WLAN Reporting and Alerting

To successfully manage any network, timely and accurate information is required. Not only is current and up-to-date information necessary (that is, "snapshots" of the WLAN in its current state), but also historical reporting capabilities are required to help identify trends. Additionally, alerting capabilities are important. WLAN reporting includes three related areas, as described in the following sections:

• Standard/systematic reports

• Trend reports

• Alerts

Standard/Systematic Reports

Standard/systematic reports are the standard set of reports that your network management toolset can generate on a regular basis. They are often called canned reports because they report upon common queries. Your IT staff can run these reports when needed or on a regular basis, such as daily, weekly, or monthly. These reports tend to be repeatable, with their reporting criteria remaining static.

Some examples include reports on the make, model, or configuration of access points in your wireless network, the number of access points in a particular region or theater, a snapshot report on the number of clients associated to a particular access point, the top ten traffic-generating clients or access points, and so on.

The following list includes more detailed possibilities for sample standard reports:

• Detailed status

• Associations

• QoS details

• Security settings

• Per VLAN clients

• Host name/IP address/MAC address/serial number

• Power status

• RADIUS authentications

• Per VLAN Client report

• EAP/MAC failed authentication

• Failed authentication

• AP memory utilization

• AP CPU utilization

• AP packet statistics

• AP packet errors

• AP radio utilization

• Associated clients statistics

• Ethernet interface utilization

• Uptime

Note

Although it is impossible to list all aspects of WLAN reporting, the lists in these sections include some areas that you might want your WLAN management toolset or framework to monitor. These lists should not be considered exclusive or comprehensive but rather indicative of the kinds of reporting metrics. Values listed in the reports are examples only.

Trending

Trending reports are similar to standard reports, but they present the information over a period of time instead of as a snapshot. They are often presented in graphical format, showing how the reported characteristic has changed over a particular period, such as the maximum number of associated or authenticated clients on a particular access point, the CPU utilization of access point, the interface utilization on a particular port, and so on. As their name implies, trending reports identify trends and help ensure that your IT department can proactively plan capacity, upgrade, reconfigure, or fine-tune the network as the environment evolves and user behavior and network utilization changes.

The following list includes sample parameters for trending reports:

• Group of access points

  - RF utilization

  - Ethernet utilization

  - Number of associations

  - Number of authentications

  - Number of failed authentications

  - Maximum client associations

  - Maximum client associations graph

  - Maximum percentage errors

• Single access point

  - RF transmission statistics

  - Ethernet transmission statistics

  - RF and Ethernet utilization graph

  - RF and Ethernet utilization table

  - Top N busiest clients

  - Top N client error rate

Alerts

Alerting is the capability to generate alarms when certain criteria are met. Alerts are useful to identify and remedy undesirable events. They enable reactive action on the part of your IT staff. When an alarm is created and your network management framework has been alerted, IT staff can correct (or in some circumstances, simply acknowledge) the problem.

Examples of common alerts include notification when the CPU utilization of an access point reaches 80 percent or higher, when the number of associated clients peaks above 20 users or devices, and when channel utilization is above 85 percent. They are excellent indicators of complications on the network and are often used to help direct the attention of your IT staff to problem areas, often before the user population realizes or experience difficulties.

The following list includes more detailed possibilities for alerts:

• Access point

  - Do not broadcast SSID

  - SNMP reachable

  - CPU utilization above 60 percent

  - CPU utilization above 80 percent

  - Memory utilization above 60 percent

  - Memory utilization above 80 percent

• Ethernet interface

  - Ethernet port status

  - Ethernet port utilization above 60 percent

• Ethernet port utilization above 80 percent radio interface

  - RF port status down

  - RF port utilization above 30 percent

  - RF port utilization above 40 percent

  - RF port packet errors above 10 percent

  - RF port packet errors above 20 percent

  - RF port WEP errors above 10 percent

  - Max retry count 60 to 90 per interval

  - Max retry count above 90 per interval

  - Associated client count 15 to 30 per AP

  - Associated client count above 30 per AP

  - Associating rate 60 to 90 per poll

  - Associating rate above 90 per poll

  - Authentication rate 60 to 90 per poll

  - Authentication rate above 90 per poll

  - Interference detection (if possible)

• Network/radio policies

  - Rogue AP detection (if possible)

  - Ad-hoc network detection (if possible)

  - Detection of 100 association requests over 15 minutes