Is it possible to determine the reason for a de-auth from an SNMP trap?

[aaron_lang]

Recently, we had a situation where multiple clients de-authenticated from an AP and I'm trying to determine the reason. Unfortunately, I no longer have logs for the associated time periods, I only have the ahConnectionChangeEvent traps that were sent to my Solarwinds server. Does anyone know if any of those fields can point me to the reason? I found this link, http:// http://www.circitor.fr/Mibs/Html/A/AH-TRAP-MIB.php#ahCode, that gives basic descriptions of the fields but doesn't expand on the codes.

Specifically, is ahCode field of any significance? Seems to be the only one I can't decipher.

ahCode = 117440525 

[aaron_lang]

Unfortunately, they are the only historical logs I have of the event. If I had the AP logs of the event or was monitoring the device at the time I wouldn't be asking.

[bruce_stahlin · Accepted solution]

Is there any particular reason you want to troubleshoot with SNMP? HiveManager can help immensely with rather elegant tools; Client 360 in the cloud is particularly helpful. Client Monitor is also very helpful for realtime troubleshooting.

Best,

BJ