Wireless Access

Reply
Contributor II

Past rogue client associations

When I'm looking at a rogue in Airwave, it will show me the current rogue client associations however it doesn't show past associations.  Does anyone know how to find this?  We're trying to find out which user has setup a rogue by finding their mac when they connected to our network, however when they aren't associated it's not easy to track down...

Moderator

Re: Past rogue client associations

AirWave maintains past rogue client associations only if that client has a valid association to a managed AP (within the retention period).  This past association would show up on the client monitoring page for that client.  The rogue ap detail page only shows the current rogue client associations that are seen.

 

The details for these rogue client associations is maintained in 2 database tables: rogue_client and rogue_client_historical.  Rogue client table keeps the current rogue client sessions.  Rogue client historical keeps the past associations.

 

Ways to get to that data via CLI:

# dbc 'select id, mac, ssid, first_heard, last_heard, rogue_ap_id, bssid, ap_id from rogue_client;'

# dbc 'select id, mac, channel, ssid, first_heard, last_heard, rogue_ap_id, bssid, from rogue_client_historical;'

 

It'd be a feature request to enhance this functionality.  Feature requests can be made through the ideas portal on the support website.


Rob Gin
Senior QA Engineer - Network Services
Aruba Networks, a Hewlett Packard Enterprise Company
Contributor II

Re: Past rogue client associations

Thanks Rob, I'll take a look on the CLI to see if that will help but for sure this would be a great feature enhancment!

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: