I used the filter (radius.Calling_Station_Id == "70-48-0F-63-6B-D1") && !(radius.code == 1),
I had to explain why there was an interim update after accounting stop, and I started by comparing what is the difference between this accounting stop and accounting interim update. Those were sent from the same AP for the same calling station ID mac address. After comparing the RADIUS attributes of the two packets I found something inserting.
In the two packets the radius.Connect_Info is different, in the accounting stop the value is 11ac which is 802.11ac , therefore the client disconnected from 5GHz. Then the accounting interim update has the value 11ng which is 802.11n/g, therefore the client has connected to 2.4GHz in the same AP. To explain what happened clearly I added a new column in Wireshak with filter radius.Connect_Info,
No comments:
Post a Comment