Security

We are using Amigopods for guest Internet access (both complimentary and purchased) which is working very well.  One outstanding issue that has been on the todo list is to create a report for our meeting planners.  We use Access Codes to grant Internet access to our guests.  These Access Codes can have a session limit ranging from 1 to several hundred, depending on the particular group requesting WiFi for their meeting.  We would like a report that shows the max # of concurrent sessions, per code, per day.  We use MAC account authentication for caching so we have to take these into account when generating the report.

We have tried in-house to create a report, unsuccessfully.  I opened a TAC case, but this didn't produce anything useful.  Several months ago, I asked our account team to find out what our options were but haven't heard back.

Is there a Professional Services Group in Aruba that we could hire to do this?

Thanks,

Bryan

Bryan,

To thank you for being a long time Amigopod customer I would like to help you out with this.

Let me ask you a few questions to scope this a bit better:

1. How many access codes do you have?  A few, a few dozen, hundreds?

2. What is the time period over which you would like to run this report?  i.e. How many days does the report need to cover?  (It would be easier to develop the report if it only has to cover 1 day)

3. What is the typical length of sessions for guests on your network?  Do you see lots of very short sessions (< 5 minutes) or do they tend to average a bit more?

4. How many sessions are you currently delivering in the course of a typical week?

5. What is the desired output of the report - would something like the following CSV work (alternatively, HTML table):

Report for date: December 6, 2012

Access Code,Max Concurrent Sessions

CODE1,10

CODE2,4

CODE3,23

6. What is the field name for your Access Code?  I assume that this is being tracked with each guest account.

7. How do you want to treat MAC caching?  Should a MAC cached account be included in the concurrency count or not?  Are the MAC cached accounts also getting a copy of the access code?  (It might not be possible to get accurate counts in the report if the MAC account does not also have the access code.)

Thanks for the reply -- I have some answers to your questions.  Let me know if you need anything else.

 1. How many access codes do you have?  A few, a few dozen, hundreds?

Typically, an access code is good for a week and we may have up to 20 codes active within that week.  Each code could have a session limit from 1 up to 300.


2. What is the time period over which you would like to run this report?  i.e. How many days does the report need to cover?  (It would be easier to develop the report if it only has to cover 1 day)

One day would be fine, we could run it several times if we wanted a longer range.


3. What is the typical length of sessions for guests on your network?  Do you see lots of very short sessions (< 5 minutes) or do they tend to average a bit more?

I ran the canned report "avg session time per day" for 30 days, and picked out a busier week in early November.  Averaging those 7 days gave me 51minutes.  Sessions for mobile devices are typically shorter, closer to the 5-10 minute range, while a guest using a laptop in a classroom can have a session lasting 8 hours.


4. How many sessions are you currently delivering in the course of a typical week?

I ran the "number of sessions per day" canned report for 30 days, and totaled up the same week's worth of sessions:  80,613.


5. What is the desired output of the report - would something like the following CSV work (alternatively, HTML table):

Yes, something like this looks great, HTML would probably be preferred.

 

Report for date: December 6, 2012

Access Code,Max Concurrent Sessions

CODE1,10

CODE2,4

CODE3,23

 

6. What is the field name for your Access Code?  I assume that this is being tracked with each guest account.

When we create the access code,  such as  INSEAD49,  is entered in the "username" field.  This is what the guests use to log in.  When the MAC accounts get auto-created, the username field is copied to the Full Name ( visitor_name ) field.  The username of the MAC account is populated with the guest device MAC address.

Expression: return ($a=GetAttr('Calling-Station-Id')) && NwaDynamicLoad('NwaCreateUser') && NwaCreateUser(array('creator_accept_terms'=>1, 'role_id'=>25, 'username'=>$a, 'password'=>$a, 'visitor_name'=>$user['username'], 'expire_time'=>$user['expire_time'], 'do_expire'=>4, 'auto_update_account'=>1)) && 0;

So:

inital  account created by us
username        Fullname ( visitor_name )
INSEAD49        

auto created Mac account
username        Fullname ( visitor_name )
00216A2EBD1E     INSEAD49



7. How do you want to treat MAC caching?  Should a MAC cached account be included in the concurrency count or not?  Are the MAC cached accounts also getting a copy of the access code?  (It might not be possible to get accurate counts in the report if the MAC account does not also have the access code.)

Yes, we would want the MAC accounts associated with a particular access code reported on.   The MAC accounts reference the master access code account (above).  
 

See below for a report definition that calculates the session concurrency per your description.

Caveats:

• You must run this report with a 24 hour time window.  (The report defaults to "Yesterday", but you can also run it for a specific day by selecting "A specific date range..." and then choose two date/times separated by exactly 24 hours.)
• Session concurrency is calculated with a 1 minute resolution.

The report is generated in HTML and lists each access code (which is basically the username OR the visitor_name if set) and the maximum session concurrency for that access code, across the entire day.

As a bonus the report also includes the total session concurrency which is graphed across the day.

You should see something like this:

Import the following block of text at Reporting > Import Reports:

-----BEGIN REPORT DEFINITION-----
eNrlWutu2zgW/r/AvgMhBJi2aFJLtnNRmu50esEs0PbHJP2xWCwIWqItbmjJpagknoyBfY15
vXmSPYcXmZLt1NnpYLHYIIBlkof8+J0Lz6HM0mSQ3tfpOI200JJH53U6PE2jj+yOZFWZNUrx
UpOa17WoyppMloRlGXyD3tyMHqWRgJH4mJzA85zNeP0Cmw753aJS+rDQc3m0KGdudM7rDB/j
5DiN3jCZNZJpTnTByZzdiXkzJ2Uzn3BFquk2DM/JAvoCFLYhZ8sj8qnSPCUfm1qTCSeqKcmt
0AVhJBmRomoU0WLOiSg1VzdMHiEMwMxLNpE8j84naQwtAGtaqTnT0TlL4/RepAOL/Merjx+i
85Vlq+BzjgOAPtuiWDkzjJyl0ZLXsARAwu+nuOcpa6Su1wJxkka1Vk2mG8WpgMU/2aGS1ZoC
8ujcrpskrm2h+I3gtxS3UGs2X/gRIFRnBc8bGQA6C6Y3+4hRzbAJvVwYlLDLGhjJ+l8+OQaE
hB2gZGIZYCDcnSEeuU3TgslpteDGCMYoy2VuRiA0qzYKkJU24B1HVnQujFQMDckgTg7xf0gG
g9T8d4eyu42ho2DoSoD6GNBxbzhRnOVVKY0KBmm0gS1OI2tE1JtyH5ST6gNYTwY2khVBUzxw
bVSKWgcdm0YW8uhnomWlKf/SMAmbWTk1AFxjNmdeDcc9NQwR3m336UHiWaMrWjL8LjwW+/Uh
wcBzh7CrS+y07gRuis7b1OCFTjZcyUrhSk5Be23gJMRRLfbGv0suhA+8XiFwXTC9AR1Cynwh
ueb5zk0ke24CuMSZPbavQO+NDgGD5OsGgJZaZBArc+IHEghU+xE/3Jd4CDc3oha6UnRP4NtE
AvQj6H7yGTEuFAQJpZdPyRWQ7kR++9evNZk2UhKUPdq5gREGscFu315vYe22AWqAmUaDqId8
awwI1u5I+aYEALxeHz9bdXCCw5W4sVYEwnAWqv4jDDoIiSMXF+S778hfyEGr35QcbKHWK7C7
SidcJP7c6piV1d2mwlZA8PiPIBieMzjit/vwAxwfn+7no88JkI/dPkuwEQla1K2o+dG+ujgG
DAcbgQNVsdmYQq6h+ZPob4fzw5z8mIq0jp7ur5k2o9gRq1AXx+2JvV0XPYp1pZmkPkHqUXkC
Mlc4IEirQjJryIcMhWZz4KCiyo1NM/DJIM2qvW/CuaDheBNZq+GqKTXNsa3MdP+gBYmmFF8a
m+UYO5qINr0BauZcKzvZendeL/5gTfww2s67HuxJ72OD7znsqQycErZHzepA8smeIbG/ga+E
w/7wMJDD82fTR/76tq8Hm6p+en25MwSePsIqgDBQ9ze3Cc6yIjSKb2QT0DdTVbP4b1jFmbUK
tz7mXSNjoaGzPhwZY7CVDHL0WkyXNMyOYRaXRaF/758d+3iR7I6hmGpCcXTDld8HsvHpln3W
2VUFRnbncgqDQfxshGDE8cBLY0c1ndZchzE4tu6JKTBtKxpADan2qDuA3a0HAETfHya2A0N9
u32X0xqmfy+7J24eq3kqq1uu9kjxu8xu9m/S6lD0mAwS/i6PAegNGvt9IYObdovoOptz9FWN
XjS6U5ntGxRA+i0TckkuvUPUX4uTtjaEAMCNxoadKmSPKiuNnrlJChhpdYQ7u3KVw1tbIwc1
964jOoHp7cELR270nBxQ8owcD556Sktwo5liiwLrLCyzBp2CYw+sW0/SDnKY5LLbt0YNU90w
2fAdsWonwuQRCLdE9Q4+WPf+gK72ZBStV5QaUD85oLt5jH1QrCvViRUATYq50L1amc+ZKA2g
ic1zToNGigXMrFIdDw+laCdYb3ELaCoqJX6uSo2FcjehcBp/xCn5GrKcUKePcIbk/9sZkrFP
It6sb+ke6x572uDgf8kGV3YTNlDT9U3a+uZvoXgNbMEiaGRBWO3fseEjv9OOTR/616jH5rjS
ANugXsr+6YTSdCKr7NrX4veQkMkG61Yh+YXieEdLNYeCClihVr1HeGe7aq/Uxg960x+E9QSb
Xmq0AHJ/YD6pyQMozgLsrV79+U8vNQKGB/JSK/yAz4KYYRdRecuuIO945Yr1N3DGv3yhi13D
8M57iyV7EfjEFfCrXfKlnlT5Eh7unxEKzsj+PvgHEbXJm6dC1ZpYDoiNGORJ/+x9Sp6tQBp8
xKTVU1XNLw7ama758iKrJBGgmwtshLEElrJTJ5B+y2YOmTpTvL2Hy9mSsDInxnODatltKluS
Q1JfiwVirLlZntyLKTnAhV5dkAQbcBHrCqKcdZbZNqGpFIMqEScgHiXwqJaeE3tXr9m1ueh/
8hQBty5n5vH3/+H83TcOFvJ2XX/gUx29uj9wBK4CXefBsB9AaREx9ndhTO6QSTErU6LErNDn
foZfvmdKsSWtpch4Gv/yPYDDKfPAFsj9CzFFFb5wOlwZ+3BmAU9otPAU7XHOB46EjlIwtelJ
EPTiPVzJxV1asxtOFZcVy/v5NE5Pq4W2oZphPn3vsl/TFfg0KJ45VLci14ULdyf2dt6cCEic
ax7ZZoOQlTesppMZOKyslH21sF5C8cxksSbk4XGzqGqhBUB2w83k782fP5HaIUzC2eBKmpOx
7y75jG3MMBiMj98NN4aEMyQD81oHI7PFNqlUbmO2CX1ImSm+CpFdl2CLnYoJ1phUWlfzjf62
fpNgmjuk8c0R8re92yg63Av+9cDOlMhp0VJ5hi+nulPFD0xlOvpk9M2xriQW6pvL3jy07OAb
LgsagOBQB0e30w3mBBDRnPnF8ZmbJqh54+QxQM4GPi2DE359SNumXLBZVUJWZO4KrDkbXBDP
r40nnXpz9kh9l33vg5OYPKjbfOptu006wetrkQcviP5ZqR0GFvvucH9D89eKi3KLeLtT272d
nrC/Kb2fx95nPAEuufP+vIW+jaSpp6XRY7W0sutYc2zXb+8SQkJhqUK0L6z/M9vAXbdBDzK4
qQhfB2Jl0Ey7bebNbybmTHYZT9p2iuBdX3uXxhdMMV31y0eIpVCJZMjpzCfFdjLJZ7zMqWQT
LlvHOMb3xsvKnRwb5GPUaqTk/pSpvzRM8d+lFk+Q04tD5eP8sQM1Z2rmXvqm0diDg2RU7gr8
vrtdqCVygNl/yXdZru/eFBy5ni2RchUeUqjm9TEAzaqyFk3vHD/Ddqm2a9nt2rXW0HvXooIK
iNYFa9/MZ0Jlknc277q91ge+EKUztnDFqIkbE6Zs03q35j2D9q3d885N4ggM3k4Aivhs9P7d
GC+esKTBkjOsWzrpwzoS+ztV+vbd+9efP1xRsxT+isH+wgDqSXUDKRUtIFGV7U8M7A9JoAgx
EEfmKvMnU5u8vfyJ5aKpIYvXl1+k86uwhLPFnaljMHOj/qcMrmScNe7FA+ZFo0l+Oj6bHI5H
CTscZSN+eDpNjg/52WkcD/loeBKftiuUFH9wEYRobMLUrQ3mA9vWLLAW77fmHF9Rta1OHvM2
VYExm6Q2PBYU/9IIIJg2wun53y3YPHE=
-----END REPORT DEFINITION-----

@bryanc – Did this report definition work out for you?

Thanks for creating this report,  it works very well.  It will help us when our clients have questions about their usage.  Now that the holidays have passed, we have several weeks of usage data that we can report on.   I do have two questions:

1)    Is the report looking at/reporting on accounts that are disabled?  The scenario would be reporting on an Access Code that was active in the past, but has since been disabled.

2)    Would there be any way to easily add the results of the two account types ( Master Access code and MAC accounts ) so it shows a total for both, per Access code?



Thanks,
Bryan

Glad to hear the report worked out OK.

1.  Yes, the report is looking at historical sessions, not accounts.

2.  Not sure, will have to take a look at this and get back to you.

@bryanc – I think the easiest way to address #2 is to use two different reports.

These would both be copies of the same report.  In the first copy, add a source filter that checks for "visitor_name is the empty string".  This captures sessions belonging to the "Master Access code" type of account.  The result shown will therefore reflect this.

In the second copy, add a source filter that checks for "visitor_name is not the empty string".  This captures the other sessions i.e. MAC authenticated accounts.

Running these 2 reports and collating the data manually would provide the breakdown between how often the MAC authentication has been used, relative to the access code login method.

Thanks for looking into this --  I will give that a try.