I'd like to revisit this old entry on COTD.
I've been reading this at CRG6.2 page 96:
"When this feature is enabled, the controller actively sends probe packets to all users with the same MAC address but different IP addresses. The users that fail to respond are purged from the system. This command enables quick detection of multiple instances of the same MAC address in the user table and removal of an “old” IP address. This can occur when a client (or an AP connected to an untrusted port on the controller) changes its IP address."
And COTD 2009 says it is ICMP packets sent to confirm the user presence:
http://community.arubanetworks.com/t5/Command-of-the-Day/COTD-aaa-user-fast-age/td-p/4098
I might be understanding it wrong since many people call "probes" to simple ICMP echo requests, but, shouldn't it be interpreted as the controller sending 802.11 management messages (PROBES) to both 802.11 clients appearing under the same mac? I mean, if it is ICMP based it would never work with Windows firewall enabled (which is by default).
Thanks!