IAPViewer Documentation

Version: 2.0 (build 0.6.0) · Last updated: May 31, 2026

This page is the screen-by-screen user guide. For installation, contact, and FAQ-style troubleshooting see the Support page.

What's new in 2.0

Version 2.0 is the largest release since the original ship. Headlines below — most are described in detail later on this page.

Latest additions (build 0.6.0)

• Voice & Video (UCC) — a live view of Wi-Fi calls, FaceTime, and meeting-app sessions the cluster can see, split into Now / Registered / Recent. Optional (off by default).
• BLE Discovery — each AP's Bluetooth radio and the beacon/asset-tag devices it hears, shown under every AP in the tree and in a dedicated browser. Optional (off by default).
• Naming & icons — pin a custom name and icon to any client or BLE device from its detail card; the choice follows the device's MAC.
• Event Log — a per-site record of connection events, API failures, logout reasons, and which VC IP was used, with one-tap email to support.
• Strict call serialisation — every controller request now runs one-at-a-time across all background and on-demand work, closing a window where overlapping requests could make the VC start rejecting calls.
• Rebuilt load bar — shows every stage (including BLE), colour-codes the optional stages, and keeps the haptics in step with the bar.
• Fewer surprise logouts — a configurable grace period tolerates brief app switches, and emailing a support log no longer ends your session.

Navigation rebuilt around the platform

• iPad and Apple Silicon Mac: persistent sidebar with four sections (Monitor, Legacy, Analyze, App).
• iPhone in portrait: native tab bar with five tabs (Clients & APs, Channels, RF Neighbors, Settings, Disconnect).
• The old custom timer/loading bar and tab-bar scroll were removed in favour of platform-native controls.
• The separate native macOS build was retired — Mac users now run the iPad app via "Designed for iPad".

Channel View (Channels tab)

• A WiFi-Explorer-style cluster spectrum view of every AP radio across 2.4 / 5 / 6 GHz.
• Bar position = channel, width = bonded block (20–160 MHz), height = TX power.
• Foreign and rogue SSIDs detected by your APs are overlaid as translucent ghost bars on a second RSSI scale.
• Tap any ghost bar to open a Foreign SSID Detail card scoped to the specific BSSID you tapped.
• Hidden foreign SSIDs that broadcast on randomized MAC addresses are vendor-attributed by cross-referencing their broadcast siblings within the cluster.

Channel Detail upgraded

• Bonded sub-channel picker — for any 40 / 80 / 160 MHz channel, a chip row breaks the bond down into its 20 MHz blocks and tints each by per-block quality so you can see which sub-channel is dragging the score.
• Spectrum panel — SNIR bar, WiFi vs interference utilisation split, non-WiFi interference breakdown by type (Bluetooth, microwave, cordless, etc.), active interferer list, and recent spectrum alerts.
• Spectrum alerts are now band-aware — alerts from a 2.4 GHz microwave no longer leak into a 5 GHz channel card.

Per-client diagnostics

• Separate Down Speed and Up Speed bars in Client Detail, with speed-asymmetry detection (down vs up ≥ 3× triggers a dedicated reason instead of generic "Slow Speed").
• "Mgmt?" detection — when a client's recorded speed falls below its SSID's configured minimum, the bar is labelled amber "Mgmt?" instead of red "Poor", since the snapshot is almost certainly a management frame rather than real data throughput. Suppresses false alerts on IoT devices that rarely receive downlink data.
• SNR bar added between Signal and Noise Floor; Asymmetric RF direction fix (uplink vs downlink); fallback noise floor pulled from the AP's channel when the client doesn't report its own.

Faster, smoother loads

• Three-stage layered load bar (light → mid → dark blue) showing critical-path, enrichment, and spectrum stages of every load.
• Per-AP client-table migration reduced API calls per refresh from 168 to 86 on a typical 12-AP cluster; full load time fell from ~20s to ~11s.
• Per-AP monitor-list aggregation closes a long-standing gap in 5/6 GHz neighbour visibility — neighbours visible to the cluster but not to the VC's own scanning radio are now merged into the RF Neighbors tree.
• Haptics rewritten on Core Haptics (was UIImpactFeedbackGenerator) — fixes the relogin failure mode where load-bar haptics didn't fire until the bar was 80% full.

Resilience and diagnostics

• Fallback VC IP — each site can carry an optional secondary VC address. IAPViewer silently retries against it when the primary fails (typical after the Aruba floating-IP rebind failure following a cluster reboot). Two consecutive fallback connects prompts a swap; sites without a fallback get a one-time tip suggesting one on first connect.
• Test API button in the site editor — a self-contained pre-login REST probe that captures the raw request/response transcript for login, show version, and logout. Copy log puts the whole thing on the clipboard for support.
• The old single "Firmware Version Error" alert has been replaced with four cause-specific dialogs (session timeout / network unreachable / VC refused / unsupported firmware). Login error wording is plain English — "Username or password is wrong" instead of HTTP codes.

Settings and presentation

• Reorganised Settings (Display & Appearance, Site Settings, Spectrum, Channel View foreign-SSID scale, Topology, Device Icons, Advanced Tuning, Experimental).
• Four colour palettes, with five distinct semantic colours per palette (the Performance tab's five filter categories all read distinct in every palette including High Contrast).
• Font Size adjustment (−3 to +3) applied globally from the site profile.
• Customisable client-icon rules: define keywords that map hostnames to SF Symbols in the topology tree.

Getting connected

Sites

IAPViewer organises every cluster you connect to as a site. The site stores the Virtual Controller address, the optional fallback address, the username, and per-site preferences (font size, RSSI cutoff, client history retention, API call gap, fallback prompt state). Passwords are held in the iOS Keychain, not in the site record.

From the login screen:

• Tap the site row to open the site list. Add a new site with the + button, or tap any saved site to edit it.
• Edit Site fields: name, icon, VC host:port, username, fallback VC host:port (optional), password (writes to Keychain), and Test API.
• Swipe a site left in the list to delete it.
• "Try Demo" enters a demo site with sample Acme Corp data — useful for inspecting every feature without hardware.

Test API

The site editor includes a Test API button that runs a pre-login REST probe against the configured VC and, if present, the fallback. The probe runs POST /rest/login, GET /rest/show-cmd?cmd=show version (with and without type=2), and POST /rest/logout, then displays each step with the raw request and response.

• Failed steps expand automatically so the diagnostic is in front of you on open.
• Re-run in the toolbar replays the probe.
• Copy log puts the whole transcript onto the clipboard for pasting into a support email.
• Email log to support opens a pre-filled message with the transcript attached.
• Open support site opens https://iapviewer.bdlfoundry.dev in Safari.

Leaving IAPViewer to send that email (or open the support site) no longer logs you out — see Keep session on switch under Settings.

Fallback VC IP

Each site can carry an optional secondary VC address. When the primary fails to bootstrap because of a network or VC-refusal error, IAPViewer silently logs in against the fallback and shows a notice once you're connected. Details:

• The auto-retry only fires for network-level failures, not for incorrect credentials or unsupported firmware.
• The site needs a stored Keychain password for the silent retry to work — biometric-protected credentials qualify.
• After two consecutive successful connects via the fallback, the app prompts to swap the primary and fallback addresses (the swapping VC has clearly become the more reliable one).
• For sites without a fallback, the app shows a one-time tip on first connect explaining the floating-IP rebind scenario and offering to add one.

Login errors

Every connection failure now produces a cause-specific dialog rather than the old generic "Firmware Version Error":

• Session timeout — VC sign-out after 15 minutes of inactivity. Log in again to continue.
• Network unreachable — couldn't reach the VC at all. Check Wi-Fi, VPN, and routing to the VC IP.
• VC refused the request — the VC is reachable but rejecting REST API calls. Usually REST API isn't enabled, or there's an auth issue.
• Firmware not supported — VC firmware is outside IAPViewer's tested range. Dialog links to this site for the supported-firmware list.

Login-screen errors are translated into plain English ("Username or password is wrong", "Couldn't reach the VC in time. Check your network and the address, then try again.") rather than HTTP codes.

Navigation

The navigation surface adapts to the device:

iPad & Apple Silicon Mac ("Designed for iPad")

A persistent sidebar runs down the left, organised into four sections:

• Monitor — Clients & APs, Channels (Channel View), RF Neighbors
• Legacy — Clients, Access Points, Channel Quality, Performance (the original flat-list views, kept alongside the hierarchical Clients & APs tree)
• Analyze — Deny List, Config, Logs, VSG Check, Firmware
• App — Exports, Settings, Disconnect

RF Locator appears under Monitor when enabled via Settings → Experimental → Show RF Location. In portrait orientation the sidebar is hidden by default and swipes out from the left edge.

iPhone Pro / Max in landscape

Same sidebar; hidden by default and swipes out from the left edge.

iPhone in portrait

A native tab bar runs along the bottom with five tabs:

• Clients & APs — the hierarchical tree
• Channels — Channel View
• RF Neighbors
• Settings — also surfaces the Analyze tools (Deny List, Config, Logs, VSG Check, Firmware), the Exports tool, and the optional Legacy / Experimental views as pushed screens
• Disconnect — turns amber with a warning triangle when your VC session is less than two minutes from timing out

Loading indicators

A thin progress strip runs along the top of the screen during loads. Each stage has its own colour and fills in turn; a light haptic pulses once per completed call, in step with the bar. The two core stages always run; the rest only run when their toggle is enabled in Settings.

1. Core — light blue. Cluster summary, firmware, clients, associations, and per-AP details. When this finishes the app is fully usable.
2. Detail — mid blue. Channel quality, per-AP statistics, RF neighbours, performance metrics, wired-port data, and ancillary info.
3. Spectrum — amber. Per-AP spectrum scans for Channel View and Channel Detail. Optional (Load Spectrum Data, on by default).
4. BLE — blue. Per-AP Bluetooth discovery. Optional (Load BLE Data, off by default).
5. UCC — green. Voice/Video (Wi-Fi calling, meeting apps). Optional (Load UCC Data, off by default), and a quick final pass.

The optional-stage colours are mirrored as a small dot next to each toggle in Settings, so the colour on the bar tells you which feature is loading. You can navigate freely while loading — views populate as their data arrives.

Clients & APs (hierarchical tree)

The primary monitoring surface. The cluster is shown as a tree:

Site
  ├── AP
  │     ├── Radio (band, channel, width)
  │     │     ├── Client
  │     │     └── Client
  │     └── Wired Interface
  │           └── LLDP Neighbour
  ├── AP …
  └── Offline AP (italicised + dimmed)

What it shows

• Site row — site pill with the cluster name, AP count, and client count. Always visible.
• AP rows — name, online state, active-band coloured dots, live client count. Offline APs are italicised with an "Offline" tag.
• Radio rows — band-coloured dot, channel + width, either monitor-mode indicator or utilisation, and client count.
• Wired Interface rows — port name, "slow link" warning triangle when the negotiated speed is ≤100 Mbps, and client count.
• Client rows — device icon (matched from your icon rules), name, an amber warning triangle if the client is currently flagged in the Performance view, and RSSI.
• LLDP neighbour rows — appear under each wired port with system name, capability flag, management IP, and remote port. Switches get a distinct icon.
• Ghost rows — clients that have just roamed away appear italicised and dimmed with their move destination, so you can trace a roam in real time.

What you can do

• Type into the search field (iPhone landscape / iPad) or use the rotate-to-search hint on iPhone portrait — matches against APs, radios, and clients and narrows the whole tree.
• Use the expand-all / collapse-all chevrons at the top.
• Tap an AP row to open AP Detail.
• Tap a radio row to open AP Detail focused on that radio's parent AP.
• Tap a wired interface row to open the wired-port detail panel (link state, speed, duplex, LLDP neighbour).
• Tap a client row to open Client Detail.
• Tap the site pill to open the site detail card.
• Pull down to refresh the cluster.

Performance flagging

The same warning triangle used in the Performance view appears inline on client rows that meet your configured retry threshold or signal/SNR limits. Tapping into Client Detail from a flagged client shows the same Performance Impact card as the Performance tab.

Wired topology overlay

If Settings → Topology → Load Wired Port & LLDP Data is on (default), per-AP port speed/duplex and a single cluster-wide LLDP fetch are pre-fetched in the background after the critical-path load. The information is then available wherever a wired port or LLDP neighbour appears.

Channels (Channel View)

A WiFi-Explorer-style cluster spectrum view. The screen is reached from the Channels tab on iPhone, or Monitor → Channels in the sidebar on iPad.

The chart

One band at a time (2.4 / 5 / 6 GHz, selected from the segmented band picker). Each AP radio in the cluster is drawn as a bar:

• Bar position — channel
• Bar width — bonded channel width (20, 40, 80, or 160 MHz)
• Bar height — TX power in dBm (left Y-axis)
• Diagonal stripe — the primary 20 MHz channel within the bonded block
• Sub-band shading — ISM, UNII-1..8, DFS, and 6 GHz PSC channels are colour-coded along the top and baseline of the chart

When spectrum data is enabled, foreign and rogue SSIDs detected by your APs are overlaid as translucent ghost bars on a separate RSSI scale shown on the right.

What you can do

• Use the band picker to switch between 2.4 / 5 / 6 GHz. Your last band is remembered.
• Tap a footer pill to filter to your own radios only, foreign SSIDs only, or rogue SSIDs only. Tap again to clear.
• Tap an own-cluster bar to open Channel Detail focused on that AP and channel.
• Tap a ghost bar to open Foreign SSID Detail for that specific BSSID.

Channel Detail

Opens from Channel View (tap a bar) or from Channel Quality (tap a row). Shows the full picture for one channel.

Sections, in order

1. Bonded sub-channels (only on bonded channels > 20 MHz) — one chip per 20 MHz block in the bond, tinted by per-block quality and marked "P" for the primary. Tap a chip to inspect that sub-channel's readings.
2. Channel Health — gauge ring with Quality score, stacked Utilization bar (WiFi vs Interference), Noise Floor, SNIR, Retry Rate. Each bar has a doc-icon button for an explainer sheet.
3. APs on This Channel — each AP's model, scanning state, client count, utilisation, and quality. The AP you tapped (if any) is highlighted with a SELECTED tag. A warning triangle appears on APs reporting non-WiFi interference.
4. Interfering SSIDs on this channel — foreign networks observed on this channel with manufacturer, PHY, width, AP type, RSSI.
5. Non-WiFi Interferers — Bluetooth / Microwave / Cordless Phone / Other breakdown, plus active interferers and the channel's spectrum-alert history.
6. Suggestions — contextual advice based on the readings (non-standard 2.4 GHz channel, DFS, high co-channel AP count, etc.).

Notes

• Spectrum-derived bars are hidden when every AP returned limited-scan sentinel zeros for the channel.
• Spectrum alerts are filtered to this band — alerts from other bands show as a "+ N more" footer line.
• The doc-icon buttons next to Channel Health, Non-WiFi, and Interfering SSIDs open explainer sheets covering what the metric means and how to interpret it.

Foreign SSID Detail

Opens from Channel View (tap a ghost bar). Scoped to the specific BSSID you tapped, not aggregated across all radios.

What it shows

• Title — ESSID (or "[Hidden network]") and the worst observed classification (Interfering / Rogue).
• Identity — signal, bandwidth, channel range, centre channel and frequency, BSSID, and manufacturer. When the vendor was inferred from a cluster sibling, an "Inferred from" row carries the anchor BSSID.
• Broadcasting Radios — every BSSID heard sharing this ESSID across the cluster, with band, channel, width, vendor (or "Vendor unknown — primary BSS not observed" for unresolvable randomised cases), RSSI, SNR, and client count. The tapped row carries a TAPPED chip.
• Classification — observed types, encryption modes, and PHY types.

RF Neighbors

The cluster's complete view of every other Wi-Fi network its radios can hear — your own SSIDs, foreign networks, and any APs classified as rogue.

Organised as a tree: SSID → BSSID → (expandable) clients on that BSSID.

• SSID rows — name, classification chip (rogue / interfering), BSSID count.
• BSSID rows — RSSI bar, MAC, manufacturer, channel badge (coloured by band), PHY badge, encryption badge.
• Client rows — MAC, manufacturer, channel, signal.

What you can do

• Type into the search field (iPhone landscape / iPad) to filter by SSID, BSSID, or manufacturer.
• Tap an SSID row to expand or collapse it.
• Tap the client-count row under an SSID to show or hide its clients.
• Use the expand-all / collapse-all chevrons.
• Pull down to refresh.

The RF RSSI Cutoff preference (Settings → Site Settings) hides BSSIDs and SSIDs whose signal is weaker than the configured threshold (Aruba's positive scale — higher = weaker).

Performance

A ranked list of wireless clients flagged for performance issues, scored by how many categories they trigger.

Categories

• Slow Speed — recorded down-speed below 12 Mbps.
• Speed Asymmetry — up-speed ≥ 3× down-speed (typical of a weak receive chain rather than an RF problem).
• Poor Signal — signal label = poor.
• High Retry — retry rate above your configured Airtime Warning Threshold.
• Asymmetric RF — > 15 dB gap between uplink and downlink SNR (with direction correctly inferred from Aruba's positive scale).
• Poor SNR — SNR below 25.

What you can do

• Toggle the five filter chips to include or exclude each category. The choices are remembered between sessions.
• Tap a client row to open Client Detail.
• Tap the doc-icon next to any legend entry for an explainer.
• Pull down to refresh.

Each row also shows the row's Impacting: list — fast peers on the same AP and band that the flagged client is harming through airtime contention.

Client Detail

The per-client card. Reached from Clients & APs, Clients, the Performance tab, Search, and the Connected Clients list inside AP Detail.

Sections

• Identity — name, IPv4 / IPv6, MAC, manufacturer, operating system.
• Connection — SSID, AP, BSSID, band, channel + width, PHY, role, association time. Wired clients show the wired interface here.
• Signal Health — Signal, SNR, Noise Floor, Down Speed, Up Speed, Last Uplink Signal, Last Downlink Signal, Retry Rate. Each bar carries a scaled fill with a Good / OK / Poor label, bold-coloured to match the value.
• Performance Impact — flagged issues with doc-icon buttons that open explainer sheets (Slow Speed, Poor Signal, Poor SNR, High Retry, Asymmetric RF, Mgmt Frame), plus the fast peers being harmed.
• Current Throughput — live down / up.
• Security — auth type, type, detail, and a row of capability pills (WMM, 11k, 11v, PMF, 11r, SAE, etc.). Tap any pill for a sheet explaining that capability.
• Mobility Trail — recent roaming events.
• Recent Stats — timestamped snapshot rows with signal / link-rate / throughput.
• Roam Cache.
• Traffic Sessions — datapath sessions with source/destination, protocol, flag string, and DENY badge.

The Mgmt? label

When Down Speed is below the SSID's configured minimum TX rate (g-min-tx-rate / a-min-tx-rate), the bar is labelled amber "Mgmt?" instead of red "Poor". The snapshot is almost certainly a management frame rather than real data throughput, which is why IoT devices (cameras, smart switches, plugs) used to misleadingly appear as Slow Speed. The doc-icon next to the row opens an explainer sheet.

What you can do

• Tap any capability pill or doc-icon to open an explainer sheet.
• Tap the refresh icon in the toolbar to re-poll live data.
• Pull down to retry on the rare load failure.

AP Detail

The per-AP card. Reached from Access Points (tap a card) or from any AP / radio row in Clients & APs.

Sections, in order

1. Identification — name, IP, model, serial, MAC, uplink port, Wi-Fi capability, status, uptime, mode.
2. Version Support — Instant minimum and maximum supported firmware for the model. An amber warning appears when the model is capped before 8.13.
3. Power over Ethernet — current and average watts.
4. LED Status — System LED state, plus a composite Radio LED row with a per-radio breakdown on multi-radio APs.
5. Radios — one section per active radio: channel, TX Power, Channel Utilisation, and Noise Floor bars.
6. WLANs — BSSIDs grouped by ESSID, each with PHY, band, and bandwidth.
7. Spectrum — per-channel Quality, SNIR, WiFi utilisation, non-WiFi breakdown by type, active interferers grouped by band, and recent spectrum alerts. Doc-icon buttons open SNIR and non-WiFi explainer sheets.
8. Connected Clients — every client currently associated to the AP.

What you can do

• Tap any client row to open Client Detail.
• Tap the refresh icon in the toolbar to re-poll LED status, BSSIDs, and spectrum.
• Tap the doc-icon next to a Spectrum section for the relevant explainer.

Voice & Video (UCC)

A live view of the Unified-Communications sessions your cluster can see — Wi-Fi calls, FaceTime, and meeting apps (Teams, Zoom, Meet). It's off by default; enable Load UCC Data in Settings to populate it. Reached from the sidebar (iPad) → Analyze, or iPhone Settings → Tools.

What it shows

Sessions are grouped into three sections:

• Now — an active call/session in progress. A green phone (or video) icon, the app/carrier, the serving AP, and a quality read-out ("audio good", etc.).
• Registered — Wi-Fi calling is set up and the IPsec tunnel is up, but no call is in progress. The device is ready to place a call over Wi-Fi; this state doesn't drain battery.
• Recent — recently classified UC clients that are now idle.

IAPViewer tells an active call from an idle registration by comparing the IPsec tunnel's traffic counters against the previous refresh, cross-checked with call-detail records and datapath sessions on the serving AP.

What you can do

• Tap a row to open its detail card (carrier/app, codecs where visible, the serving AP, and the underlying signals).
• Pull down to re-evaluate without a full cluster reload.

BLE Discovery

Surfaces the Bluetooth Low-Energy environment each AP can hear — asset tags and beacons. Off by default; enable Load BLE Data in Settings. When on, two things appear:

• In the Clients & APs tree, each AP gains a BLE radio node listing the beacon-class devices that AP currently hears.
• A dedicated BLE Discovery browser (Settings) aggregates every heard device across the whole cluster, de-duplicated by device address, with vendor attribution and the strongest-hearing AP.

Generic beacons that broadcast from rotating (private) addresses are attributed by their Bluetooth-SIG company ID rather than a hardware vendor; named asset tags (e.g. Aruba tags) are identified directly. The cluster's own AP radios are filtered out of the results.

Naming & icons (Customize)

Any client or BLE device detail card includes a Customize section that lets you pin a friendly name and an icon to that device. The topology tree picks the change up immediately.

• Name — type a label; it commits when you tap Done or leave the field (not per keystroke). Leave it blank to fall back to the auto-derived name.
• Icon — opens a sectioned icon grid; the choice applies straight away.
• Reset to default — clears the custom name and icon.

Access Points (legacy list)

Card grid of every AP — one column on iPhone, two on iPad. Each card shows name, badges (VC, Monitor, constrained-model warning), client count, IP, serial, model, PoE draw (current + average), per-radio channels (colour-coded by band), uptime, and uplink port. A Cluster PoE summary row totals current and average watts. Offline APs sit in a dimmed section at the bottom.

What you can do

• Tap an AP card to open AP Detail.
• Tap the client-count badge to jump to Clients filtered to that AP.
• Tap the Cleanup Script row above the Offline section to open a sheet of CLI commands that remove every offline AP from the allowed-AP list. Copy puts the whole script onto the clipboard.
• Pull down to refresh.

Clients (legacy flat list)

The original flat list of every client on the cluster, sortable and filterable. Available from the iPad sidebar, or from iPhone Settings → Legacy Views when the toggle is on.

Filters

The filter strip at the top supports: Online, Offline, Wireless, Wired, 2.4 GHz, 5 GHz, 6 GHz, WPA3-Ent, WPA3-SAE, WPA2, Open / OWE.

Sort

Sort header bar offers Name, Signal, or Health, ascending or descending. Tap a column header to change sort.

Offline section

Clients you've seen connected to the cluster previously but that are not currently online appear in an Offline section (only visible under the Offline filter). Each row shows last-seen timestamp, last AP, and last SSID. Swipe a row left to delete it; the section header menu can clear them all.

Retention is controlled by Settings → Site Settings → Client History (10 / 30 / 90 / 180 days / 1 year, default 90). Tightening retention shows a confirmation telling you how many entries will be removed.

Channel Quality (legacy list)

Stacked-card list of every channel the cluster's APs are using, grouped by 2.4 GHz and 5 GHz. Each card shows channel number, an overlap warning ("Overlaps ch 1 & 6") on non-standard 2.4 GHz channels, Good / OK / Poor pill, a Quality bar, a stacked WiFi/Interference utilisation bar, a Noise Floor bar, and a horizontally scrollable row of AP pills. A warning triangle appears on AP pills that are reporting non-WiFi interference.

Tap any card to open Channel Detail.

RF Locator (experimental)

An on-demand probability estimator for foreign Wi-Fi sources, drawn over a satellite map. To enable it, toggle Settings → Experimental → Show RF Location on.

Setup

The bottom card walks you through the steps: Setup → Place APs → Ready → Analysing → Result.

1. Tap the SSID button at the top to pick a target foreign BSSID — the list is ranked by RSSI on the 2.4 GHz band.
2. Tap Place APs, then tap the map to drop a pin for each of your APs. When several APs are unplaced, a sheet asks which AP each pin represents.
3. Drag an existing pin to move it; tap a pin's callout trash button to remove it.
4. Tap Analyze (or Refresh if a result is already shown) to compute the area.
5. Expand the result card to see the RSSI each AP reported for the chosen neighbour.

What controls accuracy

Accuracy depends almost entirely on your AP layout, not on the app. Estimates improve when:

• More of your APs hear the same neighbour.
• Those APs are physically separated.
• APs are installed uniformly — similar model, mounting height, and orientation.

Most production installs were designed for client coverage, not RF geolocation. Expect your own site to fall in that category — broad fuzzy areas are the norm, tight peaks the exception.

Settings tools

Deny List

Every client currently denied by the VC. Each entry shows MAC, manufacturer (or "Unknown · possibly randomised"), countdown to expiry, deny reason, originating AP, timestamp, and a single-line no denylist-client <mac> CLI snippet.

• Tap Auth Log on an entry to fetch and inline-expand recent authentication events for that MAC.
• Tap the copy icon on a row to copy that entry's remove command to the clipboard.
• Tap the Cleanup Script row to open a sheet that aggregates the remove commands for every entry.

Config

Read-only view of the cluster's running configuration as plain monospaced text. Long-press to select and copy specific lines.

Logs

Live log viewer. Three pickers at the top:

• Target AP — defaults to the VC; switchable to any online AP.
• Log type — priority types listed first (debug, sapd, security, system, user, user-debug, wireless), plus 40+ others.
• Line count — 10, 25, 50, 100, or 200.

The running show log <type> <count> command appears as the section header. Each picker change re-runs the fetch after a short debounce. Long-press log lines to select and copy.

VSG Check

A best-practice rule check of the cluster's running config against Aruba's Validated Solutions Guide. Tap Fetch & Validate to pull a fresh running config and run the rule engine.

Results are split into per-SSID sections plus a Global Settings section. Each section carries a pass-percentage pill and "passed / failed / total" subtitle. Tap a check row to expand its What this means and How to fix explanations.

Attribution credits Aaron Scott's Central Automation Studio, which inspired the rule set. Flagged checks indicate deviation from the VSG — not confirmed misconfiguration.

Firmware (Upgrade Planner)

Helps understand the impact of a firmware upgrade on the AP fleet before you commit to it.

• Current State — cluster firmware, count of APs with capability data, count of constrained-model APs.
• Firmware Upgrade Simulator — segmented picker for the target Instant train (8.10 / 8.11 / 8.12 / 8.13). Below it, every AP row shows whether it would still be supported on the chosen train.
• Remediation Options — for any AP that wouldn't survive the chosen train: replace it with a compatible model, isolate it on a separate cluster, or retire it from the allowed-AP list. The replacement suggestion uses a per-model lookup; if no replacement is known the row reads "Consult an Aruba SE".

The capability database is bundled with the app and refreshed automatically in the background when a newer version is published.

Event Log

A per-site record of what happened during your connection sessions — built for diagnosing intermittent problems after the fact. Open it from the site editor (next to Test API) or from Settings → Advanced Tuning → View Event Log. It keeps the current run plus the last few runs for the site.

What it captures

• Connection events — connecting, connected, and any fall-back to the secondary VC IP (with the reason the primary failed).
• API failures — each failed controller call with the operation, the error, the load stage, and the run-up to it.
• Logout reasons — why a session ended: you disconnected, the inactivity timeout, the VC ended the session, or the app went to the background.
• App background/foreground — so a session that ended because the device was set down is explained, not mysterious.
• Load complete — a per-load summary: total API calls, per-stage timing and call counts, and any taps you made while it was loading.

What you can do

• Pick a run from the picker (this run, last run, or an earlier one) and expand any entry for detail.
• Copy log puts the run's transcript on the clipboard; Email log to support opens a pre-filled message; Open support site opens this site.

Exports

Reports and CSV / script exports. Reached from the sidebar (iPad) → App → Exports, or from iPhone Settings → Tools → Exports.

Format picker

Choose Plain Text or PDF at the top. PDF renders in 8-point monospaced on A4 via the iOS share sheet.

Available exports

• Client List
• Access Points
• Channel Quality
• Performance
• RF Neighbors
• Deny List
• VSG Check
• Upgrade Planner
• Running Config
• Offline AP Cleanup Script — .txt of CLI remove commands for every offline AP
• Denylist Cleanup Script — .txt of CLI remove commands for every denied client
• Export AP list for GreenLake (CSV) — serial, MAC, AP name, tag URL — formatted for HPE GreenLake import

Rows whose source data hasn't been loaded yet are dimmed with a "Visit the X tab to load data first" caption. Tap a row to render the report and open the iOS share sheet.

Search

A dedicated client search. Available from the sidebar (iPad) → Monitor → Search, or from the iPhone tab bar.

Type into the bar to match against client name, wired hostname, IP, MAC, and manufacturer. Tap a result to open Client Detail. Cancel clears the query.

Settings

Reached from the sidebar (iPad) → App → Settings, or from the iPhone tab bar. The page is organised into sections from top to bottom; on iPhone portrait, additional Tools and Legacy / Experimental groups appear above the standard sections.

Display & Appearance

• Color Palette — pick from the four bundled schemes (Standard, High Contrast, Warm, Cool). Three preview swatches show the Good / OK / Poor colours each palette uses.
• Font Size — −3 to +3 steps applied globally from the site profile.
• Show Legacy Views — when on, the original Clients / Access Points / Channel Quality / Performance views appear in the iPad sidebar (Legacy section) and at the top of iPhone Settings.

Site Settings

• RF RSSI Cutoff — hides signals weaker than this value from RF Neighbors. Aruba positive scale; higher = weaker. Range 70–110 dBm, default 75.
• Airtime Warning Threshold — flags clients whose retry rate exceeds this value (range 10–200%).
• Client History — how long to keep records of clients that have left the network. 10 / 30 / 90 / 180 days / 1 year. Tightening shows a confirmation with the number of entries that would be removed.
• Clear Offline Client History — removes every offline client currently stored for this site.

Spectrum

• Load Spectrum Data — on by default. When on, an additional set of per-AP API calls runs as a third loading stage to retrieve channel quality, SNIR, non-WiFi breakdown, active interferers, and recent alerts. On a 12-AP cluster this adds roughly 3–5 seconds to load time. Disable to shave that time.

Channel View

Two sliders that control the foreign-SSID ghost-bar scale on the spectrum chart:

• Strongest RSSI (top of scale) — neighbours stronger than this clamp to the top. Lower to spread strong neighbours.
• Weakest RSSI (bottom of scale) — neighbours weaker than this fade to invisible. Raise to hide distant neighbours.

Topology

• Load Wired Port & LLDP Data — on by default. After the main load completes, fetches port speed, duplex, and LLDP neighbour data for every AP with a wired interface. Disable on large networks if pure load speed matters more than wired detail.

Voice/Video & BLE data

• Load UCC Data — off by default. Runs a final, quick set of calls to populate the Voice & Video view (Wi-Fi calls, meeting apps). Shows as the green stage on the load bar.
• Load BLE Data — off by default. Runs a per-AP Bluetooth scan to populate BLE Discovery. Shows as the blue stage on the load bar.

Each optional-load toggle (Spectrum, BLE, UCC) carries a small colour dot matching its segment on the load bar, so you can tell at a glance which stage a colour represents.

Device Icons

Tap Device Icon Rules to open the rule editor. Each rule maps a hostname keyword to an SF Symbol; the first match wins. Rules sort alphabetically. In the editor:

• Tap a row to edit it.
• Tap + to add a new rule.
• Tap EditButton to drag-reorder, or swipe a row left to delete.
• Tap Reset and confirm to restore the built-in defaults.
• The icon picker is a paged grid; the current selection is highlighted.

Advanced Tuning

• API Call Gap — minimum delay between consecutive API calls, 0–150 ms in 50 ms steps. Saved per site. Default 0 ms — most clusters run cleanly there. 50 ms is automatically applied for Aruba Central-managed clusters. Increase if you're seeing errors in the Event Log.
• View Event Log — opens the per-site Event Log (above), showing the live error count for this session. Replaces the old inline error list and load-timing line — that detail now lives in the log's "Load complete" entry.
• Keep session on switch — how long IAPViewer keeps your session alive when you briefly leave the app (switch apps, glance at a notification) before logging out for security. 10 sec / 30 sec / 1 min / 2 min / 5 min, default 30 sec. The 14-minute inactivity timeout still applies.
• Verbose API Trace — when on, logs every API call to the Event Log, not just failures. For chasing intermittent issues; noisy, so off by default.

Experimental

• Show RF Location — reveals the RF Locator view. The probability triangulation is still being tuned; treat results as a starting point, not gospel.

Quick reference

Where each tool lives

If something goes wrong

Most operational issues — load stalls, API errors, intermittent failures on Central-managed clusters, the fallback IP rebind scenario — are covered in detail on the Support page under Common Issues. The short version:

• Run Test API from the site editor first. It tells you exactly where the problem is: network, REST, auth, or firmware.
• Check Settings → Advanced Tuning → View Event Log — if it shows API errors, increase the API Call Gap in 50 ms steps until the load is clean. The log also records logout reasons and fallback use, and can be emailed to support.
• If the VC IP stops responding entirely after a cluster reboot, you've probably hit the Aruba floating-IP rebind failure. Configure a fallback VC IP on the site, or temporarily switch the site address to any individual AP's DHCP IP.

Contact

IAPViewer is developed and maintained as a side project. Support is best-effort.

Email: [email protected]
Support site: https://iapviewer.bdlfoundry.dev
Typical response: 1–2 weeks for non-critical issues

See also: Support · API Reference · Privacy Policy · Terms of Use

IAPViewer is developed independently and is not affiliated with, endorsed by, or sponsored by HPE, Aruba Networks, or any of their subsidiaries.
Aruba and Aruba Networks are registered trademarks of Hewlett Packard Enterprise.
Apple, App Store, iPhone, iPad, and TestFlight are trademarks of Apple Inc.
IEEE is a registered trademark of the Institute of Electrical and Electronics Engineers, Inc.