How can i locate heavy wireless user(s) in WLC saturating the network?

[jjessetej]

we've had situations where there's a lot of saturation in our network and we narrow it down to an AP, but how do we locate the actual client connected to that AP doing the damage?

once we get the mac address from our top talker discovering its on our wireless VLAN, we then issue the below command in our WLC and we can locate the top AP

sh wireless client summary | i MAC_ADDRESS

but how can we determine the client saturating the network connected to such AP? is there something we can run on the WLC or do we have to do it on the AP itself? if so, anyone know how?

device: C9800-40-K9

iOS: 16.12.3ES11

[Leo Laohoo]

From that command you can determine each clients Tx/Rx.  
So look at the ones with the highest value. 

Next, enable AVC/Protocol Pack and it will determine what kind of traffic each client is doing.

[Rich R]

You said you already have the top talker client MAC which you used to identify the AP.

So what more did you want?

[jjessetej · Accepted solution]

sorry, i figured this one out.. when i was writing this, our top talker at the time it was a device that was wired in in a different VLAN, so i wanted to know where it was physically plugged in, but i was able to trace it down..

[Leo Laohoo]

---

@jjessetej wrote:

our top talker at the time it was a device that was wired in in a different VLAN

---

LOL

[JPavonM]

Have you trying packet sniffing over-the-air with one AP converted to sniffer mode, or a dongle?

This way you can analize the traffic on Wireshark and see stats from every endpoint to be able to locate the MAC that is consuming the resources.

HTH
-Jesus
*** Please rate helpful responses ***