Menu
What's new
By:
Filters Better Search

Question - How Does Wireless Log determine Connected time?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

JGrana

JGrana

Very Senior Member
I'm working on my own network map using nmap to scan my network periodically. I have IP, hostname, mac and manufacturer. I can't seem to figure out how to find or calculate the clients "connected" time like the Wireless Log page shows...
Is there a log file somewhere or is it calculated from various logs - or is it closed source?
 
JGrana said:
Is there a log file somewhere or is it calculated from various logs - or is it closed source?
Click to expand...
The information is directly queried from the radio using Broadcom's API. You can use the wl userspace tool to retrieve a list of associated clients for each radio, and query it for detailed info, but it might not be very efficient unless you don't do it repeatedly.

Code: 
admin@stargate:/tmp/home/root# wl -i eth8 assoclist
assoclist 48:BC:00:01:02:03

admin@stargate:/tmp/home/root# wl -i eth8 sta_info 48:BC:00:01:02:03
[VER 8] STA 48:BC:00:01:02:03:
     chanspec 157/80 (0xe29b)
     aid:8 
     rateset [ 6 9 12 18 24 36 48 54 ]
     idle 3 seconds
==>     in network 56230 seconds
     state: AUTHENTICATED ASSOCIATED AUTHORIZED
     connection: SECURED
     auth: WPA3-SAE
     crypto: AES_CCM
     flags 0x8d1e13a: WME PS N_CAP VHT_CAP HE_CAP AMPDU AMSDU GBL_RCLASS MBO_CAP
     HT caps 0x9ef: LDPC 40MHz SGI20 SGI40 STBC-Tx STBC-Rx
     VHT caps 0x15f: LDPC SGI80 SGI160 STBC-Tx STBC-Rx SU-BFE MU-BFE
     HE caps 0x66b9: LDPC HE-HTC SU-BFR SU&MU-BFE
     OMI 0x0251: 80Mhz rx=2ss tx=2ss ER_SU_DISABLE 
     tx total pkts: 5327807
     tx total bytes: 1274940838
     tx ucast pkts: 63036
     tx ucast bytes: 266110180
     tx mcast/bcast pkts: 5264771
     tx mcast/bcast bytes: 1008830658
     tx failures: 0
     rx data pkts: 80397
     rx data bytes: 12496400
     rx data dur: 0
     rx ucast pkts: 79460
     rx ucast bytes: 12326826
     rx mcast/bcast pkts: 937
     rx mcast/bcast bytes: 169574
     rate of last tx pkt: 816660 kbps - 408330 kbps
     rate of last rx pkt: 6000 kbps
     rx decrypt succeeds: 26164
     rx decrypt failures: 0
     tx data pkts retried: 12
     per antenna rssi of last rx data frame: -73 -80 -68 -72
     per antenna average rssi of rx data frames: -72 -80 -68 -72
     per antenna noise floor: -92 -93 -91 -91
     tx total pkts sent: 64680
     tx pkts retries: 8283
     tx pkts retry exhausted: 0
     tx FW total pkts sent: 0
     tx FW pkts retries: 0
     tx FW pkts retry exhausted: 0
     rx total pkts retried: 1141
MCS SET : [ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 ]
VHT SET : 0x1 1x1 2x1 3x1 4x1 5x1 6x1 7x1 8x1 9x1 
        : 0x2 1x2 2x2 3x2 4x2 5x2 6x2 7x2 8x2 9x2 
HE SET  :
        20/40/80 MHz:
        NSS1 Tx: 0-11        Rx: 0-11
        NSS2 Tx: 0-11        Rx: 0-11
smoothed rssi: -68
tx nrate
he mcs 8 Nss 2 Tx Exp 2 bw80 ldpc 2xLTF GI 1.6us auto
rx nrate
legacy rate 6 Mbps stf mode 0 auto
wnm
0x1:  BSS-Transition
VENDOR OUI VALUE[0] 00:50:F2 
VENDOR OUI VALUE[1] 8C:FD:F0 
VENDOR OUI VALUE[2] 00:00:F0 
VENDOR OUI VALUE[3] 50:6F:9A 
link bandwidth = 80 MHZ 
RRM capability = 0x400911073 Link_Measurement Neighbor_Report Beacon_Passive Beacon_Active Beacon_Table LCI_Measurement AP_Channel_Report FTM_Range_Reporting
Frequency Bands Supported: 2.4G 5G 6G
 
What is interesting about the reported "Connected" time is that there seems to be a regularly increasing underestimation of the 2.4GHz results.

Every 24 hours, the reported "Connected" time for any given 2.4GHz device that has been kept continuously connected to the network is about 30 minutes lower than what it should be. In other words, instead of getting incremented by 86400 seconds every day, the Connected time seems to be incremented by 84600 seconds only. That does not happen with the 5GHz results. I wonder whether there's a typo in a formula or calculation...

At least that's what I see with my RT-AX86U Pro running 3004.388.7. But I'm not implying this is related to Asuswrt-Merlin, please don't get me wrong.
 
Last edited:
RMerlin said:
The information is directly queried from the radio using Broadcom's API. You can use the wl userspace tool to retrieve a list of associated clients for each radio, and query it for detailed info, but it might not be very efficient unless you don't do it repeatedly.

Code: 
admin@stargate:/tmp/home/root# wl -i eth8 assoclist
assoclist 48:BC:00:01:02:03

admin@stargate:/tmp/home/root# wl -i eth8 sta_info 48:BC:00:01:02:03
[VER 8] STA 48:BC:00:01:02:03:
     chanspec 157/80 (0xe29b)
     aid:8
     rateset [ 6 9 12 18 24 36 48 54 ]
     idle 3 seconds
==>     in network 56230 seconds
     state: AUTHENTICATED ASSOCIATED AUTHORIZED
     connection: SECURED
     auth: WPA3-SAE
     crypto: AES_CCM
     flags 0x8d1e13a: WME PS N_CAP VHT_CAP HE_CAP AMPDU AMSDU GBL_RCLASS MBO_CAP
     HT caps 0x9ef: LDPC 40MHz SGI20 SGI40 STBC-Tx STBC-Rx
     VHT caps 0x15f: LDPC SGI80 SGI160 STBC-Tx STBC-Rx SU-BFE MU-BFE
     HE caps 0x66b9: LDPC HE-HTC SU-BFR SU&MU-BFE
     OMI 0x0251: 80Mhz rx=2ss tx=2ss ER_SU_DISABLE
     tx total pkts: 5327807
     tx total bytes: 1274940838
     tx ucast pkts: 63036
     tx ucast bytes: 266110180
     tx mcast/bcast pkts: 5264771
     tx mcast/bcast bytes: 1008830658
     tx failures: 0
     rx data pkts: 80397
     rx data bytes: 12496400
     rx data dur: 0
     rx ucast pkts: 79460
     rx ucast bytes: 12326826
     rx mcast/bcast pkts: 937
     rx mcast/bcast bytes: 169574
     rate of last tx pkt: 816660 kbps - 408330 kbps
     rate of last rx pkt: 6000 kbps
     rx decrypt succeeds: 26164
     rx decrypt failures: 0
     tx data pkts retried: 12
     per antenna rssi of last rx data frame: -73 -80 -68 -72
     per antenna average rssi of rx data frames: -72 -80 -68 -72
     per antenna noise floor: -92 -93 -91 -91
     tx total pkts sent: 64680
     tx pkts retries: 8283
     tx pkts retry exhausted: 0
     tx FW total pkts sent: 0
     tx FW pkts retries: 0
     tx FW pkts retry exhausted: 0
     rx total pkts retried: 1141
MCS SET : [ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 ]
VHT SET : 0x1 1x1 2x1 3x1 4x1 5x1 6x1 7x1 8x1 9x1
        : 0x2 1x2 2x2 3x2 4x2 5x2 6x2 7x2 8x2 9x2
HE SET  :
        20/40/80 MHz:
        NSS1 Tx: 0-11        Rx: 0-11
        NSS2 Tx: 0-11        Rx: 0-11
smoothed rssi: -68
tx nrate
he mcs 8 Nss 2 Tx Exp 2 bw80 ldpc 2xLTF GI 1.6us auto
rx nrate
legacy rate 6 Mbps stf mode 0 auto
wnm
0x1:  BSS-Transition
VENDOR OUI VALUE[0] 00:50:F2
VENDOR OUI VALUE[1] 8C:FD:F0
VENDOR OUI VALUE[2] 00:00:F0
VENDOR OUI VALUE[3] 50:6F:9A
link bandwidth = 80 MHZ
RRM capability = 0x400911073 Link_Measurement Neighbor_Report Beacon_Passive Beacon_Active Beacon_Table LCI_Measurement AP_Channel_Report FTM_Range_Reporting
Frequency Bands Supported: 2.4G 5G 6G
Click to expand...
Thanks @RMerlin - looks easy enough with the script doing the work ;-)

Done, thanks again

Code: 
192.168.1.96     KasaPwrStrip                   E4:FA:C4:56:10:1D    Unknown                                  22:44:46
192.168.1.101    Oceanus                        B4:0E:DE:7E:91:C7    Intel Corporate                          00:39:35
192.168.1.105    CasitaDeckLights               1C:61:B4:B0:A7:5B    TP-Link Limited                          22:45:19
192.168.1.106    DeckLights                     1C:61:B4:C9:EB:90    TP-Link Limited                          22:44:51
 
Last edited:
This wl method of determining connection time was extremely interesting to me, and got my wheels turning for some additions I'd like to make to RTRMON... I've had success pulling info from wl / comparing the mac to the "custom_clientlist" NVRAM entry, and pulling IP info from /proc/net/arp, resulting in being able to show which clients are connecting to different wifi interfaces:

Code: 
(ex: clients connected to my eth6/5GHz)

Name        | IP            | MAC               | Uptime  | TX       | RX
Sony XBR TV | 192.168.50.75 | 40:5B:D8:4E:3B:25 | 16h:33m | 10.08 GB | 0.38 GB
XBOX One    | 192.168.50.79 | 04:27:28:4B:6D:16 | 02h:18m | 3.39 GB  | 0.40 GB

@RMerlin The question I wanted to ask you (or the community in general) is what method would be easiest to determine which clients are connected via network on br0? When I look at /proc/net/arp or run "arp -an", I get similar info showing me that wifi and network devices are mixed together, and all show as being connected to br0. I'd almost have to use that as a master list, and try to remove entries if I identify them as wifi clients, and then the resulting list would be just the LAN clients left over... or is there an easier way?
 
Last edited:
The only method I can think of to inventory what clients are physically connected over Ethernet is the same one used by networkmap: Send pings or ARP pings to the whole subnet, then gather the results. Which is why networkmap was hardcoded to a /24, because sending arp pings to a /8 would totally trash your network.
 
RMerlin said:
The only method I can think of to inventory what clients are physically connected over Ethernet is the same one used by networkmap: Send pings or ARP pings to the whole subnet, then gather the results. Which is why networkmap was hardcoded to a /24, because sending arp pings to a /8 would totally trash your network.
Click to expand...
Thank you for the advice! I'll keep plugging away at this... ;)
 
Sorry to bug you with this, @RMerlin... but I was wondering if I could please ask a follow-up question? I'm hitting a brick wall here. :(

I've been able to successfully identify and separate legit wireless and wired clients thusfar... however, wifi clients on guest networks seem to allude me? They all show up under /proc/net/arp... but they are not found when you search for their MAC addresses using the wl command on their respective wireless interfaces. It's almost like they're on some completely different interface that I can't seem to identify?

How can I locate these "guest network" clients, and return the same kind of info that the wl command provides? Like uptime, bytes tx/rx, etc?

Running ifconfig doesn't seem to identify any guest network interfaces either... so where the heck are they! I know you are doing this on the webUI, so it must be possible! LOL

Thank you in advance for your advice! ;)
 
Viktor Jaep said:
Sorry to bug you with this, @RMerlin... but I was wondering if I could please ask a follow-up question? I'm hitting a brick wall here. :(

I've been able to successfully identify and separate legit wireless and wired clients thusfar... however, wifi clients on guest networks seem to allude me? They all show up under /proc/net/arp... but they are not found when you search for their MAC addresses using the wl command on their respective wireless interfaces. It's almost like they're on some completely different interface that I can't seem to identify?

How can I locate these "guest network" clients, and return the same kind of info that the wl command provides? Like uptime, bytes tx/rx, etc?

Running ifconfig doesn't seem to identify any guest network interfaces either... so where the heck are they! I know you are doing this on the webUI, so it must be possible! LOL

Thank you in advance for your advice! ;)
Click to expand...

Not sure if the wl commands are public as it’s Broadcom. As I’m not a partner subject to any NDA here they are after googling them.


pastebin.com

Wl commands - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com pastebin.com
 
DJones said:
Not sure if the wl commands are public as it’s Broadcom. As I’m not a partner subject to any NDA here they are after googling them.


pastebin.com

Wl commands - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
pastebin.com pastebin.com
Click to expand...
Thank you... but not really what I'm after?

I can run: wl -i eth8 assoclist

And it returns a full list of clients connected to eth8 (which may be like someone's 5GHz antenna)... but "guest network" clients also connected to 5GHz do no show up here.
 
ColinTaylor said:
Works for me.

Strange. Maybe different models do it differently.
Click to expand...
Doesn't seem to be working on the GT-BE98_Pro either... nor the RT-AX86S... nor my GT-AX6000.
 
Last edited:
Viktor Jaep said:
Thank you... but not really what I'm after?

I can run: wl -i eth8 assoclist

And it returns a full list of clients connected to eth8 (which may be like someone's 5GHz antenna)... but "guest network" clients also connected to 5GHz do no show up here.
Click to expand...

Do wl commands only show actual radios or also virtualized ap’s. I’m not sure.
 
DJones said:
Do wl commands only show actual radios or also virtualized ap’s. I’m not sure.
Click to expand...
It seems to be work only with interfaces if a wl driver is tied to them... for instance, when searching for the MAC of one of my devices (on a guest network) on the 2.4GHz interface (eth6), it comes back with "bad address". If you try it on an adapter that clearly isn't a wifi interface, it will come back with "wl driver adapter not found".

Code: 
ViktorJp@GT-AX6000-3C88:/jffs/addons/rtrmon.d# wl -i eth6 sta_info 8C:8D:28:75:BA:75
wl: Bad Address
ViktorJp@GT-AX6000-3C88:/jffs/addons/rtrmon.d# wl -i eth7 sta_info 8C:8D:28:75:BA:75
wl: Bad Address
ViktorJp@GT-AX6000-3C88:/jffs/addons/rtrmon.d# wl -i eth8 sta_info 8C:8D:28:75:BA:75
wl: wl driver adapter not found
 
Viktor Jaep said:
It seems to be work only with interfaces if a wl driver is tied to them... for instance, when searching for the MAC of one of my devices (on a guest network) on the 2.4GHz interface (eth6), it comes back with "bad address". If you try it on an adapter that clearly isn't a wifi interface, it will come back with "wl driver adapter not found".

Code: 
ViktorJp@GT-AX6000-3C88:/jffs/addons/rtrmon.d# wl -i eth6 sta_info 8C:8D:28:75:BA:75
wl: Bad Address
ViktorJp@GT-AX6000-3C88:/jffs/addons/rtrmon.d# wl -i eth7 sta_info 8C:8D:28:75:BA:75
wl: Bad Address
ViktorJp@GT-AX6000-3C88:/jffs/addons/rtrmon.d# wl -i eth8 sta_info 8C:8D:28:75:BA:75
wl: wl driver adapter not found
Click to expand...
So you say there are no guest Wi-Fi interfaces shown in ifconfig?
Code: 
ifconfig | grep Link
 
Code: 
@GT-AX11000-6CC0:/tmp/home/root# wl -i wl0.2 assoclist
assoclist 00:11:F6:8B:68:DD

works for me.

can verify by looking at the wireless log and seeing the mac on guest network pertains to wl0.2 under ifconfig.
 
DJones said:
Code: 
@GT-AX11000-6CC0:/tmp/home/root# wl -i wl0.2 assoclist
assoclist 00:11:F6:8B:68:DD

works for me.

can verify by looking at the wireless log and seeing the mac on guest network pertains to wl0.2 under ifconfig.
Click to expand...
That was it! I guess guest network called variations of wl*... wl0.1 in my case... thanks!! I was able to pull back that MAC through there.

ColinTaylor said:
So you say there are no guest Wi-Fi interfaces shown in ifconfig?
Code: 
ifconfig | grep Link
Click to expand...
All interfaces come back when running this...

Code: 
ViktorJp@GT-AX6000-3C88:/jffs/addons/rtrmon.d# ifconfig | grep Link
br0       Link encap:Ethernet  HWaddr 04:42:1A:59:3C:88
eth0      Link encap:Ethernet  HWaddr 04:42:1A:59:3C:88
eth1      Link encap:Ethernet  HWaddr 04:42:1A:59:3C:88
eth2      Link encap:Ethernet  HWaddr 04:42:1A:59:3C:88
eth3      Link encap:Ethernet  HWaddr 04:42:1A:59:3C:88
eth4      Link encap:Ethernet  HWaddr 04:42:1A:59:3C:88
eth5      Link encap:Ethernet  HWaddr 04:42:1A:59:3C:88
eth6      Link encap:Ethernet  HWaddr 04:42:1A:59:3C:88
eth7      Link encap:Ethernet  HWaddr 04:42:1A:59:3C:8C
lo        Link encap:Local Loopback
lo:0      Link encap:Local Loopback
spu_ds_dummy Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
spu_us_dummy Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
tun11     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
tun15     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
wl0.1     Link encap:Ethernet  HWaddr 04:42:1A:59:3C:89
 
ColinTaylor said:
Maybe look at this old thread: https://www.snbforums.com/threads/list-associated-wifi-clients-on-command-line.46873/post-407894
Click to expand...
@ColinTaylor ... I don't suppose you know how vlan interface names fit into this puzzle, do you? :)

@visortgw has 3 vlans specified, and found this nvram entry on his router referring to interface names much in the same fashion as the ones you used in your script above: apg_ifnames=br53 br54 br55

However, when calling these interface names with wl, using a mac that is on that particular vlan, we get this:

Code: 
# wl -i br52 sta_info 7d:38:a2:58:d0:c3
wl: wl driver adapter not found

Know of anything else these vlan interface names might be referred to in order for wl to pick them up correctly?
 
You must log in or register to reply here.

Similar threads

J
Assign Device Names in System-Wireless Log specifically for AIMesh Nodes? And change AIMesh Host Name
Replies
19
Views
1K
jksmurf
J
J
How does Asus or Asus Merlin source the device name under the System Log, Wireless Log Tab?
2
Replies
32
Views
3K
glens
G
M
Skynet How to find out if a connected device tries to call any sites/google?
Replies
6
Views
696
Muon
M
F
Problem getting Wireless IP address - Some Clients
Replies
7
Views
567
lgkahn
L
P
Wireless acting wierd
Replies
1
Views
329
peevesillinois
P
Similar threads
Thread starter Title Forum Replies Date
P Basic question on usericon files Asuswrt-Merlin 0
E Question about DDNS forced update interval RT-AX86U Asuswrt-Merlin 3
octopus Wireguard question Asuswrt-Merlin 6
O service-event-end question Asuswrt-Merlin 2
W Quick Network/Guest question Asuswrt-Merlin 14
S VPN Director Question Asuswrt-Merlin 4
M GT-AX6000 Bios Question Asuswrt-Merlin 2
F Family Settings - Question -Asus App Asuswrt-Merlin 1
W Question: About AX4200 regarding SSH support and Entware Asuswrt-Merlin 23
L question of vpn director rule Asuswrt-Merlin 7

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 1,030 (members: 13, guests: 1,017)
Top