Internet2 sends reports to every eduroam subscriber with details about how their service has been operating along with anonymized metrics on where their guests are coming from and where their own users have been roaming. These reports are provided monthly. We also provide bi-annual and annual reports to give our eduroam community the ability to spot trends in their usage and, ideally, to see how their use of eduroam is growing! In this knowledge base article we'll provide an overview of each section of an eduroam report with an explanation of how to read it.
The purpose of these reports is two-fold. As technical tools, they can provide your team with the ability to spot trends which could indicate issues with user configurations or infrastructure, or to confirm that things are working as they should. Your reports can also be valuable tools for communicating the benefit of eduroam to external and internal stakeholders. Being able to show an audience where your users are connecting with eduroam and the diverse crowd of visiting users can be a powerful demonstration of what makes eduroam great!
Some basic concepts
With all of the report elements, data on your SP (Service Provider) portion will be displayed first followed by your IdP (Identity Provider) portion. You can also think of the "SP" portion as information on your guests - visiting users from other eduroam enable institutions that are authenticating at your locations. The "IdP" portion of a report element represents data on your own users. Note that it's common to see higher rates of failures with your guests than with your own users. If you are an SP-Only subscriber (e.g. an eduroam hotspot provider) your report will only have "SP" sections.
Distinct device activity over the last twelve months
This graph details the number of unique devices which have authenticated using your eduroam implementation. The stacked bar graph displays device authentications for a rolling 12 month window to provide your team with some longitudinal data on how well your users and guests are authenticating. Keep in mind that these represent individual devices, not a count of total authentication attempts.
Authentication request for the month
These pie charts show the total number of authentications which occurred on your eduroam implementation during the period of the report, in this case for one month of data in September. The charts for your SP and IdP also show the percentage of accepted and rejected authentications. Note that sometimes an individual device can initiate hundreds or thousands of requests in a very short time, often without the user even being aware, which can skew these charts.
Daily Accepted/Rejected requests
These bar charts show a more granular view of the total number of successful and unsuccessful authentications per day for your eduroam SP and IdP, broken out by day.
Daily Unique Device Activity
These bar charts show a more granular view of the total number of unique devices which authenticated on your eduroam SP and IdP, broken out by day and whether or not those authentications were accepted or rejected. Sometimes cross referencing the data in this chart and the "Daily Accepted/Rejected requests" chart can be used to identify the existence of problem devices. `
Accepted Request EAP types per Unique device
This set of pie charts shows the number of accepted authentications by a unique device which were processed by your SP and IdP during the report timeframe. The results are broken out by authentication method.
For a deeper dive into EAP authentication protocols refer to RFC 4017.
Rejected Request reason per Unique device
This set of pie charts shows the number of rejected authentications by a unique device which were processed by your SP and IdP during the report timeframe. Note the "Unkown" category - this typically occurs when the request was terminated before any further information could be gathered. The charts are broken out by rejection reason. Again, keep in mind that these represent single authentication attempts, which can be automatically initiated by a device at an extraordinarily high rate automatically which can produce abnormally high numbers of rejections.
Note that the reasons for rejection are generated by the national RADIUS infrastructure based on network conditions and how the user's home IdP responded, so a full list of possible rejection reasons would be too extensive for this guide. For more information on RADIUS issues refer to RFC 5080 and RFC 3576
Accepted Request EAP types
This set of pie charts shows the number of accepted authentications which were processed by your SP and IdP during the report timeframe. The results are broken out by authentication method.
For a deeper dive into EAP authentication protocols refer to RFC 4017.
Rejected Request reason
This set of pie charts shows the number of rejected authentications which were processed by your SP and IdP during the report timeframe. Note the "Unkown" category - this typically occurs when the request was terminated before any further information could be gathered. The charts are broken out by rejection reason. Again, keep in mind that these represent single authentication attempts, which can be automatically initiated by a device at an extraordinarily high rate automatically which can produce abnormally high numbers of rejections.
Note that the reasons for rejection are generated by the national RADIUS infrastructure based on network conditions and how the user's home IdP responded, so a full list of possible rejection reasons would be too extensive for this guide. For more information on RADIUS issues refer to RFC 5080 and RFC 3576.
Number of distinct guest devices by institution of origin (SP)
This graphic shows the home institution of unique devices which connected to eduroam while visiting your organization, along with a handy visualization showing where in the US their home institution is. Note that the list of Institution names can be extensive and may be truncated, particularly once the percentage of total users per institution drops below 1%.
Number of distinct guest devices by country of origin (SP)
This graphic shows the home institution of unique devices which connected to eduroam while visiting your organization, along with a cool visualization showing the country of their home institution. Note that the list of Institution names can be extensive and may be truncated, particularly once the percentage of total users per institution drops below 1%.
Number of distinct guest devices by institution of origin (IdP)
This graphic shows the name of the institution where devices owned by your users connected using eduroam, along with a handy visualization showing where in the US they connected. Note that the list of Institution names can be extensive and may be truncated, particularly once the percentage of total users per institution drops below 1%.
Number of distinct guest devices by country of origin (IdP)
This graphic shows the name of the country where devices owned by your users connected using eduroam, along with a map of the world showing everywhere your users have roamed. Note that the list of Institution names can be extensive and may be truncated, particularly once the percentage of total users visiting that country drops below 1%.
FAQs
- Who gets these reports?
- Anyone listed as a Reporting contact will receive the monthly, bi-annual, and annual reports for their organization. eduroam Administrators for your organization can check out the eduroam Federation Manager user guide section on adding contacts to learn more about adding or removing Reporting contacts.
- How can I view my reports?
- If you are an eduroam Administrator or listed as a Reporting contact you'll automatically receive reports for your organization via email.
- Why are there entires in my Institution and country of origin charts or error types that show up as "Unknown"?
- "Unknown" results are generated when an authentication attempt is interrupted or terminated before error information is provided to the national RADIUS infrastructure. This can be due to network issues or, more frequently, a configuration issue on the user device or their home IdP. They can also be caused by international visitors whose home institutions don't provide sufficient info for the reporting process.
- Why didn't anyone from my organization get a report?
- Have one of your eduroam Administrators confirm that there are reporting contacts set for your organization. eduroam Administrators for your organization can check out the eduroam Federation Manager user guide section on adding contacts to learn more about adding or removing Reporting contacts. Additionally, check any spam folders or mail filtering utilities as reports are sometimes mistaken for spam.
- Have one of your eduroam Administrators confirm that there are reporting contacts set for your organization. eduroam Administrators for your organization can check out the eduroam Federation Manager user guide section on adding contacts to learn more about adding or removing Reporting contacts. Additionally, check any spam folders or mail filtering utilities as reports are sometimes mistaken for spam.
- Who do I contact if I have questions or see an issue with my report?
- To ask a question about or or report an issues with your reports you can send an email to help@incommon.org