Commands

Current software images

Software images that have been loaded.

Main startup software images

Primary software images for the next startup.

Backup startup software images

Backup software images for the next startup.

Cloud connection state

Cloud connection state: Unconnected, Request, and Established.

Device state

Local device state:

·     Idle—In idle state.

·     Connecting—Connecting to the cloud server.

·     Request_CAS_url—Sent a central authentication service (CAS) URL request.

·     Request_CAS_url_success—Requesting CAS URL succeeded.

·     Request_CAS_TGT—Sent a ticket granting ticket (TGT) request.

·     Request_CAS_TGT_success—Requesting TGT succeeded.

·     Request_CAS_ST—Sent a service ticket (ST) request.

·     Request_CAS_ST_success—Requesting ST succeeded.

·     Request_cloud_auth—Sent an authentication request.

·     Request_cloud_auth_success—Authentication succeeded.

·     Register—Sent a registration request.

·     Register_success—Registration succeeded.

·     Request—Sent a handshake request.

·     Request_success—Handshake succeeded.

Cloud server address

IP address of the cloud server.

Cloud server domain name

Domain name of the cloud server.

Cloud server port

TCP port number used to establish cloud connections.

Connected at

Time when the cloud connection was established.

Duration

Duration since the establishment of the cloud connection.

Process state

Cloud connection processing state:

·     DNS not parsed.

·     DNS parsed.

·     Message not sent.

·     Message sent.

·     Message not received.

·     Message received.

Failure reason

Cloud connection failure reason:

·     DNS parse failed.

·     Socket connection failed.

·     SSL creation failed.

·     Sending CAS url request failed.

·     Sending CAS TGT failed.

·     Sending CAS ST failed.

·     Sending cloud auth failed.

·     Sending register failed.

·     Processing CAS url response failed.

·     Processing CAS TGT response failed.

·     Processing CAS ST response failed.

·     Processing cloud auth response failed.

·     Processing register response failed.

·     Sending handshake request failed.

·     Processing handshake failed.

·     Sending websocket request failed.

·     Processing websocket packet failed.

Last down reason

Reason for the most recent cloud connection interruption:

·     Device or process rebooted.

·     Socket connection error.

·     Configuration changed.

·     Received websocket close packet from cloud.

·     Keepalive expired.

·     Packet processing failed.

·     Main connection went down.

·     Cloud reset connection.

·     Memory reached threshold.

This field displays N/A if the detailed reason of the most recent disconnection cannot be obtained.

Last down at

Time when the cloud connection went down most recently.

Last report failure reason

Reason for the most recent cloud connection packet sending failure:

·     Tunnel is being deleted.

·     Tunnel socket is invalid.

·     Failed to convert string to json.

·     Failed to convert json to string.

·     Failed to create message node.

·     Tunnel is not ready.

·     Failed to create packet buffer.

·     SSL sending failure.

If the reason is SSL sending failure, one of the following detailed reason will be displayed:

·     ssl error none.

·     ssl error ssl.

·     ssl error read.

·     ssl error write.

·     ssl error x509 lookup.

·     ssl error syscall.

·     ssl error zero return.

·     ssl error connect.

·     ssl error accept.

Last report failure at

Time when the most recent cloud connection packet sending failure occurred.

Dropped packets after reaching buffer limit

Number of packets that are dropped because the CMTNL buffer limit is reached.

Total dropped packets

Total number of dropped packets.

Last report incomplete reason

Reason for the most recent unfinished packet sending:

·     Interrupted system call.

·     Socket buffer is full.

Last report incomplete at

Time when the most recent unfinished packet sending occurred.

Buffer full count

Number of times that the buffer becomes full.

Total connections

Number of online 802.1X users.

User MAC address

MAC address of the user.

Access interface

Interface through which the user access the device.

AP name

Name of the AP with which the user is associated.

Radio ID

ID of the radio with which the user is associated.

SSID

SSID with which the user is associated.

BSSID

ID of the BSS with which the user is associated.

Authentication domain

ISP domain used for 802.1X authentication.

IPv4 address

IPv4 address of the user.

If the device does not get the IPv4 address of the user, this field is not available.

IPv6 address

IPv6 address of the user.

If the device does not get the IPv6 address of the user, this field is not available.

Authentication method

EAP message handling method:

·     CHAP—Performs EAP termination and uses CHAP to communicate with the RADIUS server.

·     EAP—Relays EAP packets and supports any of the EAP authentication methods to communicate with the RADIUS server.

·     PAP—Performs EAP termination and uses PAP to communicate with the RADIUS server.

Initial VLAN

VLAN to which the user belongs before 802.1X authentication.

Authorization untagged VLAN

Untagged VLAN authorized to the user.

Authorization tagged VLAN list

Tagged VLANs authorized to the user.

Authorization ACL ID

Number of the ACL authorized to the user.

Authorization user profile

User profile authorized to the user.

Authorization CAR

Authorization CAR attributes assigned by the server.

·     Average input rate—Average rate of inbound traffic in bps.

·     Average output rate—Average rate of outbound traffic in bps.

If no authorization CAR attributes are assigned, this field displays N/A.

Authorization URL

Authorization redirect URL.

Authorization IPv6 URL

Authorization IPv6 redirect URL.

Termination action

Action attribute assigned by the server to terminate the user session:

·     Default—Logs off the online authenticated 802.1X user when the session timeout timer expires. This attribute does not take effect when 802.1X periodic reauthentication is enabled and the periodic reauthentication timer is shorter than the session timeout timer.

·     Radius-request—Reauthenticates the online user when the session timeout timer expires, regardless of whether the 802.1X periodic reauthentication feature is enabled or not.

If the device performs local authentication, this field displays N/A.

Session timeout period

Session timeout timer assigned by the server.

If the device performs local authentication, this field displays N/A.

Online from

Time from which the 802.1X user came online.

Online duration

Online duration of the 802.1X user.

Level flow statistic

Statistics about traffic flows at each accounting level:

·     Level-n—Traffic accounting level. Available levels include level-0 to level-8. Accounting levels are defined in the WLAN accounting policy.

·     Sent packets/bytes—Number of sent packets and bytes.

·     Received packets/bytes—Number of received packets and bytes.

This field is not displayed for a user if no WLAN accounting policy has been assigned to the user.

This field does not display statistics for an accounting level if no traffic of that level has been sent or received.

Member ID

IRF member ID:

·     A prefix of asterisk sign (*) indicates the master device.

·     A prefix of plus sign (+) indicates the device where you are logged in.

·     A prefix of right angle bracket (>) indicates the device that has been temporarily removed from the IRF fabric by using the undo irf member stack enable command.

Role

Role of the member device in the IRF fabric:

·     Master—Master device.

·     Standby—Standby device.

·     Loading—The device is loading software images.

Priority

IRF member priority.

CPU MAC

MAC address of the CPU in the device.

Description

Description you have configured for the member device.

·     If no description is configured, this field displays a dashed line (---).

·     If the description exceeds the maximum number of characters that can be displayed, an ellipsis (…) is displayed in place of the exceeding text. To display the complete description, use the display current-configuration command.

Bridge MAC of the IRF

Bridge MAC address of the IRF fabric.

Auto upgrade

Status of the software auto-update feature:

·     Enabled.

·     Disabled.

MAC persistence

IRF bridge MAC persistence setting:

·     6 min—Bridge MAC address of the IRF fabric remains unchanged for 6 minutes after the address owner leaves.

·     Always—Bridge MAC address of the IRF fabric does not change after the address owner leaves.

·     Disabled—Bridge MAC address of the current master replaces the original bridge MAC address as soon as the owner of the original address leaves.

Topo-domain ID

Topo-domain ID of the IRF fabric. The topo-domain ID you assign to an IRF fabric must uniquely identify the IRF fabric in a multi-IRF network.

Auto merge

Status of the auto-merge feature:

·     Enabled.

·     Disabled.

Member ID

Current IRF member ID of the device.

New ID

IRF member ID assigned to the device. This member ID takes effect at reboot.

Topo-domain

IRF topo-domain ID. The topo-domain ID takes effect at reboot.

Stack

Whether multimember stacking capability is enabled:

·     Enabled—The device can form an IRF fabric with other member devices.

·     Disabled—The device cannot form an IRF fabric with other member devices. The device will be removed from the IRF fabric in a maximum of 5 seconds.

Member interfaces

Network interfaces bound to the IRF port. This field displays Disabled if no network interfaces have been bound to the IRF port.

The channel type of each IRF link is enclosed in brackets. Available channel types include:

·     ctrl—Control channel.

·     data—Data channel.

·     ctrl&data—Hybrid channel.

Member ID

IRF member ID of the packet sender.

CPU MAC

CPU MAC address of the packet sender.

Hello timeout (sec)

The remaining amount of time before the hello packet times out, in seconds. If a new hello packet is not received before the existing hello packet expires, the member device determines that the sender has left the IRF fabric. If a new hello packet is received before the existing hello packet expires, the device refreshes the hello timeout time for the sender based on the received packet.

Member ID

IRF member ID.

Member interfaces

Network interfaces bound to the IRF port. This field displays Disabled if no network interfaces have been bound to the IRF port.

The channel type of each IRF link is enclosed in brackets. Available channel types include:

·     ctrl—Control channel.

·     data—Data channel.

·     ctrl&data—Hybrid channel.

Status

Link status of the network interface:

·     Up—The link is up.

·     Down—The link is down.

·     ADM—The interface has been manually shut down by using the shutdown command.

·     Blocked—The link is blocked. In this state, the device cannot join an IRF fabric.

This field displays two hyphens (--) if no network interfaces are bound to the IRF port.

Feature

Feature name.

Product Description

License description.

Registered at

Time when the license was installed.

License Type

License type by validity period:

·     NA—The system cannot obtain the license type.

·     Permanent—Purchased license that never expires and is always valid.

·     Days restricted—Purchased license that is valid for a period of days, for example, 30 days.

·     Trial (days restricted)—Free trial license that is valid for a period of days.

Time Left (days)

Remaining days of the license. This field is available for a purchased license.

Trial Time Left (days)

Remaining days of the trial period. This field is available for a trial license.

Current State

State of the license:

·     In use—The license is being used.

·     Usable—The license is available for use.

¡     If multiple days-restricted licenses for one feature are installed, only one license is in In use state and the rest licenses are in Usable state.

¡     A date restricted license is in this state if its start date is not reached.

·     Expired—The license has expired.

·     Uninstalled—The license has been uninstalled.

·     Unusable—The license cannot be used.

·     Invalid—The license is invalid and cannot be used.

Uninstall Key

This field is available for licenses that have been uninstalled.

Uninstall Date

Date when the activation file was uninstalled.

Total

Total number of licenses that can be installed.

Usage

Number of licenses stored in the license storage.

Feature

Feature that must be licensed before being used.

Licensed

Licensing state of the feature:

·     N—Not licensed.

·     Y—Licensed.

State

License type by purchasing state:

·     Formal—Purchased license.

·     Trial—Trial license.

·     Pre-licensed—Pre-installed license.

If the feature is not licensed, this field displays a hyphen (-). To use the feature, you must install a valid license file.

Total portal users

Total number of portal users.

Total normal users

Total number of portal users whose authentication type is normal authentication.

Total local users

Total number of portal users whose authentication type is local authentication.

Total email users

Total number of portal users whose authentication type is email authentication.

Total cloud users

Total number of portal users whose authentication type is cloud authentication.

Total QQ users

Total number of portal users whose authentication type is QQ authentication.

Total WeChat users

Total number of portal users whose authentication type is WeChat authentication.

Total facebook users

Total number of portal users whose authentication type is Facebook authentication.

Total MAC-trigger users

Total number of portal users whose authentication type is MAC-trigger authentication.

Username

Name of the user.

Portal server

Name of the portal authentication server.

State

Current state of the portal user:

·     Initialized—The user is initialized and ready for authentication.

·     Authenticating—The user is being authenticated.

·     Waiting SetRule—Deploying portal rules to the user.

·     Authorizing—The user is being authorized.

·     Online—The user is online.

·     Waiting Traffic—Waiting for traffic from the user.

·     Stop Accounting—Stopping accounting for the user.

·     Done—The user is offline.

VPN instance

This field is not supported in the current software version.

MPLS L3VPN the portal user belongs to. If the portal user is on a public network, this field displays N/A.

MAC

MAC address of the portal user.

IP

IP address of the portal user.

VLAN

VLAN where the portal user resides.

Interface

Access interface of the portal user.

Authorization information

Authorization information for the portal user.

DHCP IP pool

Name of the authorized IP address pool. If no IP address pool is authorized for the portal user, this field displays N/A.

User profile

Authorized user profile:

·     N/A—No user profile is authorized.

·     active, AAA—The AAA server has authorized the user profile successfully.

·     inactive, AAA—The AAA server failed to authorize the user profile or the user profile does not exist on the device.

·     active, OAuth—The OAuth server has authorized the user profile successfully.

·     inactive, OAuth—The OAuth server failed to authorize the user profile.

Session group profile

This field is not supported in the current software version.

Authorized session group profile:

·     N/A—No session group profile is authorized.

·     active, AAA—The AAA server has authorized the session group profile successfully.

·     inactive, AAA—The AAA server failed to authorize the session group profile or the session group profile does not exist on the device.

·     active, OAuth—The OAuth server has authorized the session group profile successfully.

·     inactive, OAuth—The OAuth server failed to authorize the session group profile.

ACL number/name

Number or name of the authorized ACL:

·     N/A—No ACL is authorized.

·     active, AAA—The AAA server has authorized the ACL successfully.

·     inactive, AAA—The AAA server failed to authorize the ACL or the ACL does not exist on the device.

·     active, OAuth—The OAuth server has authorized the ACL successfully.

·     inactive, OAuth—The OAuth server failed to authorize the ACL.

Inbound CAR

Authorized inbound CAR information:

·     N/A—No inbound CAR is authorized.

·     CIR—Committed information rate in bps.

·     PIR—Peak information rate in bps.

·     CBS—Committed burst size in bits.

·     active, AAA—The AAA server has authorized the inbound CAR successfully.

·     inactive, AAA—The AAA server failed to authorize the inbound CAR.

·     active, OAuth—The OAuth server has authorized the inbound CAR successfully.

·     inactive, OAuth—The OAuth server failed to authorize the inbound CAR.

Outbound CAR

Authorized outbound CAR information:

·     N/A—No outbound CAR is authorized.

·     CIR—Committed information rate in bps.

·     PIR—Peak information rate in bps.

·     CBS—Committed burst size in bits.

·     active, AAA—The AAA server has authorized the outbound CAR successfully.

·     inactive, AAA—The AAA server failed to authorize the outbound CAR.

·     active, OAuth—The OAuth server has authorized the outbound CAR successfully.

·     inactive, OAuth—The OAuth server failed to authorize the outbound CAR.

Web URL

Authorized Web URL. This field displays N/A if no Web URL is authorized.

Current IP address

IP address of the portal user after passing authentication.

Original IP address

IP address of the portal user during authentication.

Username

Name of the portal user.

User ID

Portal user ID.

Access interface

Access interface of the portal user.

Service-VLAN/Customer-VLAN

Public VLAN/Private VLAN to which the portal user belongs. If no VLAN is configured for the portal user, this field displays -/-.

MAC address

MAC address of the portal user.

Authentication type

Type of portal authentication:

·     Normal—Normal authentication.

·     Local—Local authentication.

·     Email—Email authentication.

·     Cloud—Cloud authentication.

·     QQ—QQ authentication.

·     WeChat—WeChat authentication.

·     Facebook—Facebook authentication.

·     MAC-trigger—MAC-trigger authentication.

Domain

ISP domain name for portal authentication.

VPN instance

This field is not supported in the current software version.

MPLS L3VPN to which the portal user belongs. If the portal user is on a public network, this field displays N/A.

Status

Status of the portal user:

·     Authenticating—The user is being authenticated.

·     Authorizing—The user is being authorized.

·     Waiting SetRule—Deploying portal rules to the user.

·     Online—The user is online.

·     Waiting Traffic—Waiting for traffic from the user.

·     Stop Accounting—Stopping accounting for the user.

·     Done—The user is offline.

Portal server

Name of the portal server.

Vendor

Vendor name of the endpoint.

Portal authentication method

Portal authentication method on the access interface.

The value Direct indicates direct authentication.

AAA

AAA information about the portal user.

Realtime accounting interval

Interval for sending real-time accounting updates, and the maximum number of accounting attempts. If the real-time accounting is not authorized, this field displays N/A.

Idle-cut

Idle timeout period and the minimum traffic threshold. If idle-cut is not authorized, this field displays N/A.

Session duration

Session duration and the remaining session time. If the session duration is not authorized, this field displays N/A.

Remaining traffic

Remaining traffic for the portal user. If the remaining traffic is not authorized, this field displays N/A.

Login time

Time when the user logged in. The field uses the device time format, for example, 2023-1-19  2:42:30 UTC.

DHCP IP pool

Authorized DHCP IP address pool. If no DHCP IP address pool is authorized for the portal user, this field displays N/A.

Web URL

Authorized Web URL. If no Web URL is authorized for the portal user, this field displays N/A.

Inbound CAR

Authorized inbound CAR information:

·     N/A—No inbound CAR is authorized.

·     CIR—Committed information rate in bps.

·     PIR—Peak information rate in bps.

·     CBS—Committed burst size in bits.

·     active, AAA—The AAA server has authorized the inbound CAR successfully.

·     inactive, AAA—The AAA server failed to authorize the inbound CAR.

·     active, OAuth—The OAuth server has authorized the inbound CAR successfully.

·     inactive, OAuth—The OAuth server failed to authorize the inbound CAR.

Outbound CAR

Authorized outbound CAR information:

·     N/A—No outbound CAR is authorized.

·     CIR—Committed information rate in bps.

·     PIR—Peak information rate in bps.

·     CBS—Committed burst size in bits.

·     active, AAA—The AAA server has authorized the outbound CAR successfully.

·     inactive, AAA—The AAA server failed to authorize the outbound CAR.

·     active, OAuth—The OAuth server has authorized the outbound CAR successfully.

·     inactive, OAuth—The OAuth server failed to authorize the outbound CAR.

ACL number/name

Number or name of the authorized ACL:

·     N/A—No ACL is authorized..

·     active, AAA—The AAA server has authorized the ACL successfully.

·     inactive, AAA—The AAA server failed to authorize the ACL or the ACL does not exist on the device.

·     active, OAuth—The OAuth server has authorized the ACL successfully.

·     inactive, OAuth—The OAuth server failed to authorize the ACL.

User profile

Authorized user profile:

·     N/A—No user profile is authorized.

·     active, AAA—The AAA server has authorized the user profile successfully.

·     inactive, AAA—The AAA server failed to authorize the user profile or the user profile does not exist on the device.

·     active, OAuth—The OAuth server has authorized the user profile successfully.

·     inactive, OAuth—The OAuth server failed to authorize the user profile.

Session group profile

This field is not supported in the current software version.

Authorized session group profile:

·     N/A—No session group profile is authorized.

·     active, AAA—The AAA server has authorized the session group profile successfully.

·     inactive, AAA—The AAA server failed to authorize the session group profile or the session group profile does not exist on the device.

·     active, OAuth—The OAuth server has authorized the session group profile successfully.

·     inactive, OAuth—The OAuth server failed to authorize the session group profile.

Max multicast addresses

Maximum number of multicast groups the portal user can join.

Multicast address list

Multicast group list the portal user can join. If no multicast group is authorized, this field displays N/A.

Traffic statistic

Traffic statistics for the portal user.

Uplink packets/bytes

Packet and byte statistics of the upstream traffic.

Downlink packets/bytes

Packet and byte statistics of the downstream traffic.

Dual-stack traffic statistic

IPv4 and IPv6 traffic statistics for the dual-stack user.

Accounting-separate traffic statistics

Traffic statistics of dual-stack users or users with multiple IPv6 addresses.

IPv4 address

IPv4 address of the portal user.

IPv6 address

IPv6 address of the portal user.

Uplink packets/bytes

Packet and byte statistics of the upstream traffic.

Downlink packets/bytes

Packet and byte statistics of the downstream traffic.

IP address

IP address of the portal user.

MAC address

MAC address of the portal user.

Online duration

Online duration of the portal user, in hh:ss:mm.

Username

Username of the portal user.

CPU utilization in 5 secs: 16.8%; 1 min: 4.7%; 5 mins: 4.7%

System CPU usage within the last 5 seconds, 1 minute, and 5 minutes.

JID

Job ID of a process. It never changes.

5Sec

CPU usage of the process within the last 5 seconds.

1Min

CPU usage of the process within the last minute.

5Min

CPU usage of the process within the last 5 minutes.

Name

Name of the process. If square brackets ([ ]) exist in a process name, the process is a kernel thread.

JID

Job ID of a process. It never changes.

Text

Text memory used by the user process, in KB. The value for a kernel thread is 0.

Data

Data memory used by the user process, in KB. The value for a kernel thread is 0.

Stack

Stack memory used by the user process, in KB. The value for a kernel thread is 0.

Dynamic

Dynamic memory used by the user process, in KB. The value for a kernel thread is 0.

Name

Name of the user process. If square brackets ([ ]) exist in a process name, the process is a kernel thread.

VSD name

Name of the VSD to which the AP belongs.

Radio ID

ID of the radio enabled with WIPS.

Status

Status of the sensor:

·     Active—The sensor is enabled with WIPS.

·     Inactive—The sensor is not enabled with WIPS.

Information from sensor n

Information collected from sensor n, where n represents the ID of the sensor.

Detected association-request flood messages

Number of detected messages for association request flood attacks.

Detected authentication flood messages

Number of detected messages for authentication request flood attacks.

Detected beacon flood messages

Number of detected messages for beacon flood attacks.

Detected block-ack flood messages

Number of detected messages for Block Ack flood attacks.

Detected cts flood messages

Number of detected messages for CTS flood attacks.

Detected deauthentication flood messages

Number of detected messages for deauthentication flood attacks.

Detected disassociation flood messages

Number of detected messages for disassociation flood attacks.

Detected eapol-start flood messages

Number of detected messages for EAPOL-start flood attacks.

Detected null-data flood messages

Number of detected messages for null data flood attacks.

Detected probe-request flood messages

Number of detected messages for probe request flood attacks.

Detected reassociation-request flood messages

Number of detected messages for reassociation request flood attacks.

Detected rts flood messages

Number of detected messages for RTS flood attacks.

Detected eapol-logoff flood messages

Number of detected messages for EAPOL-logoff flood attacks.

Detected eap-failure flood messages

Number of detected messages for EAP-failure flood attacks.

Detected eap-success flood messages

Number of detected messages for EAP-success flood attacks.

Detected duplicated-ie messages

Number of detected messages for malformed packets with duplicated IE.

Detected fata-jack messages

Number of detected messages for FATA-Jack malformed packets.

Detected illegal-ibss-ess messages

Number of detected messages for malformed packets with abnormal IBSS and ESS setting.

Detected invalid-address-combination messages

Number of detected messages for malformed packets with invalid source address.

Detected invalid-assoc-req messages

Number of detected messages for malformed association request frames.

Detected invalid-auth messages

Number of detected messages for malformed authentication request frames.

Detected invalid-deauth-code messages

Number of detected messages for malformed packets with invalid deauthentication code.

Detected invalid-disassoc-code messages

Number of detected messages for malformed packets with invalid disassociation code.

Detected invalid-ht-ie messages

Number of detected messages for malformed packets with malformed HT IE.

Detected invalid-ie-length messages

Number of detected messages for malformed packets with invalid IE length.

Detected invalid-pkt-length messages

Number of detected messages for malformed packets with invalid packet length.

Detected large-duration messages

Number of detected messages for malformed packets with oversized duration.

Detected null-probe-resp messages

Number of detected messages for malformed probe response frames.

Detected overflow-eapol-key messages

Number of detected messages for malformed packets with oversized EAPOL key.

Detected overflow-ssid messages

Number of detected messages for malformed packets with oversized SSID.

Detected redundant-ie messages

Number of detected messages for malformed packets with redundant IE.

Detected AP spoof AP messages

Number of detected messages for AP spoofing (AP spoofs AP) attacks.

Detected AP spoof client messages

Number of detected messages for client spoofing (AP spoofs client) attacks.

Detected AP spoof ad-hoc messages

Number of detected messages for Ad hoc spoofing (AP spoofs Ad hoc) attacks.

Detected ad-hoc spoof AP messages

Number of detected messages for AP spoofing (Ad hoc spoofs AP) attacks.

Detected client spoof AP messages

Number of detected messages for AP spoofing (client spoofs AP) attacks.

Detected weak IV messages

Number of detected messages for weak IVs.

Detected excess AP messages

Number of detected messages for AP entry attacks.

Detected excess client messages

Number of detected messages for client entry attacks.

Detected 40MHZ messages

Number of detected messages for clients disabled with the 40 MHz bandwidth mode.

Detected power save messages

Number of detected messages for power saving attacks.

Detected omerta messages

Number of detected messages for Omerta attacks.

Detected windows bridge messages

Number of detected messages for Windows bridge.

Detected soft AP messages

Number of detected messages for soft APs.

Detected broadcast disassoc messages

Number of detected messages for broadcast disassociation attacks.

Detected broadcast deauth messages

Number of detected messages for broadcast deauthentication attacks.

Detected AP impersonate messages

Number of detected messages for AP impersonation attacks.

Detected HT greenfield messages

Number of detected messages in HT greenfield mode.

Detected association table overflow messages

Number of detected messages for association and reassociation DoS attacks.

Detected wireless bridge messages

Number of messages detected by wireless bridges.

Detected AP flood messages

Number of detected messages for AP flood attacks.

Field

Description

Detected hotspot attack messages

Number of detected hotspot attack messages.

Detected unencrypted authorized AP messages

Number of detected unencrypted authorized AP messages.

Detected unencrypted trust client messages

Number of detected unencrypted trust client messages.

Detected honeypot AP messages

Number of detected honeypot AP messages.

Detected man in the middle messages

Number of detected man-in-the-middle messages.

Detected AP channel change messages

Number of detected AP channel change messages.

Total number times countermeasure, current number countermeasure record in virtual-security-domain name

Number of successful countermeasures. This field can display up to 1024 countermeasure records.

MAC Address

MAC address of the wireless device against which WIPS has taken countermeasures.

Type

Type of the wireless device: AP or Client.

Reason

Reason why WIPS takes countermeasures against the wireless device:

·     Att—WIPS takes countermeasures against the device because it is an attacker.

·     Ass—WIPS takes countermeasures against the device because WIPS has taken countermeasures against its associated AP.

·     Black—After WIPS takes countermeasures against the client, the client is added to the blacklist when it associates with an AP.

·     Class—WIPS takes countermeasures against the device based on its device type.

·     Manu—WIPS takes countermeasures against the device based on its MAC address.

Countermeasure AP

Name of the sensor that takes countermeasures against the wireless device.

Radio ID

Radio ID of the sensor that takes countermeasures against the wireless device.

Time

Time when the AC informs the sensor of taking countermeasures against the wireless device.

Type

Wireless device type: AP, Client, or Mesh.

Class

Category of the wireless device.

Duration

Duration since the wireless device entered the current state.

Sensors

Number of sensors that have detected the wireless device.

Channel

Channel on which the wireless device was most recently detected.

Status

Status of the AP or client:

·     Active—The AP or client is active.

·     Inactive—The AP or client is inactive.

AP

MAC address of the AP.

Mesh Neighbor

MAC address of the mesh AP's neighbor.

Client

MAC address of the client.

Last reported associated AP

MAC address of the associated AP that the client most recently reports.

Classification

Category of the AP or client:

·     AP category:

¡     ad_hoc.

¡     authorized.

¡     rogue.

¡     misconfigured.

¡     external.

¡     potential-authorized.

¡     potential-rogue.

¡     potential-external.

¡     uncategorized.

·     Client category:

¡     authorized.

¡     unauthorized.

¡     misassociated.

¡     uncategorized.

Severity level

Severity level of the device.

Classify way

AP or client classification method:

·     Manual—Manual classification.

·     Invalid OUI—Added to the invalid OUI list.

·     Block List—Added to the prohibited device list.

·     Associated—APs that are connected to the AC.

·     Trust List—Added to the permitted device list.

·     User Define—User-defined classification.

·     Auto—Automatic classification.

Dissociative status

Whether the client is an unassociated client.

Status

Status of the AP or client:

·     Active—The AP or client is active.

·     Inactive—The AP or client is inactive.

Status duration

Duration since the wireless device entered the current state.

Vendor

OUI of the device. This field displays the device OUI if the OUI matches an imported OUI. This field displays Not found if no OUI is configured for the device or the OUI does not match any imported OUIs.

SSID

SSID of the wireless service provided by the AP.

Radio Type

Radio mode of the wireless device.

40MHz intolerance

Whether the client supports 40 MHz bandwidth mode.

Countermeasuring

Whether WIPS is taking countermeasures against the wireless device:

·     No.

·     Yes.

Man in the middle

Whether an MITM attack is detected.

Security

Security method:

·     None.

·     WEP.

·     WPA.

·     WPA2.

Encryption method

Data encryption method:

·     TKIP.

·     CCMP.

·     WEP.

·     WAPI-SMS4.

·     None.

Authentication method

Authentication method:

·     None.

·     PSK.

·     802.1X.

·     Others—Authentication methods except for PSK authentication and 802.1X authentication.

Broadcast SSID

Whether the AP broadcasts the SSID. This field displays nothing if the AP does not broadcast the SSID.

QoS supported

Whether the wireless device supports QoS.

Ad-hoc

Whether the wireless device is in Ad hoc mode.

Beacon interval

Beacon interval in TUs. One TU is equal to 1024 microseconds.

Channel band-width supported

Supported channel bandwidth mode:

·     20/40/80MHZ.

·     20/40MHZ.

·     20MHZ.

Hotspot AP

Whether the AP is a hotspot attack AP.

Soft AP

Whether the AP is a soft AP.

Honeypot AP

Whether the AP is a honeypot AP.

Sensor n

Sensor that detected the wireless device. n represents the ID assigned by the system.

Channel

Channel on which the sensor most recently detected the wireless device.

First reported time

Time when the sensor first detected the wireless device.

Last reported time

Time when the sensor most recently detected the wireless device.

n: H-H-H

MAC address of the client associated with the AP. n represents the number assigned by the system.

Reported associated AP

MAC address of the associated AP that the sensor reports.

Total number of APs

Total number of fit APs, WTs, and WTUs.

Total number of connected APs

Total number of connected fit APs, WTs, and WTUs.

Total number of connected manual APs

Total number of connected manual fit APs, WTs, and WTUs.

Total number of connected auto APs

Total number of connected auto fit APs, WTs, and WTUs.

Total number of connected common APs

Total number of connected fit APs.

Total number of inside APs

Total number of connected inside APs. Inside APs are manual APs that are automatically created when anchor APs act as ACs. The name and the serial ID of an inside AP are the local MAC address and local serial ID, respectively.

Maximum supported APs

Maximum number of APs supported by the AC, including fit APs and WTUs.

Total AP licenses

Total number of AP licenses, including the number of common AP licenses and a quarter of the WTU license quantity.

The number of AP licenses used for activating an AP varies by AP type:

·     Common AP—One.

·     WTU—A quarter.

·     WT—None.

Local AP licenses

Number of AP licenses installed on the AC.

Server AP licenses

This field is not supported in the current software version.

Number of AP licenses requested from the license server.

Remaining local AP licenses

Number of unused AP licenses installed on the AC. Each AP occupies one AP license and each WTU occupies 0.25 AP licenses. WTs do not require AP licenses.

Sync AP licenses

This field is not supported in the current software version.

Number of synchronized AP licenses.

APID

ID of the AP to uniquely identify the AP on the AC.

State

Current state of the AP:

·     I—Idle.

·     J—Join.

·     JA—Join acknowledge.

·     IL—The AP is downloading the image file.

·     C—The AP is downloading initial configurations.

·     DC—The AP is checking data.

·     R—The CAPWAP tunnel is operating. It indicates that the AP and the AC have established a CAPWAP tunnel.

·     R/M—The master CAPWAP tunnel is operating. It indicates that the AP and the master AC have established a CAPWAP tunnel.

·     R/B—The backup CAPWAP tunnel is operating. It indicates that the AP and the backup AC have established a CAPWAP tunnel.

·     M—The AP is connected to the master AC.

·     B—The AP is connected to the backup AC.

·     R/IL—The CAPWAP tunnel is operating and the AP is downloading the image file.

Serial ID

Serial ID of the AP. This field displays Not configured if the serial ID of the AP is not configured.

State

Current state of the AP:

·     Idle—Idle.

·     Join—Join.

·     JoinAck—Join acknowledge.

·     Image—The AP is downloading the version.

·     Config—The AP is downloading initial configurations.

·     Data Check—The AP is checking data.

·     Run—The CAPWAP tunnel is operating. It indicates that the AP and the AC have established a CAPWAP tunnel.

·     R/M—The master CAPWAP tunnel is operating. It indicates that the AP and the master AC have established a CAPWAP tunnel.

·     R/B—The backup CAPWAP tunnel is operating. It indicates that the AP and the backup AC have established a CAPWAP tunnel.

·     M—The AP is connected to the master AC.

·     B—The AP is connected to the backup AC.

Backup type

CAPWAP tunnel type:

·     Idle—The AP has not established a CAPWAP tunnel with the AC.

·     Master—The CAPWAP tunnel established between the AP and the master AC.

·     Backup—The CAPWAP tunnel established between the AP and the backup AC.

Region code lock

·     Enabled.

·     Disabled.

Serial ID

Serial ID of the AP. If no serial ID is configured, this field displays Not configured.

MAC address

MAC address of the AP. If no MAC address is configured, this field displays Not configured.

UDP control port number

Port number used by the AP to establish the CAPWAP control tunnel.

UDP data port number

Port number used by the AP to establish the CAPWAP data tunnel.

H/W version

Hardware version of the AP.

S/W version

Software version of the AP.

WT serial ID

Serial ID of the WT that connects to the WTU. This field is displayed only for WTUs.

WT name

Name of the WT that connects to the WTU. This field is displayed only for WTUs.

WT MAC address

MAC address of the WT that connects to the WTU. This field is displayed only for WTUs.

USB state

USB state:

·     Enabled.

·     Disabled.

This field displays N/A if no USB state information is available.

Power level

Power level:

·     Low.

·     Middle.

·     High.

This field displays N/A if the power level is unknown.

Support for this field depends on the AP model.

Power info

Power supply information.

·     Power adapter—The AP uses local power supply.

·     PoE (port1+port2)—The AP uses PoE power supply. The port1 and port2 arguments represent the power supply status of PoE+ ports.

¡     N/A.

¡     802.3af.

¡     802.3at.

Support for this field depends on the AP model.

AP type

AP type:

·     Unknown—This field displays Unknown before the AP comes online.

·     WTU.

·     Virtual AP.

·     Fat AP.

·     Cloud AP.

·     Normal AP.

PoE status

PoE power supply state for each PI:

·     Enabled.

·     Disabled.

Support for this field depends on the AP model.

Description

Description for the AP. If no description is configured, this field displays Not configured.

Priority

AP connection priority for the AC.

Echo interval

Interval for an AP to send echo requests to the AC.

Echo count

Maximum number of echo request transmission attempts.

Keepalive interval

Interval for an AP to send keepalive packets through the CAPWAP data tunnel.

Discovery-response wait-time

Discovery-response timeout timer.

Statistics report interval

Interval for an AP to send statistics reports to the AC.

Fragment size (data)

Maximum fragment size for CAPWAP data packets.

Fragment size (control)

Maximum fragment size for CAPWAP control packets.

MAC type

MAC type of the AP-AC connection:

·     Local MAC—The AP encapsulates frames in 802.3 format before sending them to the AC.

·     Split MAC—The AP encapsulates frames in 802.11 format before sending them to the AC.

·     Local & Split MAC—The AP can encapsulate frames in either 802.3 format or 802.11 format before sending them to the AC.

Tunnel mode

Supported tunnel mode of the AP:

·     Local Bridging—The AP supports local bridging and does not forward data to the AC.

·     802.3 Frame—The AP encapsulates the frames in 802.3 format to send them to the AC.

·     Native Frame—The AP encapsulates the frames in 802.11 format to send them to the AC.

·     Local Bridging & 802.3 Frame—The AP supports the Local Bridging mode and the 802.3 Frame mode.

·     802.3 Frame & Native Frame—The AP supports the 802.3 Frame mode and the Native Frame mode.

·     Local Bridging & Native Frame—The AP supports the Local Bridging mode and the Native Frame mode.

CWPCAP data-tunnel status

Running status of the CAPWAP data tunnel:

·     Up.

·     Down.

Discovery type

Discovery type of the AP:

·     Static Configuration—The AP uses the manually configured IPv4 or IPv6 address of the AC.

·     DHCP—The AP gets the IP address of an AC through DHCP.

·     DNS—The AP gets the IP address of an AC through DNS.

·     Unknown.

NOTE:

In a dual-link backup network, the discovery method of an AP on the backup AC is consistent with that on the master AC.

Retransmission count

Number of retransmission attempts for an AC request.

Retransmission interval

Interval at which AC requests can be retransmitted.

Firmware upgrade

AP software upgrade:

·     Enabled.

·     Disabled.

Sent control packets

Number of sent packets, including Change State Event Response packets after the AC enters Run state. .

Received control packets

Number of received packets, including Change State Event Response packets after the AC enters Run state.

Echo requests

Number of echo requests sent by the AP in RUN state.

Lost echo responses

Number of echo responses not received by the AP in RUN state.

Average echo delay

Average echo delay in milliseconds.

Last reboot reason

Last reboot reason for the AP:

·     Power on.

·     Hard reboot.

·     Watchdog reboot.

·     Unknown reboot.

·     User soft reboot.

·     Kernel exception soft reboot.

·     Kernel deadloop soft reboot.

·     Auto update soft reboot.

·     Unknown soft reboot.

·     Memory exhausted.

·     Other unknown soft reboot.

Last reboot reason(AP check)

Reason for the most recent AP check failure that caused an AP reboot:

·     The radio state was incorrect.

·     The radio channel was incorrect.

·     The radio type was incorrect.

·     The radio bandwidth was incorrect.

·     The radio rate was incorrect.

·     The radio dependence was incorrect.

·     The radio physical status was down.

Last reboot reason(AC check)

Reason for the most recent AC check failure that caused an AP reboot:

·     The radio state was incorrect.

·     The radio channel was incorrect.

·     The radio type was incorrect.

·     The radio bandwidth was incorrect.

·     The radio rate was incorrect.

·     The radio dependence was incorrect.

·     The radio physical status was down.

Latest IP address

IP address that was most recently used by the AP.

Current AC IP

IP address of the AC that is associated with the AP.

Tunnel down reason

CAPWAP tunnel down reason:

·     Failed to create timer.

·     Neighbor dead timer expired.

·     Request wait timer expired.

·     Data check timer expired.

·     Failed to process data channel keep-alive message.

·     Failed to process request.

·     AP was reset.

·     AP was deleted.

·     Failed to come online.

·     Serial number changed.

·     MAC address changed.

·     Number of APs exceeded the limit.

·     Processed join request in Run state.

·     Failed to create AP context.

·     Received failure result code.

·     Failed to retransmit message.

·     Failed to download image file.

·     Image file downloaded successfully.

·     File operation timer expired.

·     Failed to add tunnel.

·     Received WTP tunnel down event from AP.

·     Backup AC closed the backup tunnel.

·     Master and backup tunnel switchover.

·     Failed to inherit configuration.

·     AP authentication failed.

·     Encryption status mismatch.

·     AP was reset due to inconsistent local and reported radio statistics.

·     AP was reset due to inconsistent AP state on APMGR and lib.

·     AP was reset due to inconsistent BSS state on AC and AP.

·     The AP mode will change from fat or cloud-managed AP to fit AP.

This field displays N/A if the CAPWAP tunnel did not go down.

Connection count

Number of times that the AP connects to the AC. It is cleared in either one of the following cases:

·     The AC reboots.

·     The serial ID of the AP changes.

The reset wlan ap command does not clear the connection count.

Backup IPv4

IPv4 address of the backup AC. If no backup AC is specified, this field displays Not configured.

Backup IPv6

IPv6 address of the backup AC. If no backup AC is specified, this field displays Not configured.

Ctrl-tunnel encryption

CAPWAP control tunnel encryption:

·     Enabled.

·     Disabled.

Ctrl-tunnel encryption state

CAPWAP control tunnel encryption state:

·     Encrypted.

·     Not encrypted.

Data-tunnel encryption

CAPWAP data tunnel encryption:

·     Enabled.

·     Disabled.

Data-tunnel encryption state

CAPWAP data tunnel encryption state:

·     Encrypted.

·     Not encrypted.

LED mode

LED lighting mode:

·     quiet—All LEDs are off.

·     awake—All LEDs flash once every minute.

·     always-on—All LEDs are steady on.

·     normal—How LEDs flash in this mode varies by AP model.

Remote configuration

Remote configuration assignment:

·     Enabled.

·     Disabled.

EnergySaving Level

Energy saving level:

·     0—Energy saving disabled.

·     1—Level 1.

·     2—Level 2.

Basic BSSID

MAC address of the radio. This field displays N/A if the AP has not established a CAPWAP tunnel with the AC.

Admin state

Radio state:

·     Up.

·     Down.

Radio type

Wireless mode:

·     5 GHz:

¡     802.11a.

¡     802.11n(5GHz).

¡     802.11ac.

¡     802.11ax.

·     2.4 GHz:

¡     802.11b.

¡     802.11g.

¡     802.11n(2.4GHz).

¡     802.11gac.

¡     802.11gax.

Client dot11ax-only

·     Disabled—Allows 802.11a/b/g/n/ac/ax clients to associate with the radio.

·     Enabled—Allows only 802.11ax clients to associate with the radio.

Client dot11ac-only

·     Disabled—Allows 802.11a/b/g/n/ac/ax clients to associate with the radio.

·     Enabled—Allows only 802.11ac and 802.11ax clients to associate with the radio.

Client dot11n-only

·     Disabled—Allows 802.11a/b/g/n/ac/ax clients to associate with the radio.

·     Enabled—Allows only 802.11n, 802.11ac, and 802.11ax clients to associate with the radio.

Channel bandwidth

Channel bandwidth mode:

·     20 MHz.

·     20 or 40 MHz.

·     20/40/80 MHz.

·     20/40/80/160MHz.

·     20/40/80/160/(80+80)MHz.

Operating bandwidth

Bandwidth being used by the radio.

This field displays (auto switch) if automatic bandwidth switching between 20 MHz and 40 MHz is enabled.

Secondary channel mode

Secondary channel information for the 802.11n, 802.11ac, and 802.11ax radio mode:

·     SCA (Second Channel Above)—The AP operates in 40 MHz bandwidth mode, and the secondary channel is above the primary channel.

·     SCB (Second Channel Below)—The AP operates in 40 MHz bandwidth mode, and the secondary channel is below the primary channel.

·     SCN—The AP does not operate in 40 MHz bandwidth mode.

This field is available only when the bandwidth that the radio is using is 20/40/80MHz.

Secondary channel center frequency

Center frequency information about the 80 MHz bandwidth of the secondary channel when the radio operates in 802.11ac or 802.11ax radio mode with a channel bandwidth of 160/(80+80)MHz.

This field is available only when the bandwidth that the radio is using is 160/(80+80)MHz.

Short GI for 20MHz

Whether the radio supports short GI when it operates in 20 MHz mode.

Short GI for 40MHz

Whether the radio supports short GI when it operates in 40 MHz mode.

Short GI for 80MHz

Whether the radio supports short GI when it operates in 80 MHz mode.

Short GI for 160MHz

Whether the radio supports short GI when it operates in 160 MHz mode.

MIMO

MIMO mode:

·     1x1—The radio sends and receives signals through one spatial stream.

·     2x2—The radio sends and receives signals through two spatial streams.

·     3x3—The radio sends and receives signals through three spatial streams.

·     4x4—The radio sends and receives signals through four spatial streams.

·     5x5—The radio sends and receives signals through five spatial stream.