Operations, Monitoring, and Troubleshooting
Work the layers, not the symptoms
AWCC troubleshooting items usually describe one symptom and expect a layered path: physical/PoE, then discovery and join, then VLAN and DHCP, then association and security, then forwarding and DNS. Naming the layer that fails is worth more than listing five possible causes.
Baselines and counters
- Channel utilization above roughly 50–60% and sustained retry rates above 20% usually indicate a real design problem, not a busy minute.
- Noise floor near −80 dBm or worse suggests non-802.11 interference; check with a spectrum analyzer before moving channels.
- Client count per radio and per-SSID growth explain slowdowns that look like RF faults.
- Correlate syslog, SNMP traps, and controller events by timestamp - which requires working NTP.
Worked example
Users associate successfully but receive no IP address. Association working proves RF and security are fine, so the fault sits after the 4-way handshake. Check the SSID-to-VLAN mapping, the trunk allowed list, the DHCP scope and relay, and whether DHCP snooping trusts the AP uplink. A static IP test that succeeds while DHCP fails narrows it to DHCP or VLAN, not radio.
Common root causes
Discovery failures from an unreachable manager or blocked option 43; certificate or clock errors that break secure joins; MTU and fragmentation issues that drop large frames after association; PoE class mismatch causing AP reboots under load; sticky clients held by strong 2.4 GHz coverage.
Traps that cost marks
Blaming RF for a DHCP problem; chasing retries caused by one legacy device; restarting the controller before capturing evidence; treating a single user report as a network-wide outage without checking the dashboard scope.