Cisco issued this advisory today: Cisco Security Advisory: Wireless ARP Storm Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20070724-arp.shtml Toby Krohn Account Manager CCDA, CSE [EMAIL PROTECTED] Phone :678.352.2859 Mobile :404.906.0909 Fax :678.306.4640 500 Northridge Rd, Suite 800 Atlanta, GA 30350 United States www.cisco.com This e-mail may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply e-mail and delete all copies of this message. -----Original Message----- From: Scholz, Greg [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 24, 2007 1:57 PM To: [email protected] Subject: Re: [WIRELESS-LAN] ARP floods with Cisco APs - could this be the bug? According to the network world article they run both. "Most of the W LAN is comprised of Cisco thin access points and controllers. Some older autonomous Cisco Aironet access points tend to uncover the flooding first, since they try to resolve the ARP request themselves." http://www.networkworld.com/news/2007/071607-duke-iphone.html?page=2 _________________________ Thank you, Gregory R. Scholz Director of Telecommunications Information Technology Group Keene State College (603)358-2070 --Lead, follow, or get out of the way. (author unknown) -----Original Message----- From: Michael Kaegler [mailto:[EMAIL PROTECTED] Sent: Monday, July 23, 2007 3:30 PM To: [email protected] Subject: Re: [WIRELESS-LAN] ARP floods with Cisco APs - could this be the bug? At 1:00 PM -0500 7/23/07, Frank Bulk wrote: >Joe: >No, I don't think so, as this relates to the IOS versions of Cisco's >product, and it's my understanding that Duke uses the LWAPP >configuration. >At 5:35 PM -0400 7/13/07, Kevin Miller wrote: >>For the last week or so, we have seen some unusual problems with our >autonomous (cisco) APs. According to Duke, Duke runs autonomous cisco APs. I haven't seen anyone with a Cisco BugID, and some quick toolkit surfing doesn't raise any suspects, which means they're probably keeping it under wraps. Kevin's sure been...quiet. <poke, poke> :) -porkchop -- Michael "Porkchop" Kaegler, Sr. Network Analyst (845) 575-3061 Marist College, Poughkeepsie, NY ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
