In Events, what does the ?IDS: Disconnect Station Attack? alert mean?
Product and Software: This article applies to all Aruba controllers and ArubaOS versions.
In Events, the "IDS: Disconnect Station Attack" alerts are not valid and are caused by a new sequence number generation mechanism implemented for the newer Aruba APs, and this is triggering the false positives.
This feature has been disabled in ArubaOS 3.4 and engineering is fixing this in ArubaOS 3.5.
To turn off these alerts, issue the following commands:
#ids dos-profile default