Illegal packet with cisco aireos

[johol...@gmail.com]

Hello list,

I need your help once more.

Trying to authenticate a cisco aireos device I get a

"Illegal packet (version=0xc0 type= 0x01)"

Here is the dump

10.xx.xx.xx New session
10.xx.xx.xx ---<start packet>---
10.xx.xx.xx key used: xxxxxxxxxxxxxx
10.xx.xx.xx version: 192, type: 1, seq no: 1, flags: unencrypted
10.xx.xx.xx session id: 39392662, data length: 29
10.xx.xx.xx packet body (len: 29): ݏ9-▒;\026▒▒▒lrMK▒\003Q▒o▒80▒▒E#▒b\017
10.xx.xx.xx 0000 dd 8f 39 2d a1 3b 16 8e  e8 f7 6c 72 4d 4b 98 03  ..9-.;.. ..lrMK..
10.xx.xx.xx 0010 51 95 6f af 38 30 a5 87  45 23 e1 62 0f           Q.o.80.. E#.b.
10.xx.xx.xx Packet malformed, skipping detailed dump.
10.xx.xx.xx ---<end packet>---
10.xx.xx.xx 10.xx.xx.xx (null): Illegal packet (version=0xc0 type=0x01)
10.xx.xx.xx Writing AUTHEN/ERROR size=57
---<start packet>---
10.xx.xx.xx key used: xxxxxxxxxxxxxx
10.xx.xx.xx version: 192, type: 1, seq no: 2, flags: unencrypted
10.xx.xx.xx session id: 39392662, data length: 45
10.xx.xx.xx packet body (len: 45): \a\000\000'\000\000Illegal packet (version=0xc0 type=0x01)
10.xx.xx.xx 0000 07 00 00 27 00 00 49 6c  6c 65 67 61 6c 20 70 61  ...'..Il legal pa
10.xx.xx.xx 0010 63 6b 65 74 20 28 76 65  72 73 69 6f 6e 3d 30 78  cket (ve rsion=0x
10.xx.xx.xx 0020 63 30 20 74 79 70 65 3d  30 78 30 31 29           c0 type= 0x01)
10.xx.xx.xx AUTHEN, status=7 (AUTHEN/ERROR) flags=0x0
10.xx.xx.xx msg_len=39, data_len=0
10.xx.xx.xx msg (len: 39): Illegal packet (version=0xc0 type=0x01)
10.xx.xx.xx 0000 49 6c 6c 65 67 61 6c 20  70 61 63 6b 65 74 20 28  Illegal  packet (
10.xx.xx.xx 0010 76 65 72 73 69 6f 6e 3d  30 78 63 30 20 74 79 70  version= 0xc0 typ
10.xx.xx.xx 0020 65 3d 30 78 30 31 29                              e=0x01)
10.xx.xx.xx data (len: 0):
10.xx.xx.xx ---<end pack

Any help is appreciated.

Cheers,

Jörg

[Marc Huber]

Hi Jörg,

looks like a key mismatch. Could you run a tcpdump or Wireshark capture and check whether Wireshark can decrypt the captured packets?

Cheers,

Marc

--
You received this message because you are subscribed to the Google Groups "Event-Driven Servers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to event-driven-ser...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/event-driven-servers/a0873e8f-3fe1-454c-92c1-552f9979367cn%40googlegroups.com.

[johol...@gmail.com]

Hello Marc,

thanks for the hint. I will double check the keys.

Cheers,

Jörg