WLC Debug Analyzer

[Shankar Ramanathan]

https://cway.cisco.com/tools/WirelessDebugAnalyzer/

 Wireless Debug Analyzer now supports Cat 9800 debugs (RA traces, always-on logs)

Wireless Debug Analyzer:

This tool parses debug log files for AireOS (WLC 5500/2500/8500/7500/WISM1-2/vWLC) and Cat9800 Wireless LAN Controllers. It makes it easier to troubleshoot issues with wireless client association, authentication, roaming, and connectivity issues.

This tool aims to provide logical analysis based on log sequence matching against existing issues. For AireOS the tool can also parse through output of "debug client <mac1> <mac2> ..." as well as some portions of "debug aaa/webauth/mdns". For Catalyst 9800 WLC, the tool can parse through always-on traces and radio-active trace logs generated from WLC.

Inputs Required:

AireOS: debug client <mac1> <mac2>..

Cat9800: Client RA traces/Always-on traces. 

Note: Only wireless client logs are supported in the current edition. AP join log process is work in progress.

Mar 2023 Update:

What has changed?

C9800 Advanced Insights:

Graphical summarization of Client Onboarding time, Delete reasons, Client Roam statistics, and Success/Failure sessions per WLAN.

Client Session Insights: - Table View

Sequence Diagram of Transaction Per Session :

Please use this discussions thread for any queries on the Wireless Debug Analyzer

[EvgenyG]

still down....

[jaa3rd]

It's working fine for me - Firefox and WLC 8.5.135.  Just stumbled on this today, and working great.

[EvgenyG]

not working now again...

[edgar.bermejo@itesm.mx]

Hi there! How can I access "Sequence Diagram of Transaction Per Session " I have tried differents browers but no avail. Thanks!

[absuizo14]

The Graphs are great and it shows the logs that caused the client to disconnect but if you try to search the errors and see what can solve it, you will not find the exact error and the solution. like these errors:

REMOTE_MOBILITY_DELETE, MN_IDLE_TIMEOUT, SAE_AUTH_IN_ASSOCIATED_STATE, KEY_XCHNG_TIMEOUT, DEAUTH_OR_DISASSOC_REQ, ROAM_ACROSS_POLICY_PROFILE_DENY, DOT11_INVALID_PMKID, SAE_AUTH_FAILURE, SAE_AUTH_IN_ASSOCIATED_STATE, MOBILITY_FAILURE, WLAN_CHANGE, GROUP_KEY_UPDATE_TIMEOUT, CONNECT_TIMEOUT, MOBILITY_CONNECT_TIMEOUT, INTER_WNCD_ROAM_SUCCESS

if this tool would provide a link to the errors it has detected or a single document containing all the possible errors then it would be such a help instead of looking for these errors one by one

[Leo Laohoo]

I find using WLC Debug Analyzer to look at debugs taken off IOS-XE to be highly inaccurate, if not misleading.  

Allow me to provide an example.  First, look at the picture below: 

"Association failure, reason code sent: 31".  What is that?  ¯\_(ツ)_/¯

According to Cisco's 802.11 Association Status Codes, Reason Code 31 could mean "NOT SUPPORTED".  

However, if I look at the raw debug output, the story changes:  

2023/10/06 09:42:51.681209953 {wncd_x_R0-6}{1}: [client-orch-state] [20728]: (note): MAC: aaaa.aaaa.aaaa  Client state transition: S_CO_ASSOCIATING -> S_CO_DELETE_IN_PROGRESS

2023/10/06 09:42:51.681611307 {wncd_x_R0-6}{1}: [client-orch-state] [20728]: (note): MAC: aaaa.aaaa.aaaa  Client state transition: S_CO_DELETE_IN_PROGRESS -> S_CO_DELETED

2023/10/06 09:42:53.541912042 {wncd_x_R0-6}{1}: [client-orch-sm] [20728]: (note): MAC: aaaa.aaaa.aaaa  Association received. BSSID apap.apap.apap, WLAN XXX, Slot 0 AP apap.apap.apap, AP_NAME

2023/10/06 09:42:53.542060961 {wncd_x_R0-6}{1}: [client-orch-state] [20728]: (note): MAC: aaaa.aaaa.aaaa  Client state transition: S_CO_INIT -> S_CO_ASSOCIATING

2023/10/06 09:42:53.542206043 {wncd_x_R0-6}{1}: [dot11-validate] [20728]: (ERR): MAC: aaaa.aaaa.aaaa  Failed to Dot11 validate dot11i capabilities. Received RSNIE with Invalid Capabilities STA MFPC: 0 , STA MFPR:0, AP MFPC:1 AP MFPR:1

2023/10/06 09:42:53.542206541 {wncd_x_R0-6}{1}: [dot11-validate] [20728]: (ERR): MAC: aaaa.aaaa.aaaa  Failed to dot11 ie validate wpa wpa2 info elment.  Invalid RSN IE capabilities

2023/10/06 09:42:53.542223259 {wncd_x_R0-6}{1}: [ewlc-infra-evq] [20728]: (ERR): aaaa.aaaa.aaaaCLIENT_ASSOC_FAIL Failure = IE_VALIDATION_FAILURE Validation Failure Type = 31, WLAN profile = XXX, Policy profile = XXX-Policy 

2023/10/06 09:42:53.542224394 {wncd_x_R0-6}{1}: [dot11] [20728]: (ERR): MAC: aaaa.aaaa.aaaa  Failed to assoc failure tr state entry. Incorrect validation status value :31

The issue is located is the two lines (I have put a space between the two lines to make it easier for anyone to read): 

2023/10/06 09:42:53.542206043 {wncd_x_R0-6}{1}: [dot11-validate] [20728]: (ERR): MAC: aaaa.aaaa.aaaa  Failed to Dot11 validate dot11i capabilities. Received RSNIE with Invalid Capabilities STA MFPC: 0 , STA MFPR:0, AP MFPC:1 AP MFPR:1

2023/10/06 09:42:53.542206541 {wncd_x_R0-6}{1}: [dot11-validate] [20728]: (ERR): MAC: aaaa.aaaa.aaaa  Failed to dot11 ie validate wpa wpa2 info elment.  Invalid RSN IE capabilities

These two lines are not being "analyzed" by the WLC Debug Analyzer.  

The sample debug is a very simple one and the WLC Debug Analyzer has failed to adequately identify the source of the problem.  

If the WLC Debug Analyzer incorrectly "analyzed" a simple debug, how would the WLC Debug Analyzer perform with more complex/complicated debugs?