Hi Herman.
Glad to read you again.
Yes, it is a little bit specific case. It works with ALE without any problems. ALE is using different communication method than Central streaming.
I'm working with TAC to understand the issue.
I tested also with different Central account, different APs, but the result is the same :-(
Here is a raw stream. DELETE, ADD, UPDATE
From my perspective it looks like data is buffered somewhere. Python is not my "native" language so it is very possible, that I didn't correctly understand wsclient_public.py or did some other no-no.
2023-02-16 19:09:55,761 : DEBUG : streamingExport 148 : ['STATE_WIRELESSCLIENT']
2023-02-16 19:09:55,761 : DEBUG : streamingExport 159 : Index: 0 Action: DELETE Username: <D4:38:9C:B6:98:1D> SSID:
2023-02-16 19:09:55,761 : DEBUG : streamingExport 160 : {'action': 'DELETE', }
2023-02-16 19:10:50,513 : DEBUG : wsclient_public 314 : RAW STREAMING DATA: b'\x12\nmonitoring\x1a\xc4\x01\n 58aeca167c4811ed957ab6cd43cbf282\x10\nR\x96\x01\x08\x01\x12\x08\n\x06\xd48\x9c\xb6\x98\x1d\x1a\x11d4:38:9c:b6:98:1d"\x08\x08\x02\x12\x04\xc0\xa8\x01\xe7*\x11D4:38:9C:B6:98:1D2\nCNPCKV32F3:\x08\n\x06H/k\x91\x0e\xc0B\nCelje WiFiJ\x13Celje WiFi_#guest#_R\x10Sony CorporationZ\x00b\x08802.11GNh\xa0\x02p\x01\xb8\x02\xaa\xe3\xb9\x9f\x06 \xfa\xd1\xd3\x91\xcd\x8f\x98\xa2\x17* 58aeca167c4811ed957ab6cd43cbf282'
2023-02-16 19:10:50,516 : DEBUG : wsclient_public 321 : Decoded data for customer MOC-Monitoring
{'customer_id': '',
'data': {'customer_id': '',
'data_elements': ['STATE_WIRELESSCLIENT'],
'timestamp': 1676571050,
'wireless_clients': [{'action': 'ADD',
'associated_device': 'CNPCKV32F3',
'connection': '802.11GN',
'ip_address': {'addr': 'wKgB5w==',
'af': 'ADDR_FAMILY_INET'},
'macaddr': {'addr': '1Dictpgd'},
'manufacturer': 'Sony Corporation',
'maxspeed': 288,
'name': 'd4:38:9c:b6:98:1d',
'network': 'Q2VsamUgV2lGaQ==',
'os_type': '',
'radio_mac': {'addr': 'SC9rkQ7A'},
'user_role': 'Celje WiFi_#guest#_',
'username': 'D4:38:9C:B6:98:1D',
'vlan': 1}]},
'msp_ip': '',
'timestamp': 1676571050507561210,
'topic': 'monitoring'}
2023-02-16 19:10:50,517 : DEBUG : streamingExport 148 : ['STATE_WIRELESSCLIENT']
2023-02-16 19:10:50,517 : DEBUG : streamingExport 159 : Index: 0 Action: ADD Username: <D4:38:9C:B6:98:1D> SSID: Celje WiFi
2023-02-16 19:10:50,517 : DEBUG : streamingExport 160 : {'action': 'ADD',}
2023-02-16 19:10:54,796 : DEBUG : wsclient_public 314 : RAW STREAMING DATA: b'\x12\nmonitoring\x1a\xd0\x01\n 58aeca167c4811ed957ab6cd43cbf282\x10\nR\xa2\x01\x08\x03\x12\x08\n\x06\xd48\x9c\xb6\x98\x1d\x1a\x11d4:38:9c:b6:98:1d"\x08\x08\x02\x12\x04\xc0\xa8\x01\xe7*\x11D4:38:9C:B6:98:1D2\nCNPCKV32F3:\x08\n\x06H/k\x91\x0e\xc0B\nCelje WiFiJ\x13Celje WiFi_#guest#_R\x10Sony CorporationZ\x0cSony Androidb\x08802.11GNh\xa0\x02p\x01\xb8\x02\xae\xe3\xb9\x9f\x06 \xec\xa8\x86\x8c\xdd\x8f\x98\xa2\x17* 58aeca167c4811ed957ab6cd43cbf282'
2023-02-16 19:10:54,796 : INFO : wsclient_public 317 : Decode data for customer MOC-Monitoring
2023-02-16 19:10:54,799 : DEBUG : wsclient_public 321 : Decoded data for customer MOC-Monitoring
{'customer_id': '',
'data': {'customer_id': '',
'data_elements': ['STATE_WIRELESSCLIENT'],
'timestamp': 1676571054,
'wireless_clients': [{'action': 'UPDATE',
'associated_device': 'CNPCKV32F3',
'connection': '802.11GN',
'ip_address': {'addr': 'wKgB5w==',
'af': 'ADDR_FAMILY_INET'},
'macaddr': {'addr': '1Dictpgd'},
'manufacturer': 'Sony Corporation',
'maxspeed': 288,
'name': 'd4:38:9c:b6:98:1d',
'network': 'Q2VsamUgV2lGaQ==',
'os_type': 'Sony Android',
'radio_mac': {'addr': 'SC9rkQ7A'},
'user_role': 'Celje WiFi_#guest#_',
'username': 'D4:38:9C:B6:98:1D',
'vlan': 1}]},
'msp_ip': '',
'timestamp': 1676571054790775916,
'topic': 'monitoring'}
2023-02-16 19:10:54,800 : DEBUG : streamingExport 148 : ['STATE_WIRELESSCLIENT']
2023-02-16 19:10:54,800 : DEBUG : streamingExport 159 : Index: 0 Action: UPDATE Username: <D4:38:9C:B6:98:1D> SSID: Celje WiFi
2023-02-16 19:10:54,800 : DEBUG : streamingExport 160 : {'action': 'UPDATE', }
2023-02-16 19:10:54,800 : DEBUG : streamingExport 161 :
2023-02-16 19:11:32,326 : DEBUG : wsclient_public 314 : RAW STREAMING DATA: b'\x12\nmonitoring\x1az\n 5a389090503d4bc79ea685a6a6599053\x10\x18\xe2\x01L\n\nCNLVL2H01G\x10\xc8\x01\x18\xd4\xe3\xb9\x9f\x06 \x00(\x000\xe2\xbf\r8\xd8\xc1\r@\x81\x80\x14J%data-vpnc-20:4c:03:e2:37:b8-inet_inet\xb8\x02\xd4\xe3\xb9\x9f\x06 \xb8\xf1\xa8\xf3\xe8\x90\x98\xa2\x17* 5a389090503d4bc79ea685a6a6599053'
Original Message:
Sent: Feb 16, 2023 08:45 AM
From: Herman Robers
Subject: Aruba Central streaming API monitoring API client ADD event after DELETE event when client is removed from network
It's hard to tell as you have redacted a lot (timestamps are missing for example), and we don't know what actually happened on the network.
Have you compared the data that you see from the Streaming API, with what you see in the Central Events?
As this is a quite specific use-case, it may be that the streaming monitor events have not been tested for this, or there could be an error in the wsclient_public.py that caused events are repeated. I can't really replicate the same, but that may also be because many of my client just reconnect after they are disconnected.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------