Looking to tell what access point a client was attached to at a given time

Is there any way to findout what AP a given IP address was attached to at a given time? For instance, we got a hit from our firewall log at 1:30am Sunday. We want to know which MAC had that IP at the time (need to know from WCS who t had given that IP to) and which AP it was associated with at the time.
Currently it's on one AP, but how do I know what it was on 24 hours ago? I've looked at the association history for the client, and the graph appears to be incorrect, since it's currently on AP "A" but it shows for the recorded history, including right now, it's associated with "B". One or the other of the datapoints is incorrect.
The WLC 4402 syslogs everything that I can get it to syslog, but the access points do not, since they consuend too many logging licenses. To get this information, will I need to get these APs logging as well, again?
Thanks for any advice,
Rich

I believe you can get that information if you had location services. The applicance can stor information up to 30 days. I don't know if you can get that information form WCS, unless you generate reports every 30 minutes or every hour.... But I might be wrong.

Similar Messages

  • What access point to use with O2?

    When I connect to the web I have the option to choose how I want to connect (so at home I'll use a WLAN). With O2 what access point are recommended on a postpay contract and does it vary depending on 3G or GPRS reception ?
    i.e. use O2 MobileWeb with 3G?
    Thanks,

    Generally "WEB" should be used with a standard access point i.e no proxies etc
    check the settings under menu>tools>settings>connection>access points
    open the access point you normally use and select options>advanced settings you can then see if any proxies have been added. If necessary delete both the proxy and port
    If clear leave as is and make sure your access point name is the default "02" type. Contact them for this.
    iPhone 5 32GB
    MacBook Pro Retina 15" Mac OS X Mountain Lion 10.8.4

  • How to tell what recovery point was used for restore

    Is there a way to determine what recovery point was used for a restore after the restore was started.

    The question comes from the experience of having a package installed but not being able to build it from the same PKGBUILD (due to nontrivial issues). The package must have been built successfully by *a* build system, so ideally one would want to replicate that build. The relevant differences I could think of are the compiler flags and to a lesser extent the hardware build platform.
    You should describe these supposedly non-trivial issues. I've never experienced what you describe in my years using Arch, nor have I ever heard it suggested that the famously vanilla Arch packages are built using some sort of unconventional compiler flags. I have heard multiple developers say using highly modified CPU optimizations and modified linking and such are mostly pointless, however. So I'd bet a week's pay that the build system uses vanilla GCC with the default settings. Why would the thing that actually builds Arch Linux be the one part of the Arch ecosystem that doesn't abide by the Arch standards? Why would only some packages have library linking problems and such when all packages are built on the same machine against the same library versions---and thus the conditions resulting in a failed build would be identical to those in a successful build? I could be wrong, but I think you're on the wrong track. The quickest way to find out is to describe what the real problem is, not what you imagine the solution to be.

  • Cisco aironet 1200 Series access point dropping clients

    We are having an issue where our Cisco Aironet 1220 Series AP is constantly dropping clients. We have 3 APs mounted on a single tower, all out of each others range and freq. There are approximatly 30 clients on each AP. We are noticing an increase in dropped customers (up to 20 at a time). ANy suggestions? This only became an issue in the last few weeks, and nothing major has changed.

    Hi
    Even I was facing almost the same kind of problem. But in my case it was wired clients to the workgroup bridge 350.
    I had done lot of testings and reading at that time to resolve this problem.
    However in your case I feel your problem can be resolved by keeping the option "Reliable multicast for Workgroup bridges" disabled in the APs under dot11radio interface settings. This is possibly because the radios cannot associate to more than 20 clients at a time if the option is in the enable mode.
    You need to keep this option enabled in a root bridge when you have problems of dropping the wired clients to the workgroup bridge.
    By keeping this option enabled, you are actually asking the Root bridges to consider the Workgroup bridges as Infrastructure devices and not as clients thereby making the roots to send all the multicasts to the WGBs. However in that case it losses the efficiency of associating more than 20 clients.
    Let me know if this resolves your problem.
    Regards

  • How to tell which lightweight access point is offline?

    I may be missing something really obvious here, but is there a coherent way to tell which access point has dissociated from a Cisco controller? For example - i have a controller here with many hundreds of access points being installed. If i have say 500 access points associated and i unplug a random one, the "all APs" in the controller summary will simply drop to 499 total, not 500 total, 499 up and 1 down as i would have expected - it's therefore a bit of a nightmare to trace a missing access point when the number suddenly drops below what i am expecting based on the number i know are physically installed.  
    Hope that makes sense!!! Appreciate any guidance you guys may have!

    Several ways of doing this:  
    1.  If you have a network monitoring tools like WCS/NCS/PI, then it is Cisco's preferred method.  You can enable WCS/NCS/PI to email alerts (personally, I wouldn't recommend it). 
    2.  WCS/NCS/PI uses SNMP to poll the different WLC in your network.  You can craft your own to generate your own system (what we are doing now).

  • Recovering Embeded access point 881-w password

    Can anybody help, I simply need to recover an embeded access point password.
    I have the passwords to the 881-w router, but passwords to the embeded access point I don't have.
    can anybody run me through either the recovery process for it, or the password reset process for the embeded access point.

    // Could you tell me what the configuration would look like for the access point... The router config is below. Only One VLAN, so we're just gonna need a single SSID.
    hostname dmidev3
    boot-start-marker
    boot-end-marker
    security authentication failure rate 3 log
    security passwords min-length 6
    logging message-counter syslog
    logging buffered 51200
    logging console critical
    enable secret 5 $1$TWeA$xn4svL1JR.N93GTPU99gk0
    enable password 7 022229720A122D036F1F
    no aaa new-model
    clock timezone PCTime 0
    clock summer-time PCTime date Mar 30 2003 1:00 Oct 26 2003 2:00
    no ip source-route
    ip cef
    no ip bootp server
    ip domain name dmi.dev.local
    ip name-server 192.168.9.1
    ip name-server 192.168.9.3
    ip name-server 192.168.10.46
    no ipv6 cef
    username admin privilege 15 secret 5 $1$I9/e$MqVbmafwrR5famypO23Pr.
    username dmiadmin password 7 08056147080D2735315A
    archive
    log config
      hidekeys
    ip tcp synwait-time 10
    ip ssh time-out 60
    ip ssh authentication-retries 2
    interface FastEthernet0
    interface FastEthernet1
    interface FastEthernet2
    interface FastEthernet3
    interface FastEthernet4
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    shutdown
    duplex auto
    speed auto
    interface wlan-ap0
    description Service module interface to manage the embedded AP
    ip unnumbered Vlan1
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    shutdown
    arp timeout 0
    interface Wlan-GigabitEthernet0
    description Internal switch interface connecting to the embedded AP
    interface Vlan1
    description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
    ip address 192.168.17.244 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip tcp adjust-mss 1452
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 192.168.17.254
    ip route 192.168.9.41 255.255.255.255 192.168.12.254
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000

  • 1702i access point presales questions

    I am trying to clarify the capabilities of this device before purchase. One of the points of confusion is that the configuration guide applies to the 3700 series, the 2700 series, and the 1700 series. If there is a more appropriate  manual to use than the "Cisco IOS Configuration Guide for Autonomous Cisco Aironet Access Points" for the 1702i, then that would be useful information.
    SSIDs: The manual indicates that the access points are capable of 16 SSIDs running simultaneously, but it doesn't make any distinctions between each of the series. Can I assume the 1702i is capable of 16 SSIDs, and 17 VLANs, like the WAP371?
    DHCP server capabilities: P 5-25 of the manual shows how to use the internal DHCP server capabilities of the unit, but it is not clear to me how many instances, or pools, I can make. Am I limited to only one set, applied to one subnet, or can I define a different pool and subnet for each of the 16 SSIDs?
    Specific model: The manual refers to the 1700i, but it looks like the model available is the 1702i. Are there any differences in the 1702i version?

    "you will also see what access points that is supported on": My point was that the configuration guide did not say whether 16 SSIDs were supported on some or all of the series. That was my reason for asking the question (page 7-2 of the manual)
    "The data sheet of the APs of the comparison guide will show you the feature difference of the access point": You must be looking at a different data sheet than I have been able to find:
    http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-1700-series/datasheet-c78-732347.html
    a search for "SSID" on the page had no hits.
    also the comparison between 1700, 2700, and 3700 series showed no hits for SSID:
    http://www.cisco.com/c/en/us/products/wireless/buyers-guide.html#~indoorac,
    "DHCP is strictly for that access point and it's always prefered to use a true dhcp server and not the access point itself."
    It sounds like you may have misunderstood my question. I'm asking whether the DHCP server capability can assign a different IP pool for each SSID. The "Understanding Multiple SSIDs" section on P 7-2 shows that a different VLAN may be specified for each different SSID, but I can't tell from the "Setting up the DHCP Server" section on P 5-24, whether this can be done for different IP address pools, or just for one.
    For example:
    The SSID "InterEquipment" would use VLAN 2, and the subnet 192.168.2.0
    The SSID "Staff" would use VLAN 3 and use the subnet 192.168.3.0
    The SSID "Guest" would use VLAN 4 and use the subnet 192.168.4.0
    Could the 1702i act as the DHCP server for all of these SSID/Vlan/subnet combinations, or just one of them?
    Concerning your comment "...it's always preferred to use a true dhcp server and not the access point itself." , what is it about the access point that makes it not a "true dhcp server", and why is it "preferred" to use something else?
    -Dave

  • Access point VLANS and IP Addresses for RADIUS servers

    Hi, i would like to have my IAS radius server authenticate clients. I have done that, so my question is about routing and VLANS and incorporating into my existing network.
    What VLAN does the access point communicate to the RADIUS server on? I need to tell the access point to communicate on VLAN1, any other VLAN will not goto the radius server. The access point only has one setable ip address through the http config, is this for management or communication with the radius server?
    Thanks in advance,
    Chris

    Hello,
    Would you mind sharing how you configured both the AP and IAS to work together? I'm not finding anything in the Cisco documentation that shows how to do that and I need to use my IAS server to authenticate clients who connect to the inside SSID on my AP.
    By the way, I have successfully configured an AP with two SSIDs - one for guests that connects those clients to the guest VLAN (a DMZ on my PIX), and one for trusted users that connects them to the VLAN for my inside, secure network). If you haven't got that working, I'd be glad to help.

  • How do i get AE to work as well as old d-link access point

    i have a d-link DSL-604+ which is great - works for broadband acts as a hub and provides wireless at one end of my long thin house. my main mac is plugged into it and works great. i ran some time ago a cat5e cable under the floor boards when we moved in to the other end where the wireless doesnt reach (just) and there i had a d-link dwl-900ap+ connected by the wire to the main router. it was setup with the same ssid and a different channel. my windows work laptop - depending on which end of the house i was would pick up the ssid and connect to the stronger signal no problems i could even walk up and down and it would switch over. now they are both b only and i have recently bought a new airport express with the plan of using airtunes upgrading speed of link and eventually changing my laptop to a mac. now on the old system my router would act as DHCP giving a 192.168 address. i seem unable to setup the AE to do the same thing. i can stream audio to my hifi no problems - this is cool. i can set it up to create a wireless network and give it a different ssid and channel but it doesnt seem to want to choose the same ssid. i can manually change it to the same - is this what i should do? however when i do this the AE trys to act as DHCP and gives a 10.1 address to the laptop which is odd - if i then move the laptop constantly tries connecting to both APs and changes its ip address. if i tell the AE to use 192.168 it says this conflicts with a wan setting. is there a way of saying get dhcp from elsewhere?
    i am sure this is really straightforward and i am missing something. the dlink was easy i told it it was an access point - my network was called xxx and that the network had dhcp and it just worked.
    should i be using the join a wireless network option instead of the create a network? but isnt this for people who are extending their networks wirelessly? i ran a cable.
    thanks

    i seem unable to setup the AE to do the same thing. i can stream audio to my hifi no problems - this is cool. i can set it up to create a wireless network and give it a different ssid and channel but it doesnt seem to want to choose the same ssid. i can manually change it to the same - is this what i should do?
    Yes you will manually need to enter the SSID.
    however when i do this the AE trys to act as DHCP and gives a 10.1 address to the laptop which is odd
    You also need to configure the AirPort Express (AX) to bridge (not share a single IP address).
    should i be using the join a wireless network option instead of the create a network? but isnt this for people who are extending their networks wirelessly?
    You should be using the "create a network" option.

  • Trying to figure out difference between Access Point & Gateway

    Hello All,
    I am trying to figure out how to expand my home network and getting confused by the terms. The following is what I have for equipment"
    WRT 130N
    WRT 54GS
    4 hard wired assorted items hard wired to the 130N
    Here is what I want to do and not sure if I can do it:
    I would like to use the wireless side of the 54GS to connect to the wireless side of the 130N. By [lacing the 54GS on a different floor of our home  we will have four more hard wire ports to utilize for addition hardware we want to network.
    My questions are as follows:
    Is there a way that using the firmware in the 130N & 54GS to do this> The 54GS is V.7 and the 130N is only about six months old so it's the most current firmware. I am completely confused as to what the difference is between a gateway and an access point.
    Today was spent reading everything on the net about after market upgrades and in the end I am only more confused.
    Can anyone offer me some advise or guidance?
    Thanks,
    Ted

    access point:
    A device that allows wireless-equipped computers and other devices to communicate with a wired network. Also used to expand the range of a wireless network.
    gateway:
    A device that interconnects networks with different, incompatible communications protocols
    Analyzing the network environment that you want to create, is it?
    1. wrt130N )))))                                    (((((  wrt54gs  ))))                              ((((( 4 devices 
    2. wrt130N )))))                                    (((((  wrt54gs ----------------------------------------- 4 devices
    If it is figure 1. it is not possible, neither  figure 2. to  get it working that way, because wireless routers can only function as a wireless router, wired router and an access point.
    What you can do though is :
     wrt54gs- at least fw: 7.50.5   ))))))             ((((( wap54g - in repeater mode -  ))))))            (((((( pc
     wrt54gs- at least fw: 7.50.5   ))))))             ((((( wap54g - access point client mode- wrt130n - dhcp disabled  --------------------- 4 devices
    Take note though that wrt54gs has not been know to work with wpa54g access access point client mode
    Your best bet is to just wire wrt130n to wrt54gs and change the ip address of the latter to i.e. 192.168.5.1.
    " I can do all things through Christ which strengthens me. "

  • Access point are not coming up after upgrade image of WLC

    Hi,
    I have AIR-WLC4402-50-K9 WLC i that current IOS is 7.0.98.218 and i upgraded with 7.0.116.0 IOS but after upgrading and reboot the WLC from 15 access point 3 access point are not coming up and 12 are coing up and working fine (4 1142 and 11 1131 series access point) 3 which are not coimg is 1131 series access point. when i login with console to 3 access point its rebooting 2 times and coming on ap: prompt.
    In between that i reloaded the WLC one more time because from 15 acess point only 4 aceess point are came up and i also cleck the show boot on wlc its output is
    7.0.116.0 (default)
    7.0.98.218 (active)
    so i reload  the wlc and checked out of 15 acess point now 12 acess point are up and still 3 are not. And i also checked the output of show boot command its
    7.0.116.0 (default)(active)
    7.0.98.218
    So i things its because of when 2nd time i reload the wlc the remaining 3 access point are getting image from wlc but because of reload its connection should be loss and error loading flash error are coming on acess point.
    After that i recover the IOS for access point and convert into autonomus and from autonomus convert into Leightweight Access point. I also attached the procedure for recover the ios of access poing
    But my question is why this 3 access point are not coming up is this happen's after upgrading wlc can any one please send me Step by Step WLC S/W Upgrade' process and if this this happens some time please send me any doccument related to this.

    Sunil,
         When you rebooted the controller did you do it from the Web GUI, the CLI, or did you physically reboot the controller? I believe and maybe incorrect but if your getting the ap:  < prompt > that means that there is no firmware on the unit. If you have restored these to functioning autonomous unit and then re-converted them to Lightweight and it's still happening then we need to look at a debug output of what is happening when those AP's attempt to join the controller.
    The capture you attached shows that it appears to join the controller and get a config, but are you saying that when it reboots again it stops working?? the other thing I would reccomend is clear out the flash memory since your capture shows the possibility that there are several copies stored there.
    Hope this helps.

  • Access points lost and can't recreate them after E...

    I foolishly took the latest upgrade to the E90 soft/firmware via the Nokia software updater.  Previously I was connecting to the internet & downloading e-mails into my mailbox via GPRS from my phone provider (Swisscom). 
    Following the upgrade, as well as some lesser problems (one application disappeared, calendar entries failed to restore from the backup to my PC) I found there are no access points at all.  I get "No Access Points Defined - Define One Using Connection Settings" when I open the browser.  In Tools/Settings/Connection/Access Points I get "No access points defined.  Define now?" and a screen with some connection settings that I can't complete. 
    I still have the Configuration Messages sent by Swisscom when I first put the PIN in the phone (it was bought PIN-free) that saved access point settings for GPRS and MMS.  If I try to re-save these settings I get "Settings already saved.  Save again anyway?" and on selecting "Yes", "Unable to save all settings.  2 settings saved" - all of which suggests that there are still access points in existence but I can't overwrite them.
    The settings wizard is no good as it just seems to look at e-mail settings, which I don't think have changed.  I've looked on the Swisscom web site but not found anything helpful.
    Solved!
    Go to Solution.

    Update to my previous post: I just found that the solution was to restore factory settings (under Tools/Settings for the E90).  This has restored all of the old access points, and I was also able to re-save those from my phone provider so I have access to the internet & e-mails.
    What confounded me slightly was that (contrary to several other posts I've seen on this forum) the software upgrade changed my Lock Code (which you need to restore Factory Settings) back to the old value of 12345 - I had changed this to another code.  After waiting the necessary 5 minutes I used the old code & it worked.
    In general I agree - a lot of pain and aggravation for very little advantage in taking this upgrade, so I'd say DON'T.

  • Problems probing for rogue access points

    Hello,
    I have a situation where I am trying to locate a rogue AP in one of my office buildings. When I bring a laptop over there with NetStumbler or Inssider, I get no response from any access points or clients. Its like that throughout the entire building. However when I leave the building, the AP start to come up but I cant get near them.
    I have another build that we have as well and the probing works just fine. Would there be a controller template or access point template that would be causing this problem?
    Here is what I am running:
    Cisco 4400 controller with firmware 4.2.130.0
    Cisco 4400 controller with firmware 5.0.148.0
    Cisco WCS 5.1.64.0
    The access points that are connected to the controller with a firmware of 4.2.130.0 is the one that seems to be stopping my attempts with probing. So far my searching for causes has not turned up anything=(
    Any help would be greatly appreciative.

    What are you seeing in the logs? Are the two controllers being used as primary and secondary? You should keep the code the same, just in case ap's move to the other controller?
    When you see a rouge ap, it will also state which ap's are hearing that rouge ap and the signal strength. If you see it -86db or worse, then it is outside of your building most likely.

  • Wrt54g as a wireless access point

    alright i recently changed around my configuration with my wrt54g wireless router. I have made it into an access point which i was unaware is better. Im kinda new to the networking deal though it is what i want to do as a career and access points are new to me. so to the point of this post... when i make it an access point instead of the router i cannot access the admin setup page anymore. I know that when its the DHCP server you type in the default gateway that your given and the admin page pops up... well when its just an access point the gateway is from your router box not the linksys. so how if at all possible am i able to access the setup for the linksys if say i wanted to change the SSID of my network? i appreciate any help
    Solved!
    Go to Solution.

    It depends. If you have another gateway router then you should assign a LAN IP address inside the gateway router LAN. For instance, if your gateway router uses 192.168.0.1/255.255.255.0 then you could assign a LAN IP address of 192.168.0.2/255.255.255.0, turn off the DHCP server and do the LAN-LAN connection.
    If you only have a simple modem and the computers make a direct connection to your ISP then you have to set up a static IP address temporarily. Assuming you did not change the LAN IP address of the WRT from 192.168.1.1/255.255.255.0 you would assign a static IP address 192.168.1.2 with subnet mask 255.255.255.0 on the computer. With this static IP address the computer can access http://192.168.1.1/ After that you change the computer back to DHCP (Retrieve IP address automatically).

  • SSH Version Supported by Access Points

    Hi,
    I'm hoping this is an easy question...so apologies if it appears facile, but I can't find a definitive answer in any Cisco docs I've looked through.
    When access points are used with a WLC, its possible to allow the access points to accept SSH connections (Under the advanced tab of the AP config).
    My question is this: which version of SSH will be used when SSH sessions are created to the AP? (SSH v2?)
    All of the data sheets etc. talk about SSH support, but give now version details.
    Thanks in advance.
    Nigel.

    Hi Nigel,
    Scott is right (as usual )
    Just to confirm, I accessed a CAPWAP AP and looked at the #sh derived-config and this was the only SSH output shown, with SSH enabled on the AP:
    ip ssh version 2
    So, it looks like only SSH2 is allowed. Just to let you know the code ver was 7.0.116.0
    Rocky

Maybe you are looking for