Wireless Access

Reply
Frequent Contributor II

Identify MAC Address from IP address and TimeStamp

I'm trying to use Airwave to identify a MAC Address/user given only the IP address and a timestamp. I created a client inventory report filtered on the IP Address set it to "Active during report timeframe" and then put a Report Start/Report End date but I'm getting results for all users that were on during the range and have had the IP address at sometime ever. Is there another report option that can trim the fat so I'm only getting users who were active during the range and had the IP address at during that range?

 

Thanks!

 

Rosie

Guru Elite

Re: Identify MAC Address from IP address and TimeStamp

I've never had any luck doing this via a report, but I'm usually able to track down a device using the IP address in the search at the top.


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Frequent Contributor II

Re: Identify MAC Address from IP address and TimeStamp

That's worked for me if they were online but otherwise it looked like a similar result where i'd have to look through all of the results and try to track down the device.

 

I thought I read that someone queried the database directly and didn't know if that's possible. The data is in there somewhere it just needs to be extracted.

Re: Identify MAC Address from IP address and TimeStamp

 By default, the Airwave search will look for active clients.  You can change the search's behaviour in AMP Setup.

 

Screen Shot 2013-11-07 at 9.18.25 AM.png

Seth R. Fiermonti
Consulting Systems Engineer - ACCX, ACDX, ACMX
Email: seth@hpe.com
-----
If you found my post helpful, please give kudos
Frequent Contributor II

Re: Identify MAC Address from IP address and TimeStamp

But it doesn't allow me to narrow things down by time. It just returns a list of all users who had the IP at sometime and the time stamp of their most recent connection. Unless there is a filter option I'm missing. 

Aruba Employee

Re: Identify MAC Address from IP address and TimeStamp

It seems to me that a Client Session report on the relevant date range — 'Client Search Filter' set to the IP address in question and

'Include details about every session' set to Yes — might do the trick. That should return a list of every client session with a matching IP, and then you could seemingly sort by Connect or Disconnect Time.

 

 

 

Frequent Contributor II

Re: Identify MAC Address from IP address and TimeStamp

It still has it's limitations. The Connect/Disconnect Times and the durations don't calculate correctly. Since they all match the time frame having the sessions doesn't really narrow things down based on the query being used.

 

2013-11-07 15_49_27-SUWLAN-AMP.png

Re: Identify MAC Address from IP address and TimeStamp

If you had clear pass, you could query access tracker during a specific absolute time and search for a client Mac address.

Sent from my iPhone
Seth R. Fiermonti
Consulting Systems Engineer - ACCX, ACDX, ACMX
Email: seth@hpe.com
-----
If you found my post helpful, please give kudos
Frequent Contributor II

Re: Identify MAC Address from IP address and TimeStamp

Can I write you a check for it? I can get it from my dhcp log and then match it up in airwave just trying to make it easier for the powers that be and since the data is in the Airwave databases it would be nice to drill down to it.

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: