Looking to tell what access point a client was attached to at a given time
Is there any way to findout what AP a given IP address was attached to at a given time? For instance, we got a hit from our firewall log at 1:30am Sunday. We want to know which MAC had that IP at the time (need to know from WCS who t had given that IP to) and which AP it was associated with at the time.
Currently it's on one AP, but how do I know what it was on 24 hours ago? I've looked at the association history for the client, and the graph appears to be incorrect, since it's currently on AP "A" but it shows for the recorded history, including right now, it's associated with "B". One or the other of the datapoints is incorrect.
The WLC 4402 syslogs everything that I can get it to syslog, but the access points do not, since they consuend too many logging licenses. To get this information, will I need to get these APs logging as well, again?
Re: Looking to tell what access point a client was attached to a
I believe you can get that information if you had location services. The applicance can stor information up to 30 days. I don't know if you can get that information form WCS, unless you generate reports every 30 minutes or every hour.... But I might be wrong.
Transferring Crash file from standby: Login to the Active WLC in HA.
From CLI: (Cisco Controller) >transfer upload datatype crash (Cisco
Controller) >transfer upload filename (Cisco
Controller) >transfer upload mode tftp (Cisco Controller) >transfer
This is the start of a display filter cross reference between Wireshark
and OmniPeek. The 1st installment is a table of advanced filters. More
filters will be added as time allows. It is a living doc, so check back
for changes every so often Please feel f...