Guest

Preview Tool

Cisco Bug: CSCur11060 - False positive on honeypot alert with multple SSIDs

Last Modified

Feb 19, 2018

Products (1)

  • Cisco Aironet 3700 Series

Known Affected Releases

8.0(100.0)

Description (partial)

Symptom:
The honeypot alert is triggered with multiple SSIDs in it, and one of which is the production SSID being monitored for honeypot.

Also, the "attacking" device was never in AP mode broadcasting the production SSID. Instead, it connects to production SSID as client only, then may set up MIFI with different SSID as AP later. The honeypot alert will be triggered later with both SSIDs in it.

Conditions:
Any WLC code version
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.