Forum

Has anyone ever captured any CCX Neighbor list announcements or any other related data (CCX Neighbor list, queries, etc.). I trying to capture this data but have no idea what frames to look at.

Searched up and down the Cisco site to no avail. This is a follow-up post to my last question about information elements (for those who have caught on the pattern of my questions).

Cheers,

Jordan

That is proprietary information that if it could be seen would be in the Beacons an Probe Response frames.

I doubt there currently is a sniffer that can decode this info. If there is, someone please speak up.

802.11k should be ratified by June/2008 and will standardize neighbor reports.

Hi David,

I have looked at beacons and probe responses, but can not find any IE that would hold this info. In these frames there is no undecoded data that would be the size required by neighbor lists. I can account for all the data (IE) in these frames. Maybe I need to take a longer sample. Who knows?

I wish Cisco made this type of documentation more easily accessible. I'll try to hunt this down through the controller BU and post if I get the info.

If anyone has any info no neighbor lists I would love to hear it. Anything... :D

Thanks again,

Jordan

I found OmniPeek decodes WLCCP. What are you using to capture the frames?

Bruce

>>I found OmniPeek decodes WLCCP. What are you using to >>capture the frames?

I might be all wet on this one.

I have seen WLCCP in both Omnipeek and Wireshark, I just do not recall seeing neighbor reports used to tell clients about potential APS that they can roam to.

Same with LWAPP... Here is some info about an LWAPP decoder for OmniPeek/Ethereal:

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008063e5de.shtml

Of course you could also get this info from SNMP:
https://netdot.uoregon.edu/trac/browser/trunk/mibs/cisco/CISCO-LWAPP-CLIENT-ROAMING-MIB.my?rev=1606

Never have seen WLCCP decodes but like the information hunt. I have only found a reference to common management tag values 0x85 CCX extensions 1, 0x95 CCX extensions 3, 0x88 CCX extensions 2, 0x34 AP Neighbor report these were from sans 802.11 pocket reference. Still looking for more references..

I wonder if you run a debug would it show info since you can capture it before frame transmition? Of course debug may not be an option on a secure production network. I also can not tell where referenced CCX values would appear in the frame. Still looking....