Menu
What's new
By:
Filters Better Search

Question - How Does Wireless Log determine Connected time?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

JGrana

JGrana

Very Senior Member
I'm working on my own network map using nmap to scan my network periodically. I have IP, hostname, mac and manufacturer. I can't seem to figure out how to find or calculate the clients "connected" time like the Wireless Log page shows...
Is there a log file somewhere or is it calculated from various logs - or is it closed source?
 
JGrana said:
Is there a log file somewhere or is it calculated from various logs - or is it closed source?
Click to expand...
The information is directly queried from the radio using Broadcom's API. You can use the wl userspace tool to retrieve a list of associated clients for each radio, and query it for detailed info, but it might not be very efficient unless you don't do it repeatedly.

Code: 
admin@stargate:/tmp/home/root# wl -i eth8 assoclist
assoclist 48:BC:00:01:02:03

admin@stargate:/tmp/home/root# wl -i eth8 sta_info 48:BC:00:01:02:03
[VER 8] STA 48:BC:00:01:02:03:
     chanspec 157/80 (0xe29b)
     aid:8 
     rateset [ 6 9 12 18 24 36 48 54 ]
     idle 3 seconds
==>     in network 56230 seconds
     state: AUTHENTICATED ASSOCIATED AUTHORIZED
     connection: SECURED
     auth: WPA3-SAE
     crypto: AES_CCM
     flags 0x8d1e13a: WME PS N_CAP VHT_CAP HE_CAP AMPDU AMSDU GBL_RCLASS MBO_CAP
     HT caps 0x9ef: LDPC 40MHz SGI20 SGI40 STBC-Tx STBC-Rx
     VHT caps 0x15f: LDPC SGI80 SGI160 STBC-Tx STBC-Rx SU-BFE MU-BFE
     HE caps 0x66b9: LDPC HE-HTC SU-BFR SU&MU-BFE
     OMI 0x0251: 80Mhz rx=2ss tx=2ss ER_SU_DISABLE 
     tx total pkts: 5327807
     tx total bytes: 1274940838
     tx ucast pkts: 63036
     tx ucast bytes: 266110180
     tx mcast/bcast pkts: 5264771
     tx mcast/bcast bytes: 1008830658
     tx failures: 0
     rx data pkts: 80397
     rx data bytes: 12496400
     rx data dur: 0
     rx ucast pkts: 79460
     rx ucast bytes: 12326826
     rx mcast/bcast pkts: 937
     rx mcast/bcast bytes: 169574
     rate of last tx pkt: 816660 kbps - 408330 kbps
     rate of last rx pkt: 6000 kbps
     rx decrypt succeeds: 26164
     rx decrypt failures: 0
     tx data pkts retried: 12
     per antenna rssi of last rx data frame: -73 -80 -68 -72
     per antenna average rssi of rx data frames: -72 -80 -68 -72
     per antenna noise floor: -92 -93 -91 -91
     tx total pkts sent: 64680
     tx pkts retries: 8283
     tx pkts retry exhausted: 0
     tx FW total pkts sent: 0
     tx FW pkts retries: 0
     tx FW pkts retry exhausted: 0
     rx total pkts retried: 1141
MCS SET : [ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 ]
VHT SET : 0x1 1x1 2x1 3x1 4x1 5x1 6x1 7x1 8x1 9x1 
        : 0x2 1x2 2x2 3x2 4x2 5x2 6x2 7x2 8x2 9x2 
HE SET  :
        20/40/80 MHz:
        NSS1 Tx: 0-11        Rx: 0-11
        NSS2 Tx: 0-11        Rx: 0-11
smoothed rssi: -68
tx nrate
he mcs 8 Nss 2 Tx Exp 2 bw80 ldpc 2xLTF GI 1.6us auto
rx nrate
legacy rate 6 Mbps stf mode 0 auto
wnm
0x1:  BSS-Transition
VENDOR OUI VALUE[0] 00:50:F2 
VENDOR OUI VALUE[1] 8C:FD:F0 
VENDOR OUI VALUE[2] 00:00:F0 
VENDOR OUI VALUE[3] 50:6F:9A 
link bandwidth = 80 MHZ 
RRM capability = 0x400911073 Link_Measurement Neighbor_Report Beacon_Passive Beacon_Active Beacon_Table LCI_Measurement AP_Channel_Report FTM_Range_Reporting
Frequency Bands Supported: 2.4G 5G 6G
 
What is interesting about the reported "Connected" time is that there seems to be a regularly increasing underestimation of the 2.4GHz results.

Every 24 hours, the reported "Connected" time for any given 2.4GHz device that has been kept continuously connected to the network is about 30 minutes lower than what it should be. In other words, instead of getting incremented by 86400 seconds every day, the Connected time seems to be incremented by 84600 seconds only. That does not happen with the 5GHz results. I wonder whether there's a typo in a formula or calculation...

At least that's what I see with my RT-AX86U Pro running 3004.388.7. But I'm not implying this is related to Asuswrt-Merlin, please don't get me wrong.
 
Last edited:
RMerlin said:
The information is directly queried from the radio using Broadcom's API. You can use the wl userspace tool to retrieve a list of associated clients for each radio, and query it for detailed info, but it might not be very efficient unless you don't do it repeatedly.

Code: 
admin@stargate:/tmp/home/root# wl -i eth8 assoclist
assoclist 48:BC:00:01:02:03

admin@stargate:/tmp/home/root# wl -i eth8 sta_info 48:BC:00:01:02:03
[VER 8] STA 48:BC:00:01:02:03:
     chanspec 157/80 (0xe29b)
     aid:8
     rateset [ 6 9 12 18 24 36 48 54 ]
     idle 3 seconds
==>     in network 56230 seconds
     state: AUTHENTICATED ASSOCIATED AUTHORIZED
     connection: SECURED
     auth: WPA3-SAE
     crypto: AES_CCM
     flags 0x8d1e13a: WME PS N_CAP VHT_CAP HE_CAP AMPDU AMSDU GBL_RCLASS MBO_CAP
     HT caps 0x9ef: LDPC 40MHz SGI20 SGI40 STBC-Tx STBC-Rx
     VHT caps 0x15f: LDPC SGI80 SGI160 STBC-Tx STBC-Rx SU-BFE MU-BFE
     HE caps 0x66b9: LDPC HE-HTC SU-BFR SU&MU-BFE
     OMI 0x0251: 80Mhz rx=2ss tx=2ss ER_SU_DISABLE
     tx total pkts: 5327807
     tx total bytes: 1274940838
     tx ucast pkts: 63036
     tx ucast bytes: 266110180
     tx mcast/bcast pkts: 5264771
     tx mcast/bcast bytes: 1008830658
     tx failures: 0
     rx data pkts: 80397
     rx data bytes: 12496400
     rx data dur: 0
     rx ucast pkts: 79460
     rx ucast bytes: 12326826
     rx mcast/bcast pkts: 937
     rx mcast/bcast bytes: 169574
     rate of last tx pkt: 816660 kbps - 408330 kbps
     rate of last rx pkt: 6000 kbps
     rx decrypt succeeds: 26164
     rx decrypt failures: 0
     tx data pkts retried: 12
     per antenna rssi of last rx data frame: -73 -80 -68 -72
     per antenna average rssi of rx data frames: -72 -80 -68 -72
     per antenna noise floor: -92 -93 -91 -91
     tx total pkts sent: 64680
     tx pkts retries: 8283
     tx pkts retry exhausted: 0
     tx FW total pkts sent: 0
     tx FW pkts retries: 0
     tx FW pkts retry exhausted: 0
     rx total pkts retried: 1141
MCS SET : [ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 ]
VHT SET : 0x1 1x1 2x1 3x1 4x1 5x1 6x1 7x1 8x1 9x1
        : 0x2 1x2 2x2 3x2 4x2 5x2 6x2 7x2 8x2 9x2
HE SET  :
        20/40/80 MHz:
        NSS1 Tx: 0-11        Rx: 0-11
        NSS2 Tx: 0-11        Rx: 0-11
smoothed rssi: -68
tx nrate
he mcs 8 Nss 2 Tx Exp 2 bw80 ldpc 2xLTF GI 1.6us auto
rx nrate
legacy rate 6 Mbps stf mode 0 auto
wnm
0x1:  BSS-Transition
VENDOR OUI VALUE[0] 00:50:F2
VENDOR OUI VALUE[1] 8C:FD:F0
VENDOR OUI VALUE[2] 00:00:F0
VENDOR OUI VALUE[3] 50:6F:9A
link bandwidth = 80 MHZ
RRM capability = 0x400911073 Link_Measurement Neighbor_Report Beacon_Passive Beacon_Active Beacon_Table LCI_Measurement AP_Channel_Report FTM_Range_Reporting
Frequency Bands Supported: 2.4G 5G 6G
Click to expand...
Thanks @RMerlin - looks easy enough with the script doing the work ;-)

Done, thanks again

Code: 
192.168.1.96     KasaPwrStrip                   E4:FA:C4:56:10:1D    Unknown                                  22:44:46
192.168.1.101    Oceanus                        B4:0E:DE:7E:91:C7    Intel Corporate                          00:39:35
192.168.1.105    CasitaDeckLights               1C:61:B4:B0:A7:5B    TP-Link Limited                          22:45:19
192.168.1.106    DeckLights                     1C:61:B4:C9:EB:90    TP-Link Limited                          22:44:51
 
Last edited:
This wl method of determining connection time was extremely interesting to me, and got my wheels turning for some additions I'd like to make to RTRMON... I've had success pulling info from wl / comparing the mac to the "custom_clientlist" NVRAM entry, and pulling IP info from /proc/net/arp, resulting in being able to show which clients are connecting to different wifi interfaces:

Code: 
(ex: clients connected to my eth6/5GHz)

Name        | IP            | MAC               | Uptime  | TX       | RX
Sony XBR TV | 192.168.50.75 | 40:5B:D8:4E:3B:25 | 16h:33m | 10.08 GB | 0.38 GB
XBOX One    | 192.168.50.79 | 04:27:28:4B:6D:16 | 02h:18m | 3.39 GB  | 0.40 GB

@RMerlin The question I wanted to ask you (or the community in general) is what method would be easiest to determine which clients are connected via network on br0? When I look at /proc/net/arp or run "arp -an", I get similar info showing me that wifi and network devices are mixed together, and all show as being connected to br0. I'd almost have to use that as a master list, and try to remove entries if I identify them as wifi clients, and then the resulting list would be just the LAN clients left over... or is there an easier way?
 
Last edited:
The only method I can think of to inventory what clients are physically connected over Ethernet is the same one used by networkmap: Send pings or ARP pings to the whole subnet, then gather the results. Which is why networkmap was hardcoded to a /24, because sending arp pings to a /8 would totally trash your network.
 
RMerlin said:
The only method I can think of to inventory what clients are physically connected over Ethernet is the same one used by networkmap: Send pings or ARP pings to the whole subnet, then gather the results. Which is why networkmap was hardcoded to a /24, because sending arp pings to a /8 would totally trash your network.
Click to expand...
Thank you for the advice! I'll keep plugging away at this... ;)
 
You must log in or register to reply here.

Similar threads

M
Skynet How to find out if a connected device tries to call any sites/google?
Replies
6
Views
517
Muon
M
gogreen1
How can I identify a mystery device on my network?
Replies
10
Views
2K
Tech9
Tech9
J
How does Asus or Asus Merlin source the device name under the System Log, Wireless Log Tab?
2
Replies
32
Views
2K
glens
G
M
wlceventd entries filling my log file
Replies
3
Views
1K
ColinTaylor
C
F
Problem getting Wireless IP address - Some Clients
Replies
7
Views
186
lgkahn
L
Similar threads
Thread starter Title Forum Replies Date
L question of vpn director rule Asuswrt-Merlin 7
T Quick question regarding data usage. Asuswrt-Merlin 1
F AI mesh question Asuswrt-Merlin 1
K DNS Director-No Redirection Question Asuswrt-Merlin 11
A Question about Asus Merlin Router behind a firewalla? Asuswrt-Merlin 8
D Solved Samba, LACP & WireGuard. Question. Asuswrt-Merlin 5
P Question on Wireguard tunnel configuration. Asuswrt-Merlin 9
D Solved ethtool question regarding at boot Asuswrt-Merlin 2
TheLyppardMan A question about WireGuard security Asuswrt-Merlin 25
A Question about network map Asuswrt-Merlin 2

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 698 (members: 15, guests: 683)
Top