[Trace] dartmouth/campus/syslog/01_04 (v. 2004-12-18)

top

Syslog trace is newly created.

@MISC{dartmouth-campus-syslog-01_04-2004-12-18,
  author = {David Kotz and Tristan Henderson and Ilya Abyzov and Jihwang Yeo},
  title = {{CRAWDAD} trace dartmouth/campus/syslog/01_04 (v. 2004-12-18)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/dartmouth/campus/syslog/01_04},
  month = dec,  
  year = 2004
}
					

The trace of nearly continuous recording of the syslog records produced 
by the access points, from 2001-04-11 to 2004-06-30. UNIX timestamps have been added to 
each log record, and MAC addresses and AP names sanitized.

timestamp, AP name, the MAC address of the card, and type of message

Every MAC address has been sanitized, and the IP address or host name of client 
machines has been removed. To sanitize the MAC address, we randomized the bottom six 
hex digits. We collected every MAC address from all of our syslog, SNMP, an tcpdump traces, 
and built a huge table mapping real MACs to randomized MACs, ensuring that all mappings 
are unique.  Each access point name has been blinded in the form: AcadBldg10AP3  where this 
indicates the third AP in the tenth building of type 'Academic.' The building types are 
Adm (Admin), Ath (Athletic),  Lib (Library), Oth (Other - mainly sysadmin test APs), 
Res (Residential) and Soc (Social). Refer to note for details.

We only have a list of these holes in fall 2001. We had ``spatial holes'' because many APs 
did not send syslogs.  [Configuration mistake.] And temporal holes, because our syslog 
recording server(s) failed. You may refer to note for details. It also appears that 
the engineering school's APs, building name ''cummings'' did not send any messages 
after they installed a firewall in early 2002 until I noticed the problem and asked 
them to open a hole in the firewall in late 2002. 
We do not release the syslog trace collected from 2004-07-01 to 2005-08-31.

Since syslog messages are sent from the APs to a relaying server (ns1), and from ns1 to 
our syslog recording servers, as UDP messages, it is possible for them to be lost or 
reordered along the way. The timestamps are applied by the syslog daemon on our host, 
so the timestamps are monotonically increasing. But, the events may have been recorded 
out of order, and some may be missing.  We believe this effect is small enough to be negligible. 
We have two syslog recording servers, and we do not see the same event with different timestamps 
in the two servers. From 10/19/2003 this no longer applies.

[Tool] tools/process/syslog/syslog_parser (v. 2006-11-01)

top

the initial version

@MISC{tools-process-syslog-syslog_parser-2006-11-01,
  author = {Tristan Henderson},
  title = {{CRAWDAD} tool tools/process/syslog/syslog_parser (v. 2006-11-01)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/tools/process/syslog/syslog_parser},
  month = nov,  
  year = 2006
}
					

syslog_parser is a script to parse
                the syslog traces from Cisco VxWorks, Cisco IOS and
                Aruba access points. This script was designed to parse
                the syslog traces in the dartmouth/campus/syslog
                tracesets, but should be useful for other traces as
                well.

# cisco_aruba_syslog_parser.pl: a script to parse syslogs 
#
#      Author: Tristan Henderson
#      version: v. 2006-11-01
#      Copyright (c) 2006 Dartmouth College 
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License Version 2 as published by
# the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful, but WITHOUT 
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
# more details.
#
# You should have received a copy of the GNU General Public License along with
# this program; if not, write to the Free Software Foundation, Inc., 51
# Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

Please send your suggestions, bug reports and fixes to crawdad@cs.dartmouth.edu

cisco_aruba_syslog_parser.pl uses the Time::Local and
                Getopt::Std perl modules.
                If your perl does not include these modules, please
                install a newer version of perl before   
running the cisco_aruba_syslog_parser.pl script.

cisco_aruba_syslog_parser.pl parses syslog traces (see "usage" for the supported syslogs) 
and extracts the following information:

timestamp, client MAC address, message, AP MAC address

See "usage" for details about the parameters needed for each tool.

This is a script to parse the following syslog traces:

- Cisco VxWorks
- Cisco IOS 
- Aruba: note that we don't really know what the Aruba messages mean, but 
		I assume that "station up" means associate and "station down" 
		means disassociate. Since Aruba messages are received from a
        mobility controller, not an AP, they may not correspond
        directly to 802.11 associate/disassociate.

Note that we don't parse all messages, just ones that were interesting to us.

$./cisco_aruba_syslog_parser.pl -h
usage: ./cisco_aruba_syslog_parser.pl [OPTION] [SYSLOG]
-y <year>       define a year for syslogs 
# syslog messages don't contain the year. 
# you can pass the year using -y <year>.
# otherwise we assume the current year
-t              don't reformat time as a Unix timestamp
-r              show the reason for an event (where available)
-b <file>       file containing APs to ignore
-d              output debug info to STDERR
-a <file>       file containing Aruba APs names 
# for internal use
-h              show this help

An example VxWorks syslog record:
Jun 21 05:00:16 AdmBldg25AP1 AdmBldg25AP1 (Info): Station 0006257c081a Associated

An example IOS syslog record:
Jun 21 05:00:09 AcadBldg34AP2 2698: AcadBldg34AP2: Jun 21 09:00:09: %DOT11-6-ASSOC: Interface Dot11Radio0, Station   000d93737dab Reassociated KEY_MGMT[NONE]

An example aruba syslog record:
1125561901 Sep 1 04:05:01 50.110.24.0 2005 [50.110.24.131] authmgr[643]: <INFO> station down <00:02:2d:46:1f:62> bssid 00:0b:86:5c:e5:f9, essid Kiewit Wireless, vlan 2834, ingress 0x10c3 (tunnel 99), u_encr 1, m_encr 1, loc 167.3.2 slotport 0xfc3

$ ./cisco_aruba_syslog_parser.pl 20010411.vxworks.cisco | head
986990216 0040961e58be authenticated AdmBldg19AP3
986990247 0040961e58be authenticated AdmBldg19AP3
986990247 0040961e58be associated AdmBldg19AP3
986990293 0040961e58be authenticated AdmBldg19AP3
986990364 0040961e58be authenticated AdmBldg19AP3
986990484 0040961e58be authenticated AdmBldg19AP3
986991490 0040961e58be authenticated AdmBldg19AP3
986991491 00601db0635a authenticated AdmBldg16AP1
986991491 00601db0635a associated AdmBldg16AP1
986991532 0040961e58be authenticated AdmBldg19AP3

$ ./cisco_aruba_syslog_parser.pl 20040630.IOS.cisco | head
1088568001 0009b7f3ff1f reassociated AcadBldg4AP3
1088568003 00022d12c361 reassociated ResBldg69AP6
1088568003 00022d12c361 roamed ResBldg69AP4
1088568003 00022d12c361 disassociated ResBldg69AP4
1088568006 00022d12c361 authenticated ResBldg69AP4
1088568006 00022d12c361 associated ResBldg69AP4
1088568006 00022d12c361 roamed ResBldg69AP6
1088568008 00904b86f12a disassociated ResBldg44AP4
1088568013 00022dd9b5b2 disassociated SocBldg3AP2
1088568016 0009b7f3ff1f reassociated ResBldg97AP6

$ ./cisco_aruba_syslog_parser.pl 060831.072842.aruba | head
1157009322 001124567039 associated 98.1.2
1157009335 000d93e3e675 associated 167.3.3
1157009342 0016cff28931 associated 68.3.1
1157009344 00131ab19f7c disassociated 188.4.2
1157009344 00131ab19f7c associated 188.3.1
1157009349 001302f5e3e3 disassociated 119.1.1
1157009363 000d28120f0a disassociated 23.3.11
1157009363 000d28120f0a associated 23.3.1
1157020082 0013024da937 associated 119.4.1
1157020093 00131ab19f7c disassociated 188.3.1

[Author] David Kotz

top

[Author] Tristan Henderson

top

[Author] Ilya Abyzov

top

[Author] Jihwang Yeo

top