Controllerless Networks

 View Only
last person joined: 23 hours ago 

Aruba Instant Wi-Fi: Meet the controllerless Wi-Fi solution that's easy to set-up, is loaded with security and smarts, and won't break your budget.
Expand all | Collapse all

How can I see the MAC address of the client sending this dropped "action=deny" traffic?

This thread has been viewed 17 times
  • 1.  How can I see the MAC address of the client sending this dropped "action=deny" traffic?

    Posted Sep 21, 2022 11:06 PM
    Our IAPs are logging the dropped traffic of clients using wrong IPv4 addresses and even more wrong IPv6 addresses. I'd like to figure out the client's MAC address and learn which device is sending this traffic, but that Layer2 information is not included in the syslog message:

    cb-a1-ap# sh log security

    Sep 20 16:46:42 stm[5258]: <124006> <WARN> |AP cb-a1-ap@10.201.4.121 stm| proto = 32 srcip=32.192.1.132 dstip=65.152.37.92, dpi-dst=App Unknown, action=deny

    Sep 20 16:49:47 stm[5258]: <124006> <WARN> |AP cb-a1-ap@10.201.4.121 stm| proto = 0 srcip=4006:f56:a04:33f:1139:cf3:fa5a:1bb dstip=15f9:35a1:abd2:5781:8011:401:be39:0, action=deny

    Sep 20 16:49:47 stm[5258]: <124006> <WARN> |AP cb-a1-ap@10.201.4.121 stm| proto = 0 srcip=4006:8a4f:a04:33f:4815:5b1d:fa5c:50 dstip=1427:10e5:ac6a:f6e2:8010:401:3d03:0, action=deny

    Is there a place to look to see which client sent this traffic?

    Thank you for your thoughts!

    ------------------------------
    --Scot
    ------------------------------


  • 2.  RE: How can I see the MAC address of the client sending this dropped "action=deny" traffic?

    EMPLOYEE
    Posted Sep 22, 2022 11:54 PM
    "show clients" command will show the connected clients with the mac addr and both their IPv4 and v6 addrs



    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
    ------------------------------



  • 3.  RE: How can I see the MAC address of the client sending this dropped "action=deny" traffic?

    Posted Sep 23, 2022 10:25 AM
    Hey ariyap,

    Thank you for your reply.

    Normally "show clients" would indeed show the mac addr and and IP addresses, but in this case the packet has an incorrect and *wrong* source IP address. The IP address shown in the logs is not found in the "show clients" output. The routable source IP address is not being used, so a response to these packets would never be received. Nonetheless, the packet is being received by the AP with the wrong source IP address and I'd like to determinate which client sent it.

    Maybe I can turn on "debug" level logging for "security" and that will show me the client MAC address?

    --Scot