decode client disconnection from debug log and traces

[wyfy-2015]

Hi, 

How do we  decode  or understand client disconnected  from the debug log or traces  . 

What is the difference  between disassociate and deauth

Thanks

[George Stefanick · Accepted solution]

You few google clicks you can find a number of docs talking about debugs on the WLC. There is also a COOL beat debug reader you can drop your debug in and it will read it for you ..

https://cway.cisco.com/tools/WirelessDebugAnalyzer/

Disass. Is a radio leaving an AP but the station record is still live in the WLC. The client and do a simple reass. and they are back on.

Deauth is a killing a station record from the association tables. The client will need to do a full reauth to come back on. 

[wyfy-2015]

Hi,

Thank you George .

a client  leaves the AP (client just turned off the radio )   and again the client turned on the radio. In debug this can be a deauth or disass.

And another scenario AP did not hear from the client  due to some power mismatch  or something else  what we would see in the debug  ?

Thanks

[George Stefanick]

The majority of client testing Ive done stations when disabled will either send a disassociation or not send anything at all.

If the ap does hear from the client station for a period of time exceeding the idle client timer the WLC will deauthenticate the client station. 

[mohanak]

Disassociation is sent to terminate the association of a station. Deauthentication is the frame terminating the authentication of a station.

Refer link : https://supportforums.cisco.com/document/101431/80211-sniffer-capture-analysis-management-frames-and-open-auth