Cisco Catalyst 9800 Wireless Client State

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/network-cisco-wlc-9800/generator.yml \
  --id cisco-wlc-9800 \
  --live-mode true

Event Types

Realism Features

• One controller serves 600 fixed named stations across 30 APs on 10 floors, three per floor: 540 office stations carried by employees and 60 always-on devices (phones left on chargers, scanners, sensors). Each station cycles through absence, RUN on one AP of its floor (home AP 50%, each other AP 25%), address learning and DELETE from the same AP. Some stations are already associated at the first record, so a station's first record may be its DELETE.
• Office stations come in on about 9 of 10 days, arrive around 08:45 UTC (07:00-11:00) and leave about 9 hours later (6.5-11.5 h); always-on devices stay associated apart from short sleep/wake gaps. About 50 stations are associated at night and about 410 between 10:00 and 16:00; records range from about 435 an hour at night to about 2,050 in the 09:00 hour, about 24,300 a day with 3% variation from day to day, about 2 s apart in working hours and 8 s at night. Every day is a working day: no weekends or holidays, working hours fixed to the UTC clock, and the record rate steps from hour to hour.
• Sessions have a lognormal body with a 35-minute median for office stations and 15 minutes for always-on devices (at most 12 h), absences 10 and 3 minutes (at most 8 h); each carries a 12% short tail of about 10 s-3 min sessions (sleep/wake, band steering, re-authentication) or 1-60 s quick reconnects. The median session is about 28 minutes for office stations and 12.5 minutes for always-on devices. These distributions and the attendance are synthetic choices, not measured production workload.
• RUN carries the IPv4 address, IP updates append the link-local address and, for dual-stack stations, a global IPv6 address seconds later, and DELETE lists link-local, global IPv6, then IPv4. An IP update comes a median 2.2 s after RUN in working hours and 7.5 s at night (up to about 1 and 3 minutes), not the sub-second delay of the Cisco example. The inventory holds 350 IPv4 plus link-local, 150 dual-stack, 50 IPv4-only and 50 IPv6-only stations; lists hold one to three addresses, their order is one rule fitted to the single same-client Cisco example, and IPv6-only RUN records are a synthetic assumption. Renumbering, DHCP renewal to a new lease and roaming without DELETE are not modeled.
• These severity 7 messages require wireless client syslog-detailed, and a forwarding syslog filter must include severity 7 (for example logging trap debugging). event.original is the console/buffer record with no invented RFC 3164/5424 envelope; controller and reader context is synthetic.
• Short sessions and quick reconnects are frequent in both modes: about 14% of sessions last under 3 minutes and about 11% of absences under 20 s. About seven times a day an ordinary association reaching its third distinct AP within 400 s logs no IP update although its station normally learns an address. The chain signals rapid reassociation or instability; it does not establish seamless roaming, an authentication failure, a deauthentication attack, an AP outage, a cloned client or an intrusion.
• Text follows the published 17.11 guide examples, whose MAC and IP values are redacted: complete values are synthetic, no unredacted live-controller capture was available for byte comparison, and collector or parser compatibility (Elastic, KUMA, Smart Monitor) is untested. The 17.12 channel variant is not generated.

Sample Output

{
  "@timestamp": "2026-09-01T12:36:55.168+00:00",
  "agent": {
    "name": "synthetic-wlc-reader",
    "type": "eventum"
  },
  "cisco_wlc": {
    "ap_name": "AP-Floor7-C",
    "chassis": "1 R0/0",
    "client_ips": [
      "10.20.30.115",
      "fe80::5eff:fe10:254"
    ],
    "client_mac": "0200.5e10.0254",
    "client_state": "ip_update",
    "ssid": "corp-wifi"
  },
  "client": {
    "address": "10.20.30.115",
    "ip": "10.20.30.115",
    "mac": "02-00-5E-10-02-54"
  },
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "action": "ip-update",
    "category": [
      "network"
    ],
    "code": "CLIENT_IP_UPDATED",
    "kind": "event",
    "original": "Sep  1 12:36:55.168 UTC: %CLIENT_ORCH_LOG-7-CLIENT_IP_UPDATED: Chassis 1 R0/0: wncd: Username (employee-596), MAC: 0200.5e10.0254, IP 10.20.30.115 fe80::5eff:fe10:254 IP address updated, associated to AP (AP-Floor7-C) with SSID (corp-wifi)",
    "provider": "CLIENT_ORCH_LOG",
    "severity": 7,
    "timezone": "+00:00",
    "type": [
      "connection",
      "info"
    ]
  },
  "host": {
    "name": "wlc9800-01.corp.example"
  },
  "log": {
    "level": "debugging"
  },
  "process": {
    "name": "wncd"
  },
  "related": {
    "ip": [
      "10.20.30.115",
      "fe80::5eff:fe10:254"
    ],
    "user": [
      "employee-596"
    ]
  },
  "user": {
    "name": "employee-596"
  }
}

Parameters