Wireless Access

I've been chasing an issue with TAC with visualRF and noticed a differences between the number of clients displayed on the controller dashboard and the clients displayed on Airwave's dashboard. It looks like the controller's dashboard is displaying information from the station-table while AMP is displaying information from the user-table. At least based on the numbers, that is what it appears to be doing. This FAQ describes the difference between these tables: 

 

https://arubanetworkskb.secure.force.com/pkb/articles/FAQ/What-is-the-difference-between-station-table-and-user-table

 

When I look at these tables, there is usually at least a client count of 100+ difference. Why is that? Does the user-table cache client info longer or something like that?

 

show station-table | include Entries

Station Entries: 640

 

show user-table | include Entries

User Entries: 779/779

 

Thanks,

Robert

 

 

A client may be associated but not authenticated to the network resulting in being present in the station-table and not the user-table.

This is related, but if I'm reading it correctly, I'd expect more devices in the station table than in the user table.

https://arubanetworkskb.secure.force.com/pkb/articles/HowTo/R-969

---

@rwilsonblue wrote:

This is related, but if I'm reading it correctly, I'd expect more devices in the station table than in the user table.

https://arubanetworkskb.secure.force.com/pkb/articles/HowTo/R-969

---

A device could be in the user table with its WAN (3g/4g)device ip address as well as its WLAN ip address.  The "enforce DHCP" setting in the AAA profile on the controller could prevent this.

Our primary SSID has Enforce DHCP enabled. Is there a way to dump the user table without pausing or export it in a format that one could parse?

Yes, you can use the 'no paging' command to disable paging.

 

Please not that the station-table shows associations (connected devices), the user table shows active IP-addresses.

 

In my situation, I see many stations with both an IPv4 and an IPv6 address, what also happens quite often is when clients roam from cellular 3G/4G to WLAN, or from another WLAN still use their old IP address which shows up in the user table.

 

So the same connected client (station-table) can have any number of entries in the user table (even zero user table entries is possible). If you analyze, you will likely see more than one user-table entries per mac-address (station-table).

 

This post: http://community.arubanetworks.com/t5/Unified-Wired-Wireless-Access/Why-am-I-seeing-strange-IPs-in-the-user-table/m-p/206363 seems related to your question. The valid-user ACL may help if you want to prevent this behavior.

 

Herman

Thanks for the response. "no paging" helps, but it still has the headers every page. grrrr.

 

A quick glance shows our standard IP addresses. I'll search for dupe MACs and see what that shows.

Thanks.

 

Looking for duplicate MACs shows only a few and those that are dupes have the same valid IP address. The IPs of devices in the user-table look valid.

 

Here are the current counts from both tables. 

 

Station Entries: 609

User Entries: 788/788

 

What are those settings called and what are the defaults? Maybe they've been tweaked.

Thanks,
Robert

 

Robert,

 

I don't understand what settings you are referring to..

 

Herman

Colin stated, " That is a general statement and user table timers could affect how big this descrepancy is." I assumed there are some settings for this. There may not be.

 

Thanks,
Robert

 

Robert,

If you opened a TAC case, you should continue to pursue it with TAC. You stated that this is a discrepancy between how many devices are in the user table and how many are in Airwave; you should only be comparing the user table to how many users are in Airwave at this point. My mention about the timers will not affect the number of users in the user table and Airwave.

Please continue to wok with TAC because they have your detailed information and we are only guessing here. It is too easy to undo progress simply by guessing.

At this point, it looks to me like the dashboard on the controller shows the station-table count, not the user-table table count. Montoring->Clients seems to show the user-table count. If AMP is showing the user-table count, then that explains the difference.

 

Thanks. I'll continue to work with TAC.

rwilsonblue,

 

Yes, please bring it up with TAC if that is your observation.  I really don't want to send you in the wrong direction, especially when we do not have all of the relevant information available.

 

rwilsonblue,

 

You are talking about two different things, and they might need to be addressed separately:

 

A device will make it into the user table only if it has an ip address (even a .169 address).  Devices that do not connect successfully, but still attempt, make it into the station table, but not the user table; that should be the discrepancy between the station table and the user table.  That is a general statement and user table timers could affect how big this descrepancy is.

 

With regards to airwave, if you are using AMON to send traffic from the controller to Airwave, try turning off the "Prefer AMON" setting to see if there is a difference.

 

This question maybe more acedeamic than practical. How does the Controller know the wired IP of a Laptop that is connected on the wire and wireless and puts both the wired and wireless IP in the user table ?

I saw some mention that the Controller finds that out form the DHCP, ARP request etc. Wired traffic leakage to wireless etc.

Curious how does the Controller determinr the wired IP of this dual connected client, inquiry minds want to know ....