cancel
Showing results forĀ 
Search instead forĀ 
Did you mean:Ā 

EWC ignore clients Deauth frames

EWC ignore clients Deauth frames

M_Nees
Contributor III
At several customers EWC installations i am wondering that some clients are reported as active (Reports - All Active clients) although i know they are definitive offline.

To debug this i have connect a recent Windows 7 client to a WPA2 802.1x SSID. After that i disconnect the SSID via Windows normally.

Remote wireshark trace on that AP shows me a vaild Deauth frame:

0d7bf5f15c834b00ad061f064f133b96_RackMultipart20180126-97961-5my6hv-1_inline.png



But EWC report this MAC as active till idle timer after 30 minutes cut the session ...

Why does EWC ignore this above Deauth Frame ?
EWC = 10.31.07

Anybody who observe this behaviour too ?

11 REPLIES 11

Umut_Aydin
Extreme Employee
Hi all,

I will speak with Engineering about this and will raise a Feature Request if needed.

Regards

Umut Aydin

From my point of view this special, headstrong behaviour should changed to improve the product.
Especially the XMC and Control will benefit with better / more reliable visualizations of disconnected clients - currently we need 30 min (in default) to see if a client is disconnected.

Umut_Aydin
Extreme Employee
Hi all,

FYI

The de-auth packets removes the MU for the AP itself.
#cget muInfo wifi0/1

But it will remain in the client reports for the default idle timers.
After this time the MU get cleared in the Reports.

For more Info see please
https://gtacknowledge.extremenetworks.com/articles/Q_A/How-to-adjust-the-client-timers-on-the-Identi...

Regards

Umut

Adding some Flag into Client Report that MU is disassociated will be really helpful.
GTM-P2G8KFN