| Severity |
Event Description |
EMBLEM Mnemonic |
Possible Cause or Recommended Action |
| System Warning |
Failed to create Forwarding Table Entry for Source
host host
host: host MAC address
The packet Router was unable to create a new entry due to lack
of available memory. |
PRTR_FTBL_
SCR_FAILED |
If this message appears continuously, reboot the
access point. |
| System Warning |
Failed to create Forwarding Table Entry for Destination
host host
host: host MAC address
The Packet Router was unable to create a new entry due to lack
of available memory. |
PRTR_FTBL
DEST_FAILED |
If this message appears continuously, reboot the
access point. |
| System Warning |
Host srcaddr has requested that this system's
IP Address be set to newaddr
srcaddr: Source host's IP address
newaddr: Requested new IP address |
PRTR_SYSIP_REQ |
IPSU is trying to set this access point's IP address.
Check that the IPSU user is legitimate. |
| System Warning |
Routine PktRouterRcvRtn is unable to Take the
forwardTbl Guard semaphore |
FWDTBL_
TAKE_FAILED |
If this message appears continuously, reboot the
access point. |
| System Warning |
Routine PktRouterRcvRtn is attempting to recover
the forwardTbl Guard semaphore |
FWDTBL_RECOVER |
If this message appears continuously, reboot the
access point. |
| System Warning |
Routine PktRouter RcvRtn is unable to Give the
forwardTbl Guard semaphore |
FWDTBL_GIVE_FAILED |
If this message appear continuously, reboot the
access point. |
| System Warning |
Unable to locate srchost in packet-forwarding
table
srchost: MAC address of host |
FWDTBL_UNKNW_HOST |
None. |
| System Warning |
Received 802.11 Management Packet from non-802.11
station
srchost
srchost: MAC address of host |
PRO80211_MNGPKT_RCV_ERR1 |
A rogue 802.11 device might be on your network.
Check your facility for rogue devices. |
| System Warning |
Received 802.11 Management Packet from srchost
on non-802.11 port ifDescr
scrHost: MAC address of host
ifDescr: name of network interface device |
PRO80211_MNGPKT_RCV_ERR2 |
Your wireless LAN is under malicious attack. Search
for and remove malicious devices. |
| System Warning |
Received 802.11 Control Packet from srchost
on non-802.11 port
ifDescr
srchost: MAC address of host
ifDescr: name of network interface device |
PRO80211_RCV_INV_PORT |
Your wireless LAN is under malicious attack. Search
for and remove malicious devices. |
| System Warning |
Received 802.11 Control Packet from non-802.11
station srchost
srchost: MAC address of host |
PRO80211_RCV_INV_CTRL |
A rogue 802.11 device might be on your network.
Check your facility for rogue devices. |
| System Warning |
Failed to Update system firmware status
status: Correct file header or failed header
|
SYS_FW_UPD_FAIL |
If this message appears continuously, reset the
access point configuration to defaults and reconfigure. |
| System Warning |
Updating all system firmware |
SYS_FW_UPD_ALL |
None. |
| System Warning |
Updating selected system firmware |
SYS_FW_UPD
|
None. |
| System Warning |
Received DDP Packet from non-802.11 station source
host
host: MAC address of host |
DDP_RCV_PKT_ERR |
A rogue 802.11 device might be on your network.
Check your facility for rogue devices. |
| System Warning |
Station srchost Associated with Encryption,
then attempted to send an Unencryted packet to
desthost (length pktLen)
srchost: MAC address of source host
desthost: MAC address of destination host
pktLen: Length of the 802.11 packet received, in octets |
STA_NOWEP |
A misconfigured or rogue client device is on your
wireless LAN. Find and correct or remove the client device. |
| System Warning |
Unable to start SSH server
|
SSHD_INIT_FAILED |
Reboot the access point. |
| System Warning |
BKeyRotation declared before proper initialization |
BKR_NOT_INIT
|
Ignore this message unless it appears after bootup.
If it appears after bootup, check the configuration and reboot
the access point. |
| System Warning |
BKeyRotation declared before initialization for
VLAN vlanID.
vlanID: numeric VLAN identifier
|
BKR_VLAN_NOT_INIT |
Ignore this message unless it appears after bootup.
If it appears after bootup, check the configuration and reboot
the access point. |
| System Warning |
Vlan vlanID is not Enabled. vlanID:
numeric VLAN identifier
|
BKR_VLAN_DISABLED
|
Ignore this message if the VLAN rotation period
has been set to 0. If the VLAN rotation period is set to a value
higher than 0, check the configuration and reboot the access
point.
|
| System Warning |
Vlan vlanID Key Rotation Interval is 0.
vlanID: numeric VLAN identifier |
BKR_KEY_0PERIOD |
Ignore this message if the VLAN rotation period
has been set to 0. If the VLAN rotation period is set to a value
higher than 0, check the configuration and reboot the access
point. |
| System Warning |
VLAN vlanID Key Index and Count are in
conflicting states.
vlanID: numeric VLAN identifier |
BKR_VLAN_CONFLICT |
Correct the VLAN configuration and reboot the
access point. |
| System Warning |
No WID timer for VLAN vlanID
vlanID: numeric VLAN identifier |
BKR_VLAN_NOWIDTIMER |
Correct the VLAN configuration and reboot the
access point.
|
| System Warning |
BKey1Proc:forwardTbl pointer is NULL |
BKP_FTBL_ERR |
Correct the radio configuration and reboot the
access point.
|
| System Warning |
BKey1Proc:current interface pointer is NULL |
BKP_INF_PTR_ERR
|
Correct the system configuration and reboot the
access point. |
| System Warning |
BKey1Proc:currIface pointer's IfEND is NULL |
BKP_INF_ENDPTR_ERR |
Correct the system configuration and reboot the
access point. |
| System Warning |
BKey1Proc Too many radio interfaces to process |
BKR_MANY_RADIOS |
Correct the system configuration and reboot the
access point. |
| System Warning |
BKey1Proc:DB_dot11PHYType instance is NULL
|
BKP_INF_PHYINST_ERR |
Correct the radio configuration and reboot the
access point. |
| System Warning |
BKey1Proc:DB_dot11PHYType is NULL |
BKP_INF_PHY_ERR
|
Correct the radio configuration and reboot the
access point. |
| System Warning |
BKey1Proc cannot access the radio ifIndex
interface structure.
ifIndex: MIB2 ifIndex of affected interface |
BKR_KEY1_NORADIOINF |
Correct the radio configuration and reboot the
access point. |
| System Warning |
BKey1Proc cannot access the radio ifIndex
control structure.
ifIndex: MIB2 ifIndex of affected interface
|
BKR_KEY1_NORADIOCTRL |
Correct the radio configuration and reboot the
access point.
|
| System Warning |
BKey1Proc Can't access radio ifIndex Radio802_11_c
data.
ifIndex: MIB2 ifIndex of affected interface |
BKR_KEY1_NODEV80211 |
Correct the radio configuration and reboot the
access point.
|
| System Warning |
BKey1Proc Can't access radio ifIndex MIB.
ifIndex: MIB2 ifIndex of affected interface
|
BKR_KEY1_NORADIOMIB |
Correct the radio configuration and reboot the
access point. |
| System Warning |
BKey1Proc Can't access radio ifIndex AWC_MIB.
ifIndex: MIB2 ifIndex of affected interface |
BKR_KEY1_NORADIOAMIB
|
Correct the radio configuration and reboot the
access point. |
| System Warning |
BKey1Proc current default Key Index keyIdx
and Count are in conflicting states. Using default key 0.
keyIdx: WEP key index |
BKR_KEY1_CONFLICT |
Correct the system configuration and reboot the
access point. |
| System Warning |
BKey1Proc can't access AWC_MIB's DefaultKey for
devEnhCtrl Index radioIndex |
BKR_KEY1_NOMIBDKEY |
Correct the system configuration and reboot the
access point.
|
| System Warning |
BKey1Proc is started before proper initialization
|
BKR_KEY1_NOT_INIT
|
Ignore this message unless it appears after bootup.
If it appears after bootup, check the configuration and reboot
the access point. |
| System Warning |
BKey1Proc has bad msg size or Xmit fatal error |
BKR_KEY1_BADSIZE
|
If this message persists, check the signal strength
of associated client devices. |
| System Warning |
BKey start task error
|
BKR_KEY1_TASK_FAILED
|
If this message persists, correct the system configuration
and reboot the access point. |
| System Warning |
BKey task already started |
BKR_KEY1_TASK_STARTED |
If this message persists and does not seem to
have been triggered by a change to the system configuration,
contact Cisco TAC.
|
| System Warning |
BKey declared before VLAN vlanID is ready.
vlanID: numeric VLAN identifier |
BKR_VLAN_NREADY |
Ignore this message unless it appears after bootup.
If it appears after bootup, check the configuration and reboot
the access point.
|
| System Warning |
BKeyXmit finds no entry for VLAN vlanID.
vlanID: numeric VLAN identifier |
BKR_XMIT_NOVLAN |
Ignore this message if the VLAN rotation period
has been set to 0. If the VLAN rotation period is set to a value
higher than 0, check the configuration and reboot the access
point. |
| System Warning |
BKeyXmit can't access AWC_MIB's DefaultKey |
BKR_XMIT_NOMIBKEY |
Correct the system configuration and reboot the
access point. |
| System Warning |
BKeyXmit radio is not OK
|
BKR_XMIT_RADIO_BAD |
Correct the radio configuration and reboot the
access point.
|
| System Warning |
Ethernet Link Lost. Attempting to re-establish
link to primary network
|
LOSS_ETHERNET_ACTION |
None. |
| Protocol Warning |
No EAP-Authentication response for Station |
EAP_NORESP |
Either the client device or the authentication
server might be misconfigured. Check the client and server configurations. |
| Protocol Warning |
RADIUS verification failed for Server Name. Probable
shared secret mismatch |
EAP_SRV_VRF_FAILED |
Check the access point and server configurations
for a shared-key mismatch. |
| Protocol Warning |
Station clientAddr, User username
Failed EAP-Authentication
clientAddr: client MAC address
username: |
EAP_AUTH_FAILED |
Either the client device or the authentication
server might be misconfigured. Check the client and server configurations. |
| Protocol Warning |
Station clientAddr timed-out during EAP
Authentication
clientAddr: client MAC address |
EAP_TOUT
|
Either the client device or the authentication
server might be misconfigured. Check the client and server configurations.
|
| Protocol Warning |
Failed to set Primary Interface of srchost
to port if Descr
srchost: MAC address of host
ifDescr: name of network interface device |
PRTR_PRIM_INF_FAILED |
If this message appears continuously, reboot the
access point. |
| Protocol Warning |
Station host cannot be Associated to itself
host: MAC address of host |
STA_ASSOC_SELF |
A rogue 802.11 device might be on your network.
Check your facility for rogue devices. |
| Protocol Warning |
Station host Failed Authentication, status
status
host: MAC address of host
status: see Statuses
and Reasons |
STA_AUTH_FAILED |
A misconfigured or rogue client device is on your
wireless LAN. Find and correct or remove the client device. |
| Protocol Warning |
Lost Authentication with parent |
PRNT_AUTH_LOST |
Might be caused by a poor radio link. Check for
interference on your wireless LAN. |
| Protocol Warning |
Station host cannot send 802.11 type packets
because it is not in this BSS
host: MAC address of host
type: packet types (Authenticate, Deauthenticate, Associate,
Reassociate, Disassociate) |
PRO80211_PKTBSS_ERR |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Station host must not send 802.11 type
packets because it is not in this BSS
host: MAC address of host
type: packet types
(Deauthenticate, Disassociate) |
PRO80211_PKTBSS_ERR |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Received Truncated 802.11 Management Packet from
srchost (was pktlen bytes, need reqlen
bytes)
srchost: MAC address of host
pktlen: actual length of received packet
reqlen: required length of packet |
PRO80211_MNGPKT_TRNC |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Received Truncated Association
Request from srchost (was pktlen bytes, need reqlen
bytes)
srchost: MAC address of host
pktlen: actual length of received packet
reqlen: required length of packet |
RCV_TRNC_ASSOCREQ |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Received Truncated Association Response from srchost
(was pktlen bytes, need reqlen bytes)
srchost: MAC address of host
pktlen: actual length of received packet
reqlen: required length of packet |
RCV_TRNC_ASSOCRSP |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Received Truncated Reassociation Request from
srchost (was pktlen bytes, need reqlen
bytes)
srchost: MAC address of host
pktlen: actual length of received packet
reqlen: required length of packet
|
RCV_TRNC_RASSOCREQ |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Received Truncated Disassociation from srchost
(was pktlen bytes, need reqlen bytes)
srchost: MAC address of host
pktlen: actual length of received packet
reqlen: required length of packet |
RCV_TRNC_DISASSOC |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Received Truncated Authentication from srchost
(was pktlen bytes, need reqlen bytes)
srchost: MAC address of host
pktlen: actual length of received packet
reqlen: required length of packet |
RCV_TRNC_AUTH |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Received Truncated Deauthentication from srchost
(was pktlen bytes, need reqlen bytes)
srchost: MAC address of host
pktlen: actual length of received packet
reqlen: required length of packet |
RFC_TRNC_DEAUTHREQ |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| Protocol Warning |
Received Truncated 802.11 Control Packet from
srchost (was pktlen bytes, need reqlen bytes)
srchost: MAC address of host
pktlen: actual length of received packet
reqlen: required length of packet |
PRO80211_RCV_TRNC_CTRL |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
Protocol Warning
|
Repeatedly failed to connect to DNS Server. Temporarily
DISABLING DNS lookups. To re-enable, explicitly Disable then
re-Enable DNS on the Name Server Setup page. |
DNS_CON_FAILED |
The DNS server is down or the link to the DNS
server is down. Check the server and the link to it. |
| Protocol Warning |
WEP Required in Associate Response from Parent
host, though this system disallows WEP
host: MAC address of host |
RCV_ASSOCRSP_ENC |
WEP is misconfigured. Correct the WEP mismatch. |
| Protocol Warning |
WEP Unavailable in Associate Response from Parent
host, though this system requires WEP
host: MAC address of host |
RCV_ASSOCRSP_UNENC |
WEP is misconfigured. Correct the WEP mismatch.
|
| Protocol Warning |
Attempt to use SNMP while SNMP is disabled |
SNMP_NOUSE_DISABLED |
Check your SNMP configuration, or check for an
SNMP attack. |
| Protocol Warning |
No EAP-Authentication response for Station clientAddr
from server serverName
clientAddr: client MAC address
serverName: authentication server name or IP addrs |
MACAUTH_NORESP |
Check the authentication server and the link to
it. Check for a shared-key mismatch on the access point or the
authentication server. Check that the server IP address is correctly
configured on the access point.
|
| Protocol Warning |
Station host Failed Reassociation, status
host: host MAC address
status: see Statuses and Reasons |
STA_REASSOC_FAILED |
None. |
| Protocol Warning |
WEP Required in Reassociate Response from Parent
host, though this system disallows WEP
host: host MAC address |
RCV_RASSOCRSP_ENC |
WEP might be misconfigured. Check for a WEP mismatch. |
| Protocol Warning |
WEP Unavailable in Reassociate Response from Parent
host, though this system requires WEP
host: host MAC address |
RCV_RASSOCRSP_UNENC |
WEP might be misconfigured. Check for a WEP mismatch. |
| Protocol Warning |
Received Truncated Reassociation Response from
host (was length bytes, need frame bytes)
host: host MAC address
length: packet length
frame: ReassociationResponseFrame
|
RCV_TRNC_RASSOCRSP |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device.
|
| Protocol Warning |
Unable to start SSH connection |
SSHD_CON_INIT_FAILED |
Reboot the access point.
|
| Protocol Warning |
CRC compensation attack is detected. Disconnect
remote user from ipAddr
ipAddr: IP address of SSH client |
SSHD_CRC_ATTACK |
A user attacked a known security hole in the SSH
protocol. Find and remove the user or disable SSH. |
| Protocol Warning |
VLAN (802.1Q) Tagging is Enabled, but no Native
VLAN is Enabled |
VLAN_NO_NATIVE |
Configure a native VLAN on the access point. |
| Protocol Warning |
Unencrypted traffic is disallowed for VLAN vlanName,
ID vlanID, but configuration does not guarantee an encryption
mechanism
vlanName: textual VLAN name
vlanID: numeric VLAN identifier
|
VLAN_UNENC_TRAF |
Check that the access point VLAN configuration
is complete. |
| Protocol Warning |
The user from Station host is not allowed
Association via SSID ssidIdx
host: host MAC address
ssidIdx: numeric SSID index
|
STA_DISALLOW_SSID
|
None. |
| Protocol Warning |
Default VLAN vlanID, for Infrastructure
SSID ssidIdx is not enabled
vlanID: numeric VLAN identifier of default VLAN
ssidIdx: numeric Infrastructure SSID index |
VLAN_INFRA_DISABLED |
Check the VLAN configuration on the access point.
|
| Protocol Warning |
Default VLAN vlanID, for Infrastructure
SSID is not the Native VLAN nativeVlanID
vlanID: numeric VLAN identifier of default VLAN
nativeVlanID: numeric VLAN identifier of Native VLAN |
VLAN_INFRA_NOT_NATIVE |
This message might appear if a bridge on the wireless
LAN is in workgroup bridge mode. Check the VLAN configuration
on the access point. |
| Port Warning |
Failure connecting to MAC-Authentication Server
for Host host
host: host MAC address |
MACAUTH_CON_FAIL |
Check the configuration on the authentication
server.
|
| Port Warning |
MAC-Address Authentication denied for Station
clientAddr
clientAddr: client MAC address
|
MACAUTH_DENY
|
A rogue 802.11 device might be on your network.
Check your facility for rogue devices.
|
| Port Warning |
Unable to allocate mBlk for packet from srchost
to desthost on port ifDescr
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface |
PRTR_MBLK_ERR |
If this message appears continuously, reboot the
access point. |
| Port Warning |
Unable to allocate link-level header for packet
from srchost to desthost on port ifDescr
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface |
PRTR_NO_PKT_HDR |
If this message appears continuously, reboot the
access point. |
| Port Warning |
Failed to Send Packet on port ifDescr (error=
errornum)
errornum: status error number |
SEND_PCKT_FAILED |
None. |
Port Warning
|
Failed to Address Packet from srchost to
desthost on port ifDescr
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface
|
PRTR_ADDR_ERR |
A device attempting to authenticate might have
roamed during the authentication exchange.
|
| Port Warning |
Failed to parse header of packet from srchost
to desthost on port ifDescr (error=erronum)
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface
errornum: status error number |
PRTR_PKT_HDR_BAD |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
Port Warning
|
Failed to allocate packet to host for procedure
on port ifDescr
procedure: Authentication, Deauthentication, Disassociation,
Association Response, Reassociation Response
ifDescr: Name of network interface |
PRO80211_PKTALLOC_ERR |
If this message appears continuously, reboot the
access point.
|
| Port Warning |
Failed to address or send packet to host
(status=status)
host: MAC address of host
status: see Statuses
and Reasons |
PRO80211_SND_ERROR
|
A device attempting to authenticate might have
roamed during the authentication exchange. |
| Port Warning |
Attempt to set ifAdminStatus of port ifDescr
to unsupported value status
ifDescr: Name of network interface
status: see Statuses
and Reasons |
NET_ADMSTAT_SET_FAILED |
A network management station is misconfigured
or malicious. Check the configuration of your network management
stations |
| External Warning |
Received a DHCP message for an expired request
from host
host: source IP address of host |
PRTR_DHCP_XID_EXP |
The DHCP server or the link to the DHCP server
might be down. Check the server and the link to it. |
| External Warning |
Received multicast MAC address srchost
as SOURCE to destination desthost on port ifDescr
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface |
PRTR_RCV_MCAST |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| External Warning |
Received NULL MAC address as SOURCE to destination
desthost on port ifDescr
desthost: MAC address of destination host
ifDescr: Name of network interface |
PRTR_RCV_MAC0_SRC |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device.
|
| External Warning |
Received NULL MAC address as DESTINATION from
source srchost on port ifDescr
srchost: MAC address of source host
ifDescr: Name of network interface |
PRTR_RCV_MAC0_DEST |
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device. |
| External Warning |
Network Bridge Loop: Received packet from Self
destined to desthost on port ifDescr
desthost: MAC address of destination host
ifDescr: Name of network interface
|
BRLP_SADDR_PKT |
Find and correct the bridge loop. |
| External Warning |
Detected IP address 0.0.0.0 as a Destination address
from source srchost on port ifDescr
srchost: MAC address of source host
ifDescr: Name of network interface |
PRTR_IP0_DEST
|
Your wireless LAN contains a confused or rogue
device. Find and correct or remove the device.
|
| External Warning |
Host srcaddr has incorrect IP address of
this system (believes this address is dstaddr)
srcaddr: IP address of host
dstaddr: IP address
|
PRTR_HOSTIP_BAD
|
There is a problem with the ARP table on a device
on your network. Find and correct or remove the device.
|
| External Warning |
Sorry, IPv6 protocol analysis not yet implemented
(source srchost, destination desthost, port ifDescr
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface
|
PRTR_IPV6_ERR |
None. |
| External Warning |
Packet from srchost to desthost is using
unknown IP version version
srchost: MAC address of source host
desthost: MAC address of destination host
version: IP protocol version number
|
PRTR_IPVER_BAD |
None. |
| External Warning |
Received ARP packet from srchost to desthost
of unknown MAC address format format, length length
srchost: MAC address of source host
desthost: MAC address of destination host
format: MAC address format number
length: ARP packet length |
PRTR_ARP_FMT_BAD
|
None. |
| External Warning |
Attempt by srchost to Seize Self IP Address
via Proxy ARP to desthost
srchost: MAC address of source host
desthost: MAC address of destination host |
PRTR_SEIZEIP |
Your wireless LAN contains a rogue or misconfigured
device with a duplicate IP address. Find and correct or remove
the device. |
| External Warning |
Sorry, IPv6 ARP not yet implemented (source srchost,
destination desthost, port ifDescr
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface |
PRTR_ARP_IPV6_ERR |
None. |
| External Warning |
Received ARP packet from srchost to desthost
on port ifDescr of unrecognized length-byte
IP address)
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface
length: ARP packet length
|
PRTR_ARP_IP_BAD |
There is a problem with the ARP table on a device
on your network. Find and correct or remove the device.
|
External Warning
|
Received ARP packet from srchost to desthost
on port ifDescr of unsupported protocol type type
srchost: MAC address of source host
desthost: MAC address of destination host
ifDescr: Name of network interface
type: protocol type number
|
PRTR_ARP_PROT_BAD
|
There is a problem with the ARP table on a device
on your network. Find and correct or remove the device. |
