May 29 06:40:49 sapd[2011]: <404404> |AP PR-G206-AP301@10.28.88.11 sapd| AM 00:0b:86:77:30:c0: AP to APM : Too much coverage on channel 1 coverage 28 tx-power 6 May 29 06:40:49 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 06:40:50 KERNEL(PR-G206-AP301@10.28.88.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:41:08 sapd[602]: <404063> |AP PR-A150-AP330@10.28.64.121 sapd| AM 00:1a:1e:13:cd:20: ARM Channel Band Trigger new 6-3/1 old 0-0/0 new_rra 6/7 May 29 06:41:08 sapd[602]: <404405> |AP PR-A150-AP330@10.28.64.121 sapd| AM 00:1a:1e:13:cd:20: Coverage hole: APM converting to AP on channel 6 coverage 3 7 May 29 06:41:09 KERNEL(PR-A150-AP330@10.28.64.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:41:09 KERNEL(PR-A150-AP330@10.28.64.121): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:41:09 KERNEL(PR-A150-AP330@10.28.64.121): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:41:23 sapd[956]: <404074> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 06:41:50 sapd[600]: <404075> |AP PR-G119-AP4@10.21.180.10 sapd| AM 00:1a:1e:63:c5:a0: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 11/6 May 29 06:42:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:42:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:42:20 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 04:46:65:b3:d5:06) on channel 6. May 29 06:42:20 sapd[956]: <127102> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 04:46:65:b3:d5:06) on channel 6. May 29 06:42:36 sapd[589]: <404097> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 149-153/7 May 29 06:42:51 sapd[603]: <404075> |AP PR-D122-AP65@10.21.21.37 sapd| AM 00:1a:1e:63:cb:60: ARM - decreasing power cov-index 7/6 tx-power 7 new_rra 11/6 May 29 06:43:18 sapd[603]: <404097> |AP PR-C306ab-AP35@10.21.23.39 sapd| AM 00:1a:1e:63:97:70: ARM - HT increasing power cov-index 6/2 tx-power 6 new_rra 36-40/7 May 29 06:43:25 sapd[606]: <404075> |AP PR-A142-AP327@10.28.64.125 sapd| AM 00:1a:1e:5f:75:e0: ARM - decreasing power cov-index 29/7 tx-power 6 new_rra 1/42 May 29 06:43:25 sapd[606]: <404404> |AP PR-A142-AP327@10.28.64.125 sapd| AM 00:1a:1e:5f:75:e0: AP to APM : Too much coverage on channel 1 coverage 36 tx-power 6 May 29 06:43:26 KERNEL(PR-A142-AP327@10.28.64.125): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:43:32 sapd[589]: <404075> |AP PR-B115-AP28@10.21.11.19 sapd| AM 00:1a:1e:63:c3:c0: ARM - decreasing power cov-index 10/5 tx-power 6 new_rra 6/42 May 29 06:43:32 sapd[589]: <404404> |AP PR-B115-AP28@10.21.11.19 sapd| AM 00:1a:1e:63:c3:c0: AP to APM : Too much coverage on channel 6 coverage 15 tx-power 6 May 29 06:43:33 KERNEL(PR-B115-AP28@10.21.11.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:43:36 sapd[610]: <404075> |AP PR-L108-AP234@10.26.17.121 sapd| AM 00:24:6c:20:51:50: ARM - decreasing power cov-index 19/6 tx-power 6 new_rra 6/42 May 29 06:43:36 sapd[610]: <404404> |AP PR-L108-AP234@10.26.17.121 sapd| AM 00:24:6c:20:51:50: AP to APM : Too much coverage on channel 6 coverage 25 tx-power 6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:43:37 KERNEL(PR-L108-AP234@10.26.17.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:43:59 sapd[603]: <404075> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM - decreasing power cov-index 9/3 tx-power 6 new_rra 11/42 May 29 06:43:59 sapd[603]: <404404> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: AP to APM : Too much coverage on channel 11 coverage 12 tx-power 6 May 29 06:44:00 KERNEL(PR-IWC23-AP12@10.21.23.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:44:00 sapd[931]: <404075> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:20: ARM - decreasing power cov-index 9/5 tx-power 6 new_rra 6/42 May 29 06:44:00 sapd[931]: <404404> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:20: AP to APM : Too much coverage on channel 6 coverage 14 tx-power 6 May 29 06:44:01 KERNEL(PR-L334-AP225@10.26.33.125): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:44:01 sapd[603]: <404074> |AP PR-C316-AP136@10.21.180.18 sapd| AM 00:1a:1e:63:bf:80: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 06:44:04 sapd[633]: <404075> |AP PR-E324-AP64@10.20.215.10 sapd| AM 00:1a:1e:63:cb:20: ARM - decreasing power cov-index 12/2 tx-power 6 new_rra 1/42 May 29 06:44:04 sapd[633]: <404404> |AP PR-E324-AP64@10.20.215.10 sapd| AM 00:1a:1e:63:cb:20: AP to APM : Too much coverage on channel 1 coverage 14 tx-power 6 May 29 06:44:06 KERNEL(PR-E324-AP64@10.20.215.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:44:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:44:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:44:18 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 06:44:18 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 06:44:29 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 1/6 May 29 06:44:35 sapd[610]: <404075> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:00: ARM - decreasing power cov-index 10/4 tx-power 6 new_rra 1/42 May 29 06:44:35 sapd[610]: <404404> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:00: AP to APM : Too much coverage on channel 1 coverage 14 tx-power 6 May 29 06:44:37 KERNEL(PR-L127-AP246@10.26.29.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:44:46 sapd[916]: <404075> |AP PR-A355-AP151@10.28.46.10 sapd| AM 00:24:6c:b6:f3:70: ARM - decreasing power cov-index 10/9 tx-power 6 new_rra 11/42 May 29 06:44:46 sapd[916]: <404404> |AP PR-A355-AP151@10.28.46.10 sapd| AM 00:24:6c:b6:f3:70: AP to APM : Too much coverage on channel 11 coverage 19 tx-power 6 May 29 06:44:47 KERNEL(PR-A355-AP151@10.28.46.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:44:49 sapd[610]: <404075> |AP PR-A234-AP178@10.28.21.138 sapd| AM 00:24:6c:b6:fd:c0: ARM - decreasing power cov-index 13/8 tx-power 6 new_rra 11/42 May 29 06:44:49 sapd[610]: <404404> |AP PR-A234-AP178@10.28.21.138 sapd| AM 00:24:6c:b6:fd:c0: AP to APM : Too much coverage on channel 11 coverage 21 tx-power 6 May 29 06:44:50 KERNEL(PR-A234-AP178@10.28.21.138): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:44:56 sapd[633]: <127000> |AP PR-E324-AP64@10.20.215.10 sapd| |ids-ap| AP(00:1a:1e:63:cb:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:44:56 sapd[633]: <127000> |AP PR-E324-AP64@10.20.215.10 sapd| |ids-ap| AP(00:1a:1e:63:cb:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:44:59 sapd[610]: <404075> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:40: ARM - decreasing power cov-index 16/4 tx-power 6 new_rra 11/42 May 29 06:44:59 sapd[610]: <404404> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:40: AP to APM : Too much coverage on channel 11 coverage 20 tx-power 6 May 29 06:45:01 KERNEL(PR-A240B-AP199@10.28.19.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:45:17 sapd[610]: <404085> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:98: ARM HT Channel Interference Trigger new 44-48/58 old 161/157-86 new_rra 44/48-6 TCI 10 May 29 06:45:20 sapd[1641]: <404074> |AP PR-G141-AP297@10.28.88.12 sapd| AM 00:0b:86:77:3c:10: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 11/8 May 29 06:45:57 sapd[610]: <404097> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:98: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 44-48/7 May 29 06:46:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:46:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:46:14 sapd[610]: <404075> |AP PR-L229-AP211@10.26.28.122 sapd| AM 00:24:6c:20:52:e0: ARM - decreasing power cov-index 14/12 tx-power 6 new_rra 11/42 May 29 06:46:14 sapd[610]: <404404> |AP PR-L229-AP211@10.26.28.122 sapd| AM 00:24:6c:20:52:e0: AP to APM : Too much coverage on channel 11 coverage 26 tx-power 6 May 29 06:46:15 KERNEL(PR-L229-AP211@10.26.28.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:46:41 sapd[610]: <404075> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:70: ARM - decreasing power cov-index 9/4 tx-power 6 new_rra 1/42 May 29 06:46:41 sapd[610]: <404404> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:70: AP to APM : Too much coverage on channel 1 coverage 13 tx-power 6 May 29 06:46:42 KERNEL(PR-L310-AP222@10.26.36.132): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:46:46 sapd[1726]: <404093> |AP PR-SCrm2-AP8@10.20.60.17 sapd| AM 00:1a:1e:63:c4:90: ARM HT Empty Channel Trigger new 36-40/0/0 old 161-157/5/1 new_rra 36-40/7 May 29 06:46:50 sapd[589]: <404098> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 149-153/6 May 29 06:47:30 sapd[1643]: <404075> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - decreasing power cov-index 10/5 tx-power 6 new_rra 11/42 May 29 06:47:30 sapd[1643]: <404404> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: AP to APM : Too much coverage on channel 11 coverage 15 tx-power 6 May 29 06:47:31 KERNEL(PR-DGYM-ap310@10.28.88.20): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:47:43 sapd[610]: <404075> |AP PR-A317-AP140@10.28.37.120 sapd| AM 00:24:6c:b6:f5:40: ARM - decreasing power cov-index 13/6 tx-power 6 new_rra 6/42 May 29 06:47:43 sapd[610]: <404404> |AP PR-A317-AP140@10.28.37.120 sapd| AM 00:24:6c:b6:f5:40: AP to APM : Too much coverage on channel 6 coverage 19 tx-power 6 May 29 06:47:45 KERNEL(PR-A317-AP140@10.28.37.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:48:00 sapd[956]: <404075> |AP PR-D220-AP46@10.21.32.131 sapd| AM 00:1a:1e:63:d0:e0: ARM - decreasing power cov-index 10/5 tx-power 6 new_rra 1/42 May 29 06:48:00 sapd[956]: <404404> |AP PR-D220-AP46@10.21.32.131 sapd| AM 00:1a:1e:63:d0:e0: AP to APM : Too much coverage on channel 1 coverage 15 tx-power 6 May 29 06:48:01 KERNEL(PR-D220-AP46@10.21.32.131): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:48:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:48:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:48:12 sapd[610]: <404075> |AP PR-A322-AP141@10.28.43.10 sapd| AM 00:24:6c:b6:ed:60: ARM - decreasing power cov-index 41/11 tx-power 6 new_rra 1/42 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:48:12 sapd[610]: <404404> |AP PR-A322-AP141@10.28.43.10 sapd| AM 00:24:6c:b6:ed:60: AP to APM : Too much coverage on channel 1 coverage 52 tx-power 6 May 29 06:48:12 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:48:12 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:48:12 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:48:12 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:48:14 KERNEL(PR-A322-AP141@10.28.43.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:48:27 sapd[916]: <404075> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c0: ARM - decreasing power cov-index 13/4 tx-power 6 new_rra 1/42 May 29 06:48:27 sapd[916]: <404404> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c0: AP to APM : Too much coverage on channel 1 coverage 17 tx-power 6 May 29 06:48:28 KERNEL(PR-L114A-AP258@10.26.19.123): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:48:40 sapd[635]: <127000> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.20.19.2). May 29 06:48:40 sapd[635]: <127000> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 11) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.20.19.2). May 29 06:48:46 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 06:48:46 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 06:49:17 sapd[931]: <404074> |AP PR-A185-AP172@10.28.4.10 sapd| AM 00:24:6c:b6:fe:80: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 06:49:28 sapd[589]: <404075> |AP PR-B323-AP36@10.21.13.61 sapd| AM 00:1a:1e:63:90:60: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 1/6 May 29 06:49:31 sapd[602]: <404075> |AP PR-A150-AP330@10.28.64.121 sapd| AM 00:1a:1e:13:cd:20: ARM - decreasing power cov-index 7/6 tx-power 7 new_rra 6/6 May 29 06:49:55 sapd[931]: <404098> |AP PR-A239-AP177@10.28.21.133 sapd| AM 00:24:6c:b6:fb:f8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 44-48/7 May 29 06:50:00 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 06:50:00 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 06:50:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:50:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:50:20 authmgr[1871]: <522027> |authmgr| MAC=2c:a8:35:f5:c1:ae IP=10.24.32.148 IP Spoof from MAC=30:f7:c5:51:8f:27 role=CCwLan/(null) May 29 06:50:25 sapd[916]: <404075> |AP PR-A236-AP180@10.28.21.135 sapd| AM 00:24:6c:b6:f7:c0: ARM - decreasing power cov-index 22/10 tx-power 6 new_rra 11/42 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:50:25 sapd[916]: <404404> |AP PR-A236-AP180@10.28.21.135 sapd| AM 00:24:6c:b6:f7:c0: AP to APM : Too much coverage on channel 11 coverage 32 tx-power 6 May 29 06:50:26 KERNEL(PR-A236-AP180@10.28.21.135): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:50:42 sapd[934]: <404075> |AP PR-B210-AP285@10.21.12.12 sapd| AM 00:24:6c:29:48:c0: ARM - decreasing power cov-index 14/3 tx-power 6 new_rra 6/42 May 29 06:50:42 sapd[934]: <404404> |AP PR-B210-AP285@10.21.12.12 sapd| AM 00:24:6c:29:48:c0: AP to APM : Too much coverage on channel 6 coverage 17 tx-power 6 May 29 06:50:44 KERNEL(PR-B210-AP285@10.21.12.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:50:44 sapd[610]: <404075> |AP PR-A170-AP175@10.28.7.11 sapd| AM 00:24:6c:b6:fe:30: ARM - decreasing power cov-index 6/7 tx-power 6 new_rra 11/42 May 29 06:50:44 sapd[610]: <404404> |AP PR-A170-AP175@10.28.7.11 sapd| AM 00:24:6c:b6:fe:30: AP to APM : Too much coverage on channel 11 coverage 13 tx-power 6 May 29 06:50:46 KERNEL(PR-A170-AP175@10.28.7.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:50:55 sapd[1641]: <404074> |AP PR-G104-AP293@10.28.88.15 sapd| AM 00:0b:86:77:3c:80: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 06:50:59 sapd[600]: <404074> |AP PR-G119-AP4@10.21.180.10 sapd| AM 00:1a:1e:63:c5:a0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 06:51:09 sapd[610]: <404075> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:30: ARM - decreasing power cov-index 6/11 tx-power 6 new_rra 6/42 May 29 06:51:09 sapd[610]: <404404> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:30: AP to APM : Too much coverage on channel 6 coverage 17 tx-power 6 May 29 06:51:10 KERNEL(PR-A123-AP165@10.28.8.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:51:29 sapd[916]: <404075> |AP PR-L217-AP202@10.26.26.127 sapd| AM 00:24:6c:b6:e7:c0: ARM - decreasing power cov-index 6/12 tx-power 6 new_rra 6/42 May 29 06:51:29 sapd[916]: <404404> |AP PR-L217-AP202@10.26.26.127 sapd| AM 00:24:6c:b6:e7:c0: AP to APM : Too much coverage on channel 6 coverage 18 tx-power 6 May 29 06:51:30 KERNEL(PR-L217-AP202@10.26.26.127): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:51:45 sapd[589]: <404050> |AP PR-B307-AP69@10.21.30.22 sapd| AM 00:1a:1e:63:c9:d0: ARM C 44 PER 0 MER 78 FRR 0 50-30 May 29 06:51:45 sapd[919]: <404050> |AP PR-B212-AP284@10.21.12.11 sapd| AM 00:24:6c:29:4a:78: ARM C 44 PER 0 MER 80 FRR 0 50-30 May 29 06:51:46 sapd[589]: <404089> |AP PR-B307-AP69@10.21.30.22 sapd| AM 00:1a:1e:63:c9:d0: ARM HT Error Threshold Trigger Current Channel old 44-48 new 161-157/7 May 29 06:51:46 sapd[919]: <404089> |AP PR-B212-AP284@10.21.12.11 sapd| AM 00:24:6c:29:4a:78: ARM HT Error Threshold Trigger Current Channel old 44-48 new 40-36/8 May 29 06:51:55 sapd[610]: <404075> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:50: ARM - decreasing power cov-index 19/10 tx-power 6 new_rra 1/42 May 29 06:51:55 sapd[610]: <404404> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:50: AP to APM : Too much coverage on channel 1 coverage 29 tx-power 6 May 29 06:51:56 sapd[635]: <404075> |AP PR-IWC21-AP14@10.20.19.10 sapd| AM 00:1a:1e:63:c1:c0: ARM - decreasing power cov-index 13/3 tx-power 7 new_rra 1/6 May 29 06:51:57 KERNEL(PR-A292-AP184@10.28.16.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:52:01 sapd[610]: <404097> |AP PR-A113-AP159@10.28.12.10 sapd| AM 00:24:6c:b6:f4:68: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 161-157/7 May 29 06:52:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:52:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:52:10 sapd[931]: <404075> |AP PR-L127-AP250@10.26.29.122 sapd| AM 00:24:6c:20:54:70: ARM - decreasing power cov-index 9/5 tx-power 6 new_rra 11/42 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:52:10 sapd[931]: <404404> |AP PR-L127-AP250@10.26.29.122 sapd| AM 00:24:6c:20:54:70: AP to APM : Too much coverage on channel 11 coverage 14 tx-power 6 May 29 06:52:11 KERNEL(PR-L127-AP250@10.26.29.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:52:21 sapd[610]: <127000> |AP PR-A292-AP184@10.28.16.122 sapd| |ids-ap| AP(00:24:6c:b6:f6:50): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:52:21 sapd[610]: <127000> |AP PR-A292-AP184@10.28.16.122 sapd| |ids-ap| AP(00:24:6c:b6:f6:50): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 06:52:22 sapd[589]: <404097> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 149-153/7 May 29 06:52:31 sapd[956]: <404063> |AP PR-D220-AP46@10.21.32.131 sapd| AM 00:1a:1e:63:d0:e0: ARM Channel Band Trigger new 11-3/1 old 0-0/0 new_rra 11/7 May 29 06:52:31 sapd[956]: <404405> |AP PR-D220-AP46@10.21.32.131 sapd| AM 00:1a:1e:63:d0:e0: Coverage hole: APM converting to AP on channel 11 coverage 3 7 May 29 06:52:32 KERNEL(PR-D220-AP46@10.21.32.131): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:52:32 KERNEL(PR-D220-AP46@10.21.32.131): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:52:32 KERNEL(PR-D220-AP46@10.21.32.131): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:52:32 sapd[610]: <404098> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 06:52:33 sapd[956]: <404099> |AP PR-D220-AP46@10.21.32.131 sapd| AM 00:1a:1e:63:d0:e0: Tx Hang: Driver reset radio to 20 MHz mode 11-0 May 29 06:52:34 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:52:34 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:52:34 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:52:34 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:52:34 sapd[956]: <404073> |AP PR-D220-AP46@10.21.32.131 sapd| AM 00:1a:1e:63:d0:e0: ARM - too little power increasing... cov-index 5/4 tx-power 5 new_rra 11/6 May 29 06:52:53 sapd[916]: <404075> |AP PR-A361-AP153@10.28.40.36 sapd| AM 00:24:6c:b6:f3:a0: ARM - decreasing power cov-index 9/7 tx-power 6 new_rra 6/42 May 29 06:52:53 sapd[916]: <404404> |AP PR-A361-AP153@10.28.40.36 sapd| AM 00:24:6c:b6:f3:a0: AP to APM : Too much coverage on channel 6 coverage 16 tx-power 6 May 29 06:52:54 KERNEL(PR-A361-AP153@10.28.40.36): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:52:54 sapd[1341]: <404075> |AP PR-D113-AP32@10.21.182.7 sapd| AM 00:1a:1e:63:8e:c0: ARM - decreasing power cov-index 10/2 tx-power 6 new_rra 1/42 May 29 06:52:54 sapd[1341]: <404404> |AP PR-D113-AP32@10.21.182.7 sapd| AM 00:1a:1e:63:8e:c0: AP to APM : Too much coverage on channel 1 coverage 12 tx-power 6 May 29 06:52:56 KERNEL(PR-D113-AP32@10.21.182.7): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:53:08 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:53:08 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 06:53:14 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:53:14 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 06:53:24 sapd[610]: <404069> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM Channel Interference Trigger new 11-78 old 1-107 new_rra 11/6 TCI 10 May 29 06:53:40 sapd[956]: <404074> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 06:53:54 sapd[2172]: <404074> |AP PR-E129-AP60@10.21.42.10 sapd| AM 00:1a:1e:63:d1:20: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 06:54:03 sapd[1726]: <404085> |AP PR-SCrm2-AP8@10.20.60.17 sapd| AM 00:1a:1e:63:c4:90: ARM HT Channel Interference Trigger new 161-157/38 old 36/40-83 new_rra 161/157-7 TCI 10 May 29 06:54:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:54:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:54:58 sapd[602]: <404074> |AP PR-A150-AP330@10.28.64.121 sapd| AM 00:1a:1e:13:cd:20: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 06:55:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:3d:31 doing 802.1x May 29 06:55:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:3d:31 doing 802.1x May 29 06:55:15 sapd[2011]: <404075> |AP PR-G200-AP300@10.28.88.16 sapd| AM 00:0b:86:77:30:50: ARM - decreasing power cov-index 25/3 tx-power 6 new_rra 6/42 May 29 06:55:15 sapd[2011]: <404404> |AP PR-G200-AP300@10.28.88.16 sapd| AM 00:0b:86:77:30:50: AP to APM : Too much coverage on channel 6 coverage 28 tx-power 6 May 29 06:55:17 KERNEL(PR-G200-AP300@10.28.88.16): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:55:17 sapd[916]: <404075> |AP PR-A311-AP137@10.28.39.10 sapd| AM 00:24:6c:b6:f8:60: ARM - decreasing power cov-index 6/20 tx-power 6 new_rra 11/42 May 29 06:55:17 sapd[916]: <404404> |AP PR-A311-AP137@10.28.39.10 sapd| AM 00:24:6c:b6:f8:60: AP to APM : Too much coverage on channel 11 coverage 26 tx-power 6 May 29 06:55:18 KERNEL(PR-A311-AP137@10.28.39.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:55:26 sapd[610]: <404098> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:98: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 157-161/7 May 29 06:55:33 sapd[610]: <404075> |AP PR-A298-AP193@10.28.66.120 sapd| AM 00:24:6c:20:38:b0: ARM - decreasing power cov-index 6/0 tx-power 6 new_rra 6/42 May 29 06:55:33 sapd[610]: <404404> |AP PR-A298-AP193@10.28.66.120 sapd| AM 00:24:6c:20:38:b0: AP to APM : Too much coverage on channel 6 coverage 6 tx-power 6 May 29 06:55:34 KERNEL(PR-A298-AP193@10.28.66.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:55:38 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f1 doing 802.1x May 29 06:55:38 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f1 doing 802.1x May 29 06:55:39 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:55:39 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:39 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:39 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:40 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:40 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:40 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:40 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:41 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:41 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:41 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:41 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:e9:f2 May 29 06:55:41 sapd[610]: <404075> |AP PR-L114-AP257@10.26.19.124 sapd| AM 00:24:6c:20:56:c0: ARM - decreasing power cov-index 6/9 tx-power 6 new_rra 6/42 May 29 06:55:41 sapd[610]: <404404> |AP PR-L114-AP257@10.26.19.124 sapd| AM 00:24:6c:20:56:c0: AP to APM : Too much coverage on channel 6 coverage 15 tx-power 6 May 29 06:55:42 KERNEL(PR-L114-AP257@10.26.19.124): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:56:00 sapd[916]: <404075> |AP PR-A321-AP143@10.28.45.120 sapd| AM 00:24:6c:b6:ed:50: ARM - decreasing power cov-index 19/3 tx-power 6 new_rra 6/42 May 29 06:56:00 sapd[916]: <404404> |AP PR-A321-AP143@10.28.45.120 sapd| AM 00:24:6c:b6:ed:50: AP to APM : Too much coverage on channel 6 coverage 22 tx-power 6 May 29 06:56:01 KERNEL(PR-A321-AP143@10.28.45.120): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:56:04 sapd[916]: <404075> |AP PR-A220B-AP176@10.28.21.139 sapd| AM 00:24:6c:b6:fe:10: ARM - decreasing power cov-index 19/11 tx-power 6 new_rra 11/42 May 29 06:56:04 sapd[916]: <404404> |AP PR-A220B-AP176@10.28.21.139 sapd| AM 00:24:6c:b6:fe:10: AP to APM : Too much coverage on channel 11 coverage 30 tx-power 6 May 29 06:56:05 KERNEL(PR-A220B-AP176@10.28.21.139): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:56:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:56:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:56:24 sapd[610]: <404097> |AP PR-A111-AP157@10.28.13.12 sapd| AM 00:24:6c:b6:f3:38: ARM - HT increasing power cov-index 6/2 tx-power 6 new_rra 36-40/7 May 29 06:56:29 sapd[589]: <404098> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 149-153/6 May 29 06:56:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f2 May 29 06:56:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f2 May 29 06:56:36 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f1 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:56:36 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f1 doing 802.1x May 29 06:56:43 authmgr[1871]: <522027> |authmgr| MAC=00:21:06:99:3c:58 IP=10.24.22.4 IP Spoof from MAC=5c:95:ae:cc:d9:38 role=authenticated/(null) May 29 06:56:45 sapd[610]: <404075> |AP PR-A120A-AP166@10.28.13.14 sapd| AM 00:24:6c:b6:e8:30: ARM - decreasing power cov-index 21/4 tx-power 6 new_rra 11/42 May 29 06:56:45 sapd[610]: <404404> |AP PR-A120A-AP166@10.28.13.14 sapd| AM 00:24:6c:b6:e8:30: AP to APM : Too much coverage on channel 11 coverage 25 tx-power 6 May 29 06:56:46 KERNEL(PR-A120A-AP166@10.28.13.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:57:18 sapd[931]: <404097> |AP PR-A239-AP177@10.28.21.133 sapd| AM 00:24:6c:b6:fb:f8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 44-48/8 May 29 06:57:22 sapd[634]: <404050> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:e0: ARM C 1 PER 0 MER 0 FRR 86 50-30 May 29 06:57:23 sapd[634]: <404065> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:e0: ARM Error Threshold Trigger Current Channel 1 new_rra 6/6 May 29 06:57:35 sapd[610]: <404097> |AP PR-A113-AP159@10.28.12.10 sapd| AM 00:24:6c:b6:f4:68: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 06:57:38 sapd[610]: <404075> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:40: ARM - decreasing power cov-index 14/10 tx-power 6 new_rra 6/42 May 29 06:57:38 sapd[610]: <404404> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:40: AP to APM : Too much coverage on channel 6 coverage 24 tx-power 6 May 29 06:57:40 KERNEL(PR-L306-AP217@10.26.34.124): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:57:44 sapd[610]: <404097> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 06:57:57 sapd[589]: <404075> |AP PR-C211s7-AP53@10.21.12.17 sapd| AM 00:1a:1e:63:c9:60: ARM - decreasing power cov-index 6/0 tx-power 6 new_rra 1/42 May 29 06:57:57 sapd[589]: <404404> |AP PR-C211s7-AP53@10.21.12.17 sapd| AM 00:1a:1e:63:c9:60: AP to APM : Too much coverage on channel 1 coverage 6 tx-power 6 May 29 06:57:58 KERNEL(PR-C211s7-AP53@10.21.12.17): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:58:02 sapd[956]: <404074> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 06:58:07 sapd[589]: <404085> |AP PR-B318-AP135@10.21.30.67 sapd| AM 00:1a:1e:63:ca:50: ARM HT Channel Interference Trigger new 48-44/43 old 161/157-75 new_rra 48/44-7 TCI 10 May 29 06:58:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:58:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 06:58:17 sapd[610]: <404098> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 06:58:35 sapd[610]: <404075> |AP PR-A293-AP186@10.28.17.10 sapd| AM 00:24:6c:b6:f4:c0: ARM - decreasing power cov-index 17/3 tx-power 6 new_rra 11/42 May 29 06:58:35 sapd[610]: <404404> |AP PR-A293-AP186@10.28.17.10 sapd| AM 00:24:6c:b6:f4:c0: AP to APM : Too much coverage on channel 11 coverage 20 tx-power 6 May 29 06:58:36 KERNEL(PR-A293-AP186@10.28.17.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 06:58:41 sapd[603]: <404074> |AP PR-D122-AP65@10.21.21.37 sapd| AM 00:1a:1e:63:cb:60: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 06:58:53 sapd[2011]: <404063> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: ARM Channel Band Trigger new 1-1/1 old 0-0/0 new_rra 1/7 May 29 06:58:53 sapd[2011]: <404405> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: Coverage hole: APM converting to AP on channel 1 coverage 1 7 May 29 06:58:54 KERNEL(PR-G207-AP302@10.28.88.19): vap aruba100 vlan is 0. discovering tunnel vlan --More-- (q) quit (u) pageup (/) search (n) repeat May 29 06:58:54 KERNEL(PR-G207-AP302@10.28.88.19): vap aruba101 vlan is 0. discovering tunnel vlan May 29 06:58:54 KERNEL(PR-G207-AP302@10.28.88.19): vap aruba102 vlan is 0. discovering tunnel vlan May 29 06:58:55 sapd[2011]: <404099> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: Tx Hang: Driver reset radio to 20 MHz mode 1-0 May 29 06:58:56 sapd[2011]: <404073> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: ARM - too little power increasing... cov-index 5/1 tx-power 5 new_rra 1/6 May 29 06:59:03 sapd[634]: <404050> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:e0: ARM C 6 PER 0 MER 2 FRR 88 50-30 May 29 06:59:04 sapd[634]: <404065> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:e0: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 06:59:40 sapd[635]: <404074> |AP PR-C203-AP44@10.21.20.10 sapd| AM 00:1a:1e:63:d8:00: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 1/7 May 29 07:00:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:00:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:00:18 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:00:18 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:00:31 sapd[610]: <404085> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM HT Channel Interference Trigger new 36-40/108 old 161/157-135 new_rra 36/40-8 TCI 10 May 29 07:00:55 sapd[1705]: <404075> |AP PR-G200-AP299@10.28.88.17 sapd| AM 00:0b:86:77:2f:c0: ARM - decreasing power cov-index 17/6 tx-power 6 new_rra 1/42 May 29 07:00:55 sapd[1705]: <404404> |AP PR-G200-AP299@10.28.88.17 sapd| AM 00:0b:86:77:2f:c0: AP to APM : Too much coverage on channel 1 coverage 23 tx-power 6 May 29 07:00:56 KERNEL(PR-G200-AP299@10.28.88.17): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:01:50 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:ea:21 doing 802.1x May 29 07:01:50 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:ea:21 doing 802.1x May 29 07:01:55 sapd[589]: <404074> |AP PR-C209-AP54@10.21.12.14 sapd| AM 00:1a:1e:63:d0:c0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 07:02:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:02:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:02:20 sapd[1341]: <127000> |AP PR-E112-AP31@10.21.180.12 sapd| |ids-ap| AP(00:1a:1e:63:98:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:02:20 sapd[1341]: <127000> |AP PR-E112-AP31@10.21.180.12 sapd| |ids-ap| AP(00:1a:1e:63:98:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:02:44 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:ea:20 May 29 07:02:44 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:ea:20 May 29 07:02:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:ea:21 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:02:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:b6:ea:21 doing 802.1x May 29 07:03:11 sapd[603]: <404063> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: ARM Channel Band Trigger new 1-0/1 old 0-0/0 new_rra 1/7 May 29 07:03:11 sapd[603]: <404405> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: Coverage hole: APM converting to AP on channel 1 coverage 0 7 May 29 07:03:12 KERNEL(PR-D319-AP10@10.21.23.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:03:12 KERNEL(PR-D319-AP10@10.21.23.10): vap aruba101 vlan is 0. discovering tunnel vlan May 29 07:03:12 KERNEL(PR-D319-AP10@10.21.23.10): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:03:15 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:03:15 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:03:28 sapd[610]: <404075> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:70: ARM - decreasing power cov-index 15/8 tx-power 6 new_rra 11/42 May 29 07:03:28 sapd[610]: <404404> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:70: AP to APM : Too much coverage on channel 11 coverage 23 tx-power 6 May 29 07:03:30 KERNEL(PR-L306A-AP218@10.26.34.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:03:30 sapd[610]: <404074> |AP PR-L117-AP237@10.26.18.122 sapd| AM 00:24:6c:20:4e:70: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 07:03:35 sapd[934]: <404074> |AP PR-C211-AP287@10.21.12.22 sapd| AM 00:24:6c:29:4b:f0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 1/7 May 29 07:03:36 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 07:03:53 sapd[931]: <404075> |AP PR-A130-AP164@10.28.13.13 sapd| AM 00:24:6c:b6:e8:a0: ARM - decreasing power cov-index 19/10 tx-power 6 new_rra 11/42 May 29 07:03:53 sapd[931]: <404404> |AP PR-A130-AP164@10.28.13.13 sapd| AM 00:24:6c:b6:e8:a0: AP to APM : Too much coverage on channel 11 coverage 29 tx-power 6 May 29 07:03:54 KERNEL(PR-A130-AP164@10.28.13.13): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:04:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:04:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:04:27 sapd[610]: <404075> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c0: ARM - decreasing power cov-index 21/4 tx-power 6 new_rra 11/42 May 29 07:04:27 sapd[610]: <404404> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c0: AP to APM : Too much coverage on channel 11 coverage 25 tx-power 6 May 29 07:04:28 KERNEL(PR-A323-AP144@10.28.32.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:04:33 sapd[610]: <404098> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM - HT decreasing power cov-index 16/1 tx-power 8 new_rra 36-40/6 May 29 07:05:02 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:05:02 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:05:03 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:05:03 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.11.2). May 29 07:05:06 sapd[610]: <404074> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:05:07 sapd[612]: <404075> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:20: ARM - decreasing power cov-index 18/5 tx-power 6 new_rra 6/42 May 29 07:05:07 sapd[612]: <404404> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:20: AP to APM : Too much coverage on channel 6 coverage 23 tx-power 6 May 29 07:05:08 KERNEL(PR-L1stFloor-AP289@10.26.19.18): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:05:09 sapd[634]: <404097> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:f0: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 May 29 07:05:10 sapd[1726]: <404075> |AP PR-SCstore-AP33@10.20.60.11 sapd| AM 00:1a:1e:63:96:80: ARM - decreasing power cov-index 12/0 tx-power 7 new_rra 1/6 May 29 07:05:19 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.28 IP Spoof from MAC=f8:1e:df:2e:2b:80 role=authenticated/(null) May 29 07:05:33 sapd[919]: <404075> |AP PR-Bookstore-AP283@10.21.12.10 sapd| AM 00:24:6c:29:4d:30: ARM - decreasing power cov-index 8/7 tx-power 8 new_rra 6/6 May 29 07:06:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:06:10 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:06:14 sapd[610]: <404075> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d0: ARM - decreasing power cov-index 12/2 tx-power 6 new_rra 11/42 May 29 07:06:14 sapd[610]: <404404> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d0: AP to APM : Too much coverage on channel 11 coverage 14 tx-power 6 May 29 07:06:15 KERNEL(PR-A180A-AP173@10.28.7.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:06:19 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:06:19 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:06:29 sapd[2096]: <404074> |AP PR-c203-AP47@10.21.20.144 sapd| AM 00:1a:1e:63:d1:a0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 07:06:33 sapd[610]: <404075> |AP PR-A110-AP158@10.28.13.11 sapd| AM 00:24:6c:b6:f4:80: ARM - decreasing power cov-index 10/5 tx-power 6 new_rra 6/42 May 29 07:06:33 sapd[610]: <404404> |AP PR-A110-AP158@10.28.13.11 sapd| AM 00:24:6c:b6:f4:80: AP to APM : Too much coverage on channel 6 coverage 15 tx-power 6 May 29 07:06:35 KERNEL(PR-A110-AP158@10.28.13.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:06:49 sapd[610]: <404098> |AP PR-L308-AP221@10.26.37.123 sapd| AM 00:24:6c:20:4f:c8: ARM - HT decreasing power cov-index 13/0 tx-power 8 new_rra 36-40/6 May 29 07:07:03 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:03 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:03 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:03 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:07:04 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:04 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:04 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:04 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:05 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:05 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:05 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:05 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:a9:53:3d 00:24:6c:20:55:e2 May 29 07:07:07 sapd[1341]: <404075> |AP PR-E112-AP31@10.21.180.12 sapd| AM 00:1a:1e:63:98:60: ARM - decreasing power cov-index 10/1 tx-power 6 new_rra 1/42 May 29 07:07:07 sapd[1341]: <404404> |AP PR-E112-AP31@10.21.180.12 sapd| AM 00:1a:1e:63:98:60: AP to APM : Too much coverage on channel 1 coverage 11 tx-power 6 May 29 07:07:08 KERNEL(PR-E112-AP31@10.21.180.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:07:22 sapd[610]: <404097> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:98: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 157-161/8 May 29 07:07:25 sapd[1641]: <404074> |AP PR-G104-AP293@10.28.88.15 sapd| AM 00:0b:86:77:3c:80: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 6/8 May 29 07:07:25 sapd[610]: <404085> |AP PR-L308-AP221@10.26.37.123 sapd| AM 00:24:6c:20:4f:c8: ARM HT Channel Interference Trigger new 157-161/48 old 36/40-85 new_rra 157/161-6 TCI 10 May 29 07:07:53 sapd[610]: <404069> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM Channel Interference Trigger new 6-56 old 11-88 new_rra 6/6 TCI 10 May 29 07:07:53 sapd[610]: <404098> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 07:07:54 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 07:07:54 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 07:08:11 sapd[1341]: <127000> |AP PR-E112-AP31@10.21.180.12 sapd| |ids-ap| AP(00:1a:1e:63:98:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:08:11 sapd[1341]: <127000> |AP PR-E112-AP31@10.21.180.12 sapd| |ids-ap| AP(00:1a:1e:63:98:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:08:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:08:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:08:46 sapd[1641]: <404075> |AP PR-DGYM-AP306@10.28.89.18 sapd| AM 00:0b:86:77:31:c0: ARM - decreasing power cov-index 13/2 tx-power 6 new_rra 6/42 May 29 07:08:46 sapd[1641]: <404404> |AP PR-DGYM-AP306@10.28.89.18 sapd| AM 00:0b:86:77:31:c0: AP to APM : Too much coverage on channel 6 coverage 15 tx-power 6 May 29 07:08:47 KERNEL(PR-DGYM-AP306@10.28.89.18): vap aruba100 vlan is 0. discovering tunnel vlan --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:08:55 sapd[610]: <404074> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 07:09:09 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 07:09:09 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 07:09:15 sapd[610]: <404097> |AP PR-L207-AP212@10.26.30.122 sapd| AM 00:24:6c:20:55:58: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 07:09:26 sapd[610]: <404075> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:80: ARM - decreasing power cov-index 38/3 tx-power 6 new_rra 1/42 May 29 07:09:26 sapd[610]: <404404> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:80: AP to APM : Too much coverage on channel 1 coverage 41 tx-power 6 May 29 07:09:27 KERNEL(PR-L306B-AP219@10.26.34.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:10:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:10:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:10:42 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 38:aa:3c:da:e7:e0 00:1a:1e:63:d2:91 doing 802.1x May 29 07:10:42 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 38:aa:3c:da:e7:e0 00:1a:1e:63:d2:91 doing 802.1x May 29 07:10:42 authmgr[1871]: <132207> |authmgr| RADIUS reject for station MNV795015 38:aa:3c:da:e7:e0 from server msradius01. May 29 07:10:42 authmgr[1871]: <132207> |authmgr| RADIUS reject for station MNV795015 38:aa:3c:da:e7:e0 from server msradius01. May 29 07:10:51 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 38:aa:3c:da:e7:e0 00:1a:1e:63:d2:91 doing 802.1x May 29 07:10:51 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 38:aa:3c:da:e7:e0 00:1a:1e:63:d2:91 doing 802.1x May 29 07:10:51 authmgr[1871]: <132207> |authmgr| RADIUS reject for station MNV795015 38:aa:3c:da:e7:e0 from server msradius01. May 29 07:10:51 authmgr[1871]: <132207> |authmgr| RADIUS reject for station MNV795015 38:aa:3c:da:e7:e0 from server msradius01. May 29 07:10:52 sapd[603]: <404075> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 1/6 May 29 07:11:02 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:11:02 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:11:32 sapd[1341]: <404063> |AP PR-E112-AP31@10.21.180.12 sapd| AM 00:1a:1e:63:98:60: ARM Channel Band Trigger new 6-1/1 old 0-0/0 new_rra 6/6 May 29 07:11:32 sapd[1341]: <404405> |AP PR-E112-AP31@10.21.180.12 sapd| AM 00:1a:1e:63:98:60: Coverage hole: APM converting to AP on channel 6 coverage 1 6 May 29 07:11:33 KERNEL(PR-E112-AP31@10.21.180.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:11:33 KERNEL(PR-E112-AP31@10.21.180.12): vap aruba101 vlan is 0. discovering tunnel vlan May 29 07:11:33 KERNEL(PR-E112-AP31@10.21.180.12): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:11:34 sapd[1341]: <404099> |AP PR-E112-AP31@10.21.180.12 sapd| AM 00:1a:1e:63:98:60: Tx Hang: Driver reset radio to 20 MHz mode 6-0 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:11:35 sapd[1341]: <404073> |AP PR-E112-AP31@10.21.180.12 sapd| AM 00:1a:1e:63:98:60: ARM - too little power increasing... cov-index 5/1 tx-power 5 new_rra 6/6 May 29 07:11:35 sapd[589]: <127102> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC c8:7b:5b:11:22:3a) on channel 6. May 29 07:11:35 sapd[956]: <127102> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC c8:7b:5b:11:22:3a) on channel 6. May 29 07:12:06 sapd[604]: <404093> |AP PR-C211-AP27@10.21.12.19 sapd| AM 00:1a:1e:63:c2:d0: ARM HT Empty Channel Trigger new 44-48/0/0 old 161-157/10/0 new_rra 44-48/7 May 29 07:12:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:12:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:12:21 sapd[610]: <404075> |AP PR-A315-AP139@10.28.37.11 sapd| AM 00:24:6c:b6:f6:d0: ARM - decreasing power cov-index 24/2 tx-power 6 new_rra 1/42 May 29 07:12:21 sapd[610]: <404404> |AP PR-A315-AP139@10.28.37.11 sapd| AM 00:24:6c:b6:f6:d0: AP to APM : Too much coverage on channel 1 coverage 26 tx-power 6 May 29 07:12:22 KERNEL(PR-A315-AP139@10.28.37.11): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:12:22 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:80:93:7e:9e:83 00:24:6c:20:48:91 doing 802.1x May 29 07:12:22 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:80:93:7e:9e:83 00:24:6c:20:48:91 doing 802.1x May 29 07:12:40 sapd[610]: <404074> |AP PR-L117-AP237@10.26.18.122 sapd| AM 00:24:6c:20:4e:70: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 11/8 May 29 07:12:55 sapd[603]: <404074> |AP PR-E323-AP43@172.27.1.101 sapd| AM 00:1a:1e:63:d8:80: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 1/7 May 29 07:13:09 sapd[610]: <404074> |AP PR-A280-AP183@10.28.16.120 sapd| AM 00:24:6c:b6:fa:60: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 1/7 May 29 07:13:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:35 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:35 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:36 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:36 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:37 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:37 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:13:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:13:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 4c:80:93:7e:9e:83 00:24:6c:b6:e9:d2 May 29 07:14:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:14:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:14:21 sapd[1271]: <404063> |AP PR-G124-AP295@10.28.88.14 sapd| AM 00:0b:86:77:33:d0: ARM Channel Band Trigger new 1-0/1 old 0-0/0 new_rra 1/8 May 29 07:14:21 sapd[1271]: <404405> |AP PR-G124-AP295@10.28.88.14 sapd| AM 00:0b:86:77:33:d0: Coverage hole: APM converting to AP on channel 1 coverage 0 8 May 29 07:14:23 KERNEL(PR-G124-AP295@10.28.88.14): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:14:23 KERNEL(PR-G124-AP295@10.28.88.14): vap aruba101 vlan is 0. discovering tunnel vlan May 29 07:14:23 KERNEL(PR-G124-AP295@10.28.88.14): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:14:24 sapd[956]: <404074> |AP PR-E316-AP24@10.20.70.162 sapd| AM 00:1a:1e:63:c3:20: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 1/7 May 29 07:14:38 sapd[610]: <404098> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT decreasing power cov-index 11/2 tx-power 8 new_rra 149-153/6 May 29 07:14:46 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:14:46 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:14:46 sapd[610]: <404098> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:68: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 157-161/7 May 29 07:14:54 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 07:14:58 sapd[1305]: <404074> |AP PR-DGYM-ap309@10.28.88.21 sapd| AM 00:0b:86:77:3a:40: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 07:15:03 sapd[612]: <404097> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 40-36/7 May 29 07:15:03 sapd[956]: <404075> |AP PR-E314-49@10.21.33.137 sapd| AM 00:1a:1e:63:d2:60: ARM - decreasing power cov-index 13/1 tx-power 7 new_rra 6/6 May 29 07:15:04 authmgr[1871]: <522027> |authmgr| MAC=18:e2:c2:99:5b:6a IP=10.24.14.36 IP Spoof from MAC=6c:3e:6d:b4:3c:67 role=authenticated/(null) May 29 07:15:17 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:15:17 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:15:17 sapd[603]: <404074> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 1/7 May 29 07:15:23 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:23 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:23 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:23 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:15:24 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:24 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:24 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:24 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:25 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:25 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:25 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:25 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:16:d8:d2:07:90 00:1a:1e:63:c4:82 May 29 07:15:26 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:52:41 doing 802.1x May 29 07:15:26 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:52:41 doing 802.1x May 29 07:15:35 sapd[1641]: <404074> |AP PR-G125-AP296@10.28.89.129 sapd| AM 00:0b:86:77:3c:20: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 07:15:38 sapd[916]: <404075> |AP PR-L302-AP226@10.26.32.122 sapd| AM 00:24:6c:20:3d:30: ARM - decreasing power cov-index 35/1 tx-power 6 new_rra 1/42 May 29 07:15:38 sapd[916]: <404404> |AP PR-L302-AP226@10.26.32.122 sapd| AM 00:24:6c:20:3d:30: AP to APM : Too much coverage on channel 1 coverage 36 tx-power 6 May 29 07:15:39 KERNEL(PR-L302-AP226@10.26.32.122): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:16:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:16:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:16:18 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1f:69:50 00:24:6c:20:40:4a May 29 07:16:18 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1f:69:50 00:24:6c:20:40:4a May 29 07:16:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1f:69:50 00:24:6c:20:40:49 doing 802.1x May 29 07:16:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1f:69:50 00:24:6c:20:40:49 doing 802.1x May 29 07:16:42 sapd[1641]: <404069> |AP PR-G111-AP294@10.28.88.121 sapd| AM 00:0b:86:77:3c:f0: ARM Channel Interference Trigger new 11-43 old 1-92 new_rra 11/6 TCI 10 May 29 07:16:47 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station e8:92:a4:9a:c2:1f 00:1a:1e:63:d8:81, deauthenticating the station May 29 07:16:47 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station e8:92:a4:9a:c2:1f 00:1a:1e:63:d8:81, deauthenticating the station May 29 07:16:55 sapd[610]: <404050> |AP PR-A163-AP168@10.28.7.13 sapd| AM 00:24:6c:b6:e7:60: ARM C 11 PER 0 MER 70 FRR 0 50-30 May 29 07:16:56 sapd[610]: <404065> |AP PR-A163-AP168@10.28.7.13 sapd| AM 00:24:6c:b6:e7:60: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 07:16:57 sapd[599]: <404050> |AP PR-C306-AP9@10.21.180.13 sapd| AM 00:1a:1e:63:c0:60: ARM C 6 PER 0 MER 2 FRR 76 50-30 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:16:58 sapd[599]: <404065> |AP PR-C306-AP9@10.21.180.13 sapd| AM 00:1a:1e:63:c0:60: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 07:17:02 sapd[589]: <404050> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:00: ARM C 6 PER 0 MER 4 FRR 67 50-30 May 29 07:17:02 sapd[956]: <404050> |AP PR-C201-AP45@10.21.20.150 sapd| AM 00:1a:1e:63:d6:e0: ARM C 6 PER 0 MER 14 FRR 63 50-30 May 29 07:17:03 sapd[589]: <404065> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:00: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 07:17:03 sapd[956]: <404065> |AP PR-C201-AP45@10.21.20.150 sapd| AM 00:1a:1e:63:d6:e0: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 07:17:11 sapd[610]: <404098> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:98: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 157-161/7 May 29 07:17:12 sapd[610]: <404075> |AP PR-L308-AP221@10.26.37.123 sapd| AM 00:24:6c:20:4f:c0: ARM - decreasing power cov-index 10/4 tx-power 6 new_rra 6/42 May 29 07:17:12 sapd[610]: <404404> |AP PR-L308-AP221@10.26.37.123 sapd| AM 00:24:6c:20:4f:c0: AP to APM : Too much coverage on channel 6 coverage 14 tx-power 6 May 29 07:17:13 KERNEL(PR-L308-AP221@10.26.37.123): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:17:17 sapd[610]: <404098> |AP PR-L207-AP212@10.26.30.122 sapd| AM 00:24:6c:20:55:58: ARM - HT decreasing power cov-index 14/1 tx-power 8 new_rra 48-44/6 May 29 07:17:21 sapd[634]: <404098> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:f0: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 149-153/6 May 29 07:17:57 sapd[604]: <404085> |AP PR-C211-AP27@10.21.12.19 sapd| AM 00:1a:1e:63:c2:d0: ARM HT Channel Interference Trigger new 161-157/40 old 44/48-98 new_rra 161/157-7 TCI 10 May 29 07:18:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:18:11 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:18:33 sapd[1341]: <404074> |AP PR-E112-AP31@10.21.180.12 sapd| AM 00:1a:1e:63:98:60: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 07:18:34 sapd[584]: <404050> |AP PR-B107-AP63@10.21.11.15 sapd| AM 00:1a:1e:63:ca:80: ARM C 6 PER 0 MER 2 FRR 52 50-30 May 29 07:18:35 sapd[584]: <404065> |AP PR-B107-AP63@10.21.11.15 sapd| AM 00:1a:1e:63:ca:80: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 07:18:37 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:18:37 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:18:39 sapd[956]: <127000> |AP PR-E316-AP24@10.20.70.162 sapd| |ids-ap| AP(00:1a:1e:63:c3:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:18:39 sapd[956]: <127000> |AP PR-E316-AP24@10.20.70.162 sapd| |ids-ap| AP(00:1a:1e:63:c3:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:18:43 sapd[603]: <404063> |AP PR-C306ab-AP35@10.21.23.39 sapd| AM 00:1a:1e:63:97:60: ARM Channel Band Trigger new 6-2/1 old 0-0/0 new_rra 6/6 May 29 07:18:43 sapd[603]: <404405> |AP PR-C306ab-AP35@10.21.23.39 sapd| AM 00:1a:1e:63:97:60: Coverage hole: APM converting to AP on channel 6 coverage 2 6 May 29 07:18:45 KERNEL(PR-C306ab-AP35@10.21.23.39): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:18:45 KERNEL(PR-C306ab-AP35@10.21.23.39): vap aruba101 vlan is 0. discovering tunnel vlan --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:18:45 KERNEL(PR-C306ab-AP35@10.21.23.39): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:18:59 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 07:18:59 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.23.2). May 29 07:18:59 sapd[931]: <404085> |AP PR-L409-AP230@10.26.41.10 sapd| AM 00:24:6c:20:4f:f8: ARM HT Channel Interference Trigger new 161-157/117 old 40/36-155 new_rra 161/157-8 TCI 10 May 29 07:19:20 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:19:20 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:19:28 sapd[1641]: <404075> |AP PR-G111-AP294@10.28.88.121 sapd| AM 00:0b:86:77:3c:f0: ARM - decreasing power cov-index 10/1 tx-power 6 new_rra 11/42 May 29 07:19:28 sapd[1641]: <404404> |AP PR-G111-AP294@10.28.88.121 sapd| AM 00:0b:86:77:3c:f0: AP to APM : Too much coverage on channel 11 coverage 11 tx-power 6 May 29 07:19:29 KERNEL(PR-G111-AP294@10.28.88.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:19:35 sapd[610]: <404097> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 07:19:38 sapd[600]: <404063> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: ARM Channel Band Trigger new 6-3/1 old 0-0/0 new_rra 6/7 May 29 07:19:38 sapd[600]: <404405> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: Coverage hole: APM converting to AP on channel 6 coverage 3 7 May 29 07:19:39 KERNEL(PR-C306A-AP23@10.21.180.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:19:39 KERNEL(PR-C306A-AP23@10.21.180.19): vap aruba101 vlan is 0. discovering tunnel vlan May 29 07:19:39 KERNEL(PR-C306A-AP23@10.21.180.19): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:19:55 sapd[931]: <404098> |AP PR-L409-AP230@10.26.41.10 sapd| AM 00:24:6c:20:4f:f8: ARM - HT decreasing power cov-index 18/2 tx-power 8 new_rra 161-157/6 May 29 07:20:03 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:c2:1f 00:24:6c:20:46:81 PR-Bridge-AP259 did not match the replay counter 01 vs 02 May 29 07:20:03 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:c2:1f 00:24:6c:20:46:81 PR-Bridge-AP259 did not match the replay counter 01 vs 02 May 29 07:20:04 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:c2:1f 00:24:6c:20:46:81 PR-Bridge-AP259 did not match the replay counter 02 vs 03 May 29 07:20:04 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:c2:1f 00:24:6c:20:46:81 PR-Bridge-AP259 did not match the replay counter 02 vs 03 May 29 07:20:06 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:c2:1f 00:24:6c:20:46:81 PR-Bridge-AP259 did not match the replay counter 03 vs 04 May 29 07:20:06 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:c2:1f 00:24:6c:20:46:81 PR-Bridge-AP259 did not match the replay counter 03 vs 04 May 29 07:20:12 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:20:12 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:20:13 sapd[916]: <404075> |AP PR-A313-AP138@10.28.39.16 sapd| AM 00:24:6c:b6:e5:f0: ARM - decreasing power cov-index 8/7 tx-power 8 new_rra 6/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:20:14 sapd[599]: <127000> |AP PR-C306-AP9@10.21.180.13 sapd| |ids-ap| AP(00:1a:1e:63:c0:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:20:14 sapd[599]: <127000> |AP PR-C306-AP9@10.21.180.13 sapd| |ids-ap| AP(00:1a:1e:63:c0:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:20:19 sapd[1643]: <404063> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM Channel Band Trigger new 6-3/1 old 0-0/0 new_rra 6/7 May 29 07:20:19 sapd[1643]: <404405> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: Coverage hole: APM converting to AP on channel 6 coverage 3 7 May 29 07:20:20 KERNEL(PR-DGYM-ap310@10.28.88.20): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:20:20 KERNEL(PR-DGYM-ap310@10.28.88.20): vap aruba101 vlan is 0. discovering tunnel vlan May 29 07:20:20 KERNEL(PR-DGYM-ap310@10.28.88.20): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:20:20 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f1 doing 802.1x May 29 07:20:20 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f1 doing 802.1x May 29 07:20:39 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f2 May 29 07:20:39 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f2 May 29 07:20:39 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:21:6a:7a:55:00 00:24:6c:20:39:99 doing 802.1x May 29 07:20:39 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:21:6a:7a:55:00 00:24:6c:20:39:99 doing 802.1x May 29 07:20:43 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station e0:2a:82:3b:a9:a6 00:24:6c:29:4b:f2 May 29 07:20:43 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station e0:2a:82:3b:a9:a6 00:24:6c:29:4b:f2 May 29 07:20:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e0:2a:82:3b:a9:a6 00:24:6c:29:4b:f1 doing 802.1x May 29 07:20:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e0:2a:82:3b:a9:a6 00:24:6c:29:4b:f1 doing 802.1x May 29 07:20:47 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f2 May 29 07:20:47 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f2 May 29 07:20:47 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f1 doing 802.1x May 29 07:20:47 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:21:6a:7a:55:00 00:1a:1e:90:7f:f1 doing 802.1x May 29 07:21:01 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:21:01 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:21:07 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e8:92:a4:9a:c2:1f 00:24:6c:29:4d:71 May 29 07:21:07 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e8:92:a4:9a:c2:1f 00:24:6c:29:4d:71 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:21:10 sapd[635]: <127000> |AP PR-C203-AP44@10.21.20.10 sapd| |ids-ap| AP(00:1a:1e:63:d8:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:21:10 sapd[635]: <127000> |AP PR-C203-AP44@10.21.20.10 sapd| |ids-ap| AP(00:1a:1e:63:d8:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:21:28 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.43 IP Spoof from MAC=f0:d1:a9:2c:60:10 role=authenticated/(null) May 29 07:21:55 authmgr[1871]: <522027> |authmgr| MAC=34:bb:1f:f3:a0:a5 IP=10.24.26.12 IP Spoof from MAC=10:9a:dd:19:74:74 role=authenticated/(null) May 29 07:21:55 sapd[603]: <404063> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM Channel Band Trigger new 6-3/1 old 0-0/0 new_rra 6/7 May 29 07:21:55 sapd[603]: <404405> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: Coverage hole: APM converting to AP on channel 6 coverage 3 7 May 29 07:21:56 KERNEL(PR-IWC23-AP12@10.21.23.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:21:57 KERNEL(PR-IWC23-AP12@10.21.23.12): vap aruba101 vlan is 0. discovering tunnel vlan May 29 07:21:57 KERNEL(PR-IWC23-AP12@10.21.23.12): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:22:00 sapd[916]: <404075> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:00: ARM - decreasing power cov-index 12/4 tx-power 6 new_rra 11/42 May 29 07:22:00 sapd[916]: <404404> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:00: AP to APM : Too much coverage on channel 11 coverage 16 tx-power 6 May 29 07:22:01 KERNEL(PR-L218-AP203@10.26.26.12): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:22:22 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:22:22 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 07:22:53 sapd[603]: <404050> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM C 6 PER 0 MER 70 FRR 0 50-30 May 29 07:22:54 sapd[603]: <404065> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM Error Threshold Trigger Current Channel 6 new_rra 11/7 May 29 07:22:58 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 07:23:00 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station rpersa e8:92:a4:9a:c2:1f 00:24:6c:29:4d:31, deauthenticating the station May 29 07:23:00 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station rpersa e8:92:a4:9a:c2:1f 00:24:6c:29:4d:31, deauthenticating the station May 29 07:23:10 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 07:23:12 sapd[610]: <404085> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:88: ARM HT Channel Interference Trigger new 36-40/162 old 157/161-202 new_rra 36/40-8 TCI 10 May 29 07:23:26 sapd[1726]: <404093> |AP PR-SCrm2-AP8@10.20.60.17 sapd| AM 00:1a:1e:63:c4:90: ARM HT Empty Channel Trigger new 36-40/0/0 old 161-157/5/1 new_rra 36-40/7 May 29 07:23:37 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.43 IP Spoof from MAC=f0:d1:a9:2c:60:10 role=authenticated/(null) May 29 07:24:10 sapd[606]: <404098> |AP PR-A142-AP327@10.28.64.125 sapd| AM 00:1a:1e:5f:75:f0: ARM - HT decreasing power cov-index 13/0 tx-power 7 new_rra 153-149/6 May 29 07:24:12 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:24:12 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:24:14 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:24:14 sapd[603]: <127000> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:24:31 sapd[916]: <404050> |AP PR-A320-AP146@10.28.39.15 sapd| AM 00:24:6c:b6:f0:30: ARM C 11 PER 0 MER 8 FRR 77 50-30 May 29 07:24:32 sapd[916]: <404065> |AP PR-A320-AP146@10.28.39.15 sapd| AM 00:24:6c:b6:f0:30: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 07:24:43 sapd[931]: <404050> |AP PR-A220-AP179@10.28.21.140 sapd| AM 00:24:6c:b6:f2:d0: ARM C 11 PER 0 MER 18 FRR 84 50-30 May 29 07:24:43 sapd[931]: <404050> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM C 11 PER 0 MER 15 FRR 84 50-30 May 29 07:24:44 sapd[931]: <404065> |AP PR-A220-AP179@10.28.21.140 sapd| AM 00:24:6c:b6:f2:d0: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 07:24:44 sapd[931]: <404065> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 07:24:58 authmgr[1871]: <522027> |authmgr| MAC=30:7c:30:17:6b:18 IP=10.24.14.4 IP Spoof from MAC=20:68:9d:89:de:c2 role=authenticated/(null) May 29 07:25:01 sapd[2011]: <404074> |AP PR-DGYM-AP305@10.28.88.10 sapd| AM 00:0b:86:77:30:20: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 1/7 May 29 07:25:07 sapd[1305]: <404074> |AP PR-DGYM-ap309@10.28.88.21 sapd| AM 00:0b:86:77:3a:40: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 11/8 May 29 07:25:28 sapd[2192]: <404074> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:00: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 07:25:30 sapd[919]: <404074> |AP PR-Bookstore-AP283@10.21.12.10 sapd| AM 00:24:6c:29:4d:30: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 07:25:36 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:25:36 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:26:09 sapd[610]: <404098> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:88: ARM - HT decreasing power cov-index 21/0 tx-power 8 new_rra 36-40/6 May 29 07:26:14 sapd[931]: <404050> |AP PR-A220-AP179@10.28.21.140 sapd| AM 00:24:6c:b6:f2:d0: ARM C 6 PER 0 MER 3 FRR 62 50-30 May 29 07:26:15 sapd[931]: <404065> |AP PR-A220-AP179@10.28.21.140 sapd| AM 00:24:6c:b6:f2:d0: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 07:26:20 sapd[916]: <404050> |AP PR-A320-AP146@10.28.39.15 sapd| AM 00:24:6c:b6:f0:30: ARM C 6 PER 0 MER 2 FRR 90 50-30 May 29 07:26:21 sapd[916]: <404065> |AP PR-A320-AP146@10.28.39.15 sapd| AM 00:24:6c:b6:f0:30: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 07:26:26 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 00:21:06:ff:87:26) on channel 6. May 29 07:26:29 sapd[589]: <404075> |AP PR-C209-AP54@10.21.12.14 sapd| AM 00:1a:1e:63:d0:c0: ARM - decreasing power cov-index 28/3 tx-power 7 new_rra 11/6 May 29 07:26:56 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:26:56 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:26:56 authmgr[1871]: <522027> |authmgr| MAC=6c:9b:02:a8:7e:dc IP=10.24.30.71 IP Spoof from MAC=9c:20:7b:63:24:bf role=authenticated/(null) May 29 07:26:58 sapd[610]: <404097> |AP PR-A315-AP139@10.28.37.11 sapd| AM 00:24:6c:b6:f6:d8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 07:27:09 sapd[610]: <404074> |AP PR-L227-AP208@10.26.28.120 sapd| AM 00:24:6c:b6:e9:d0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 07:27:26 authmgr[1871]: <522027> |authmgr| MAC=a0:0b:ba:ce:e5:bd IP=10.24.30.74 IP Spoof from MAC=34:bb:1f:de:df:7e role=authenticated/(null) May 29 07:27:30 sapd[610]: <404097> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:68: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 157-161/8 May 29 07:27:30 sapd[610]: <404098> |AP PR-L111-AP243@10.26.19.122 sapd| AM 00:24:6c:20:48:08: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 07:27:58 sapd[603]: <404075> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 11/6 May 29 07:28:01 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 07:28:01 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 07:28:04 sapd[610]: <404098> |AP PR-L418-AP227@10.26.43.120 sapd| AM 00:24:6c:20:4e:f8: ARM - HT decreasing power cov-index 17/1 tx-power 8 new_rra 36-40/6 May 29 07:28:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:28:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:28:36 sapd[603]: <404075> |AP PR-D122-AP65@10.21.21.37 sapd| AM 00:1a:1e:63:cb:60: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 11/6 May 29 07:28:50 sapd[931]: <404074> |AP PR-L120-AP255@10.26.18.120 sapd| AM 00:24:6c:20:58:b0: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 11/7 May 29 07:29:06 sapd[931]: <404050> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM C 6 PER 0 MER 14 FRR 87 50-30 May 29 07:29:07 sapd[931]: <404065> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 07:29:11 sapd[610]: <404050> |AP PR-L229-AP211@10.26.28.122 sapd| AM 00:24:6c:20:52:e8: ARM C 48 PER 0 MER 54 FRR 0 50-30 May 29 07:29:11 sapd[916]: <404050> |AP PR-L127-AP247@10.26.29.123 sapd| AM 00:24:6c:20:54:18: ARM C 44 PER 0 MER 79 FRR 0 50-30 May 29 07:29:12 sapd[610]: <404089> |AP PR-L229-AP211@10.26.28.122 sapd| AM 00:24:6c:20:52:e8: ARM HT Error Threshold Trigger Current Channel old 48-44 new 157-161/8 May 29 07:29:12 sapd[916]: <404089> |AP PR-L127-AP247@10.26.29.123 sapd| AM 00:24:6c:20:54:18: ARM HT Error Threshold Trigger Current Channel old 44-48 new 157-161/8 May 29 07:29:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 07:29:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 07:29:30 sapd[610]: <404074> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 07:29:34 sapd[610]: <404097> |AP PR-L308-AP221@10.26.37.123 sapd| AM 00:24:6c:20:4f:c8: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 157-161/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:29:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:29:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:29:45 sapd[1726]: <404085> |AP PR-SCrm2-AP8@10.20.60.17 sapd| AM 00:1a:1e:63:c4:90: ARM HT Channel Interference Trigger new 161-157/41 old 36/40-82 new_rra 161/157-7 TCI 10 May 29 07:29:47 sapd[931]: <404074> |AP PR-L409-AP230@10.26.41.10 sapd| AM 00:24:6c:20:4f:f0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 07:30:08 authmgr[1871]: <522027> |authmgr| MAC=5c:b5:24:2f:d6:fe IP=10.24.22.76 IP Spoof from MAC=5c:95:ae:79:9e:7a role=authenticated/(null) May 29 07:30:11 sapd[610]: <404097> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:98: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 157-161/8 May 29 07:30:14 authmgr[1871]: <522027> |authmgr| MAC=6c:9b:02:a8:a7:22 IP=10.24.14.78 IP Spoof from MAC=cc:af:78:0b:ce:66 role=authenticated/(null) May 29 07:30:16 sapd[603]: <404074> |AP PR-C306ab-AP35@10.21.23.39 sapd| AM 00:1a:1e:63:97:60: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 07:30:28 sapd[610]: <404098> |AP PR-L403-AP251@10.26.42.12 sapd| AM 00:24:6c:20:4b:48: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 07:30:45 authmgr[1871]: <522027> |authmgr| MAC=6c:9b:02:a8:a7:22 IP=10.24.14.78 IP Spoof from MAC=cc:af:78:0b:ce:66 role=authenticated/(null) May 29 07:30:56 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:30:56 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:31:07 sapd[916]: <404098> |AP PR-L302-AP226@10.26.32.122 sapd| AM 00:24:6c:20:3d:38: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 44-48/7 May 29 07:31:23 sapd[635]: <404075> |AP PR-C203-AP44@10.21.20.10 sapd| AM 00:1a:1e:63:d8:00: ARM - decreasing power cov-index 11/1 tx-power 7 new_rra 1/6 May 29 07:31:30 sapd[2192]: <404074> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:00: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 6/8 May 29 07:31:35 sapd[919]: <404075> |AP PR-Bookstore-AP283@10.21.12.10 sapd| AM 00:24:6c:29:4d:30: ARM - decreasing power cov-index 11/2 tx-power 7 new_rra 6/6 May 29 07:31:41 sapd[610]: <404074> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 07:31:46 authmgr[1871]: <522027> |authmgr| MAC=6c:9b:02:a8:a7:22 IP=10.24.14.78 IP Spoof from MAC=cc:af:78:0b:ce:66 role=authenticated/(null) May 29 07:32:01 sapd[2011]: <404074> |AP PR-DGYM-AP305@10.28.88.10 sapd| AM 00:0b:86:77:30:20: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 1/8 May 29 07:32:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:32:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:32:21 sapd[610]: <404097> |AP PR-A111-AP157@10.28.13.12 sapd| AM 00:24:6c:b6:f3:38: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 36-40/8 May 29 07:32:29 sapd[1643]: <404074> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:32:47 authmgr[1871]: <522027> |authmgr| MAC=6c:9b:02:a8:a7:22 IP=10.24.14.78 IP Spoof from MAC=cc:af:78:0b:ce:66 role=authenticated/(null) May 29 07:33:31 sapd[916]: <404050> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM C 48 PER 0 MER 51 FRR 0 50-30 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:33:32 sapd[916]: <404089> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM HT Error Threshold Trigger Current Channel old 48-44 new 149-153/8 May 29 07:33:35 sapd[605]: <404074> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:a0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 07:33:36 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:33:36 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:33:42 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:1e:4c:c9:ea:a0 00:24:6c:20:39:91 doing 802.1x May 29 07:33:42 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:1e:4c:c9:ea:a0 00:24:6c:20:39:91 doing 802.1x May 29 07:33:42 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/Laptop-PC 00:1e:4c:c9:ea:a0 from server msradius01. May 29 07:33:42 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/Laptop-PC 00:1e:4c:c9:ea:a0 from server msradius01. May 29 07:33:44 sapd[916]: <404074> |AP PR-A313-AP138@10.28.39.16 sapd| AM 00:24:6c:b6:e5:f0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 07:33:49 sapd[610]: <404097> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:48: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 36-40/7 May 29 07:33:55 authmgr[1871]: <522027> |authmgr| MAC=6c:9b:02:a8:a7:22 IP=10.24.14.78 IP Spoof from MAC=cc:af:78:0b:ce:66 role=authenticated/(null) May 29 07:34:07 sapd[599]: <404069> |AP PR-C306-AP9@10.21.180.13 sapd| AM 00:1a:1e:63:c0:60: ARM Channel Interference Trigger new 1-148 old 11-227 new_rra 1/6 TCI 22 May 29 07:34:14 sapd[1641]: <404075> |AP PR-G209-AP303@10.28.89.10 sapd| AM 00:0b:86:77:2f:e0: ARM - decreasing power cov-index 14/0 tx-power 6 new_rra 6/42 May 29 07:34:14 sapd[1641]: <404404> |AP PR-G209-AP303@10.28.89.10 sapd| AM 00:0b:86:77:2f:e0: AP to APM : Too much coverage on channel 6 coverage 14 tx-power 6 May 29 07:34:15 KERNEL(PR-G209-AP303@10.28.89.10): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:34:17 authmgr[1871]: <522027> |authmgr| MAC=6c:9b:02:a8:a7:22 IP=10.24.14.78 IP Spoof from MAC=cc:af:78:0b:ce:66 role=authenticated/(null) May 29 07:34:20 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:1e:4c:c9:ea:a0 00:24:6c:b6:f6:d9 doing 802.1x May 29 07:34:20 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:1e:4c:c9:ea:a0 00:24:6c:b6:f6:d9 doing 802.1x May 29 07:34:31 sapd[610]: <404074> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 07:34:38 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.79 IP Spoof from MAC=00:88:65:51:d4:c4 role=authenticated/(null) May 29 07:34:39 sapd[610]: <404098> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT decreasing power cov-index 11/2 tx-power 8 new_rra 36-40/6 May 29 07:34:41 authmgr[1871]: <522027> |authmgr| MAC=6c:9b:02:a8:a7:22 IP=10.24.14.78 IP Spoof from MAC=cc:af:78:0b:ce:66 role=authenticated/(null) May 29 07:34:44 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 07:34:50 sapd[610]: <404074> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 07:34:57 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:34:57 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:35:02 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.79 IP Spoof from MAC=00:88:65:51:d4:c4 role=authenticated/(null) May 29 07:35:02 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 07:35:10 sapd[610]: <404050> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM C 40 PER 0 MER 81 FRR 0 50-30 May 29 07:35:11 sapd[610]: <404089> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM HT Error Threshold Trigger Current Channel old 40-36 new 48-44/8 May 29 07:35:12 sapd[931]: <404075> |AP PR-L409-AP230@10.26.41.10 sapd| AM 00:24:6c:20:4f:f0: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 6/6 May 29 07:35:21 sapd[610]: <404097> |AP PR-L111-AP243@10.26.19.122 sapd| AM 00:24:6c:20:48:08: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 07:35:33 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:52:41 doing 802.1x May 29 07:35:33 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:52:41 doing 802.1x May 29 07:35:38 sapd[600]: <404097> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:b0: ARM - HT increasing power cov-index 6/2 tx-power 6 new_rra 36-40/7 May 29 07:35:46 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.79 IP Spoof from MAC=00:88:65:51:d4:c4 role=authenticated/(null) May 29 07:35:46 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:35:46 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:35:57 sapd[931]: <404074> |AP PR-A185-AP172@10.28.4.10 sapd| AM 00:24:6c:b6:fe:80: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:35:59 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 07:36:02 sapd[603]: <404074> |AP PR-D122-AP65@10.21.21.37 sapd| AM 00:1a:1e:63:cb:60: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 07:36:02 sapd[610]: <404074> |AP PR-L222-AP209@10.26.27.120 sapd| AM 00:24:6c:b6:ea:20: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 11/7 May 29 07:36:06 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:78:78 00:24:6c:20:40:49 doing 802.1x May 29 07:36:06 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:78:78 00:24:6c:20:40:49 doing 802.1x May 29 07:36:13 sapd[603]: <404075> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 1/6 May 29 07:36:13 sapd[610]: <404097> |AP PR-L308-AP221@10.26.37.123 sapd| AM 00:24:6c:20:4f:c8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 157-161/8 May 29 07:36:13 sapd[916]: <404098> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 07:36:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:36:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:36:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:78:78 00:24:6c:20:40:49 doing 802.1x May 29 07:36:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:78:78 00:24:6c:20:40:49 doing 802.1x May 29 07:36:40 sapd[934]: <404069> |AP PR-A215-AP288@10.28.67.123 sapd| AM 00:24:6c:29:4a:10: ARM Channel Interference Trigger new 6-172 old 1-209 new_rra 6/6 TCI 30 May 29 07:36:46 authmgr[1871]: <522027> |authmgr| MAC=b0:ec:71:f2:94:d5 IP=10.24.26.28 IP Spoof from MAC=98:fe:94:20:dc:f8 role=authenticated/(null) May 29 07:37:02 sapd[606]: <404097> |AP PR-A142-AP327@10.28.64.125 sapd| AM 00:1a:1e:5f:75:f0: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 153-149/7 May 29 07:37:06 sapd[592]: <404074> |AP PR-B317i-AP21@10.21.30.26 sapd| AM 00:1a:1e:63:c3:80: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 07:37:08 sapd[934]: <404075> |AP PR-A215-AP288@10.28.67.123 sapd| AM 00:24:6c:29:4a:10: ARM - decreasing power cov-index 14/0 tx-power 6 new_rra 6/42 May 29 07:37:08 sapd[934]: <404404> |AP PR-A215-AP288@10.28.67.123 sapd| AM 00:24:6c:29:4a:10: AP to APM : Too much coverage on channel 6 coverage 14 tx-power 6 May 29 07:37:09 KERNEL(PR-A215-AP288@10.28.67.123): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:37:17 sapd[934]: <404075> |AP PR-C211-AP287@10.21.12.22 sapd| AM 00:24:6c:29:4b:f0: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 1/6 May 29 07:37:29 sapd[603]: <404063> |AP PR-D305-AP61@10.21.23.138 sapd| AM 00:1a:1e:63:ca:20: ARM Channel Band Trigger new 6-2/1 old 0-0/0 new_rra 6/6 May 29 07:37:29 sapd[603]: <404405> |AP PR-D305-AP61@10.21.23.138 sapd| AM 00:1a:1e:63:ca:20: Coverage hole: APM converting to AP on channel 6 coverage 2 6 May 29 07:37:30 KERNEL(PR-D305-AP61@10.21.23.138): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:37:31 KERNEL(PR-D305-AP61@10.21.23.138): vap aruba101 vlan is 0. discovering tunnel vlan May 29 07:37:31 KERNEL(PR-D305-AP61@10.21.23.138): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:37:31 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 07:37:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:37:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:37:50 sapd[916]: <404098> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 07:38:00 sapd[610]: <404097> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:48: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 36-40/8 May 29 07:38:03 sapd[610]: <404085> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM HT Channel Interference Trigger new 40-36/88 old 161/157-124 new_rra 40/36-8 TCI 10 May 29 07:38:46 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:f7:c9 doing 802.1x May 29 07:38:46 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:f7:c9 doing 802.1x May 29 07:38:47 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e0:06:e6:68:f4:27 00:24:6c:20:3f:69 doing 802.1x May 29 07:38:47 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e0:06:e6:68:f4:27 00:24:6c:20:3f:69 doing 802.1x May 29 07:38:47 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/sabz-mate e0:06:e6:68:f4:27 from server msradius01. --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:38:47 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/sabz-mate e0:06:e6:68:f4:27 from server msradius01. May 29 07:38:57 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:38:57 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:38:58 sapd[916]: <404085> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM HT Channel Interference Trigger new 48-44/74 old 149/153-125 new_rra 48/44-7 TCI 10 May 29 07:39:02 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 07:39:08 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 07:39:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e0:06:e6:68:f4:27 00:24:6c:b6:f6:d9 doing 802.1x May 29 07:39:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e0:06:e6:68:f4:27 00:24:6c:b6:f6:d9 doing 802.1x May 29 07:39:20 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 5c:0a:5b:c8:fb:ce 00:1a:1e:61:99:01 May 29 07:39:20 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 5c:0a:5b:c8:fb:ce 00:1a:1e:61:99:01 May 29 07:39:20 authmgr[1871]: <132222> |authmgr| Received EAP packet on the wrong BSSID for station 5c:0a:5b:c8:fb:ce00:1a:1e:61:99:01 May 29 07:39:20 authmgr[1871]: <132222> |authmgr| Received EAP packet on the wrong BSSID for station 5c:0a:5b:c8:fb:ce00:1a:1e:61:99:01 May 29 07:39:23 sapd[1641]: <404074> |AP PR-G125-AP296@10.28.89.129 sapd| AM 00:0b:86:77:3c:20: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 11/8 May 29 07:39:41 sapd[931]: <404074> |AP PR-L120-AP255@10.26.18.120 sapd| AM 00:24:6c:20:58:b0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 11/8 May 29 07:39:56 sapd[603]: <404074> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 07:40:12 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:40:12 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 07:40:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:40:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:40:18 sapd[610]: <404097> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:98: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 44-48/8 May 29 07:40:21 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e0:06:e6:68:f4:27 00:24:6c:b6:f6:d9 doing 802.1x May 29 07:40:21 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e0:06:e6:68:f4:27 00:24:6c:b6:f6:d9 doing 802.1x May 29 07:40:28 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:40:28 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:40:49 sapd[610]: <404098> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT decreasing power cov-index 12/1 tx-power 8 new_rra 40-36/6 May 29 07:40:51 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e8:92:a4:9a:c2:1f 00:1a:1e:63:c2:91 doing 802.1x May 29 07:40:51 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station e8:92:a4:9a:c2:1f 00:1a:1e:63:c2:91 doing 802.1x May 29 07:40:51 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station rpersa e8:92:a4:9a:c2:1f 00:1a:1e:63:d2:41, deauthenticating the station May 29 07:40:51 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station rpersa e8:92:a4:9a:c2:1f 00:1a:1e:63:d2:41, deauthenticating the station May 29 07:40:56 sapd[610]: <404098> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d8: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 44-48/7 May 29 07:41:11 sapd[1271]: <404069> |AP PR-G124-AP295@10.28.88.14 sapd| AM 00:0b:86:77:33:d0: ARM Channel Interference Trigger new 6-56 old 1-92 new_rra 6/8 TCI 10 May 29 07:41:19 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.20.2). May 29 07:41:19 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.20.2). May 29 07:41:33 sapd[610]: <404074> |AP PR-L222-AP209@10.26.27.120 sapd| AM 00:24:6c:b6:ea:20: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 11/8 May 29 07:41:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:41:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:41:54 sapd[610]: <404075> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - decreasing power cov-index 11/2 tx-power 7 new_rra 11/6 May 29 07:42:06 sapd[2096]: <404075> |AP PR-c203-AP47@10.21.20.144 sapd| AM 00:1a:1e:63:d1:a0: ARM - decreasing power cov-index 14/1 tx-power 7 new_rra 6/6 May 29 07:42:06 sapd[916]: <404097> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 07:42:20 sapd[610]: <404050> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM C 48 PER 0 MER 56 FRR 0 50-30 May 29 07:42:20 sapd[916]: <404074> |AP PR-A313-AP138@10.28.39.16 sapd| AM 00:24:6c:b6:e5:f0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:42:21 sapd[610]: <404089> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM HT Error Threshold Trigger Current Channel old 48-44 new 157-161/8 May 29 07:42:27 sapd[610]: <404074> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:42:32 sapd[934]: <404074> |AP PR-C211-AP287@10.21.12.22 sapd| AM 00:24:6c:29:4b:f0: ARM - increasing power cov-index 5/2 tx-power 6 new_rra 1/7 May 29 07:42:37 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:c4:89:47 00:24:6c:b6:fd:71 doing 802.1x May 29 07:42:37 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:c4:89:47 00:24:6c:b6:fd:71 doing 802.1x May 29 07:42:37 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300755578 20:64:32:c4:89:47 from server msradius01. --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:42:37 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300755578 20:64:32:c4:89:47 from server msradius01. May 29 07:42:53 sapd[604]: <404050> |AP PR-C211-AP27@10.21.12.19 sapd| AM 00:1a:1e:63:c2:c0: ARM C 11 PER 0 MER 21 FRR 76 50-30 May 29 07:42:54 sapd[604]: <404065> |AP PR-C211-AP27@10.21.12.19 sapd| AM 00:1a:1e:63:c2:c0: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 07:42:57 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:42:57 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:43:01 sapd[1271]: <404075> |AP PR-G124-AP295@10.28.88.14 sapd| AM 00:0b:86:77:33:d0: ARM - decreasing power cov-index 11/2 tx-power 8 new_rra 6/6 May 29 07:43:28 sapd[956]: <404075> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 07:44:14 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:4a:58:48 00:24:6c:b6:f0:21 doing 802.1x May 29 07:44:14 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:4a:58:48 00:24:6c:b6:f0:21 doing 802.1x May 29 07:44:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300733121 20:64:32:4a:58:48 00:24:6c:b6:f0:21, deauthenticating the station May 29 07:44:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300733121 20:64:32:4a:58:48 00:24:6c:b6:f0:21, deauthenticating the station May 29 07:44:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:44:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:44:49 sapd[610]: <404074> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:70: ARM - increasing power cov-index 5/2 tx-power 6 new_rra 1/7 May 29 07:45:06 sapd[610]: <404074> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 07:45:21 sapd[610]: <404098> |AP PR-A315-AP139@10.28.37.11 sapd| AM 00:24:6c:b6:f6:d8: ARM - HT decreasing power cov-index 16/0 tx-power 8 new_rra 48-44/6 May 29 07:45:29 sapd[610]: <404097> |AP PR-L207-AP212@10.26.30.122 sapd| AM 00:24:6c:20:55:58: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 48-44/7 May 29 07:45:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:45:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:45:50 sapd[610]: <404085> |AP PR-L102-AP241@10.26.19.126 sapd| AM 00:24:6c:20:56:78: ARM HT Channel Interference Trigger new 48-44/164 old 157/161-202 new_rra 48/44-6 TCI 10 May 29 07:46:00 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 07:46:00 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (10.21.12.2). May 29 07:46:07 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 07:46:13 sapd[634]: <404097> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:f0: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:46:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:c4:89:47 00:24:6c:b6:f3:31 doing 802.1x May 29 07:46:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:c4:89:47 00:24:6c:b6:f3:31 doing 802.1x May 29 07:46:15 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300755578 20:64:32:c4:89:47 from server msradius01. May 29 07:46:15 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300755578 20:64:32:c4:89:47 from server msradius01. May 29 07:46:16 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 68:94:23:a1:01:e6 00:1a:1e:63:c2:c2 May 29 07:46:16 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 68:94:23:a1:01:e6 00:1a:1e:63:c2:c2 May 29 07:46:16 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:94:23:a1:01:e6 00:1a:1e:63:c2:c2 May 29 07:46:16 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:94:23:a1:01:e6 00:1a:1e:63:c2:c2 May 29 07:46:17 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:17 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:17 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:17 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 90:00:4e:d0:50:e2 00:1a:1e:90:7f:e1 doing 802.1x May 29 07:46:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 90:00:4e:d0:50:e2 00:1a:1e:90:7f:e1 doing 802.1x May 29 07:46:18 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:18 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:18 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:18 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:19 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:19 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:19 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:19 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:94:23:a1:01:e6 00:24:6c:29:4d:32 May 29 07:46:22 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 07:46:36 sapd[603]: <404075> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 11/6 May 29 07:46:38 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 90:00:4e:d0:50:e2 00:24:6c:b6:e5:f0 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:46:38 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 90:00:4e:d0:50:e2 00:24:6c:b6:e5:f0 May 29 07:46:38 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 90:00:4e:d0:50:e2 00:24:6c:20:3f:61 doing 802.1x May 29 07:46:38 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 90:00:4e:d0:50:e2 00:24:6c:20:3f:61 doing 802.1x May 29 07:46:53 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 07:46:57 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:46:57 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:47:22 sapd[610]: <404097> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 36-40/7 May 29 07:47:38 sapd[916]: <404098> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 48-44/7 May 29 07:47:54 sapd[956]: <404074> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 07:48:01 sapd[610]: <404074> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:60: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 11/8 May 29 07:48:08 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 07:48:08 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:d0:90 00:24:6c:20:52:41 doing 802.1x May 29 07:48:13 sapd[610]: <404097> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 153-149/7 May 29 07:48:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:48:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:48:18 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 07:48:29 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:84:25:60 00:0b:86:77:3c:8a May 29 07:48:29 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:84:25:60 00:0b:86:77:3c:8a May 29 07:48:29 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:25:60 00:0b:86:77:3c:89 doing 802.1x May 29 07:48:29 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:25:60 00:0b:86:77:3c:89 doing 802.1x May 29 07:48:36 sapd[610]: <404074> |AP PR-A121-AP163@10.28.10.120 sapd| AM 00:24:6c:b6:e7:a0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 1/7 May 29 07:48:45 sapd[1643]: <404075> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - decreasing power cov-index 8/4 tx-power 8 new_rra 6/7 May 29 07:48:50 sapd[610]: <404074> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 07:48:55 sapd[931]: <404074> |AP PR-L111A-AP240@10.26.19.121 sapd| AM 00:24:6c:20:50:70: ARM - increasing power cov-index 8/0 tx-power 6 new_rra 11/7 May 29 07:49:09 sapd[2011]: <404075> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: ARM - decreasing power cov-index 6/0 tx-power 6 new_rra 1/42 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:49:09 sapd[2011]: <404404> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: AP to APM : Too much coverage on channel 1 coverage 6 tx-power 6 May 29 07:49:10 KERNEL(PR-G207-AP302@10.28.88.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:49:14 sapd[610]: <404085> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM HT Channel Interference Trigger new 48-44/56 old 157/161-118 new_rra 48/44-8 TCI 10 May 29 07:49:27 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 07:49:27 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:19:28 00:1a:1e:63:cf:51 doing 802.1x May 29 07:49:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:49:37 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:50:14 sapd[956]: <404050> |AP PR-C201-AP45@10.21.20.150 sapd| AM 00:1a:1e:63:d6:f0: ARM C 161 PER 0 MER 74 FRR 0 50-30 May 29 07:50:15 sapd[956]: <404089> |AP PR-C201-AP45@10.21.20.150 sapd| AM 00:1a:1e:63:d6:f0: ARM HT Error Threshold Trigger Current Channel old 161-157 new 40-36/7 May 29 07:50:36 sapd[604]: <404050> |AP PR-C211-AP27@10.21.12.19 sapd| AM 00:1a:1e:63:c2:d0: ARM C 161 PER 0 MER 68 FRR 0 50-30 May 29 07:50:37 sapd[604]: <404089> |AP PR-C211-AP27@10.21.12.19 sapd| AM 00:1a:1e:63:c2:d0: ARM HT Error Threshold Trigger Current Channel old 161-157 new 149-153/7 May 29 07:50:49 sapd[916]: <404098> |AP PR-L216-AP200@10.26.26.10 sapd| AM 00:24:6c:20:3f:08: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 40-36/7 May 29 07:50:58 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:50:58 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:51:07 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 07:51:35 sapd[610]: <404097> |AP PR-L207-AP212@10.26.30.122 sapd| AM 00:24:6c:20:55:58: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 07:51:44 sapd[934]: <404075> |AP PR-C211-AP287@10.21.12.22 sapd| AM 00:24:6c:29:4b:f0: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 1/6 May 29 07:51:48 sapd[610]: <404074> |AP PR-L404-AP253@10.26.40.11 sapd| AM 00:24:6c:20:53:80: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 07:52:04 sapd[610]: <404085> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM HT Channel Interference Trigger new 36-40/52 old 48/44-83 new_rra 36/40-8 TCI 10 May 29 07:52:21 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:52:21 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:91, deauthenticating the station May 29 07:52:37 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 07:52:55 sapd[610]: <404075> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - decreasing power cov-index 11/3 tx-power 7 new_rra 11/6 May 29 07:53:02 sapd[610]: <404050> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM C 36 PER 0 MER 73 FRR 0 50-30 May 29 07:53:03 sapd[610]: <404089> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM HT Error Threshold Trigger Current Channel old 36-40 new 48-44/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:53:20 sapd[635]: <404050> |AP PR-C203-AP44@10.21.20.10 sapd| AM 00:1a:1e:63:d8:10: ARM C 161 PER 0 MER 79 FRR 0 50-30 May 29 07:53:21 sapd[635]: <404089> |AP PR-C203-AP44@10.21.20.10 sapd| AM 00:1a:1e:63:d8:10: ARM HT Error Threshold Trigger Current Channel old 161-157 new 44-48/7 May 29 07:53:30 sapd[610]: <404098> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:58: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 07:53:34 sapd[610]: <404074> |AP PR-L227-AP208@10.26.28.120 sapd| AM 00:24:6c:b6:e9:d0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:53:39 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 07:53:41 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:53:41 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:53:42 authmgr[1871]: <522027> |authmgr| MAC=38:aa:3c:f1:3d:79 IP=10.24.2.15 IP Spoof from MAC=1c:e6:2b:e1:c7:7c role=authenticated/(null) May 29 07:54:08 sapd[610]: <404050> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:78: ARM C 161 PER 0 MER 55 FRR 0 50-30 May 29 07:54:09 sapd[610]: <404089> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:78: ARM HT Error Threshold Trigger Current Channel old 161-157 new 48-44/8 May 29 07:54:12 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 07:54:13 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 07:54:28 sapd[610]: <404097> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 36-40/8 May 29 07:54:38 sapd[610]: <404050> |AP PR-L308-AP221@10.26.37.123 sapd| AM 00:24:6c:20:4f:c8: ARM C 157 PER 0 MER 61 FRR 0 50-30 May 29 07:54:39 sapd[610]: <404089> |AP PR-L308-AP221@10.26.37.123 sapd| AM 00:24:6c:20:4f:c8: ARM HT Error Threshold Trigger Current Channel old 157-161 new 153-149/8 May 29 07:54:44 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 07:54:54 sapd[2011]: <404063> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: ARM Channel Band Trigger new 1-0/1 old 0-0/0 new_rra 1/8 May 29 07:54:54 sapd[2011]: <404405> |AP PR-G207-AP302@10.28.88.19 sapd| AM 00:0b:86:77:2f:30: Coverage hole: APM converting to AP on channel 1 coverage 0 8 May 29 07:54:55 KERNEL(PR-G207-AP302@10.28.88.19): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:54:55 KERNEL(PR-G207-AP302@10.28.88.19): vap aruba101 vlan is 0. discovering tunnel vlan May 29 07:54:55 KERNEL(PR-G207-AP302@10.28.88.19): vap aruba102 vlan is 0. discovering tunnel vlan May 29 07:55:00 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:55:00 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:55:11 sapd[916]: <404075> |AP PR-A320-AP146@10.28.39.15 sapd| AM 00:24:6c:b6:f0:30: ARM - decreasing power cov-index 18/0 tx-power 6 new_rra 11/42 May 29 07:55:11 sapd[916]: <404404> |AP PR-A320-AP146@10.28.39.15 sapd| AM 00:24:6c:b6:f0:30: AP to APM : Too much coverage on channel 11 coverage 18 tx-power 6 May 29 07:55:13 KERNEL(PR-A320-AP146@10.28.39.15): vap aruba100 vlan is 0. discovering tunnel vlan May 29 07:55:16 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:55:21 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1e:4c:c9:ea:a0 00:24:6c:b6:f6:d9, deauthenticating the station May 29 07:55:21 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1e:4c:c9:ea:a0 00:24:6c:b6:f6:d9, deauthenticating the station May 29 07:55:22 sapd[610]: <404075> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - decreasing power cov-index 11/1 tx-power 8 new_rra 6/7 May 29 07:55:27 authmgr[1871]: <522027> |authmgr| MAC=20:64:32:7b:36:94 IP=10.24.30.19 IP Spoof from MAC=4c:b1:99:f4:14:63 role=authenticated/(null) May 29 07:55:35 sapd[610]: <404074> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:55:40 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:52:41 doing 802.1x May 29 07:55:40 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:ac:4c:7d:e2:b5 00:24:6c:20:52:41 doing 802.1x May 29 07:55:40 sapd[635]: <404098> |AP PR-C203-AP44@10.21.20.10 sapd| AM 00:1a:1e:63:d8:10: ARM - HT decreasing power cov-index 11/3 tx-power 7 new_rra 44-48/6 May 29 07:55:52 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 2c:a8:35:28:30:9f 00:24:6c:20:3b:21 doing 802.1x May 29 07:55:52 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 2c:a8:35:28:30:9f 00:24:6c:20:3b:21 doing 802.1x May 29 07:55:52 authmgr[1871]: <132207> |authmgr| RADIUS reject for station djeanathan 2c:a8:35:28:30:9f from server msradius01. May 29 07:55:52 authmgr[1871]: <132207> |authmgr| RADIUS reject for station djeanathan 2c:a8:35:28:30:9f from server msradius01. May 29 07:56:07 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:56:07 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 07:56:08 sapd[610]: <404074> |AP PR-A280-AP183@10.28.16.120 sapd| AM 00:24:6c:b6:fa:60: ARM - increasing power cov-index 5/0 tx-power 7 new_rra 1/8 May 29 07:56:20 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:56:20 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:56:20 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 07:56:24 sapd[610]: <404074> |AP PR-L404-AP253@10.26.40.11 sapd| AM 00:24:6c:20:53:80: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 11/8 May 29 07:56:28 sapd[1643]: <404074> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:56:32 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:78:78 00:24:6c:20:40:49 doing 802.1x May 29 07:56:32 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:78:78 00:24:6c:20:40:49 doing 802.1x May 29 07:56:34 sapd[610]: <404097> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 153-149/8 May 29 07:57:01 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:57:01 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:01 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:01 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:02 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:02 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:02 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:02 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:03 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:03 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:03 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:03 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 9c:4e:36:34:fe:7c 00:24:6c:b6:fe:82 May 29 07:57:12 sapd[592]: <404075> |AP PR-B317i-AP21@10.21.30.26 sapd| AM 00:1a:1e:63:c3:80: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 11/6 May 29 07:57:40 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:57:40 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:57:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 2c:a8:35:28:30:9f 00:24:6c:20:3b:21 doing 802.1x May 29 07:57:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 2c:a8:35:28:30:9f 00:24:6c:20:3b:21 doing 802.1x May 29 07:57:43 authmgr[1871]: <132207> |authmgr| RADIUS reject for station djeanathan 2c:a8:35:28:30:9f from server msradius01. May 29 07:57:43 authmgr[1871]: <132207> |authmgr| RADIUS reject for station djeanathan 2c:a8:35:28:30:9f from server msradius01. May 29 07:58:11 sapd[634]: <404098> |AP PR-A219-AP336@10.28.67.125 sapd| AM 00:1a:1e:90:7f:f0: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 149-153/6 May 29 07:59:01 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:59:01 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 07:59:05 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:fd:c9 doing 802.1x May 29 07:59:05 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:fd:c9 doing 802.1x May 29 07:59:11 sapd[610]: <404098> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 36-40/7 May 29 07:59:23 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 07:59:23 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 07:59:30 sapd[610]: <404074> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 07:59:30 sapd[610]: <404097> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:58: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 07:59:33 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 2c:a8:35:28:30:9f 00:24:6c:20:3b:21 doing 802.1x May 29 07:59:33 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 2c:a8:35:28:30:9f 00:24:6c:20:3b:21 doing 802.1x May 29 07:59:33 authmgr[1871]: <132207> |authmgr| RADIUS reject for station djeanathan 2c:a8:35:28:30:9f from server msradius01. May 29 07:59:33 authmgr[1871]: <132207> |authmgr| RADIUS reject for station djeanathan 2c:a8:35:28:30:9f from server msradius01. May 29 07:59:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:0b:ba:29:69:fd 00:24:6c:b6:ed:78 May 29 07:59:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:0b:ba:29:69:fd 00:24:6c:b6:ed:78 May 29 07:59:35 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station a0:0b:ba:29:69:fd 00:24:6c:b6:f8:69 doing 802.1x May 29 07:59:35 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station a0:0b:ba:29:69:fd 00:24:6c:b6:f8:69 doing 802.1x May 29 08:00:08 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 50:cc:f8:e0:13:b0) on channel 6. May 29 08:00:20 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:00:20 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:00:34 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:00:49 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:84:12:dc 00:1a:1e:63:cf:72 May 29 08:00:49 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:84:12:dc 00:1a:1e:63:cf:72 May 29 08:00:49 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:12:dc 00:1a:1e:63:c0:91 doing 802.1x May 29 08:00:49 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:12:dc 00:1a:1e:63:c0:91 doing 802.1x May 29 08:00:56 authmgr[1871]: <522027> |authmgr| MAC=5c:0a:5b:fa:bf:a5 IP=10.24.10.88 IP Spoof from MAC=14:5a:05:ef:a1:c8 role=authenticated/(null) May 29 08:01:41 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:01:41 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:01:49 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:0b:6b:03:59:1e 00:24:6c:20:55:e1, deauthenticating the station May 29 08:01:49 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:0b:6b:03:59:1e 00:24:6c:20:55:e1, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:02:00 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:1e:4c:c9:ea:a0 00:24:6c:b6:e5:f9 doing 802.1x May 29 08:02:00 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:1e:4c:c9:ea:a0 00:24:6c:b6:e5:f9 doing 802.1x May 29 08:02:12 sapd[919]: <404085> |AP PR-B212-AP284@10.21.12.11 sapd| AM 00:24:6c:29:4a:78: ARM HT Channel Interference Trigger new 44-48/17 old 40/36-55 new_rra 44/48-8 TCI 10 May 29 08:02:13 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station e0:ca:94:8b:1c:38 00:24:6c:20:4e:f2 May 29 08:02:13 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station e0:ca:94:8b:1c:38 00:24:6c:20:4e:f2 May 29 08:02:13 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e0:ca:94:8b:1c:38 00:24:6c:20:4e:f2 May 29 08:02:13 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e0:ca:94:8b:1c:38 00:24:6c:20:4e:f2 May 29 08:02:15 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station e0:ca:94:8b:1c:38 00:24:6c:20:4e:f2 May 29 08:02:15 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station e0:ca:94:8b:1c:38 00:24:6c:20:4e:f2 May 29 08:02:15 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e0:ca:94:8b:1c:38 00:24:6c:20:4e:f2 May 29 08:02:15 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e0:ca:94:8b:1c:38 00:24:6c:20:4e:f2 May 29 08:02:34 sapd[610]: <404098> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 153-149/7 May 29 08:02:52 sapd[916]: <404097> |AP PR-L216-AP200@10.26.26.10 sapd| AM 00:24:6c:20:3f:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 40-36/8 May 29 08:03:01 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:03:01 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:03:06 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 08:03:26 authmgr[1871]: <522027> |authmgr| MAC=64:a3:cb:3f:7c:b3 IP=10.24.6.74 IP Spoof from MAC=14:8f:c6:3c:5c:09 role=authenticated/(null) May 29 08:03:26 sapd[956]: <404075> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 08:03:29 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 08:03:51 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 50:cc:f8:e0:13:b0) on channel 6. May 29 08:04:00 sapd[635]: <127000> |AP PR-C203-AP44@10.21.20.10 sapd| |ids-ap| AP(00:1a:1e:63:d8:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:04:00 sapd[635]: <127000> |AP PR-C203-AP44@10.21.20.10 sapd| |ids-ap| AP(00:1a:1e:63:d8:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:04:21 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:04:21 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:04:21 sapd[931]: <404050> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM C 11 PER 0 MER 19 FRR 95 50-30 May 29 08:04:22 sapd[931]: <404065> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 08:04:48 authmgr[1871]: <522027> |authmgr| MAC=50:a4:c8:25:2b:cc IP=10.24.26.82 IP Spoof from MAC=44:2a:60:6a:28:0a role=authenticated/(null) May 29 08:05:07 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.134 IP Spoof from MAC=14:8f:c6:ab:f0:aa role=authenticated/(null) May 29 08:05:40 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:05:40 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:05:43 sapd[916]: <404074> |AP PR-L104-AP239@10.26.16.121 sapd| AM 00:24:6c:20:50:60: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 08:05:51 sapd[605]: <127000> |AP PR-A148-AP326@10.28.64.122 sapd| |ids-ap| AP(00:1a:1e:90:74:60): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 08:05:51 sapd[605]: <127000> |AP PR-A148-AP326@10.28.64.122 sapd| |ids-ap| AP(00:1a:1e:90:74:60): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 08:06:13 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:06:21 sapd[610]: <404098> |AP PR-L108-AP234@10.26.17.121 sapd| AM 00:24:6c:20:51:58: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 153-149/7 May 29 08:06:28 sapd[916]: <404098> |AP PR-L302-AP226@10.26.32.122 sapd| AM 00:24:6c:20:3d:38: ARM - HT decreasing power cov-index 14/1 tx-power 7 new_rra 44-48/6 May 29 08:06:30 sapd[589]: <404097> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 May 29 08:06:38 sapd[603]: <404098> |AP PR-C306ab-AP35@10.21.23.39 sapd| AM 00:1a:1e:63:97:70: ARM - HT decreasing power cov-index 7/5 tx-power 7 new_rra 36-40/6 May 29 08:06:40 sapd[603]: <127102> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:06:51 sapd[605]: <404098> |AP PR-A148-AP326@10.28.64.122 sapd| AM 00:1a:1e:90:74:70: ARM - HT decreasing power cov-index 15/1 tx-power 7 new_rra 149-153/6 May 29 08:06:58 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1 doing 802.1x May 29 08:06:58 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1 doing 802.1x May 29 08:06:58 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/Jenny 94:39:e5:af:32:f7 from server msradius01. May 29 08:06:58 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/Jenny 94:39:e5:af:32:f7 from server msradius01. May 29 08:06:59 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300676273 cc:78:5f:46:54:2f 00:24:6c:20:57:79, deauthenticating the station May 29 08:06:59 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300676273 cc:78:5f:46:54:2f 00:24:6c:20:57:79, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:07:01 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:07:01 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:07:11 sapd[604]: <404075> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 08:07:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:b9:58:f1 00:24:6c:20:46:89 doing 802.1x May 29 08:07:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:b9:58:f1 00:24:6c:20:46:89 doing 802.1x May 29 08:07:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300731492 20:64:32:b9:58:f1 00:24:6c:20:46:89, deauthenticating the station May 29 08:07:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300731492 20:64:32:b9:58:f1 00:24:6c:20:46:89, deauthenticating the station May 29 08:07:46 sapd[931]: <404050> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM C 6 PER 0 MER 4 FRR 91 50-30 May 29 08:07:47 sapd[931]: <404065> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 08:07:48 sapd[610]: <404097> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 153-149/8 May 29 08:08:17 sapd[931]: <404050> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM C 11 PER 0 MER 24 FRR 88 50-30 May 29 08:08:18 sapd[931]: <404065> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 08:08:21 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:08:21 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:08:26 sapd[1705]: <404063> |AP PR-G200-AP299@10.28.88.17 sapd| AM 00:0b:86:77:2f:c0: ARM Channel Band Trigger new 11-1/1 old 0-0/0 new_rra 11/7 May 29 08:08:26 sapd[1705]: <404405> |AP PR-G200-AP299@10.28.88.17 sapd| AM 00:0b:86:77:2f:c0: Coverage hole: APM converting to AP on channel 11 coverage 1 7 May 29 08:08:27 KERNEL(PR-G200-AP299@10.28.88.17): vap aruba100 vlan is 0. discovering tunnel vlan May 29 08:08:28 KERNEL(PR-G200-AP299@10.28.88.17): vap aruba101 vlan is 0. discovering tunnel vlan May 29 08:08:28 KERNEL(PR-G200-AP299@10.28.88.17): vap aruba102 vlan is 0. discovering tunnel vlan May 29 08:08:29 sapd[1705]: <404099> |AP PR-G200-AP299@10.28.88.17 sapd| AM 00:0b:86:77:2f:c0: Tx Hang: Driver reset radio to 20 MHz mode 11-0 May 29 08:08:30 sapd[1705]: <404073> |AP PR-G200-AP299@10.28.88.17 sapd| AM 00:0b:86:77:2f:c0: ARM - too little power increasing... cov-index 5/1 tx-power 5 new_rra 11/6 May 29 08:08:48 sapd[931]: <404050> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM C 6 PER 0 MER 2 FRR 94 50-30 May 29 08:08:49 sapd[610]: <404085> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM HT Channel Interference Trigger new 44-48/68 old 40/36-94 new_rra 44/48-6 TCI 10 May 29 08:08:49 sapd[931]: <404065> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 08:08:53 sapd[610]: <404097> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 44-48/7 May 29 08:09:12 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 20:64:32:b2:eb:90) on channel 6. --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:09:19 sapd[931]: <404050> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM C 11 PER 0 MER 31 FRR 86 50-30 May 29 08:09:20 sapd[931]: <404065> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM Error Threshold Trigger Current Channel 11 new_rra 6/6 May 29 08:09:21 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:09:23 sapd[589]: <404074> |AP PR-B307-AP69@10.21.30.22 sapd| AM 00:1a:1e:63:c9:c0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 08:09:42 sapd[610]: <404050> |AP PR-A322-AP141@10.28.43.10 sapd| AM 00:24:6c:b6:ed:68: ARM C 153 PER 0 MER 79 FRR 0 50-30 May 29 08:09:43 sapd[610]: <404089> |AP PR-A322-AP141@10.28.43.10 sapd| AM 00:24:6c:b6:ed:68: ARM HT Error Threshold Trigger Current Channel old 153-149 new 157-161/8 May 29 08:09:44 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:09:44 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:31, deauthenticating the station May 29 08:09:51 sapd[934]: <404098> |AP PR-B210-AP285@10.21.12.12 sapd| AM 00:24:6c:29:48:c8: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 153-149/7 May 29 08:09:52 sapd[610]: <404050> |AP PR-A110B-AP162@10.28.13.10 sapd| AM 00:24:6c:b6:e7:f8: ARM C 153 PER 0 MER 94 FRR 0 50-30 May 29 08:09:53 sapd[610]: <404089> |AP PR-A110B-AP162@10.28.13.10 sapd| AM 00:24:6c:b6:e7:f8: ARM HT Error Threshold Trigger Current Channel old 153-149 new 157-161/8 May 29 08:10:02 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 149-153/7 May 29 08:10:11 sapd[610]: <404050> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:28: ARM C 44 PER 0 MER 73 FRR 0 50-30 May 29 08:10:12 sapd[610]: <404089> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:28: ARM HT Error Threshold Trigger Current Channel old 44-48 new 40-36/6 May 29 08:10:23 sapd[610]: <404093> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b8: ARM HT Empty Channel Trigger new 44-48/0/0 old 157-161/7/2 new_rra 44-48/8 May 29 08:10:46 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station c8:f7:33:c5:f8:f5 00:24:6c:b6:fe:19 May 29 08:10:46 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station c8:f7:33:c5:f8:f5 00:24:6c:b6:fe:19 May 29 08:11:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:11:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:11:24 sapd[931]: <404050> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM C 6 PER 0 MER 20 FRR 88 50-30 May 29 08:11:25 sapd[931]: <404065> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:70: ARM Error Threshold Trigger Current Channel 6 new_rra 11/6 May 29 08:11:25 sapd[956]: <404074> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 08:12:02 sapd[610]: <404050> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:98: ARM C 44 PER 0 MER 63 FRR 0 50-30 May 29 08:12:03 sapd[610]: <404089> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:98: ARM HT Error Threshold Trigger Current Channel old 44-48 new 40-36/8 May 29 08:12:48 sapd[610]: <404097> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 36-40/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:12:54 sapd[610]: <404075> |AP PR-L227-AP208@10.26.28.120 sapd| AM 00:24:6c:b6:e9:d0: ARM - decreasing power cov-index 11/2 tx-power 8 new_rra 6/6 May 29 08:13:18 sapd[589]: <127000> |AP PR-CafeATM-AP29@10.21.11.136 sapd| |ids-ap| AP(00:1a:1e:63:c1:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:13:18 sapd[589]: <127000> |AP PR-CafeATM-AP29@10.21.11.136 sapd| |ids-ap| AP(00:1a:1e:63:c1:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:13:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:13:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:13:31 authmgr[1871]: <522027> |authmgr| MAC=30:85:a9:df:d0:6f IP=10.24.6.145 IP Spoof from MAC=70:11:24:c3:b1:fb role=authenticated/(null) May 29 08:13:58 sapd[610]: <404097> |AP PR-L108-AP234@10.26.17.121 sapd| AM 00:24:6c:20:51:58: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 153-149/8 May 29 08:14:19 sapd[610]: <404097> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 44-48/8 May 29 08:14:24 webui[1735]: USER: mikem has logged in from 199.212.60.107. May 29 08:14:27 sapd[587]: <127000> |AP PR-Cafe1-AP7@10.21.11.134 sapd| |ids-ap| AP(00:1a:1e:63:bf:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:14:27 sapd[587]: <127000> |AP PR-Cafe1-AP7@10.21.11.134 sapd| |ids-ap| AP(00:1a:1e:63:bf:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:14:48 sapd[931]: <404075> |AP PR-L120-AP255@10.26.18.120 sapd| AM 00:24:6c:20:58:b0: ARM - decreasing power cov-index 14/0 tx-power 8 new_rra 11/6 May 29 08:14:52 sapd[934]: <404098> |AP PR-B210-AP285@10.21.12.12 sapd| AM 00:24:6c:29:48:c8: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 153-149/6 May 29 08:15:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:15:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:15:28 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 08:15:40 sapd[610]: <404097> |AP PR-A315-AP139@10.28.37.11 sapd| AM 00:24:6c:b6:f6:d8: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 48-44/7 May 29 08:15:59 sapd[613]: <404085> |AP PR-L103-AP290@10.26.19.120 sapd| AM 00:24:6c:29:4a:68: ARM HT Channel Interference Trigger new 161-157/120 old 149/153-152 new_rra 161/157-8 TCI 10 May 29 08:16:00 authmgr[1871]: <522027> |authmgr| MAC=5c:da:d4:5f:af:15 IP=10.24.30.138 IP Spoof from MAC=48:60:bc:e5:11:97 role=authenticated/(null) May 29 08:16:00 sapd[610]: <404074> |AP PR-A110B-AP162@10.28.13.10 sapd| AM 00:24:6c:b6:e7:f0: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 08:16:08 sapd[610]: <404098> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:98: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 40-36/7 May 29 08:16:24 sapd[610]: <404085> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:78: ARM HT Channel Interference Trigger new 161-157/13 old 48/44-43 new_rra 161/157-8 TCI 10 May 29 08:16:44 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:5d:43:d5:86:2b 00:1a:1e:63:d2:41 May 29 08:16:44 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 68:5d:43:d5:86:2b 00:1a:1e:63:d2:41 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:16:51 sapd[610]: <404075> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - decreasing power cov-index 11/1 tx-power 8 new_rra 6/7 May 29 08:17:00 sapd[613]: <404098> |AP PR-L103-AP290@10.26.19.120 sapd| AM 00:24:6c:29:4a:68: ARM - HT decreasing power cov-index 14/1 tx-power 8 new_rra 161-157/6 May 29 08:17:10 sapd[610]: <404085> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b8: ARM HT Channel Interference Trigger new 161-157/20 old 44/48-70 new_rra 161/157-8 TCI 10 May 29 08:17:10 sapd[931]: <404085> |AP PR-A211D-AP196@10.28.67.124 sapd| AM 00:24:6c:20:3f:68: ARM HT Channel Interference Trigger new 44-48/122 old 36/40-150 new_rra 44/48-6 TCI 10 May 29 08:17:16 sapd[1641]: <404063> |AP PR-G111-AP294@10.28.88.121 sapd| AM 00:0b:86:77:3c:f0: ARM Channel Band Trigger new 1-2/1 old 0-0/0 new_rra 1/8 May 29 08:17:16 sapd[1641]: <404405> |AP PR-G111-AP294@10.28.88.121 sapd| AM 00:0b:86:77:3c:f0: Coverage hole: APM converting to AP on channel 1 coverage 2 8 May 29 08:17:17 KERNEL(PR-G111-AP294@10.28.88.121): vap aruba100 vlan is 0. discovering tunnel vlan May 29 08:17:18 KERNEL(PR-G111-AP294@10.28.88.121): vap aruba101 vlan is 0. discovering tunnel vlan May 29 08:17:18 KERNEL(PR-G111-AP294@10.28.88.121): vap aruba102 vlan is 0. discovering tunnel vlan May 29 08:17:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:17:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:18:33 sapd[610]: <404085> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM HT Channel Interference Trigger new 157-161/85 old 153/149-113 new_rra 157/161-8 TCI 10 May 29 08:19:08 sapd[589]: <404098> |AP PR-Cafe2-AP7@10.21.11.21 sapd| AM 00:1a:1e:63:c5:f0: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 44-48/6 May 29 08:19:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:f7:c9 doing 802.1x May 29 08:19:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:f7:c9 doing 802.1x May 29 08:19:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:19:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:19:51 sapd[610]: <404098> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:38: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 157-161/7 May 29 08:20:01 sapd[610]: <404097> |AP PR-A323-AP144@10.28.32.10 sapd| AM 00:24:6c:b6:ef:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 08:20:05 sapd[1002]: <404085> |AP PR-C104-AP66@10.21.21.21 sapd| AM 00:1a:1e:63:c9:90: ARM HT Channel Interference Trigger new 161-157/56 old 36/40-88 new_rra 161/157-6 TCI 10 May 29 08:20:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:20:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:34 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:34 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:34 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:34 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 78:92:9c:60:5a:7e 00:24:6c:b6:e9:e2 May 29 08:20:40 sapd[931]: <404074> |AP PR-L111A-AP240@10.26.19.121 sapd| AM 00:24:6c:20:50:70: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 11/8 May 29 08:20:45 sapd[2011]: <404050> |AP PR-DGYM-AP308@10.28.88.18 sapd| AM 00:0b:86:77:3d:08: ARM C 157 PER 0 MER 82 FRR 0 50-30 May 29 08:20:45 sapd[2192]: <404050> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:08: ARM C 161 PER 0 MER 78 FRR 0 50-30 May 29 08:20:46 sapd[2011]: <404089> |AP PR-DGYM-AP308@10.28.88.18 sapd| AM 00:0b:86:77:3d:08: ARM HT Error Threshold Trigger Current Channel old 157-161 new 36-40/8 May 29 08:20:46 sapd[2192]: <404089> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:08: ARM HT Error Threshold Trigger Current Channel old 161-157 new 36-40/8 May 29 08:20:58 sapd[600]: <404075> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 08:21:02 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:21:12 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.156 IP Spoof from MAC=00:1e:65:97:1c:a4 role=authenticated/(null) May 29 08:21:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:21:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:21:43 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.156 IP Spoof from MAC=00:1e:65:97:1c:a4 role=authenticated/(null) May 29 08:21:49 sapd[916]: <404097> |AP PR-A313-AP138@10.28.39.16 sapd| AM 00:24:6c:b6:e5:f8: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 36-40/7 May 29 08:22:48 sapd[610]: <404074> |AP PR-A110B-AP162@10.28.13.10 sapd| AM 00:24:6c:b6:e7:f0: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 6/8 May 29 08:22:50 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.156 IP Spoof from MAC=00:1e:65:97:1c:a4 role=authenticated/(null) May 29 08:23:02 sapd[956]: <127000> |AP PR-E314-49@10.21.33.137 sapd| |ids-ap| AP(00:1a:1e:63:d2:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 08:23:02 sapd[956]: <127000> |AP PR-E314-49@10.21.33.137 sapd| |ids-ap| AP(00:1a:1e:63:d2:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (10.21.33.5). May 29 08:23:10 sapd[1002]: <404097> |AP PR-C104-AP66@10.21.21.21 sapd| AM 00:1a:1e:63:c9:90: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 161-157/7 May 29 08:23:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:23:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:23:17 sapd[610]: <404097> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 44-48/8 May 29 08:23:47 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:23:50 sapd[610]: <404098> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:98: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 157-161/7 May 29 08:23:53 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.156 IP Spoof from MAC=00:1e:65:97:1c:a4 role=authenticated/(null) May 29 08:24:12 sapd[610]: <404098> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM - HT decreasing power cov-index 14/0 tx-power 8 new_rra 48-44/6 May 29 08:24:35 sapd[916]: <404097> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:78: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 44-48/7 May 29 08:24:37 sapd[934]: <404085> |AP PR-A215-AP288@10.28.67.123 sapd| AM 00:24:6c:29:4a:18: ARM HT Channel Interference Trigger new 153-149/137 old 157/161-168 new_rra 153/149-6 TCI 10 May 29 08:24:53 sapd[934]: <404097> |AP PR-A215-AP288@10.28.67.123 sapd| AM 00:24:6c:29:4a:18: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 153-149/7 May 29 08:25:02 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.156 IP Spoof from MAC=00:1e:65:97:1c:a4 role=authenticated/(null) May 29 08:25:09 sapd[934]: <404097> |AP PR-B210-AP285@10.21.12.12 sapd| AM 00:24:6c:29:48:c8: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 153-149/7 May 29 08:25:20 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:25:20 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:25:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:24:d7:8b:13:14 00:24:6c:b6:f4:8a May 29 08:25:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:24:d7:8b:13:14 00:24:6c:b6:f4:8a May 29 08:25:33 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:13:14 00:24:6c:b6:f3:39 doing 802.1x May 29 08:25:33 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:13:14 00:24:6c:b6:f3:39 doing 802.1x May 29 08:25:33 sapd[2192]: <404098> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:08: ARM - HT decreasing power cov-index 16/0 tx-power 8 new_rra 36-40/6 May 29 08:25:43 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:24:d7:8b:13:14 00:24:6c:b6:f4:8a May 29 08:25:43 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:24:d7:8b:13:14 00:24:6c:b6:f4:8a May 29 08:25:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:13:14 00:24:6c:b6:f4:89 doing 802.1x May 29 08:25:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:13:14 00:24:6c:b6:f4:89 doing 802.1x May 29 08:25:46 sapd[589]: <404098> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 149-153/6 May 29 08:26:02 sapd[2011]: <404085> |AP PR-DGYM-AP308@10.28.88.18 sapd| AM 00:0b:86:77:3d:08: ARM HT Channel Interference Trigger new 161-157/39 old 36/40-131 new_rra 161/157-8 TCI 10 May 29 08:26:31 sapd[1643]: <404075> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - decreasing power cov-index 11/2 tx-power 8 new_rra 6/6 May 29 08:26:34 sapd[610]: <404098> |AP PR-L111-AP243@10.26.19.122 sapd| AM 00:24:6c:20:48:08: ARM - HT decreasing power cov-index 12/1 tx-power 8 new_rra 161-157/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:26:40 sapd[603]: <404097> |AP PR-C306ab-AP35@10.21.23.39 sapd| AM 00:1a:1e:63:97:70: ARM - HT increasing power cov-index 6/2 tx-power 6 new_rra 36-40/7 May 29 08:27:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:27:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:27:34 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:27:42 sapd[604]: <404074> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 08:27:52 sapd[589]: <404097> |AP PR-Cafe2-AP7@10.21.11.21 sapd| AM 00:1a:1e:63:c5:f0: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 44-48/7 May 29 08:28:35 sapd[610]: <404098> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a8: ARM - HT decreasing power cov-index 8/4 tx-power 8 new_rra 40-36/7 May 29 08:28:55 sapd[610]: <404097> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 48-44/7 May 29 08:28:59 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:28:59 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:29:00 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:00 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:00 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:00 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:01 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:01 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:01 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:01 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:01 sapd[956]: <404074> |AP PR-D318-AP39@10.21.33.16 sapd| AM 00:1a:1e:61:99:00: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 08:29:02 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:02 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:02 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:02 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:4b:f5:12:22:e0 00:24:6c:20:55:52 May 29 08:29:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:29:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:29:42 sapd[587]: <404097> |AP PR-Cafe1-AP7@10.21.11.134 sapd| AM 00:1a:1e:63:bf:b0: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 36-40/7 May 29 08:29:46 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station b0:79:94:2e:8d:54 00:1a:1e:63:ca:21 doing 802.1x May 29 08:29:46 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station b0:79:94:2e:8d:54 00:1a:1e:63:ca:21 doing 802.1x May 29 08:29:46 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 1302370500654182@wlan.mnc370.mcc302.3gppnetwork.org b0:79:94:2e:8d:54 from server msradius01. May 29 08:29:46 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 1302370500654182@wlan.mnc370.mcc302.3gppnetwork.org b0:79:94:2e:8d:54 from server msradius01. May 29 08:30:06 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:30:06 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:30:09 sapd[605]: <404098> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:b0: ARM - HT decreasing power cov-index 13/0 tx-power 7 new_rra 157-161/6 May 29 08:30:17 sapd[610]: <404074> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 08:31:03 sapd[934]: <404097> |AP PR-A215-AP288@10.28.67.123 sapd| AM 00:24:6c:29:4a:18: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 153-149/8 May 29 08:31:09 sapd[600]: <404074> |AP PR-C306A-AP23@10.21.180.19 sapd| AM 00:1a:1e:61:69:a0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 08:31:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:31:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:31:17 sapd[934]: <404097> |AP PR-B210-AP285@10.21.12.12 sapd| AM 00:24:6c:29:48:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 153-149/8 May 29 08:31:21 sapd[610]: <404098> |AP PR-A317-AP140@10.28.37.120 sapd| AM 00:24:6c:b6:f5:48: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 08:31:21 sapd[916]: <404097> |AP PR-A310-AP142@10.28.39.13 sapd| AM 00:24:6c:b6:ed:78: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 44-48/8 May 29 08:31:34 sapd[2192]: <404085> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:08: ARM HT Channel Interference Trigger new 161-157/54 old 36/40-111 new_rra 161/157-6 TCI 10 May 29 08:32:13 sapd[931]: <404098> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:78: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 44-48/7 May 29 08:32:18 sapd[610]: <404085> |AP PR-A322-AP141@10.28.43.10 sapd| AM 00:24:6c:b6:ed:68: ARM HT Channel Interference Trigger new 153-149/64 old 157/161-118 new_rra 153/149-8 TCI 10 May 29 08:32:21 sapd[610]: <404097> |AP PR-A117-AP161@10.28.10.11 sapd| AM 00:24:6c:b6:e8:98: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 40-36/8 May 29 08:32:37 sapd[1643]: <404074> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 08:32:37 sapd[610]: <404098> |AP PR-A322-AP141@10.28.43.10 sapd| AM 00:24:6c:b6:ed:68: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 153-149/7 May 29 08:32:40 sapd[604]: <404075> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:32:58 sapd[916]: <404097> |AP PR-L302-AP226@10.26.32.122 sapd| AM 00:24:6c:20:3d:38: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 44-48/7 May 29 08:33:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:33:14 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:33:49 sapd[916]: <404097> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 161-157/7 May 29 08:34:02 sapd[610]: <404097> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 08:34:05 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 08:34:07 sapd[610]: <404074> |AP PR-A121-AP163@10.28.10.120 sapd| AM 00:24:6c:b6:e7:a0: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 1/8 May 29 08:34:18 authmgr[1871]: <522027> |authmgr| MAC=a8:6a:6f:f6:25:9c IP=10.24.22.48 IP Spoof from MAC=a4:17:31:aa:03:89 role=authenticated/(null) May 29 08:34:26 authmgr[1871]: <522027> |authmgr| MAC=a0:0b:ba:21:ac:db IP=10.24.30.59 IP Spoof from MAC=38:59:f9:19:a0:6e role=authenticated/(null) May 29 08:34:38 sapd[916]: <404098> |AP PR-A361-AP153@10.28.40.36 sapd| AM 00:24:6c:b6:f3:a8: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 48-44/6 May 29 08:35:03 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f1 doing 802.1x May 29 08:35:03 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f1 doing 802.1x May 29 08:35:03 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300658562 84:a6:c8:89:92:34 from server msradius01. May 29 08:35:03 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300658562 84:a6:c8:89:92:34 from server msradius01. May 29 08:35:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:35:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:35:23 sapd[956]: <404075> |AP PR-D318-AP39@10.21.33.16 sapd| AM 00:1a:1e:61:99:00: ARM - decreasing power cov-index 10/4 tx-power 7 new_rra 11/6 May 29 08:35:31 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:31 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:31 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:31 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:35:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:35:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 84:a6:c8:89:92:34 00:24:6c:20:4f:f2 May 29 08:36:39 sapd[610]: <404098> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 36-40/7 May 29 08:37:12 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:37:12 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:37:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:37:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:37:19 sapd[610]: <404085> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:88: ARM HT Channel Interference Trigger new 149-153/152 old 36/40-180 new_rra 149/153-6 TCI 10 May 29 08:37:41 sapd[610]: <404098> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:98: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 157-161/6 May 29 08:37:59 sapd[610]: <404098> |AP PR-A110B-AP162@10.28.13.10 sapd| AM 00:24:6c:b6:e7:f8: ARM - HT decreasing power cov-index 11/2 tx-power 8 new_rra 157-161/6 May 29 08:38:49 authmgr[1871]: <522027> |authmgr| MAC=70:73:cb:30:c0:9f IP=10.24.30.134 IP Spoof from MAC=20:68:9d:f8:82:d8 role=authenticated/(null) May 29 08:38:56 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:56 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:56 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:56 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:57 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:57 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:57 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:57 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:57 sapd[610]: <404074> |AP PR-L227-AP208@10.26.28.120 sapd| AM 00:24:6c:b6:e9:d0: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 08:38:57 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:38:57 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:38:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 20:68:9d:f8:82:d8 00:1a:1e:63:d8:82 May 29 08:38:59 sapd[931]: <404097> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:78: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 44-48/8 May 29 08:39:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:39:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:39:22 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:f7:c9 doing 802.1x May 29 08:39:22 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:f7:c9 doing 802.1x May 29 08:39:26 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station a0:f4:50:53:ed:61 00:1a:1e:90:7f:e1 doing 802.1x May 29 08:39:26 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station a0:f4:50:53:ed:61 00:1a:1e:90:7f:e1 doing 802.1x May 29 08:39:26 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300731710 a0:f4:50:53:ed:61 00:1a:1e:90:7f:e1, deauthenticating the station May 29 08:39:26 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300731710 a0:f4:50:53:ed:61 00:1a:1e:90:7f:e1, deauthenticating the station May 29 08:39:26 sapd[604]: <404074> |AP PR-IWC43-AP16@10.21.43.10 sapd| AM 00:1a:1e:63:c0:a0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 08:39:35 sapd[610]: <404093> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b8: ARM HT Empty Channel Trigger new 157-161/0/0 old 161-157/0/5 new_rra 157-161/8 May 29 08:39:45 sapd[934]: <404098> |AP PR-A215-AP288@10.28.67.123 sapd| AM 00:24:6c:29:4a:18: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 153-149/7 May 29 08:39:48 authmgr[1871]: <522027> |authmgr| MAC=a0:6c:ec:8b:91:9c IP=10.24.26.48 IP Spoof from MAC=40:6f:2a:74:ba:b5 role=authenticated/(null) May 29 08:40:00 sapd[610]: <404097> |AP PR-A212A-AP195@10.28.67.121 sapd| AM 00:24:6c:20:3e:88: ARM - HT increasing power cov-index 6/2 tx-power 6 new_rra 36-40/7 May 29 08:40:07 sapd[916]: <404097> |AP PR-A313-AP138@10.28.39.16 sapd| AM 00:24:6c:b6:e5:f8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 36-40/8 May 29 08:40:20 authmgr[1871]: <522027> |authmgr| MAC=a0:6c:ec:8b:91:9c IP=10.24.26.48 IP Spoof from MAC=40:6f:2a:74:ba:b5 role=authenticated/(null) May 29 08:40:39 sapd[956]: <404085> |AP PR-C201-AP45@10.21.20.150 sapd| AM 00:1a:1e:63:d6:f0: ARM HT Channel Interference Trigger new 161-157/21 old 40/36-67 new_rra 161/157-7 TCI 10 May 29 08:41:11 sapd[931]: <404074> |AP PR-L120-AP255@10.26.18.120 sapd| AM 00:24:6c:20:58:b0: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 11/7 May 29 08:41:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:41:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:41:31 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:31 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:31 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:31 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 48:5d:60:eb:7c:d6 00:1a:1e:63:c5:a2 May 29 08:41:40 sapd[916]: <404097> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 08:41:49 authmgr[1871]: <522027> |authmgr| MAC=a0:6c:ec:8b:91:9c IP=10.24.26.48 IP Spoof from MAC=40:6f:2a:74:ba:b5 role=authenticated/(null) May 29 08:42:03 sapd[610]: <404098> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 08:42:42 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:42:57 sapd[610]: <404097> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 36-40/7 May 29 08:43:04 sapd[613]: <404085> |AP PR-L103-AP290@10.26.19.120 sapd| AM 00:24:6c:29:4a:68: ARM HT Channel Interference Trigger new 149-153/99 old 161/157-159 new_rra 149/153-6 TCI 10 May 29 08:43:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:43:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:44:02 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:44:02 sapd[589]: <127000> |AP PR-C209-AP54@10.21.12.14 sapd| |ids-ap| AP(00:1a:1e:63:d0:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:44:22 sapd[2043]: <404085> |AP PR-DGYM-AP307@10.28.89.12 sapd| AM 00:0b:86:77:2f:48: ARM HT Channel Interference Trigger new 161-157/74 old 149/153-102 new_rra 161/157-6 TCI 10 May 29 08:44:24 sapd[610]: <404097> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:38: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 157-161/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:44:25 sapd[610]: <404050> |AP PR-A183-AP171@10.28.3.10 sapd| AM 00:24:6c:b6:fe:40: ARM C 1 PER 0 MER 2 FRR 65 50-30 May 29 08:44:25 sapd[610]: <404050> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d0: ARM C 1 PER 0 MER 6 FRR 69 50-30 May 29 08:44:26 sapd[610]: <404065> |AP PR-A183-AP171@10.28.3.10 sapd| AM 00:24:6c:b6:fe:40: ARM Error Threshold Trigger Current Channel 1 new_rra 11/6 May 29 08:44:26 sapd[610]: <404065> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d0: ARM Error Threshold Trigger Current Channel 1 new_rra 11/6 May 29 08:44:34 sapd[610]: <404085> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:28: ARM HT Channel Interference Trigger new 161-157/125 old 40/36-164 new_rra 161/157-6 TCI 10 May 29 08:44:37 sapd[610]: <404098> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT decreasing power cov-index 14/0 tx-power 8 new_rra 157-161/6 May 29 08:44:39 sapd[610]: <404050> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM C 44 PER 0 MER 70 FRR 0 50-30 May 29 08:44:40 sapd[610]: <404089> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM HT Error Threshold Trigger Current Channel old 44-48 new 40-36/8 May 29 08:44:44 sapd[610]: <404050> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM C 48 PER 0 MER 75 FRR 0 50-30 May 29 08:44:45 sapd[610]: <404089> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM HT Error Threshold Trigger Current Channel old 48-44 new 36-40/8 May 29 08:44:48 sapd[916]: <404050> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM C 48 PER 0 MER 68 FRR 0 50-30 May 29 08:44:49 sapd[916]: <404089> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM HT Error Threshold Trigger Current Channel old 48-44 new 36-40/7 May 29 08:45:11 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:1d:18 00:24:6c:20:3e:89 doing 802.1x May 29 08:45:11 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:1d:18 00:24:6c:20:3e:89 doing 802.1x May 29 08:45:12 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1f:6a:fc 00:1a:1e:63:c9:71 doing 802.1x May 29 08:45:12 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1f:6a:fc 00:1a:1e:63:c9:71 doing 802.1x May 29 08:45:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:45:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:45:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 68:5d:43:e4:27:58 00:24:6c:20:4f:f1 doing 802.1x May 29 08:45:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 68:5d:43:e4:27:58 00:24:6c:20:4f:f1 doing 802.1x May 29 08:45:17 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300702587 68:5d:43:e4:27:58 from server msradius01. May 29 08:45:17 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300702587 68:5d:43:e4:27:58 from server msradius01. May 29 08:45:25 authmgr[1871]: <522027> |authmgr| MAC=78:d6:f0:48:22:95 IP=10.24.18.3 IP Spoof from MAC=00:26:4a:2c:89:f8 role=authenticated/(null) May 29 08:45:25 sapd[605]: <404097> |AP PR-A148-AP326@10.28.64.122 sapd| AM 00:1a:1e:90:74:70: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 May 29 08:45:29 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1f:6a:fc 00:1a:1e:63:c9:71 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:45:29 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1f:6a:fc 00:1a:1e:63:c9:71 doing 802.1x May 29 08:45:34 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:1d:18 00:24:6c:20:3e:89 doing 802.1x May 29 08:45:34 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:24:d7:8b:1d:18 00:24:6c:20:3e:89 doing 802.1x May 29 08:45:46 sapd[610]: <404050> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM C 48 PER 0 MER 80 FRR 0 50-30 May 29 08:45:47 sapd[610]: <404089> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM HT Error Threshold Trigger Current Channel old 48-44 new 40-36/8 May 29 08:45:53 sapd[605]: <404097> |AP PR-A144-AP328@10.28.64.124 sapd| AM 00:1a:1e:97:de:b0: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 157-161/7 May 29 08:45:59 sapd[610]: <404098> |AP PR-A317-AP140@10.28.37.120 sapd| AM 00:24:6c:b6:f5:48: ARM - HT decreasing power cov-index 10/2 tx-power 7 new_rra 149-153/6 May 29 08:46:13 sapd[610]: <404074> |AP PR-L227-AP208@10.26.28.120 sapd| AM 00:24:6c:b6:e9:d0: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 6/8 May 29 08:46:35 sapd[931]: <404074> |AP PR-L120-AP255@10.26.18.120 sapd| AM 00:24:6c:20:58:b0: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 11/8 May 29 08:47:09 sapd[916]: <404050> |AP PR-L115-AP242@10.26.30.123 sapd| AM 00:24:6c:20:55:e8: ARM C 44 PER 0 MER 57 FRR 0 50-30 May 29 08:47:09 sapd[916]: <404050> |AP PR-L302-AP226@10.26.32.122 sapd| AM 00:24:6c:20:3d:38: ARM C 44 PER 0 MER 69 FRR 0 50-30 May 29 08:47:10 sapd[916]: <404089> |AP PR-L115-AP242@10.26.30.123 sapd| AM 00:24:6c:20:55:e8: ARM HT Error Threshold Trigger Current Channel old 44-48 new 149-153/6 May 29 08:47:10 sapd[916]: <404089> |AP PR-L302-AP226@10.26.32.122 sapd| AM 00:24:6c:20:3d:38: ARM HT Error Threshold Trigger Current Channel old 44-48 new 36-40/7 May 29 08:47:11 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1f:6a:fc 00:1a:1e:63:c9:71 doing 802.1x May 29 08:47:11 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1f:6a:fc 00:1a:1e:63:c9:71 doing 802.1x May 29 08:47:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:7f:f0:7b 00:24:6c:b6:ef:29 doing 802.1x May 29 08:47:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:7f:f0:7b 00:24:6c:b6:ef:29 doing 802.1x May 29 08:47:17 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1c:24:0c 00:24:6c:20:3e:8a May 29 08:47:17 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1c:24:0c 00:24:6c:20:3e:8a May 29 08:47:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:24:0c 00:24:6c:29:4a:19 doing 802.1x May 29 08:47:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:24:0c 00:24:6c:29:4a:19 doing 802.1x May 29 08:47:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:47:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:47:52 sapd[610]: <404050> |AP PR-A121-AP163@10.28.10.120 sapd| AM 00:24:6c:b6:e7:a0: ARM C 1 PER 0 MER 11 FRR 73 50-30 May 29 08:47:53 sapd[610]: <404065> |AP PR-A121-AP163@10.28.10.120 sapd| AM 00:24:6c:b6:e7:a0: ARM Error Threshold Trigger Current Channel 1 new_rra 11/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:48:33 sapd[610]: <404050> |AP PR-L127-AP249@10.26.29.11 sapd| AM 00:24:6c:20:46:28: ARM C 48 PER 0 MER 68 FRR 0 50-30 May 29 08:48:33 sapd[916]: <404097> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 36-40/8 May 29 08:48:34 sapd[610]: <404089> |AP PR-L127-AP249@10.26.29.11 sapd| AM 00:24:6c:20:46:28: ARM HT Error Threshold Trigger Current Channel old 48-44 new 161-157/8 May 29 08:48:46 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 08:48:50 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 08:49:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:49:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:49:23 sapd[633]: <127000> |AP PR-E324-AP64@10.20.215.10 sapd| |ids-ap| AP(00:1a:1e:63:cb:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:49:23 sapd[633]: <127000> |AP PR-E324-AP64@10.20.215.10 sapd| |ids-ap| AP(00:1a:1e:63:cb:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:49:33 sapd[610]: <404098> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:38: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 157-161/7 May 29 08:49:43 sapd[610]: <404098> |AP PR-A234-AP178@10.28.21.138 sapd| AM 00:24:6c:b6:fd:c8: ARM - HT decreasing power cov-index 13/0 tx-power 8 new_rra 153-149/6 May 29 08:49:47 sapd[931]: <404098> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:28: ARM - HT decreasing power cov-index 13/3 tx-power 8 new_rra 36-40/6 May 29 08:50:27 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1c:15:ac 00:1a:1e:63:c9:72 May 29 08:50:27 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1c:15:ac 00:1a:1e:63:c9:72 May 29 08:50:27 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:15:ac 00:1a:1e:63:c9:71 doing 802.1x May 29 08:50:27 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:15:ac 00:1a:1e:63:c9:71 doing 802.1x May 29 08:50:36 sapd[610]: <404097> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:98: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 157-161/7 May 29 08:50:40 authmgr[1871]: <522027> |authmgr| MAC=5c:0a:5b:c7:80:4e IP=10.24.6.3 IP Spoof from MAC=34:15:9e:bb:be:ae role=authenticated/(null) May 29 08:50:51 sapd[931]: <404098> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:78: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 44-48/7 May 29 08:51:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:51:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:51:20 sapd[931]: <404085> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:28: ARM HT Channel Interference Trigger new 161-157/35 old 36/40-64 new_rra 161/157-6 TCI 10 May 29 08:51:21 sapd[1305]: <404097> |AP PR-DGYM-ap309@10.28.88.21 sapd| AM 00:0b:86:77:3a:48: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:51:22 sapd[610]: <404085> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM HT Channel Interference Trigger new 44-48/35 old 36/40-98 new_rra 44/48-8 TCI 10 May 29 08:51:37 sapd[610]: <404097> |AP PR-A212A-AP195@10.28.67.121 sapd| AM 00:24:6c:20:3e:88: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 36-40/8 May 29 08:51:45 sapd[610]: <404075> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - decreasing power cov-index 11/1 tx-power 8 new_rra 6/7 May 29 08:51:57 sapd[2011]: <404098> |AP PR-DGYM-AP308@10.28.88.18 sapd| AM 00:0b:86:77:3d:08: ARM - HT decreasing power cov-index 16/0 tx-power 8 new_rra 161-157/6 May 29 08:52:08 sapd[931]: <404075> |AP PR-L111A-AP240@10.26.19.121 sapd| AM 00:24:6c:20:50:70: ARM - decreasing power cov-index 12/0 tx-power 8 new_rra 11/7 May 29 08:52:09 sapd[610]: <404050> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM C 44 PER 0 MER 74 FRR 0 50-30 May 29 08:52:10 sapd[610]: <404089> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM HT Error Threshold Trigger Current Channel old 44-48 new 40-36/8 May 29 08:52:12 authmgr[1871]: <522027> |authmgr| MAC=04:46:65:8f:31:0b IP=10.24.22.3 IP Spoof from MAC=d8:30:62:bc:1d:99 role=authenticated/(null) May 29 08:52:27 authmgr[1871]: <522027> |authmgr| MAC=d8:30:62:bc:1d:99 IP=10.24.22.7 IP Spoof from MAC=00:24:36:e7:ec:cb role=authenticated/(null) May 29 08:52:52 sapd[610]: <404075> |AP PR-A121-AP163@10.28.10.120 sapd| AM 00:24:6c:b6:e7:a0: ARM - decreasing power cov-index 16/0 tx-power 8 new_rra 11/6 May 29 08:53:03 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:03 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:03 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:03 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:04 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:04 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:04 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:04 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:05 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:05 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:05 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:05 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:56:72 May 29 08:53:06 sapd[610]: <404085> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM HT Channel Interference Trigger new 48-44/37 old 40/36-99 new_rra 48/44-8 TCI 10 May 29 08:53:08 authmgr[1871]: <522027> |authmgr| MAC=e8:99:c4:a5:ff:5a IP=10.24.10.64 IP Spoof from MAC=ac:3c:0b:ec:80:52 role=authenticated/(null) May 29 08:53:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:53:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:53:19 sapd[610]: <404050> |AP PR-L207-AP212@10.26.30.122 sapd| AM 00:24:6c:20:55:58: ARM C 48 PER 0 MER 68 FRR 0 50-30 May 29 08:53:20 sapd[610]: <404089> |AP PR-L207-AP212@10.26.30.122 sapd| AM 00:24:6c:20:55:58: ARM HT Error Threshold Trigger Current Channel old 48-44 new 161-157/8 May 29 08:53:31 authmgr[1871]: <522027> |authmgr| MAC=d8:30:62:bc:1d:99 IP=10.24.22.7 IP Spoof from MAC=00:24:36:e7:ec:cb role=authenticated/(null) May 29 08:53:37 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:4a:58:48 00:1a:1e:63:cf:01 doing 802.1x May 29 08:53:37 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:4a:58:48 00:1a:1e:63:cf:01 doing 802.1x May 29 08:53:43 sapd[1711]: <127000> |AP PR-E220-AP58@10.21.32.159 sapd| |ids-ap| AP(00:1a:1e:63:d0:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:53:43 sapd[1711]: <127000> |AP PR-E220-AP58@10.21.32.159 sapd| |ids-ap| AP(00:1a:1e:63:d0:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 08:53:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:53:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:54:06 sapd[931]: <404097> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:28: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 161-157/7 May 29 08:54:29 sapd[610]: <404050> |AP PR-L222-AP209@10.26.27.120 sapd| AM 00:24:6c:b6:ea:20: ARM C 11 PER 0 MER 14 FRR 71 50-30 May 29 08:54:30 sapd[610]: <404050> |AP PR-L117-AP237@10.26.18.122 sapd| AM 00:24:6c:20:4e:78: ARM C 153 PER 0 MER 78 FRR 0 50-30 May 29 08:54:30 sapd[610]: <404065> |AP PR-L222-AP209@10.26.27.120 sapd| AM 00:24:6c:b6:ea:20: ARM Error Threshold Trigger Current Channel 11 new_rra 1/8 May 29 08:54:31 sapd[610]: <404089> |AP PR-L117-AP237@10.26.18.122 sapd| AM 00:24:6c:20:4e:78: ARM HT Error Threshold Trigger Current Channel old 153-149 new 48-44/8 May 29 08:54:31 sapd[916]: <404050> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM C 149 PER 0 MER 73 FRR 0 50-30 May 29 08:54:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:32 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:54:32 sapd[600]: <127000> |AP PR-C306A-AP23@10.21.180.19 sapd| |ids-ap| AP(00:1a:1e:61:69:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 08:54:32 sapd[916]: <404089> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM HT Error Threshold Trigger Current Channel old 149-153 new 48-44/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:54:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:34 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:34 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:34 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:34 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 74:f0:6d:94:87:5d 00:1a:1e:63:c0:42 May 29 08:54:40 sapd[610]: <404050> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM C 157 PER 0 MER 77 FRR 0 50-30 May 29 08:54:41 sapd[610]: <404089> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM HT Error Threshold Trigger Current Channel old 157-161 new 44-48/6 May 29 08:55:02 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:55:02 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:55:02 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/n/a May 29 08:55:12 sapd[610]: <404050> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM C 44 PER 0 MER 71 FRR 0 50-30 May 29 08:55:13 sapd[610]: <404089> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM HT Error Threshold Trigger Current Channel old 44-48 new 161-157/6 May 29 08:55:23 sapd[610]: <404085> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:28: ARM HT Channel Interference Trigger new 48-44/126 old 161/157-158 new_rra 48/44-6 TCI 10 May 29 08:55:24 sapd[610]: <404075> |AP PR-L222-AP209@10.26.27.120 sapd| AM 00:24:6c:b6:ea:20: ARM - decreasing power cov-index 20/2 tx-power 8 new_rra 1/6 May 29 08:55:26 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:55:26 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:55:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:55:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:55:56 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:56 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:56 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:56 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:55:57 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:57 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:57 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:57 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:55:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 00:0b:6b:03:59:1e 00:24:6c:20:48:92 May 29 08:56:38 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:56:38 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:57:04 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 08:57:12 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 08:57:20 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:57:20 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:0b:6b:03:59:1e 00:24:6c:20:48:91 doing 802.1x May 29 08:57:22 authmgr[1871]: <522027> |authmgr| MAC=a0:f4:50:94:28:b1 IP=10.24.18.20 IP Spoof from MAC=04:f7:e4:99:24:c3 role=authenticated/(null) May 29 08:57:23 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 08:57:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:57:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 08:57:35 sapd[604]: <404098> |AP PR-C211-AP27@10.21.12.19 sapd| AM 00:1a:1e:63:c2:d0: ARM - HT decreasing power cov-index 13/0 tx-power 7 new_rra 149-153/6 May 29 08:57:40 sapd[916]: <404098> |AP PR-L208A-AP214@10.26.24.12 sapd| AM 00:24:6c:20:52:98: ARM - HT decreasing power cov-index 12/2 tx-power 8 new_rra 161-157/6 May 29 08:57:41 sapd[610]: <404097> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:28: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 48-44/7 May 29 08:57:45 sapd[1643]: <404074> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 08:57:52 sapd[1305]: <404097> |AP PR-DGYM-ap309@10.28.88.21 sapd| AM 00:0b:86:77:3a:48: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 149-153/8 May 29 08:58:33 sapd[610]: <404074> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:70: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 1/8 May 29 08:58:34 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:0b:6b:03:59:1e 00:24:6c:20:48:91, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 08:58:34 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:0b:6b:03:59:1e 00:24:6c:20:48:91, deauthenticating the station May 29 08:58:35 sapd[931]: <404098> |AP PR-A185-AP172@10.28.4.10 sapd| AM 00:24:6c:b6:fe:88: ARM - HT decreasing power cov-index 13/0 tx-power 8 new_rra 157-161/6 May 29 08:58:58 authmgr[1871]: <522027> |authmgr| MAC=5c:95:ae:a6:65:6e IP=10.24.22.6 IP Spoof from MAC=0c:77:1a:54:2c:23 role=authenticated/(null) May 29 08:59:07 sapd[610]: <404085> |AP PR-L127-AP249@10.26.29.11 sapd| AM 00:24:6c:20:46:28: ARM HT Channel Interference Trigger new 40-36/85 old 161/157-123 new_rra 40/36-8 TCI 10 May 29 08:59:09 authmgr[1871]: <522027> |authmgr| MAC=5c:0a:5b:a5:d6:7d IP=10.24.2.34 IP Spoof from MAC=64:b9:e8:f2:f8:64 role=authenticated/(null) May 29 08:59:17 sapd[931]: <404075> |AP PR-L111A-AP240@10.26.19.121 sapd| AM 00:24:6c:20:50:70: ARM - decreasing power cov-index 14/0 tx-power 7 new_rra 11/6 May 29 08:59:18 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:84:12:dc 00:1a:1e:63:cf:72 May 29 08:59:18 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:84:12:dc 00:1a:1e:63:cf:72 May 29 08:59:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:12:dc 00:1a:1e:63:cf:71 doing 802.1x May 29 08:59:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:84:12:dc 00:1a:1e:63:cf:71 doing 802.1x May 29 08:59:23 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:23:15:51:be:64 00:1a:1e:63:c3:91 doing 802.1x May 29 08:59:23 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:23:15:51:be:64 00:1a:1e:63:c3:91 doing 802.1x May 29 08:59:23 sapd[931]: <404097> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:28: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 08:59:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:59:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:96:81, deauthenticating the station May 29 08:59:26 sapd[610]: <404075> |AP PR-A110B-AP162@10.28.13.10 sapd| AM 00:24:6c:b6:e7:f0: ARM - decreasing power cov-index 8/4 tx-power 8 new_rra 6/7 May 29 08:59:31 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:f7:c9 doing 802.1x May 29 08:59:31 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:1a:40 00:24:6c:b6:f7:c9 doing 802.1x May 29 08:59:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:23:15:51:be:64 00:1a:1e:63:c3:91 doing 802.1x May 29 08:59:44 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 00:23:15:51:be:64 00:1a:1e:63:c3:91 doing 802.1x May 29 08:59:54 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:7f:f0:7b 00:24:6c:20:57:29 doing 802.1x May 29 08:59:54 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:7f:f0:7b 00:24:6c:20:57:29 doing 802.1x May 29 09:00:23 sapd[610]: <404050> |AP PR-A187-AP174@10.28.5.120 sapd| AM 00:24:6c:b6:fe:08: ARM C 149 PER 0 MER 64 FRR 0 50-30 May 29 09:00:24 sapd[610]: <404089> |AP PR-A187-AP174@10.28.5.120 sapd| AM 00:24:6c:b6:fe:08: ARM HT Error Threshold Trigger Current Channel old 149-153 new 44-48/8 May 29 09:00:26 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 11/1 tx-power 8 new_rra 6/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:00:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:35 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:35 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:36 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:36 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:37 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:37 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 88:53:2e:8a:37:d4 00:24:6c:b6:e7:62 May 29 09:00:46 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:00:46 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:00:59 sapd[610]: <404097> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:98: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 157-161/8 May 29 09:01:05 sapd[610]: <404085> |AP PR-L222-AP209@10.26.27.120 sapd| AM 00:24:6c:b6:ea:28: ARM HT Channel Interference Trigger new 48-44/56 old 161/157-100 new_rra 48/44-8 TCI 10 May 29 09:01:10 sapd[916]: <404098> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT decreasing power cov-index 13/1 tx-power 8 new_rra 48-44/6 May 29 09:01:12 sapd[1341]: <127000> |AP PR-P107-AP40@10.21.31.12 sapd| |ids-ap| AP(00:1a:1e:63:91:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:01:12 sapd[1341]: <127000> |AP PR-P107-AP40@10.21.31.12 sapd| |ids-ap| AP(00:1a:1e:63:91:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:01:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:01:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:01:31 sapd[931]: <404074> |AP PR-L409-AP230@10.26.41.10 sapd| AM 00:24:6c:20:4f:f0: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 09:01:48 sapd[610]: <404075> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:60: ARM - decreasing power cov-index 8/4 tx-power 8 new_rra 11/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:01:52 sapd[610]: <404085> |AP PR-L406-AP254@10.26.40.120 sapd| AM 00:24:6c:20:59:38: ARM HT Channel Interference Trigger new 44-48/26 old 40/36-82 new_rra 44/48-8 TCI 10 May 29 09:01:55 sapd[610]: <404098> |AP PR-A187-AP174@10.28.5.120 sapd| AM 00:24:6c:b6:fe:08: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 44-48/7 May 29 09:02:03 sapd[610]: <404098> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:58: ARM - HT decreasing power cov-index 11/4 tx-power 8 new_rra 149-153/6 May 29 09:02:07 sapd[603]: <404075> |AP PR-D122-AP65@10.21.21.37 sapd| AM 00:1a:1e:63:cb:60: ARM - decreasing power cov-index 10/4 tx-power 7 new_rra 11/6 May 29 09:02:11 sapd[633]: <127000> |AP PR-E324-AP64@10.20.215.10 sapd| |ids-ap| AP(00:1a:1e:63:cb:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:02:11 sapd[633]: <127000> |AP PR-E324-AP64@10.20.215.10 sapd| |ids-ap| AP(00:1a:1e:63:cb:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:02:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:0b:6b:03:59:1e 00:24:6c:20:48:91, deauthenticating the station May 29 09:02:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:0b:6b:03:59:1e 00:24:6c:20:48:91, deauthenticating the station May 29 09:03:15 sapd[610]: <404097> |AP PR-A227-AP197@10.28.67.122 sapd| AM 00:24:6c:20:3b:28: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 09:03:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:03:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:03:19 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 09:03:20 sapd[934]: <404098> |AP PR-A215-AP288@10.28.67.123 sapd| AM 00:24:6c:29:4a:18: ARM - HT decreasing power cov-index 16/0 tx-power 7 new_rra 153-149/6 May 29 09:03:24 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:04:55 sapd[610]: <404097> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 09:05:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:05:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:06:14 sapd[610]: <404097> |AP PR-A180A-AP173@10.28.7.12 sapd| AM 00:24:6c:b6:f4:d8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 36-40/8 May 29 09:06:20 authmgr[1871]: <522027> |authmgr| MAC=6c:83:36:47:eb:6e IP=10.24.2.123 IP Spoof from MAC=38:59:f9:19:9e:0c role=authenticated/(null) May 29 09:06:44 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:06:44 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:06:44 sapd[931]: <404074> |AP PR-L409-AP230@10.26.41.10 sapd| AM 00:24:6c:20:4f:f0: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 6/8 May 29 09:06:50 sapd[1641]: <404050> |AP PR-G125-AP296@10.28.89.129 sapd| AM 00:0b:86:77:3c:20: ARM C 11 PER 0 MER 1 FRR 75 50-30 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:06:51 authmgr[1871]: <522027> |authmgr| MAC=6c:83:36:47:eb:6e IP=10.24.2.123 IP Spoof from MAC=38:59:f9:19:9e:0c role=authenticated/(null) May 29 09:06:51 sapd[1641]: <404065> |AP PR-G125-AP296@10.28.89.129 sapd| AM 00:0b:86:77:3c:20: ARM Error Threshold Trigger Current Channel 11 new_rra 6/8 May 29 09:06:55 sapd[610]: <404098> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d8: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 44-48/7 May 29 09:07:03 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.163 IP Spoof from MAC=14:5a:05:37:c2:3a role=authenticated/(null) May 29 09:07:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:07:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:07:31 sapd[610]: <404050> |AP PR-L229-AP211@10.26.28.122 sapd| AM 00:24:6c:20:52:e8: ARM C 157 PER 0 MER 61 FRR 0 50-30 May 29 09:07:32 sapd[610]: <404089> |AP PR-L229-AP211@10.26.28.122 sapd| AM 00:24:6c:20:52:e8: ARM HT Error Threshold Trigger Current Channel old 157-161 new 44-48/8 May 29 09:07:34 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.163 IP Spoof from MAC=14:5a:05:37:c2:3a role=authenticated/(null) May 29 09:07:37 sapd[589]: <404097> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 149-153/7 May 29 09:07:41 sapd[604]: <404097> |AP PR-C211-AP27@10.21.12.19 sapd| AM 00:1a:1e:63:c2:d0: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 May 29 09:08:21 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 48-44/7 May 29 09:08:24 sapd[916]: <404085> |AP PR-L216-AP200@10.26.26.10 sapd| AM 00:24:6c:20:3f:08: ARM HT Channel Interference Trigger new 149-153/69 old 40/36-113 new_rra 149/153-8 TCI 10 May 29 09:08:29 sapd[610]: <404098> |AP PR-A187-AP174@10.28.5.120 sapd| AM 00:24:6c:b6:fe:08: ARM - HT decreasing power cov-index 15/0 tx-power 7 new_rra 44-48/6 May 29 09:08:49 authmgr[1871]: <522027> |authmgr| MAC=f0:dc:e2:e9:ec:62 IP=10.24.18.39 IP Spoof from MAC=3c:e0:72:98:3b:bc role=authenticated/(null) May 29 09:08:54 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:08:55 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 00:1a:dc:04:63:c8) on channel 6. May 29 09:08:55 sapd[919]: <404098> |AP PR-L114-AP292@10.26.19.16 sapd| AM 00:24:6c:29:4a:98: ARM - HT decreasing power cov-index 8/4 tx-power 8 new_rra 149-153/7 May 29 09:09:08 sapd[610]: <404075> |AP PR-L117-AP237@10.26.18.122 sapd| AM 00:24:6c:20:4e:70: ARM - decreasing power cov-index 8/4 tx-power 8 new_rra 11/7 May 29 09:09:15 sapd[916]: <404098> |AP PR-L302-AP226@10.26.32.122 sapd| AM 00:24:6c:20:3d:38: ARM - HT decreasing power cov-index 15/0 tx-power 7 new_rra 36-40/6 May 29 09:09:26 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:09:26 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:09:26 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:09:33 sapd[610]: <404098> |AP PR-L404-AP253@10.26.40.11 sapd| AM 00:24:6c:20:53:88: ARM - HT decreasing power cov-index 12/3 tx-power 8 new_rra 149-153/6 May 29 09:09:39 sapd[610]: <404098> |AP PR-A315-AP139@10.28.37.11 sapd| AM 00:24:6c:b6:f6:d8: ARM - HT decreasing power cov-index 13/1 tx-power 7 new_rra 48-44/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:09:43 sapd[610]: <404097> |AP PR-A322-AP141@10.28.43.10 sapd| AM 00:24:6c:b6:ed:68: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 153-149/8 May 29 09:09:51 sapd[916]: <404098> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 09:10:13 authmgr[1871]: <522027> |authmgr| MAC=28:37:37:dc:9e:13 IP=10.24.18.62 IP Spoof from MAC=b8:c7:5d:3f:c9:85 role=authenticated/(null) May 29 09:10:37 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:10:52 authmgr[1871]: <522027> |authmgr| MAC=40:6f:2a:74:ba:b5 IP=10.24.26.48 IP Spoof from MAC=5c:ac:4c:09:77:14 role=authenticated/(null) May 29 09:10:54 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:11:13 sapd[610]: <404074> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 6/8 May 29 09:11:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:11:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:11:18 authmgr[1871]: <522027> |authmgr| MAC=a0:6c:ec:d9:73:1a IP=10.24.32.201 IP Spoof from MAC=34:c0:59:ca:dd:c5 role=CCwLan/(null) May 29 09:11:26 sapd[931]: <404075> |AP PR-L120-AP255@10.26.18.120 sapd| AM 00:24:6c:20:58:b0: ARM - decreasing power cov-index 11/1 tx-power 8 new_rra 11/7 May 29 09:11:34 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300681432 4c:0f:6e:fc:3f:2a 00:1a:1e:90:7f:e1, deauthenticating the station May 29 09:11:34 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300681432 4c:0f:6e:fc:3f:2a 00:1a:1e:90:7f:e1, deauthenticating the station May 29 09:12:20 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 09:12:29 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:12:29 sapd[600]: <127000> |AP PR-C306s6-AP38@10.21.30.12 sapd| |ids-ap| AP(00:1a:1e:63:97:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:12:33 sapd[610]: <404098> |AP PR-L403-AP251@10.26.42.12 sapd| AM 00:24:6c:20:4b:48: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 161-157/6 May 29 09:12:36 sapd[610]: <404098> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:48: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 36-40/7 May 29 09:13:15 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC e8:3e:b6:3c:83:fd) on channel 6. May 29 09:13:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:0f:6e:fc:3f:2a 00:24:6c:20:39:91 doing 802.1x May 29 09:13:17 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:0f:6e:fc:3f:2a 00:24:6c:20:39:91 doing 802.1x May 29 09:13:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:13:25 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:13:25 sapd[610]: <404093> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:48: ARM HT Empty Channel Trigger new 44-48/0/0 old 149-153/13/4 new_rra 44-48/8 May 29 09:13:26 sapd[931]: <404085> |AP PR-L409-AP230@10.26.41.10 sapd| AM 00:24:6c:20:4f:f8: ARM HT Channel Interference Trigger new 36-40/59 old 161/157-161 new_rra 36/40-6 TCI 10 May 29 09:13:33 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:0f:6e:fc:3f:2a 00:24:6c:20:39:91 doing 802.1x May 29 09:13:33 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:0f:6e:fc:3f:2a 00:24:6c:20:39:91 doing 802.1x May 29 09:13:37 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:13:37 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:14:03 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 4c:0f:6e:fc:3f:2a 00:1a:1e:90:7f:e0 May 29 09:14:03 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 4c:0f:6e:fc:3f:2a 00:1a:1e:90:7f:e0 May 29 09:14:03 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:0f:6e:fc:3f:2a 00:24:6c:20:39:91 doing 802.1x May 29 09:14:03 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:0f:6e:fc:3f:2a 00:24:6c:20:39:91 doing 802.1x May 29 09:14:22 sapd[610]: <404074> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:60: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 11/8 May 29 09:14:33 sapd[610]: <404050> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:48: ARM C 44 PER 0 MER 72 FRR 0 50-30 May 29 09:14:34 sapd[610]: <404089> |AP PR-L127-AP245@10.26.29.124 sapd| AM 00:24:6c:20:4f:48: ARM HT Error Threshold Trigger Current Channel old 44-48 new 149-153/8 May 29 09:14:52 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1 doing 802.1x May 29 09:14:52 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1 doing 802.1x May 29 09:14:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1c:17:1c 00:1a:1e:63:cf:70 May 29 09:14:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1c:17:1c 00:1a:1e:63:cf:70 May 29 09:14:58 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:17:1c 00:1a:1e:63:c0:91 doing 802.1x May 29 09:14:58 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:17:1c 00:1a:1e:63:c0:91 doing 802.1x May 29 09:15:08 sapd[610]: <404098> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM - HT decreasing power cov-index 14/1 tx-power 7 new_rra 36-40/6 May 29 09:15:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1 doing 802.1x May 29 09:15:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1 doing 802.1x May 29 09:15:13 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300685441 94:39:e5:af:32:f7 00:24:6c:20:3f:61, deauthenticating the station May 29 09:15:13 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300685441 94:39:e5:af:32:f7 00:24:6c:20:3f:61, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:15:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:15:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:15:22 sapd[610]: <404098> |AP PR-L228-AP210@10.26.28.121 sapd| AM 00:24:6c:b6:e9:e8: ARM - HT decreasing power cov-index 11/2 tx-power 8 new_rra 149-153/6 May 29 09:15:34 sapd[610]: <404097> |AP PR-A293-AP186@10.28.17.10 sapd| AM 00:24:6c:b6:f4:c8: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 161-157/7 May 29 09:16:08 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:16:14 sapd[610]: <404050> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM C 157 PER 0 MER 81 FRR 0 50-30 May 29 09:16:15 sapd[610]: <404089> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM HT Error Threshold Trigger Current Channel old 157-161 new 40-36/8 May 29 09:16:21 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 11/1 tx-power 8 new_rra 6/7 May 29 09:16:21 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 48-44/8 May 29 09:16:35 sapd[635]: <127000> |AP PR-C203-AP44@10.21.20.10 sapd| |ids-ap| AP(00:1a:1e:63:d8:00): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 7) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 09:16:35 sapd[635]: <127000> |AP PR-C203-AP44@10.21.20.10 sapd| |ids-ap| AP(00:1a:1e:63:d8:00): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID on CHANNEL 7) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 09:16:39 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:16:41 sapd[931]: <404074> |AP PR-L120-AP255@10.26.18.120 sapd| AM 00:24:6c:20:58:b0: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 11/8 May 29 09:16:44 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:16:44 authmgr[1871]: <522027> |authmgr| MAC=70:aa:b2:f6:18:ba IP=10.24.6.57 IP Spoof from MAC=3c:d0:f8:86:94:ea role=authenticated/(null) May 29 09:16:45 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:16:45 authmgr[1871]: <522027> |authmgr| MAC=70:aa:b2:f6:18:ba IP=10.24.6.57 IP Spoof from MAC=3c:d0:f8:86:94:ea role=authenticated/(null) May 29 09:16:46 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:16:46 authmgr[1871]: <522027> |authmgr| MAC=70:aa:b2:f6:18:ba IP=10.24.6.57 IP Spoof from MAC=3c:d0:f8:86:94:ea role=authenticated/(null) May 29 09:17:22 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300685441 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1, deauthenticating the station May 29 09:17:22 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300685441 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1, deauthenticating the station May 29 09:17:24 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 18:87:96:e6:f6:14 00:1a:1e:61:99:01 doing 802.1x May 29 09:17:24 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 18:87:96:e6:f6:14 00:1a:1e:61:99:01 doing 802.1x May 29 09:17:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300693879 18:87:96:e6:f6:14 00:1a:1e:63:ca:21, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:17:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300693879 18:87:96:e6:f6:14 00:1a:1e:63:ca:21, deauthenticating the station May 29 09:17:24 sapd[916]: <404097> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 09:17:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:17:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:17:41 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:b9:58:f1 00:24:6c:b6:f3:31 doing 802.1x May 29 09:17:41 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:b9:58:f1 00:24:6c:b6:f3:31 doing 802.1x May 29 09:17:47 sapd[603]: <404074> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 09:17:49 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:18:29 sapd[610]: <404097> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 161-157/7 May 29 09:18:32 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station ayeung 38:aa:3c:0c:b5:e5 00:1a:1e:63:bf:81, deauthenticating the station May 29 09:18:32 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station ayeung 38:aa:3c:0c:b5:e5 00:1a:1e:63:bf:81, deauthenticating the station May 29 09:19:01 sapd[931]: <404098> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:28: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 09:19:09 authmgr[1871]: <522027> |authmgr| MAC=b4:07:f9:41:ad:8e IP=10.24.14.178 IP Spoof from MAC=98:b8:e3:d0:ee:95 role=authenticated/(null) May 29 09:19:10 sapd[610]: <404097> |AP PR-L403-AP251@10.26.42.12 sapd| AM 00:24:6c:20:4b:48: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 161-157/7 May 29 09:19:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:19:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:19:17 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 09:19:30 sapd[956]: <127000> |AP PR-D318-AP39@10.21.33.16 sapd| |ids-ap| AP(00:1a:1e:61:99:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 09:19:30 sapd[956]: <127000> |AP PR-D318-AP39@10.21.33.16 sapd| |ids-ap| AP(00:1a:1e:61:99:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 09:19:47 authmgr[1871]: <522027> |authmgr| MAC=14:f4:2a:0d:08:68 IP=10.24.30.173 IP Spoof from MAC=a8:96:8a:d6:3f:f2 role=authenticated/(null) May 29 09:19:51 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300685441 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1, deauthenticating the station May 29 09:19:51 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300685441 94:39:e5:af:32:f7 00:24:6c:b6:e5:f1, deauthenticating the station May 29 09:20:22 sapd[610]: <404074> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 09:20:32 sapd[610]: <404085> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM HT Channel Interference Trigger new 161-157/69 old 40/36-114 new_rra 161/157-8 TCI 10 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:21:05 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:21:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:21:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:21:29 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300685441 94:39:e5:af:32:f7 00:1a:1e:90:7f:e1, deauthenticating the station May 29 09:21:29 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300685441 94:39:e5:af:32:f7 00:1a:1e:90:7f:e1, deauthenticating the station May 29 09:22:41 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:22:54 sapd[610]: <404097> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 09:23:00 authmgr[1871]: <522027> |authmgr| MAC=70:11:24:c6:aa:e8 IP=10.24.18.63 IP Spoof from MAC=14:8f:c6:b0:5b:5f role=authenticated/(null) May 29 09:23:01 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:23:06 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1 doing 802.1x May 29 09:23:06 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1 doing 802.1x May 29 09:23:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 980048682 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1, deauthenticating the station May 29 09:23:06 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 980048682 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1, deauthenticating the station May 29 09:23:19 sapd[916]: <404098> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 09:23:21 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 40:6a:ab:df:96:5c 00:1a:1e:63:97:a1 doing 802.1x May 29 09:23:21 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 40:6a:ab:df:96:5c 00:1a:1e:63:97:a1 doing 802.1x May 29 09:23:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:23:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:24:11 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:24:18 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 09:24:31 sapd[956]: <404074> |AP PR-D318-AP39@10.21.33.16 sapd| AM 00:1a:1e:61:99:00: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 09:24:52 sapd[610]: <404098> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM - HT decreasing power cov-index 12/1 tx-power 8 new_rra 161-157/6 May 29 09:24:58 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:24:58 sapd[600]: <404063> |AP PR-IWC42-AP17@10.21.42.99 sapd| AM 00:1a:1e:63:c0:80: ARM Channel Band Trigger new 11-2/1 old 0-0/0 new_rra 11/6 May 29 09:24:58 sapd[600]: <404405> |AP PR-IWC42-AP17@10.21.42.99 sapd| AM 00:1a:1e:63:c0:80: Coverage hole: APM converting to AP on channel 11 coverage 2 6 May 29 09:24:59 KERNEL(PR-IWC42-AP17@10.21.42.99): vap aruba100 vlan is 0. discovering tunnel vlan --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:24:59 KERNEL(PR-IWC42-AP17@10.21.42.99): vap aruba101 vlan is 0. discovering tunnel vlan May 29 09:24:59 KERNEL(PR-IWC42-AP17@10.21.42.99): vap aruba102 vlan is 0. discovering tunnel vlan May 29 09:25:07 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:25:07 sapd[600]: <127000> |AP PR-IWC42-AP17@10.21.42.99 sapd| |ids-ap| AP(00:1a:1e:63:c0:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:25:09 sapd[610]: <404097> |AP PR-A293-AP186@10.28.17.10 sapd| AM 00:24:6c:b6:f4:c8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 09:25:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:25:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:25:28 authmgr[1871]: <522027> |authmgr| MAC=00:26:5e:25:a8:9d IP=10.24.14.171 IP Spoof from MAC=ec:85:2f:a2:ff:0b role=authenticated/(null) May 29 09:25:46 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:26:07 sapd[610]: <404098> |AP PR-A181-AP170@10.28.2.11 sapd| AM 00:24:6c:b6:e7:b8: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 161-157/7 May 29 09:26:29 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 09:26:29 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 09:26:36 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:26:49 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:27:00 authmgr[1871]: <522027> |authmgr| MAC=bc:cf:cc:48:71:60 IP=10.24.26.148 IP Spoof from MAC=4c:8d:79:c9:23:1c role=authenticated/(null) May 29 09:27:05 sapd[633]: <127000> |AP PR-E324-AP64@10.20.215.10 sapd| |ids-ap| AP(00:1a:1e:63:cb:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:27:05 sapd[633]: <127000> |AP PR-E324-AP64@10.20.215.10 sapd| |ids-ap| AP(00:1a:1e:63:cb:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:27:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:27:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:27:19 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC d0:c1:b1:a5:07:98) on channel 6. May 29 09:27:21 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:27:21 sapd[603]: <127000> |AP PR-C306AG-AP11@10.21.23.136 sapd| |ids-ap| AP(00:1a:1e:63:c0:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:27:21 sapd[610]: <404050> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM C 48 PER 0 MER 75 FRR 0 50-30 May 29 09:27:22 sapd[610]: <404089> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM HT Error Threshold Trigger Current Channel old 48-44 new 161-157/8 May 29 09:27:41 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 40:6a:ab:7b:75:7f) on channel 6. May 29 09:27:41 sapd[916]: <404074> |AP PR-L104-AP239@10.26.16.121 sapd| AM 00:24:6c:20:50:60: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 1/8 May 29 09:27:52 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:27:56 sapd[610]: <404098> |AP PR-L207-AP212@10.26.30.122 sapd| AM 00:24:6c:20:55:58: ARM - HT decreasing power cov-index 16/0 tx-power 8 new_rra 161-157/6 May 29 09:27:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station d8:d1:cb:b5:13:08 00:24:6c:b6:f3:31 May 29 09:27:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station d8:d1:cb:b5:13:08 00:24:6c:b6:f3:31 May 29 09:28:22 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 40:6a:ab:7b:75:7f) on channel 6. May 29 09:28:26 fpcli: USER: mikem has logged in from 199.212.60.107. May 29 09:28:34 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 40:6a:ab:7b:75:7f) on channel 6. May 29 09:28:39 sapd[916]: <404097> |AP PR-A361-AP153@10.28.40.36 sapd| AM 00:24:6c:b6:f3:a8: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 48-44/7 May 29 09:28:47 sapd[931]: <404075> |AP PR-L120-AP255@10.26.18.120 sapd| AM 00:24:6c:20:58:b0: ARM - decreasing power cov-index 15/0 tx-power 8 new_rra 11/6 May 29 09:28:56 authmgr[1871]: <522027> |authmgr| MAC=b8:c7:5d:7b:f4:4d IP=10.24.14.168 IP Spoof from MAC=cc:08:e0:66:7c:4e role=authenticated/(null) May 29 09:28:56 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:29:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:29:16 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:29:43 authmgr[1871]: <522027> |authmgr| MAC=34:bb:1f:46:15:58 IP=10.24.2.211 IP Spoof from MAC=98:fe:94:4f:5e:f0 role=authenticated/(null) May 29 09:29:59 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:30:10 sapd[610]: <404093> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b8: ARM HT Empty Channel Trigger new 44-48/0/0 old 157-161/7/0 new_rra 44-48/8 May 29 09:30:13 sapd[931]: <404085> |AP PR-A211D-AP196@10.28.67.124 sapd| AM 00:24:6c:20:3f:68: ARM HT Channel Interference Trigger new 161-157/111 old 44/48-157 new_rra 161/157-6 TCI 10 May 29 09:30:20 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:1c:02:a4) on channel 6. May 29 09:30:20 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:1c:02:a4) on channel 6. --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:30:24 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:1c:02:a4) on channel 6. May 29 09:30:39 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1, deauthenticating the station May 29 09:30:39 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1, deauthenticating the station May 29 09:30:47 sapd[610]: <404074> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 6/7 May 29 09:30:56 sapd[589]: <404050> |AP PR-B317t-AP20@10.21.30.28 sapd| AM 00:1a:1e:63:c2:60: ARM C 1 PER 0 MER 1 FRR 93 50-30 May 29 09:30:57 sapd[589]: <404065> |AP PR-B317t-AP20@10.21.30.28 sapd| AM 00:1a:1e:63:c2:60: ARM Error Threshold Trigger Current Channel 1 new_rra 6/6 May 29 09:31:02 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:31:07 sapd[589]: <404050> |AP PR-B323-AP36@10.21.13.61 sapd| AM 00:1a:1e:63:90:60: ARM C 1 PER 0 MER 1 FRR 95 50-30 May 29 09:31:08 sapd[589]: <404065> |AP PR-B323-AP36@10.21.13.61 sapd| AM 00:1a:1e:63:90:60: ARM Error Threshold Trigger Current Channel 1 new_rra 11/6 May 29 09:31:08 sapd[604]: <404050> |AP PR-IWC12-AP6@10.21.12.20 sapd| AM 00:1a:1e:63:c3:60: ARM C 1 PER 0 MER 4 FRR 99 50-30 May 29 09:31:09 sapd[604]: <404065> |AP PR-IWC12-AP6@10.21.12.20 sapd| AM 00:1a:1e:63:c3:60: ARM Error Threshold Trigger Current Channel 1 new_rra 11/7 May 29 09:31:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:31:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:31:54 authmgr[1871]: <522027> |authmgr| MAC=cc:3a:61:29:25:f8 IP=10.24.2.172 IP Spoof from MAC=7c:c3:a1:27:e0:1a role=authenticated/(null) May 29 09:31:58 sapd[610]: <404098> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM - HT decreasing power cov-index 8/4 tx-power 8 new_rra 48-44/7 May 29 09:31:59 sapd[916]: <404050> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM C 48 PER 0 MER 60 FRR 0 50-30 May 29 09:32:00 sapd[916]: <404089> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM HT Error Threshold Trigger Current Channel old 48-44 new 40-36/8 May 29 09:32:02 sapd[612]: <404050> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM C 40 PER 0 MER 72 FRR 0 50-30 May 29 09:32:03 sapd[612]: <404089> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM HT Error Threshold Trigger Current Channel old 40-36 new 157-161/7 May 29 09:32:24 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC fc:a1:3e:46:f6:d9) on channel 6. May 29 09:32:27 authmgr[1871]: <522027> |authmgr| MAC=5c:0a:5b:f5:d8:56 IP=10.24.26.26 IP Spoof from MAC=78:a3:e4:c6:34:d3 role=authenticated/(null) May 29 09:32:36 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1, deauthenticating the station May 29 09:32:36 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1, deauthenticating the station May 29 09:32:47 sapd[610]: <404074> |AP PR-L208-AP215@10.26.24.10 sapd| AM 00:24:6c:20:4f:e0: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 6/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:33:07 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 09:33:09 authmgr[1871]: <522027> |authmgr| MAC=e0:c9:7a:96:ce:1b IP=10.24.14.134 IP Spoof from MAC=94:eb:cd:14:e9:5f role=authenticated/(null) May 29 09:33:10 sapd[612]: <404097> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 157-161/8 May 29 09:33:16 sapd[610]: <404085> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM HT Channel Interference Trigger new 48-44/35 old 161/157-114 new_rra 48/44-8 TCI 10 May 29 09:33:16 sapd[916]: <404098> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT decreasing power cov-index 11/2 tx-power 8 new_rra 40-36/6 May 29 09:33:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:33:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:33:22 sapd[916]: <404050> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM C 36 PER 0 MER 62 FRR 0 50-30 May 29 09:33:23 sapd[916]: <404089> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM HT Error Threshold Trigger Current Channel old 36-40 new 161-157/8 May 29 09:33:46 authmgr[1871]: <522027> |authmgr| MAC=84:00:d2:21:0a:00 IP=10.24.10.227 IP Spoof from MAC=6c:c2:6b:34:d1:4d role=authenticated/(null) May 29 09:33:56 sapd[610]: <404050> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d8: ARM C 44 PER 0 MER 71 FRR 0 50-30 May 29 09:33:57 sapd[610]: <404089> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d8: ARM HT Error Threshold Trigger Current Channel old 44-48 new 149-153/7 May 29 09:33:57 sapd[610]: <404097> |AP PR-L403-AP251@10.26.42.12 sapd| AM 00:24:6c:20:4b:48: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 09:34:19 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:34:24 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 09:34:31 authmgr[1871]: <522027> |authmgr| MAC=3c:74:37:d0:64:9e IP=10.24.10.228 IP Spoof from MAC=84:00:d2:21:0a:00 role=authenticated/(null) May 29 09:34:35 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:34:42 sapd[610]: <404050> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM C 1 PER 0 MER 5 FRR 76 50-30 May 29 09:34:43 sapd[610]: <404065> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM Error Threshold Trigger Current Channel 1 new_rra 6/6 May 29 09:34:43 sapd[610]: <404098> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d8: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 149-153/6 May 29 09:34:45 sapd[931]: <404097> |AP PR-A297-AP260@10.28.21.134 sapd| AM 00:24:6c:20:57:78: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 44-48/8 May 29 09:34:45 sapd[956]: <127000> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 09:34:45 sapd[956]: <127000> |AP PR-C201-AP45@10.21.20.150 sapd| |ids-ap| AP(00:1a:1e:63:d6:e0): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:34:50 sapd[610]: <404097> |AP PR-L228-AP210@10.26.28.121 sapd| AM 00:24:6c:b6:e9:e8: ARM - HT increasing power cov-index 6/2 tx-power 6 new_rra 149-153/7 May 29 09:35:01 authmgr[1871]: <522027> |authmgr| MAC=cc:55:ad:53:21:ff IP=10.24.18.56 IP Spoof from MAC=e8:06:88:9d:13:79 role=authenticated/(null) May 29 09:35:05 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:35:14 authmgr[1871]: <522027> |authmgr| MAC=70:aa:b2:83:6a:6e IP=10.24.30.77 IP Spoof from MAC=5c:da:d4:5f:af:15 role=authenticated/(null) May 29 09:35:17 sapd[604]: <404075> |AP PR-IWC12-AP6@10.21.12.20 sapd| AM 00:1a:1e:63:c3:60: ARM - decreasing power cov-index 17/4 tx-power 7 new_rra 11/6 May 29 09:35:17 sapd[610]: <404050> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM C 6 PER 0 MER 5 FRR 88 50-30 May 29 09:35:18 sapd[610]: <404065> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 09:35:24 sapd[916]: <404097> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 09:35:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:35:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:35:31 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC e8:3e:b6:86:84:4e) on channel 6. May 29 09:35:32 sapd[610]: <404074> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - increasing power cov-index 6/2 tx-power 7 new_rra 11/8 May 29 09:35:39 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC e8:3e:b6:86:84:4e) on channel 6. May 29 09:35:39 sapd[931]: <404074> |AP PR-L111A-AP240@10.26.19.121 sapd| AM 00:24:6c:20:50:70: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 11/7 May 29 09:35:49 sapd[610]: <404098> |AP PR-A110-AP158@10.28.13.11 sapd| AM 00:24:6c:b6:f4:88: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 48-44/7 May 29 09:35:55 authmgr[1871]: <522027> |authmgr| MAC=70:aa:b2:83:6a:6e IP=10.24.30.77 IP Spoof from MAC=5c:da:d4:5f:af:15 role=authenticated/(null) May 29 09:36:02 sapd[956]: <404075> |AP PR-D318-AP39@10.21.33.16 sapd| AM 00:1a:1e:61:99:00: ARM - decreasing power cov-index 10/5 tx-power 7 new_rra 11/6 May 29 09:36:11 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 24:5f:df:63:54:5d) on channel 6. May 29 09:36:11 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 24:5f:df:63:54:5d) on channel 6. May 29 09:36:15 sapd[610]: <404085> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM HT Channel Interference Trigger new 40-36/87 old 161/157-114 new_rra 40/36-6 TCI 10 May 29 09:36:17 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 09:36:22 sapd[610]: <404050> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:60: ARM C 11 PER 0 MER 65 FRR 0 50-30 May 29 09:36:23 sapd[610]: <404065> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:60: ARM Error Threshold Trigger Current Channel 11 new_rra 1/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:36:25 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:36:28 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:ec:99:62:f7:2e 00:1a:1e:63:c9:c1 doing 802.1x May 29 09:36:28 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:ec:99:62:f7:2e 00:1a:1e:63:c9:c1 doing 802.1x May 29 09:36:28 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/User-PC 24:ec:99:62:f7:2e from server msradius01. May 29 09:36:28 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/User-PC 24:ec:99:62:f7:2e from server msradius01. May 29 09:36:57 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:36:57 sapd[589]: <404098> |AP PR-C207-AP51@10.21.12.42 sapd| AM 00:1a:1e:63:cf:10: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 149-153/6 May 29 09:37:08 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 1c:b0:94:31:21:2e) on channel 6. May 29 09:37:22 sapd[610]: <404050> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM C 48 PER 0 MER 63 FRR 0 50-30 May 29 09:37:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:37:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:37:23 sapd[610]: <404089> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM HT Error Threshold Trigger Current Channel old 48-44 new 161-157/8 May 29 09:37:32 sapd[589]: <127000> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:37:32 sapd[589]: <127000> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:37:36 sapd[589]: <404075> |AP PR-B307-AP69@10.21.30.22 sapd| AM 00:1a:1e:63:c9:c0: ARM - decreasing power cov-index 15/1 tx-power 7 new_rra 11/6 May 29 09:37:41 sapd[589]: <404075> |AP PR-IWC13-AP13@10.21.13.45 sapd| AM 00:1a:1e:63:97:a0: ARM - decreasing power cov-index 17/1 tx-power 7 new_rra 11/6 May 29 09:37:58 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:38:01 sapd[610]: <404097> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 40-36/7 May 29 09:38:26 sapd[610]: <404097> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:58: ARM - HT increasing power cov-index 6/2 tx-power 6 new_rra 149-153/7 May 29 09:38:45 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:38:49 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:38:51 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 24:ec:99:62:f7:2e 00:1a:1e:63:c2:c1 May 29 09:38:51 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 24:ec:99:62:f7:2e 00:1a:1e:63:c2:c1 May 29 09:39:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:ec:99:62:f7:2e 00:1a:1e:63:c2:c1 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:39:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:ec:99:62:f7:2e 00:1a:1e:63:c2:c1 doing 802.1x May 29 09:39:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:39:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:39:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station jpickard 24:ec:99:62:f7:2e 00:1a:1e:63:c2:c1, deauthenticating the station May 29 09:39:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station jpickard 24:ec:99:62:f7:2e 00:1a:1e:63:c2:c1, deauthenticating the station May 29 09:39:22 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station dc:85:de:99:67:06 00:1a:1e:63:d6:e0 May 29 09:39:22 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station dc:85:de:99:67:06 00:1a:1e:63:d6:e0 May 29 09:39:22 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station dc:85:de:99:67:06 00:1a:1e:63:d6:e1 doing 802.1x May 29 09:39:22 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station dc:85:de:99:67:06 00:1a:1e:63:d6:e1 doing 802.1x May 29 09:39:22 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:39:29 sapd[610]: <404075> |AP PR-L233-AP213@10.26.30.19 sapd| AM 00:24:6c:20:53:60: ARM - decreasing power cov-index 23/3 tx-power 8 new_rra 1/6 May 29 09:39:46 sapd[916]: <404075> |AP PR-L104-AP239@10.26.16.121 sapd| AM 00:24:6c:20:50:60: ARM - decreasing power cov-index 8/4 tx-power 8 new_rra 1/7 May 29 09:39:53 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:ec:99:62:f7:2e 00:1a:1e:63:c5:c0 May 29 09:39:53 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:ec:99:62:f7:2e 00:1a:1e:63:c5:c0 May 29 09:39:53 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:ec:99:62:f7:2e 00:24:6c:29:4d:31 doing 802.1x May 29 09:39:53 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:ec:99:62:f7:2e 00:24:6c:29:4d:31 doing 802.1x May 29 09:40:05 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:40:08 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:40:08 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:40:09 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:40:09 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:40:09 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:40:09 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:40:10 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:40:10 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:40:11 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:40:11 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:40:14 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:40:14 sapd[610]: <404098> |AP PR-A291-AP185@10.28.16.121 sapd| AM 00:24:6c:b6:f5:18: ARM - HT decreasing power cov-index 13/0 tx-power 8 new_rra 149-153/6 May 29 09:40:16 sapd[610]: <404050> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM C 40 PER 0 MER 78 FRR 0 50-30 May 29 09:40:17 sapd[610]: <404089> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM HT Error Threshold Trigger Current Channel old 40-36 new 44-48/7 May 29 09:40:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:7a:c7:b8 00:24:6c:20:3e:d9 doing 802.1x May 29 09:40:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:7a:c7:b8 00:24:6c:20:3e:d9 doing 802.1x May 29 09:40:27 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:40:32 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:40:33 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:40:33 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:40:34 sapd[916]: <404097> |AP PR-A361-AP153@10.28.40.36 sapd| AM 00:24:6c:b6:f3:a8: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 09:40:42 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 00:aa:70:83:49:c9) on channel 6. May 29 09:40:47 sapd[1017]: <127000> |AP PR-D114-AP67@10.21.21.23 sapd| |ids-ap| AP(00:1a:1e:63:c9:20): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[1017]: <127000> |AP PR-D114-AP67@10.21.21.23 sapd| |ids-ap| AP(00:1a:1e:63:c9:20): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[1341]: <127000> |AP PR-IWC31-AP15@10.20.28.20 sapd| |ids-ap| AP(00:1a:1e:63:98:80): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (10.20.28.130). May 29 09:40:47 sapd[1341]: <127000> |AP PR-IWC31-AP15@10.20.28.20 sapd| |ids-ap| AP(00:1a:1e:63:98:80): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (10.20.28.130). May 29 09:40:47 sapd[1726]: <127000> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:40:47 sapd[1726]: <127000> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[603]: <127000> |AP PR-D122-AP65@10.21.21.37 sapd| |ids-ap| AP(00:1a:1e:63:cb:60): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[603]: <127000> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[635]: <127000> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:47 sapd[635]: <127000> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:40:54 sapd[610]: <404050> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM C 1 PER 0 MER 2 FRR 75 50-30 May 29 09:40:55 sapd[610]: <404065> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM Error Threshold Trigger Current Channel 1 new_rra 6/6 May 29 09:41:02 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:02 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:02 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:41:02 sapd[956]: <127000> |AP PR-D220-AP46@10.21.32.131 sapd| |ids-ap| AP(00:1a:1e:63:d0:e0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:41:15 sapd[603]: <404075> |AP PR-E120-AP59@10.21.42.11 sapd| AM 00:1a:1e:63:d0:80: ARM - decreasing power cov-index 15/0 tx-power 7 new_rra 11/6 May 29 09:41:20 sapd[1711]: <404050> |AP PR-E220-AP58@10.21.32.159 sapd| AM 00:1a:1e:63:d0:30: ARM C 157 PER 0 MER 68 FRR 0 50-30 May 29 09:41:21 sapd[1711]: <404089> |AP PR-E220-AP58@10.21.32.159 sapd| AM 00:1a:1e:63:d0:30: ARM HT Error Threshold Trigger Current Channel old 157-161 new 48-44/7 May 29 09:41:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:41:24 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:41:28 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:41:28 sapd[2128]: <127000> |AP PR-D205-AP41@10.21.20.140 sapd| |ids-ap| AP(00:1a:1e:63:d1:c0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:41:29 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:29 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:30 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:30 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:31 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:31 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:32 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:32 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:33 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:33 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:39 sapd[610]: <404050> |AP PR-A120A-AP166@10.28.13.14 sapd| AM 00:24:6c:b6:e8:38: ARM C 36 PER 0 MER 68 FRR 0 50-30 May 29 09:41:40 sapd[610]: <404089> |AP PR-A120A-AP166@10.28.13.14 sapd| AM 00:24:6c:b6:e8:38: ARM HT Error Threshold Trigger Current Channel old 36-40 new 153-149/8 May 29 09:41:43 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:44 sapd[931]: <404075> |AP PR-L111A-AP240@10.26.19.121 sapd| AM 00:24:6c:20:50:70: ARM - decreasing power cov-index 13/0 tx-power 7 new_rra 11/6 May 29 09:41:45 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:45 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:45 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:46 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:47 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:47 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:51 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:51 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) May 29 09:41:52 sapd[610]: <404097> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:48: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 36-40/8 May 29 09:41:57 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:41:57 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.146 IP Spoof from MAC=64:27:37:94:c9:cd role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:42:29 sapd[610]: <404050> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM C 6 PER 0 MER 3 FRR 81 50-30 May 29 09:42:30 sapd[610]: <404065> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 09:42:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 48:5d:60:38:c8:4a 00:1a:1e:63:d2:61 May 29 09:42:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 48:5d:60:38:c8:4a 00:1a:1e:63:d2:61 May 29 09:42:54 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:42:54 sapd[603]: <127000> |AP PR-D305-AP61@10.21.23.138 sapd| |ids-ap| AP(00:1a:1e:63:ca:20): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:43:09 sapd[610]: <404075> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - decreasing power cov-index 12/2 tx-power 8 new_rra 11/6 May 29 09:43:21 sapd[956]: <127000> |AP PR-D318-AP39@10.21.33.16 sapd| |ids-ap| AP(00:1a:1e:61:99:00): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:43:21 sapd[956]: <127000> |AP PR-D318-AP39@10.21.33.16 sapd| |ids-ap| AP(00:1a:1e:61:99:00): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:43:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:43:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:43:36 sapd[610]: <404050> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM C 48 PER 0 MER 80 FRR 0 50-30 May 29 09:43:37 sapd[610]: <404089> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM HT Error Threshold Trigger Current Channel old 48-44 new 36-40/7 May 29 09:43:42 sapd[931]: <404074> |AP PR-L304-AP216@10.26.37.124 sapd| AM 00:24:6c:20:52:40: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 1/7 May 29 09:43:52 sapd[1341]: <127037> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Station Associated to Rogue AP: An AP detected a client 60:21:c0:1e:e5:48 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4). May 29 09:44:04 sapd[1341]: <127037> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Station Associated to Rogue AP: An AP detected a client 30:85:a9:f3:c9:fb associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4). May 29 09:44:04 sapd[1726]: <127037> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Station Associated to Rogue AP: An AP detected a client 30:85:a9:f3:c9:fb associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4). May 29 09:44:10 sapd[610]: <404097> |AP PR-L106-AP232@10.26.16.123 sapd| AM 00:24:6c:20:50:f8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 44-48/8 May 29 09:44:22 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:22 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:22 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:22 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:44:23 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:23 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:23 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:23 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:23 sapd[916]: <404085> |AP PR-L127-AP247@10.26.29.123 sapd| AM 00:24:6c:20:54:18: ARM HT Channel Interference Trigger new 48-44/50 old 157/161-111 new_rra 48/44-8 TCI 10 May 29 09:44:24 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:24 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:24 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:24 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:ab:45 00:24:6c:20:55:e2 May 29 09:44:25 sapd[916]: <404085> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM HT Channel Interference Trigger new 48-44/67 old 161/157-93 new_rra 48/44-8 TCI 10 May 29 09:44:45 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:f4:50:95:4f:ae 00:1a:1e:63:c9:20 May 29 09:44:45 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:f4:50:95:4f:ae 00:1a:1e:63:c9:20 May 29 09:44:45 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:f4:50:95:4f:ae 00:1a:1e:63:c9:20 May 29 09:44:45 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:f4:50:95:4f:ae 00:1a:1e:63:c9:20 May 29 09:44:50 sapd[916]: <404098> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 48-44/7 May 29 09:44:53 sapd[610]: <404050> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM C 40 PER 0 MER 58 FRR 0 50-30 May 29 09:44:54 sapd[610]: <404089> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM HT Error Threshold Trigger Current Channel old 40-36 new 48-44/8 May 29 09:45:00 sapd[600]: <404075> |AP PR-G119-AP4@10.21.180.10 sapd| AM 00:1a:1e:63:c5:a0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 11/6 May 29 09:45:14 sapd[610]: <404050> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM C 1 PER 0 MER 1 FRR 73 50-30 May 29 09:45:15 sapd[610]: <404065> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM Error Threshold Trigger Current Channel 1 new_rra 6/6 May 29 09:45:16 sapd[1643]: <404075> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - decreasing power cov-index 11/2 tx-power 8 new_rra 6/6 May 29 09:45:21 sapd[956]: <127000> |AP PR-E316-AP24@10.20.70.162 sapd| |ids-ap| AP(00:1a:1e:63:c3:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:45:21 sapd[956]: <127000> |AP PR-E316-AP24@10.20.70.162 sapd| |ids-ap| AP(00:1a:1e:63:c3:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:45:23 sapd[610]: <404050> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:70: ARM C 1 PER 0 MER 74 FRR 0 50-30 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:45:24 sapd[610]: <404065> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:70: ARM Error Threshold Trigger Current Channel 1 new_rra 6/8 May 29 09:45:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:45:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:45:53 sapd[610]: <404085> |AP PR-A360-AP155@10.28.35.12 sapd| AM 00:24:6c:b6:f2:48: ARM HT Channel Interference Trigger new 161-157/32 old 40/36-63 new_rra 161/157-8 TCI 10 May 29 09:46:35 sapd[613]: <404085> |AP PR-L103-AP290@10.26.19.120 sapd| AM 00:24:6c:29:4a:68: ARM HT Channel Interference Trigger new 48-44/130 old 149/153-196 new_rra 48/44-6 TCI 10 May 29 09:46:42 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:04 sapd[610]: <404050> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM C 6 PER 0 MER 4 FRR 84 50-30 May 29 09:47:05 sapd[610]: <404065> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a0: ARM Error Threshold Trigger Current Channel 6 new_rra 1/6 May 29 09:47:14 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:15 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:20 sapd[988]: <127000> |AP PR-P110-AP19@10.21.31.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:47:20 sapd[988]: <127000> |AP PR-P110-AP19@10.21.31.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:47:22 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:22 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:47:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:47:23 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:23 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:24 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:25 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:25 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:26 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:26 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:26 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:47:29 sapd[610]: <404050> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:70: ARM C 6 PER 0 MER 9 FRR 88 50-30 May 29 09:47:29 sapd[956]: <404074> |AP PR-D220-AP46@10.21.32.131 sapd| AM 00:1a:1e:63:d0:e0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 09:47:30 sapd[610]: <404065> |AP PR-A229-AP181@10.28.21.130 sapd| AM 00:24:6c:b6:fd:70: ARM Error Threshold Trigger Current Channel 6 new_rra 1/8 May 29 09:47:35 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:35 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:40 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:42 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:42 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:42 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:43 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:43 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:44 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:47:45 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:47:56 sapd[956]: <127000> |AP PR-E314-49@10.21.33.137 sapd| |ids-ap| AP(00:1a:1e:63:d2:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 09:47:56 sapd[956]: <127000> |AP PR-E314-49@10.21.33.137 sapd| |ids-ap| AP(00:1a:1e:63:d2:60): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (10.21.33.6). May 29 09:47:57 sapd[610]: <404074> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 09:48:01 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1, deauthenticating the station May 29 09:48:01 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:24:6c:20:4f:f1, deauthenticating the station May 29 09:48:08 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:1c:02:a4) on channel 6. May 29 09:48:13 sapd[606]: <404098> |AP PR-A142-AP327@10.28.64.125 sapd| AM 00:1a:1e:5f:75:f0: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 153-149/6 May 29 09:48:15 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:48:16 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 09:48:16 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:1c:02:a4) on channel 6. --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:48:23 sapd[610]: <404050> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM C 36 PER 0 MER 82 FRR 0 50-30 May 29 09:48:24 sapd[610]: <404089> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM HT Error Threshold Trigger Current Channel old 36-40 new 48-44/7 May 29 09:48:33 sapd[1341]: <127000> |AP PR-D312-AP22@10.21.180.14 sapd| |ids-ap| AP(00:1a:1e:63:c2:80): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:48:33 sapd[1341]: <127000> |AP PR-D312-AP22@10.21.180.14 sapd| |ids-ap| AP(00:1a:1e:63:c2:80): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:48:40 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 00:aa:70:83:49:c9) on channel 6. May 29 09:48:41 sapd[916]: <404075> |AP PR-L104-AP239@10.26.16.121 sapd| AM 00:24:6c:20:50:60: ARM - decreasing power cov-index 13/4 tx-power 7 new_rra 1/6 May 29 09:48:42 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:48:44 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:48:45 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:48:51 sapd[956]: <404075> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: ARM - decreasing power cov-index 11/1 tx-power 7 new_rra 11/6 May 29 09:48:55 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:48:55 sapd[584]: <127000> |AP PR-B107-AP63@10.21.11.15 sapd| |ids-ap| AP(00:1a:1e:63:ca:80): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:49:14 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:14 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:14 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:14 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:15 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:15 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:15 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:15 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:16 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:16 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:16 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:49:16 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 38:59:f9:19:9e:ef 00:24:6c:20:55:e2 May 29 09:49:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:49:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:49:17 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:49:22 sapd[610]: <404050> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM C 36 PER 0 MER 59 FRR 0 50-30 May 29 09:49:23 sapd[610]: <404089> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM HT Error Threshold Trigger Current Channel old 36-40 new 157-161/6 May 29 09:49:26 authmgr[1871]: <522027> |authmgr| MAC=b4:98:42:7a:93:b1 IP=10.24.26.195 IP Spoof from MAC=48:5d:60:73:44:8c role=authenticated/(null) May 29 09:49:27 authmgr[1871]: <522027> |authmgr| MAC=60:d0:a9:13:b2:c1 IP=10.24.18.51 IP Spoof from MAC=e8:06:88:6a:23:76 role=authenticated/(null) May 29 09:49:27 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 09:49:29 authmgr[1871]: <522027> |authmgr| MAC=60:d0:a9:13:b2:c1 IP=10.24.18.51 IP Spoof from MAC=e8:06:88:6a:23:76 role=authenticated/(null) May 29 09:49:29 authmgr[1871]: <522027> |authmgr| MAC=b4:98:42:7a:93:b1 IP=10.24.26.195 IP Spoof from MAC=48:5d:60:73:44:8c role=authenticated/(null) May 29 09:49:30 authmgr[1871]: <522027> |authmgr| MAC=b4:98:42:7a:93:b1 IP=10.24.26.195 IP Spoof from MAC=48:5d:60:73:44:8c role=authenticated/(null) May 29 09:49:31 authmgr[1871]: <522027> |authmgr| MAC=60:d0:a9:13:b2:c1 IP=10.24.18.51 IP Spoof from MAC=e8:06:88:6a:23:76 role=authenticated/(null) May 29 09:49:32 authmgr[1871]: <522027> |authmgr| MAC=b4:98:42:7a:93:b1 IP=10.24.26.195 IP Spoof from MAC=48:5d:60:73:44:8c role=authenticated/(null) May 29 09:49:33 sapd[931]: <404075> |AP PR-L304-AP216@10.26.37.124 sapd| AM 00:24:6c:20:52:40: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 1/6 May 29 09:49:48 sapd[589]: <127000> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 09:49:48 sapd[589]: <127000> |AP PR-C207-AP51@10.21.12.42 sapd| |ids-ap| AP(00:1a:1e:63:cf:00): Rogue AP: An AP classified an access point(BSSID c0:c1:c0:51:e4:ee and SSID JCL-PC_Network on CHANNEL 6) as rogue because it matched the MAC (00:d0:01:e2:04:00) with IP (0.0.0.0). May 29 09:50:00 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 09:50:11 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 09:50:15 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 09:50:33 sapd[610]: <404097> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM - HT increasing power cov-index 6/2 tx-power 6 new_rra 157-161/7 May 29 09:50:36 sapd[610]: <404097> |AP PR-A292-AP184@10.28.16.122 sapd| AM 00:24:6c:b6:f6:58: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 48-44/8 May 29 09:50:39 sapd[916]: <404050> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM C 48 PER 0 MER 81 FRR 0 50-30 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:50:40 sapd[916]: <404089> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM HT Error Threshold Trigger Current Channel old 48-44 new 161-157/7 May 29 09:50:43 sapd[1726]: <127037> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Station Associated to Rogue AP: An AP detected a client 60:21:c0:1e:e5:48 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4). May 29 09:50:55 sapd[610]: <404098> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 09:51:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:51:17 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:51:19 sapd[610]: <404085> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f8: ARM HT Channel Interference Trigger new 161-157/10 old 44/48-57 new_rra 161/157-8 TCI 10 May 29 09:51:25 sapd[1711]: <127000> |AP PR-E220-AP58@10.21.32.159 sapd| |ids-ap| AP(00:1a:1e:63:d0:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:51:25 sapd[1711]: <127000> |AP PR-E220-AP58@10.21.32.159 sapd| |ids-ap| AP(00:1a:1e:63:d0:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:51:51 sapd[1726]: <127038> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Cleared Station Associated to Rogue AP: An AP is no longer detecting a client 60:21:c0:1e:e5:48 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4). May 29 09:51:54 sapd[1341]: <127038> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Cleared Station Associated to Rogue AP: An AP is no longer detecting a client 60:21:c0:1e:e5:48 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4). May 29 09:52:40 sapd[610]: <404097> |AP PR-A123-AP165@10.28.8.10 sapd| AM 00:24:6c:b6:e7:38: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 157-161/8 May 29 09:52:44 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:53:01 sapd[916]: <404098> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT decreasing power cov-index 11/2 tx-power 8 new_rra 161-157/6 May 29 09:53:06 authmgr[1871]: <522027> |authmgr| MAC=78:ca:04:bd:bc:2b IP=10.24.6.7 IP Spoof from MAC=1c:b0:94:8b:5c:eb role=authenticated/(null) May 29 09:53:18 sapd[610]: <404075> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 11/6 May 29 09:53:22 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:22 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:22 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:22 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:23 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:23 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:23 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:23 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:53:24 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:24 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:24 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:24 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:c1:e2 May 29 09:53:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:53:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:53:37 sapd[589]: <404074> |AP PR-B317t-AP20@10.21.30.28 sapd| AM 00:1a:1e:63:c2:60: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 09:53:43 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:53:43 sapd[956]: <404075> |AP PR-D220-AP46@10.21.32.131 sapd| AM 00:1a:1e:63:d0:e0: ARM - decreasing power cov-index 11/3 tx-power 7 new_rra 11/6 May 29 09:54:29 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:54:42 sapd[610]: <404074> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 09:54:45 authmgr[1871]: <522027> |authmgr| MAC=70:f9:27:bf:fe:bc IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:54:45 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:54:45 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID 401j on CHANNEL 4) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 09:55:11 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 09:55:14 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:5f:ce:0c IP=10.24.32.139 IP Spoof from MAC=e0:b9:ba:3b:89:91 role=CCwLan/(null) May 29 09:55:17 sapd[610]: <404098> |AP PR-A181-AP170@10.28.2.11 sapd| AM 00:24:6c:b6:e7:b8: ARM - HT decreasing power cov-index 15/0 tx-power 7 new_rra 161-157/6 May 29 09:55:20 authmgr[1871]: <522027> |authmgr| MAC=e8:92:a4:f2:41:26 IP=10.24.2.13 IP Spoof from MAC=cc:08:e0:63:03:6f role=authenticated/(null) May 29 09:55:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:55:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:55:29 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:55:43 sapd[610]: <404085> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:88: ARM HT Channel Interference Trigger new 48-44/178 old 149/153-243 new_rra 48/44-6 TCI 10 May 29 09:56:28 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:56:29 authmgr[1871]: <522027> |authmgr| MAC=04:f7:e4:96:58:67 IP=10.24.26.24 IP Spoof from MAC=58:1f:aa:a7:80:4c role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:56:30 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:56:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:36 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:36 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:36 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:37 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:37 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:37 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:38 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:38 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:38 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:38 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:49 sapd[610]: <404097> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 09:56:53 authmgr[1871]: <522027> |authmgr| MAC=d0:c1:b1:b0:84:ff IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:56:54 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:56:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:58 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:58 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:59 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:59 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:59 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:56:59 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:57:00 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:57:00 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:57:00 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:57:00 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:82 May 29 09:57:04 authmgr[1871]: <522027> |authmgr| MAC=cc:3a:61:27:42:15 IP=10.24.30.102 IP Spoof from MAC=58:55:ca:a2:a6:ec role=authenticated/(null) May 29 09:57:05 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 09:57:09 sapd[956]: <127000> |AP PR-P104-AP18@10.21.180.15 sapd| |ids-ap| AP(00:1a:1e:63:c0:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:57:09 sapd[956]: <127000> |AP PR-P104-AP18@10.21.180.15 sapd| |ids-ap| AP(00:1a:1e:63:c0:40): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:57:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:81 doing 802.1x May 29 09:57:18 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:81 doing 802.1x May 29 09:57:18 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 70F1A122666C 70:f1:a1:22:66:6c from server msradius01. May 29 09:57:18 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 70F1A122666C 70:f1:a1:22:66:6c from server msradius01. May 29 09:57:19 authmgr[1871]: <522027> |authmgr| MAC=54:26:96:3e:6e:aa IP=10.24.26.77 IP Spoof from MAC=14:8f:c6:00:06:dd role=authenticated/(null) May 29 09:57:19 authmgr[1871]: <522027> |authmgr| MAC=d0:c1:b1:b0:84:ff IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:57:19 authmgr[1871]: <522027> |authmgr| MAC=d0:c1:b1:b0:84:ff IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:57:19 sapd[610]: <404098> |AP PR-A113-AP159@10.28.12.10 sapd| AM 00:24:6c:b6:f4:68: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 161-157/7 May 29 09:57:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:57:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:57:34 sapd[610]: <404097> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:58: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 09:57:44 authmgr[1871]: <522027> |authmgr| MAC=8c:64:22:48:d6:03 IP=10.24.30.110 IP Spoof from MAC=1c:ab:a7:9f:eb:db role=authenticated/(null) May 29 09:57:59 authmgr[1871]: <522027> |authmgr| MAC=d0:c1:b1:b0:84:ff IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:58:00 sapd[1341]: <404063> |AP PR-D113-AP32@10.21.182.7 sapd| AM 00:1a:1e:63:8e:c0: ARM Channel Band Trigger new 11-1/1 old 0-0/0 new_rra 11/6 May 29 09:58:00 sapd[1341]: <404405> |AP PR-D113-AP32@10.21.182.7 sapd| AM 00:1a:1e:63:8e:c0: Coverage hole: APM converting to AP on channel 11 coverage 1 6 May 29 09:58:01 KERNEL(PR-D113-AP32@10.21.182.7): vap aruba100 vlan is 0. discovering tunnel vlan May 29 09:58:01 KERNEL(PR-D113-AP32@10.21.182.7): vap aruba101 vlan is 0. discovering tunnel vlan May 29 09:58:01 KERNEL(PR-D113-AP32@10.21.182.7): vap aruba102 vlan is 0. discovering tunnel vlan May 29 09:58:02 authmgr[1871]: <522027> |authmgr| MAC=d0:c1:b1:b0:84:ff IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:58:03 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:58:03 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 09:58:04 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:58:04 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 09:58:10 sapd[603]: <404075> |AP PR-D319-AP10@10.21.23.10 sapd| AM 00:1a:1e:63:c7:20: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 1/6 May 29 09:58:19 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:81 doing 802.1x May 29 09:58:19 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 70:f1:a1:22:66:6c 00:1a:1e:63:ca:81 doing 802.1x May 29 09:58:35 authmgr[1871]: <522027> |authmgr| MAC=d0:c1:b1:b0:84:ff IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 09:59:16 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:16 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:16 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:16 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:17 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:17 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:17 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:17 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:18 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:18 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:18 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:18 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:e9:8a May 29 09:59:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:59:23 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 09:59:29 authmgr[1871]: <522027> |authmgr| MAC=90:18:7c:43:f2:ed IP=10.24.14.99 IP Spoof from MAC=5c:96:9d:d6:e9:88 role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 09:59:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:32 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:32 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:33 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:33 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:34 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:34 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:34 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:34 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station a0:88:b4:e9:09:e4 00:24:6c:b6:ea:2a May 29 09:59:45 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1c:17:1c 00:1a:1e:63:cf:70 May 29 09:59:45 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 24:77:03:1c:17:1c 00:1a:1e:63:cf:70 May 29 09:59:45 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:17:1c 00:1a:1e:63:cf:71 doing 802.1x May 29 09:59:45 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 24:77:03:1c:17:1c 00:1a:1e:63:cf:71 doing 802.1x May 29 09:59:59 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 40:6a:ab:7b:75:7f) on channel 6. May 29 10:00:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:eb:42:69:74:2c 00:24:6c:20:53:81 doing 802.1x May 29 10:00:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:eb:42:69:74:2c 00:24:6c:20:53:81 doing 802.1x May 29 10:00:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300590069 4c:eb:42:69:74:2c 00:24:6c:20:53:81, deauthenticating the station May 29 10:00:15 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300590069 4c:eb:42:69:74:2c 00:24:6c:20:53:81, deauthenticating the station May 29 10:00:18 sapd[610]: <404097> |AP PR-L228-AP210@10.26.28.121 sapd| AM 00:24:6c:b6:e9:e8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 10:00:22 authmgr[1871]: <522027> |authmgr| MAC=90:18:7c:4c:34:1e IP=10.24.22.16 IP Spoof from MAC=6c:3e:6d:3f:6e:b4 role=authenticated/(null) May 29 10:00:25 authmgr[1871]: <522027> |authmgr| MAC=04:46:65:3c:34:b4 IP=10.24.2.19 IP Spoof from MAC=18:e7:f4:c4:cd:c1 role=authenticated/(null) May 29 10:00:30 sapd[610]: <404097> |AP PR-A137B-AP191@10.28.65.121 sapd| AM 00:24:6c:20:3e:a8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 40-36/8 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:00:38 authmgr[1871]: <522027> |authmgr| MAC=d0:c1:b1:b0:84:ff IP=10.24.2.56 IP Spoof from MAC=04:0c:ce:d4:59:a0 role=authenticated/(null) May 29 10:00:42 sapd[919]: <404097> |AP PR-L114-AP292@10.26.19.16 sapd| AM 00:24:6c:29:4a:98: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 149-153/8 May 29 10:00:49 sapd[956]: <404074> |AP PR-D318-AP39@10.21.33.16 sapd| AM 00:1a:1e:61:99:00: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 10:00:58 sapd[2011]: <404075> |AP PR-DGYM-AP305@10.28.88.10 sapd| AM 00:0b:86:77:30:20: ARM - decreasing power cov-index 14/0 tx-power 8 new_rra 1/6 May 29 10:00:59 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:eb:42:69:74:2c 00:24:6c:20:53:81 doing 802.1x May 29 10:00:59 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:eb:42:69:74:2c 00:24:6c:20:53:81 doing 802.1x May 29 10:01:13 sapd[931]: <404097> |AP PR-A185-AP172@10.28.4.10 sapd| AM 00:24:6c:b6:fe:88: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 157-161/7 May 29 10:01:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 78:dd:08:d5:67:0b 00:1a:1e:63:ca:21 doing 802.1x May 29 10:01:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 78:dd:08:d5:67:0b 00:1a:1e:63:ca:21 doing 802.1x May 29 10:01:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:01:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:01:24 sapd[610]: <404085> |AP PR-A291-AP185@10.28.16.121 sapd| AM 00:24:6c:b6:f5:18: ARM HT Channel Interference Trigger new 40-36/33 old 149/153-68 new_rra 40/36-6 TCI 10 May 29 10:01:36 sapd[916]: <404085> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM HT Channel Interference Trigger new 36-40/66 old 161/157-105 new_rra 36/40-7 TCI 10 May 29 10:01:49 sapd[916]: <404097> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 36-40/8 May 29 10:01:58 sapd[589]: <127000> |AP PR-CafeATM-AP29@10.21.11.136 sapd| |ids-ap| AP(00:1a:1e:63:c1:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 10:01:58 sapd[589]: <127000> |AP PR-CafeATM-AP29@10.21.11.136 sapd| |ids-ap| AP(00:1a:1e:63:c1:e0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 10:02:23 authmgr[1871]: <522027> |authmgr| MAC=cc:3a:61:2a:fc:f6 IP=10.24.30.69 IP Spoof from MAC=84:4b:f5:47:04:86 role=authenticated/(null) May 29 10:02:34 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:02:40 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 10:02:40 sapd[1341]: <127000> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (0.0.0.0). May 29 10:03:02 authmgr[1871]: <522027> |authmgr| MAC=00:37:6d:ad:25:a8 IP=10.24.22.3 IP Spoof from MAC=d8:30:62:bc:1d:99 role=authenticated/(null) May 29 10:03:04 sapd[916]: <404085> |AP PR-L208A-AP214@10.26.24.12 sapd| AM 00:24:6c:20:52:98: ARM HT Channel Interference Trigger new 48-44/28 old 161/157-57 new_rra 48/44-6 TCI 10 May 29 10:03:13 sapd[610]: <404098> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:03:18 authmgr[1871]: <522027> |authmgr| MAC=40:6a:ab:9a:99:bf IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:03:20 sapd[603]: <404074> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 10:03:24 sapd[610]: <404097> |AP PR-L404-AP253@10.26.40.11 sapd| AM 00:24:6c:20:53:88: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 149-153/7 May 29 10:03:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:03:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:03:38 sapd[610]: <404050> |AP PR-L105-AP231@10.26.16.122 sapd| AM 00:24:6c:20:51:70: ARM C 1 PER 0 MER 3 FRR 77 50-30 May 29 10:03:39 sapd[610]: <404065> |AP PR-L105-AP231@10.26.16.122 sapd| AM 00:24:6c:20:51:70: ARM Error Threshold Trigger Current Channel 1 new_rra 11/6 May 29 10:03:50 sapd[956]: <404074> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 10:04:13 sapd[610]: <404098> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 161-157/7 May 29 10:04:19 sapd[916]: <404097> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 161-157/7 May 29 10:04:20 authmgr[1871]: <522027> |authmgr| MAC=60:d0:a9:6f:c1:c0 IP=10.24.30.3 IP Spoof from MAC=58:55:ca:9c:61:dd role=authenticated/(null) May 29 10:04:28 sapd[956]: <404075> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 10:05:13 sapd[610]: <404075> |AP PR-L226-AP207@10.26.28.13 sapd| AM 00:24:6c:b6:e9:f0: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 6/6 May 29 10:05:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:05:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:05:25 sapd[956]: <404075> |AP PR-D318-AP39@10.21.33.16 sapd| AM 00:1a:1e:61:99:00: ARM - decreasing power cov-index 10/3 tx-power 7 new_rra 11/6 May 29 10:05:38 authmgr[1871]: <522027> |authmgr| MAC=38:aa:3c:db:31:b3 IP=10.24.30.95 IP Spoof from MAC=18:34:51:4e:7c:40 role=authenticated/(null) May 29 10:05:42 sapd[956]: <404098> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:10: ARM - HT decreasing power cov-index 12/0 tx-power 7 new_rra 44-48/6 May 29 10:06:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:eb:42:69:74:2c 00:24:6c:20:53:81 doing 802.1x May 29 10:06:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 4c:eb:42:69:74:2c 00:24:6c:20:53:81 doing 802.1x May 29 10:06:21 sapd[610]: <404097> |AP PR-L306A-AP218@10.26.34.122 sapd| AM 00:24:6c:20:4b:78: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 157-161/8 May 29 10:06:38 sapd[610]: <404097> |AP PR-A291-AP185@10.28.16.121 sapd| AM 00:24:6c:b6:f5:18: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 40-36/7 May 29 10:06:59 sapd[916]: <404097> |AP PR-L208A-AP214@10.26.24.12 sapd| AM 00:24:6c:20:52:98: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 48-44/7 May 29 10:07:06 sapd[610]: <404097> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:88: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 48-44/7 May 29 10:07:06 sapd[931]: <404074> |AP PR-A211D-AP196@10.28.67.124 sapd| AM 00:24:6c:20:3f:60: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 11/7 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:07:19 sapd[610]: <404074> |AP PR-L117-AP237@10.26.18.122 sapd| AM 00:24:6c:20:4e:70: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 11/8 May 29 10:07:22 authmgr[1871]: <522027> |authmgr| MAC=74:e5:0b:18:89:d4 IP=10.24.30.63 IP Spoof from MAC=14:8f:c6:b2:75:85 role=authenticated/(null) May 29 10:07:26 sapd[610]: <404097> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 10:07:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:07:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:07:28 sapd[931]: <404097> |AP PR-L334-AP225@10.26.33.125 sapd| AM 00:24:6c:20:4f:28: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 10:07:29 fpcli: USER: mikem connected from 199.212.60.107 has logged out. May 29 10:07:44 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e8:cb:a1:18:8d:7c 00:1a:1e:63:c2:c1 May 29 10:07:44 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e8:cb:a1:18:8d:7c 00:1a:1e:63:c2:c1 May 29 10:07:53 sapd[931]: <404097> |AP PR-A185-AP172@10.28.4.10 sapd| AM 00:24:6c:b6:fe:88: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 157-161/8 May 29 10:07:59 sapd[603]: <404075> |AP PR-C316-AP136@10.21.180.18 sapd| AM 00:1a:1e:63:bf:80: ARM - decreasing power cov-index 7/5 tx-power 7 new_rra 11/6 May 29 10:08:13 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 6/1 tx-power 6 new_rra 40-36/7 May 29 10:08:24 sapd[610]: <404097> |AP PR-L404-AP253@10.26.40.11 sapd| AM 00:24:6c:20:53:88: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 10:08:36 sapd[956]: <404074> |AP PR-D318-AP48@10.21.33.14 sapd| AM 00:1a:1e:63:d2:40: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 6/7 May 29 10:08:37 sapd[2011]: <404074> |AP PR-DGYM-AP305@10.28.88.10 sapd| AM 00:0b:86:77:30:20: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 1/7 May 29 10:09:03 authmgr[1871]: <522027> |authmgr| MAC=1c:69:a5:53:49:75 IP=10.24.30.35 IP Spoof from MAC=3c:e0:72:90:63:2a role=authenticated/(null) May 29 10:09:10 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:09:10 sapd[610]: <404098> |AP PR-A240B-AP199@10.28.19.120 sapd| AM 00:24:6c:20:3e:48: ARM - HT decreasing power cov-index 12/0 tx-power 8 new_rra 36-40/7 May 29 10:09:10 sapd[916]: <404085> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM HT Channel Interference Trigger new 48-44/31 old 40/36-65 new_rra 48/44-7 TCI 10 May 29 10:09:20 sapd[1711]: <127000> |AP PR-E220-AP58@10.21.32.159 sapd| |ids-ap| AP(00:1a:1e:63:d0:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 10:09:20 sapd[1711]: <127000> |AP PR-E220-AP58@10.21.32.159 sapd| |ids-ap| AP(00:1a:1e:63:d0:20): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 10:09:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:09:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:09:43 sapd[603]: <404075> |AP PR-IWC23-AP12@10.21.23.12 sapd| AM 00:1a:1e:63:c0:00: ARM - decreasing power cov-index 10/2 tx-power 7 new_rra 11/6 May 29 10:10:15 sapd[605]: <404098> |AP PR-A148-AP326@10.28.64.122 sapd| AM 00:1a:1e:90:74:70: ARM - HT decreasing power cov-index 11/1 tx-power 7 new_rra 149-153/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:10:27 sapd[916]: <404074> |AP PR-L104-AP239@10.26.16.121 sapd| AM 00:24:6c:20:50:60: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 1/7 May 29 10:10:34 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:10:42 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 10:10:42 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 10:10:50 sapd[610]: <404097> |AP PR-A291-AP185@10.28.16.121 sapd| AM 00:24:6c:b6:f5:18: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 40-36/8 May 29 10:11:12 sapd[603]: <127037> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Station Associated to Rogue AP: An AP detected a client c8:7b:5b:11:22:3a associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:11:12 sapd[635]: <127037> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Station Associated to Rogue AP: An AP detected a client c8:7b:5b:11:22:3a associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:11:16 sapd[956]: <404097> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:10: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 44-48/7 May 29 10:11:19 sapd[1641]: <404050> |AP PR-G141-AP297@10.28.88.12 sapd| AM 00:0b:86:77:3c:10: ARM C 11 PER 0 MER 85 FRR 87 50-30 May 29 10:11:20 sapd[1641]: <404065> |AP PR-G141-AP297@10.28.88.12 sapd| AM 00:0b:86:77:3c:10: ARM Error Threshold Trigger Current Channel 11 new_rra 6/8 May 29 10:11:22 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 10:11:22 sapd[2096]: <127000> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:9c and SSID on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:9c) with IP (0.0.0.0). May 29 10:11:38 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:11:38 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:11:46 sapd[610]: <404098> |AP PR-L306-AP217@10.26.34.124 sapd| AM 00:24:6c:20:53:48: ARM - HT decreasing power cov-index 16/1 tx-power 8 new_rra 161-157/6 May 29 10:11:50 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 80:60:07:23:72:a8) on channel 6. May 29 10:11:56 sapd[610]: <404097> |AP PR-L127-AP246@10.26.29.121 sapd| AM 00:24:6c:20:56:08: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 161-157/8 May 29 10:12:05 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:12:43 sapd[610]: <404098> |AP PR-L310-AP222@10.26.36.132 sapd| AM 00:24:6c:20:4d:78: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 48-44/7 May 29 10:12:56 sapd[610]: <404074> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - increasing power cov-index 6/1 tx-power 6 new_rra 11/7 May 29 10:13:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:13:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:13:22 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 24:5f:df:23:45:b2) on channel 6. May 29 10:13:42 sapd[931]: <404075> |AP PR-A211D-AP196@10.28.67.124 sapd| AM 00:24:6c:20:3f:60: ARM - decreasing power cov-index 16/1 tx-power 7 new_rra 11/6 May 29 10:13:53 sapd[956]: <404075> |AP PR-E322-AP25@10.21.33.134 sapd| AM 00:1a:1e:63:c2:00: ARM - decreasing power cov-index 11/1 tx-power 7 new_rra 11/6 May 29 10:14:01 sapd[610]: <404097> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d8: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 May 29 10:14:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:1a:1e:63:d0:c1, deauthenticating the station May 29 10:14:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:1a:1e:63:d0:c1, deauthenticating the station May 29 10:14:29 sapd[916]: <404097> |AP PR-L208A-AP214@10.26.24.12 sapd| AM 00:24:6c:20:52:98: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 48-44/8 May 29 10:14:38 sapd[1641]: <404085> |AP PR-DGYM-AP306@10.28.89.18 sapd| AM 00:0b:86:77:31:c8: ARM HT Channel Interference Trigger new 149-153/53 old 48/44-83 new_rra 149/153-6 TCI 10 May 29 10:15:26 sapd[916]: <404074> |AP PR-L104-AP239@10.26.16.121 sapd| AM 00:24:6c:20:50:60: ARM - increasing power cov-index 7/1 tx-power 7 new_rra 1/8 May 29 10:15:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:15:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:15:33 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:1a:1e:63:bf:a1, deauthenticating the station May 29 10:15:33 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:1a:1e:63:bf:a1, deauthenticating the station May 29 10:16:06 sapd[603]: <127037> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Station Associated to Rogue AP: An AP detected a client 30:85:a9:f3:c9:fb associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:16:06 sapd[635]: <127037> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Station Associated to Rogue AP: An AP detected a client 30:85:a9:f3:c9:fb associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:16:16 sapd[1726]: <127037> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Station Associated to Rogue AP: An AP detected a client 30:85:a9:f3:c9:fb associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:16:16 sapd[985]: <127102> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 10:16:21 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:16:22 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 90:18:7c:04:51:e2) on channel 6. May 29 10:16:24 sapd[2011]: <404074> |AP PR-DGYM-AP305@10.28.88.10 sapd| AM 00:0b:86:77:30:20: ARM - increasing power cov-index 7/0 tx-power 7 new_rra 1/8 May 29 10:16:32 sapd[1341]: <404050> |AP PR-D113-AP32@10.21.182.7 sapd| AM 00:1a:1e:63:8e:c0: ARM C 11 PER 0 MER 5 FRR 71 50-30 May 29 10:16:33 sapd[1341]: <404065> |AP PR-D113-AP32@10.21.182.7 sapd| AM 00:1a:1e:63:8e:c0: ARM Error Threshold Trigger Current Channel 11 new_rra 1/6 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:16:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:64:32:b9:58:f1 00:24:6c:b6:f4:68 May 29 10:16:35 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 20:64:32:b9:58:f1 00:24:6c:b6:f4:68 May 29 10:16:35 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:b9:58:f1 00:1a:1e:90:7f:e1 doing 802.1x May 29 10:16:35 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:b9:58:f1 00:1a:1e:90:7f:e1 doing 802.1x May 29 10:16:35 sapd[1341]: <127037> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Station Associated to Rogue AP: An AP detected a client 30:85:a9:f3:c9:fb associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:16:43 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 78:d6:f0:34:e2:2f) on channel 6. May 29 10:16:49 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:16:49 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:16:51 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:16:51 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:16:52 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:16:52 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:16:59 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 10:68:3f:75:b8:31) on channel 6. May 29 10:16:59 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 10:68:3f:75:b8:31) on channel 6. May 29 10:17:26 sapd[605]: <404097> |AP PR-A148-AP326@10.28.64.122 sapd| AM 00:1a:1e:90:74:70: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 149-153/7 May 29 10:17:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:17:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:17:32 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:1a:1e:63:d0:c1, deauthenticating the station May 29 10:17:32 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:1a:1e:63:d0:c1, deauthenticating the station May 29 10:17:33 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:17:35 sapd[934]: <404050> |AP PR-C211-AP287@10.21.12.22 sapd| AM 00:24:6c:29:4b:f0: ARM C 1 PER 0 MER 9 FRR 70 50-30 May 29 10:17:36 sapd[934]: <404065> |AP PR-C211-AP287@10.21.12.22 sapd| AM 00:24:6c:29:4b:f0: ARM Error Threshold Trigger Current Channel 1 new_rra 6/6 May 29 10:17:47 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:17:47 sapd[2192]: <404075> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:00: ARM - decreasing power cov-index 14/0 tx-power 8 new_rra 6/6 May 29 10:17:48 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:17:49 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:17:51 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:17:52 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:17:56 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:17:57 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:18:01 authmgr[1871]: <522027> |authmgr| MAC=cc:08:e0:63:03:6f IP=10.24.2.13 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) May 29 10:18:02 authmgr[1871]: <522027> |authmgr| MAC=08:fc:88:99:99:71 IP=10.24.10.21 IP Spoof from MAC=10:68:3f:73:70:11 role=authenticated/(null) May 29 10:18:04 sapd[610]: <404097> |AP PR-L306B-AP219@10.26.34.121 sapd| AM 00:24:6c:20:52:88: ARM - HT increasing power cov-index 7/0 tx-power 7 new_rra 48-44/8 May 29 10:18:25 sapd[610]: <404097> |AP PR-A295-AP187@10.28.17.120 sapd| AM 00:24:6c:b6:fd:d8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 149-153/8 May 29 10:18:26 sapd[610]: <404075> |AP PR-A212C-AP198@10.28.67.120 sapd| AM 00:24:6c:20:39:90: ARM - decreasing power cov-index 11/2 tx-power 7 new_rra 11/6 May 29 10:18:27 sapd[600]: <404093> |AP PR-IWC42-AP17@10.21.42.99 sapd| AM 00:1a:1e:63:c0:90: ARM HT Empty Channel Trigger new 157-161/0/0 old 36-40/0/4 new_rra 157-161/7 May 29 10:18:39 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 5c:0a:5b:60:80:9d) on channel 6. May 29 10:18:39 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 5c:0a:5b:60:80:9d) on channel 6. May 29 10:18:49 sapd[603]: <127037> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Station Associated to Rogue AP: An AP detected a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:18:49 sapd[635]: <127037> |AP PR-IWC21-AP14@10.20.19.10 sapd| |ids-ap| AP(00:1a:1e:63:c1:c0): Station Associated to Rogue AP: An AP detected a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:18:55 sapd[1341]: <127037> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Station Associated to Rogue AP: An AP detected a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:18:57 sapd[1726]: <127037> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Station Associated to Rogue AP: An AP detected a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:19:06 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:06 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:06 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:19:06 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:07 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:07 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:07 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:07 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:08 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:08 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:08 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:08 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:13 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:13 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f2 May 29 10:19:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f1 doing 802.1x May 29 10:19:13 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f1 doing 802.1x May 29 10:19:18 sapd[1305]: <404098> |AP PR-DGYM-ap309@10.28.88.21 sapd| AM 00:0b:86:77:3a:48: ARM - HT decreasing power cov-index 13/1 tx-power 8 new_rra 149-153/6 May 29 10:19:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:19:27 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:19:30 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:1a:1e:63:bf:a1, deauthenticating the station May 29 10:19:30 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:1a:1e:63:bf:a1, deauthenticating the station May 29 10:19:39 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC c4:6a:b7:4c:1a:82) on channel 6. May 29 10:19:46 authmgr[1871]: <522027> |authmgr| MAC=64:77:91:e7:3e:77 IP=10.24.6.17 IP Spoof from MAC=0c:74:c2:13:f1:04 role=authenticated/(null) May 29 10:19:46 sapd[916]: <404097> |AP PR-L114A-AP258@10.26.19.123 sapd| AM 00:24:6c:20:58:c8: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 161-157/8 May 29 10:19:51 sapd[916]: <404097> |AP PR-L215-AP201@10.26.25.10 sapd| AM 00:24:6c:b6:ea:18: ARM - HT increasing power cov-index 7/1 tx-power 7 new_rra 48-44/8 May 29 10:19:53 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:1a:1e:63:90:61, deauthenticating the station May 29 10:19:53 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:1a:1e:63:90:61, deauthenticating the station --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:20:03 sapd[603]: <127038> |AP PR-D319-AP10@10.21.23.10 sapd| |ids-ap| AP(00:1a:1e:63:c7:20): Cleared Station Associated to Rogue AP: An AP is no longer detecting a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:20:04 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f0 May 29 10:20:04 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4e:f0 May 29 10:20:04 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f1 doing 802.1x May 29 10:20:04 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f1 doing 802.1x May 29 10:20:04 sapd[1341]: <127038> |AP PR-D113-AP32@10.21.182.7 sapd| |ids-ap| AP(00:1a:1e:63:8e:c0): Cleared Station Associated to Rogue AP: An AP is no longer detecting a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:20:12 sapd[916]: <404085> |AP PR-L216-AP200@10.26.26.10 sapd| AM 00:24:6c:20:3f:08: ARM HT Channel Interference Trigger new 36-40/46 old 149/153-95 new_rra 36/40-8 TCI 10 May 29 10:20:14 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 10:20:14 sapd[985]: <127000> |AP PR-D314-AP70@10.21.23.73 sapd| |ids-ap| AP(00:1a:1e:63:ca:00): Rogue AP: An AP classified an access point(BSSID 00:02:6f:ef:9a:88 and SSID seamlessout on CHANNEL 11) as rogue because it matched the MAC (00:02:6f:ef:9a:88) with IP (0.0.0.0). May 29 10:20:18 sapd[916]: <404075> |AP PR-L104-AP239@10.26.16.121 sapd| AM 00:24:6c:20:50:60: ARM - decreasing power cov-index 18/1 tx-power 8 new_rra 1/6 May 29 10:20:22 sapd[1726]: <127038> |AP PR-D212-AP50@10.21.32.10 sapd| |ids-ap| AP(00:1a:1e:63:d3:00): Cleared Station Associated to Rogue AP: An AP is no longer detecting a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:20:25 sapd[603]: <127102> |AP PR-C306ab-AP35@10.21.23.39 sapd| |ids-ap| AP(00:1a:1e:63:97:60): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 3c:74:37:27:71:97) on channel 6. May 29 10:20:37 sapd[610]: <404098> |AP PR-L119-AP244@10.26.18.121 sapd| AM 00:24:6c:20:56:58: ARM - HT decreasing power cov-index 11/1 tx-power 8 new_rra 149-153/7 May 29 10:20:39 authmgr[1871]: <522027> |authmgr| MAC=d0:c1:b1:bf:be:79 IP=10.24.15.1 IP Spoof from MAC=f8:d0:bd:bf:c3:e1 role=authenticated/(null) May 29 10:20:44 sapd[1643]: <404074> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c0: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 10:20:44 sapd[2011]: <404097> |AP PR-G200-AP300@10.28.88.16 sapd| AM 00:0b:86:77:30:58: ARM - HT increasing power cov-index 6/0 tx-power 6 new_rra 48-44/7 May 29 10:20:49 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 48:5d:60:38:c8:4a 00:1a:1e:63:d0:81 doing 802.1x May 29 10:20:49 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 48:5d:60:38:c8:4a 00:1a:1e:63:d0:81 doing 802.1x May 29 10:20:57 authmgr[1871]: <522027> |authmgr| MAC=1c:69:a5:ef:be:99 IP=10.24.14.95 IP Spoof from MAC=9c:2a:70:68:45:1b role=authenticated/(null) May 29 10:21:15 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:53:80 May 29 10:21:15 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:53:80 May 29 10:21:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f1 doing 802.1x --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:21:15 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f1 doing 802.1x May 29 10:21:17 sapd[587]: <404098> |AP PR-Cafe1-AP7@10.21.11.134 sapd| AM 00:1a:1e:63:bf:b0: ARM - HT decreasing power cov-index 10/3 tx-power 7 new_rra 36-40/6 May 29 10:21:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:21:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:21:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:1a:1e:63:90:61, deauthenticating the station May 29 10:21:28 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:1a:1e:63:90:61, deauthenticating the station May 29 10:21:28 sapd[612]: <404050> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM C 157 PER 0 MER 64 FRR 0 50-30 May 29 10:21:29 sapd[612]: <404089> |AP PR-L1stFloor-AP289@10.26.19.18 sapd| AM 00:24:6c:29:4c:28: ARM HT Error Threshold Trigger Current Channel old 157-161 new 36-40/8 May 29 10:21:31 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 48:5d:60:38:c8:4a 00:1a:1e:63:d0:81 doing 802.1x May 29 10:21:31 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 48:5d:60:38:c8:4a 00:1a:1e:63:d0:81 doing 802.1x May 29 10:21:32 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:24:6c:29:4b:f1, deauthenticating the station May 29 10:21:32 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:16:6f:8b:b4:db 00:24:6c:29:4b:f1, deauthenticating the station May 29 10:21:38 sapd[956]: <127037> |AP PR-D318-AP39@10.21.33.16 sapd| |ids-ap| AP(00:1a:1e:61:99:00): Station Associated to Rogue AP: An AP detected a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:21:52 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:52 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:52 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:52 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:53 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:53 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:53 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:53 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:54 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:54 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:54 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:21:54 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:21:57 sapd[610]: <404098> |AP PR-A356-A149@10.28.34.12 sapd| AM 00:24:6c:b6:ef:b8: ARM - HT decreasing power cov-index 13/0 tx-power 8 new_rra 44-48/6 May 29 10:21:59 sapd[2192]: <404074> |AP PR-G200-AP298@10.28.89.22 sapd| AM 00:0b:86:77:30:00: ARM - increasing power cov-index 6/0 tx-power 6 new_rra 6/7 May 29 10:22:01 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:22:01 authmgr[1871]: <132023> |authmgr| 802.1x authentication is disabled in profile Station 50:b7:c3:3a:6f:aa 00:24:6c:20:4f:f2 May 29 10:22:01 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:20:53:81 doing 802.1x May 29 10:22:01 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 50:b7:c3:3a:6f:aa 00:24:6c:20:53:81 doing 802.1x May 29 10:22:06 sapd[2096]: <127102> |AP PR-c203-AP47@10.21.20.144 sapd| |ids-ap| AP(00:1a:1e:63:d1:a0): AP Deauth Containment: An AP attempted to contain an access point (BSSID 00:26:5a:f7:8e:0e) by disconnecting its client (MAC 3c:74:37:27:71:97) on channel 6. May 29 10:22:08 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 48:5d:60:38:c8:4a 00:1a:1e:63:d0:81 doing 802.1x May 29 10:22:08 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 48:5d:60:38:c8:4a 00:1a:1e:63:d0:81 doing 802.1x May 29 10:22:19 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:0a:5b:ca:12:aa 00:24:6c:20:50:61 doing 802.1x May 29 10:22:19 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 5c:0a:5b:ca:12:aa 00:24:6c:20:50:61 doing 802.1x May 29 10:22:19 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300759446 5c:0a:5b:ca:12:aa from server msradius01. May 29 10:22:19 authmgr[1871]: <132207> |authmgr| RADIUS reject for station 300759446 5c:0a:5b:ca:12:aa from server msradius01. May 29 10:22:29 sapd[592]: <404074> |AP PR-B317i-AP21@10.21.30.26 sapd| AM 00:1a:1e:63:c3:80: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 10:22:41 authmgr[1871]: <132094> |authmgr| MIC failed in WPA2 Key Message 2 from Station 20:64:32:7f:f0:7b 00:24:6c:20:4f:e1 PR-L208-AP215 May 29 10:22:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:7f:f0:7b 00:24:6c:20:53:69 doing 802.1x May 29 10:22:43 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 20:64:32:7f:f0:7b 00:24:6c:20:53:69 doing 802.1x May 29 10:22:43 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300686634 20:64:32:7f:f0:7b 00:24:6c:20:4f:e1, deauthenticating the station May 29 10:22:43 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 300686634 20:64:32:7f:f0:7b 00:24:6c:20:4f:e1, deauthenticating the station May 29 10:22:58 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:8c:6e 00:1a:1e:63:96:31 PR-SChall-AP34 did not match the replay counter 01 vs 02 May 29 10:22:58 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:8c:6e 00:1a:1e:63:96:31 PR-SChall-AP34 did not match the replay counter 01 vs 02 May 29 10:22:59 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:8c:6e 00:1a:1e:63:96:31 PR-SChall-AP34 did not match the replay counter 02 vs 03 May 29 10:22:59 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:8c:6e 00:1a:1e:63:96:31 PR-SChall-AP34 did not match the replay counter 02 vs 03 May 29 10:23:00 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:8c:6e 00:1a:1e:63:96:31 PR-SChall-AP34 did not match the replay counter 03 vs 04 May 29 10:23:00 authmgr[1871]: <132093> |authmgr| WPA2 Key message 2 from Station e8:92:a4:9a:8c:6e 00:1a:1e:63:96:31 PR-SChall-AP34 did not match the replay counter 03 vs 04 --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:23:08 sapd[605]: <127000> |AP PR-A148-AP326@10.28.64.122 sapd| |ids-ap| AP(00:1a:1e:90:74:60): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 10:23:08 sapd[605]: <127000> |AP PR-A148-AP326@10.28.64.122 sapd| |ids-ap| AP(00:1a:1e:90:74:60): Rogue AP: An AP classified an access point(BSSID 54:e6:fc:b9:c4:02 and SSID on CHANNEL 4) as rogue because it matched the MAC (54:e6:fc:b9:c4:02) with IP (0.0.0.0). May 29 10:23:11 authmgr[1871]: <132094> |authmgr| MIC failed in WPA2 Key Message 2 from Station 5c:0a:5b:c8:fb:ce 00:1a:1e:63:c2:61 PR-B317t-AP20 May 29 10:23:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:23:18 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 00:1f:5b:d0:6b:47 00:1a:1e:63:cf:51, deauthenticating the station May 29 10:23:22 authmgr[1871]: <522027> |authmgr| MAC=94:3a:f0:0d:83:dc IP=10.24.6.199 IP Spoof from MAC=d8:9e:3f:58:4f:7a role=authenticated/(null) May 29 10:23:28 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e8:cb:a1:18:8d:7c 00:24:6c:b6:f0:21 May 29 10:23:28 authmgr[1871]: <132030> |authmgr| Dropping EAPOL packet sent by Station e8:cb:a1:18:8d:7c 00:24:6c:b6:f0:21 May 29 10:23:32 sapd[956]: <404074> |AP PR-D318-AP39@10.21.33.16 sapd| AM 00:1a:1e:61:99:00: ARM - increasing power cov-index 6/2 tx-power 6 new_rra 11/7 May 29 10:23:38 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:1a:1e:63:90:61, deauthenticating the station May 29 10:23:38 authmgr[1871]: <132197> |authmgr| Maximum number of retries was attempted for station 78:dd:08:d5:67:0b 00:1a:1e:63:90:61, deauthenticating the station May 29 10:23:45 sapd[1341]: <127037> |AP PR-D312-AP22@10.21.180.14 sapd| |ids-ap| AP(00:1a:1e:63:c2:80): Station Associated to Rogue AP: An AP detected a client 08:60:6e:d0:19:52 associated to a rogue access point (BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1). May 29 10:23:53 sapd[610]: <404075> |AP PR-L227-AP208@10.26.28.120 sapd| AM 00:24:6c:b6:e9:d0: ARM - decreasing power cov-index 11/1 tx-power 8 new_rra 6/7 May 29 10:23:54 sapd[1643]: <404085> |AP PR-DGYM-ap310@10.28.88.20 sapd| AM 00:0b:86:77:33:c8: ARM HT Channel Interference Trigger new 48-44/68 old 153/149-95 new_rra 48/44-8 TCI 10 May 29 10:24:05 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 1c:69:a5:c8:f7:07 00:24:6c:29:4d:31 doing 802.1x May 29 10:24:05 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 1c:69:a5:c8:f7:07 00:24:6c:29:4d:31 doing 802.1x May 29 10:24:12 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 78:dd:08:d5:67:0b 00:1a:1e:63:90:61 doing 802.1x May 29 10:24:12 authmgr[1871]: <132053> |authmgr| Dropping the radius packet for Station 78:dd:08:d5:67:0b 00:1a:1e:63:90:61 doing 802.1x May 29 10:24:12 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/shuraya-VAIO 78:dd:08:d5:67:0b from server msradius01. May 29 10:24:12 authmgr[1871]: <132207> |authmgr| RADIUS reject for station host/shuraya-VAIO 78:dd:08:d5:67:0b from server msradius01. May 29 10:24:23 sapd[1341]: <127000> |AP PR-IWC31-AP15@10.20.28.20 sapd| |ids-ap| AP(00:1a:1e:63:98:80): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (10.20.28.26). May 29 10:24:23 sapd[1341]: <127000> |AP PR-IWC31-AP15@10.20.28.20 sapd| |ids-ap| AP(00:1a:1e:63:98:80): Rogue AP: An AP classified an access point(BSSID 10:bf:48:e6:79:4c and SSID ASUS on CHANNEL 1) as rogue because it matched the MAC (10:bf:48:e6:79:4c) with IP (10.20.28.26). May 29 10:24:31 authmgr[1871]: <522027> |authmgr| MAC=14:5a:05:d8:bc:2c IP=10.24.2.9 IP Spoof from MAC=e8:92:a4:f2:41:26 role=authenticated/(null) --More-- (q) quit (u) pageup (/) search (n) repeat May 29 10:24:33 fpcli: USER: mikem has logged in from 199.212.60.107. May 29 10:24:34 sapd[916]: <404098> |AP PR-L218-AP203@10.26.26.12 sapd| AM 00:24:6c:b6:ea:08: ARM - HT decreasing power cov-index 13/1 tx-power 8 new_rra 36-40/6 May 29 10:24:36 fpcli: USER: mikem connected from