Wireless Access

I'm trying to use Airwave to identify a MAC Address/user given only the IP address and a timestamp. I created a client inventory report filtered on the IP Address set it to "Active during report timeframe" and then put a Report Start/Report End date but I'm getting results for all users that were on during the range and have had the IP address at sometime ever. Is there another report option that can trim the fat so I'm only getting users who were active during the range and had the IP address at during that range?

 

Thanks!

 

Rosie

I've never had any luck doing this via a report, but I'm usually able to track down a device using the IP address in the search at the top.

That's worked for me if they were online but otherwise it looked like a similar result where i'd have to look through all of the results and try to track down the device.

 

I thought I read that someone queried the database directly and didn't know if that's possible. The data is in there somewhere it just needs to be extracted.

 By default, the Airwave search will look for active clients.  You can change the search's behaviour in AMP Setup.

 

But it doesn't allow me to narrow things down by time. It just returns a list of all users who had the IP at sometime and the time stamp of their most recent connection. Unless there is a filter option I'm missing. 

It seems to me that a Client Session report on the relevant date range — 'Client Search Filter' set to the IP address in question and

'Include details about every session' set to Yes — might do the trick. That should return a list of every client session with a matching IP, and then you could seemingly sort by Connect or Disconnect Time.

 

 

 

It still has it's limitations. The Connect/Disconnect Times and the durations don't calculate correctly. Since they all match the time frame having the sessions doesn't really narrow things down based on the query being used.

 

If you had clear pass, you could query access tracker during a specific absolute time and search for a client Mac address.

Sent from my iPhone

Can I write you a check for it? I can get it from my dhcp log and then match it up in airwave just trying to make it easier for the powers that be and since the data is in the Airwave databases it would be nice to drill down to it.