Hey

Ive got a few AP1200's that Ive just deployed. Most only have 1 or 2
associations right now as Im ramping it up for production.

Ive got 1 client an IBM laptop with an Intel 2200BG card that keeps
causing these errors on the AP.

%DOT11-4-TKIP_MIC_FAILURE_REPORT: Received TKIP Michael MIC failure
report from the station 000e.3568.a238 on the packet (TSC=0x0)
encrypted and protected by pairwise key.

I see these 1 every few minutes, sometimes it will happen more often
and then the radio interface is put on hold and all my WPA clients are
disassociated. All WPA clients diassociated is bad.

%DOT11-3-TKIP_MIC_FAILURE_REPEATED: Two TKIP Michael MIC failures were
detected within 0 seconds on Dot11Radio0 interface. The interface will
be put on MIC failure hold state for next 60 seconds.


So I read some about these messages and they point to someone attackign
my AP but these are being generated by MAC Addrs that are friendly.

Heres the rundown on my setup,  Cisco AP1200's IOS 12.3(2)JA configed
for WPA \TKIP  with a MS IAS RADIUS server backend.

Anyone ever see these errors before ?  Thanks

Timo

Timo schrieb:

> Ive got 1 client an IBM laptop with an Intel 2200BG card that keeps
> causing these errors on the AP.

Update the drivers. Since the 2200BG uses even the CCX compatibility 
label, blame Intel for their drivers.

> So I read some about these messages and they point to someone attackign
> my AP but these are being generated by MAC Addrs that are friendly.
�
Until now, a setup with WPA with 802.1x PEAP using TKIP/Michael can be 
considered safe.

> Anyone ever see these errors before ?  Thanks

Not the same, but I remember that a Intel 2101B WLAN card wasn't able to 
use broadcast key rotation together with 802.1x. So I avoid Centrino and 
use cards with better drivers. Atheros based cards work fine.

-- 
Uli

These opinions are mine. All found typos are yours.