Question about how to find unfinished requests

[John Douglass]

I am trying to debug an issue on my servers with the following 
configuration:

freeradius 2.2.0 -> proxy to AD server running radius for auth -> return 
auth (yes/no) then my server appends the necessary vlan attributes from 
its local DB

I am seeing a number of these messages:

Nov 11 17:57:31 dvlanc radiusd[17781]: Received conflicting packet from 
client resnet4-WiSM-A port 32770 - ID: 18 due to unfinished request 
928878.  Giving up on old request.
Nov 11 17:57:35 dvlanc radiusd[17781]: Received conflicting packet from 
client Rich-core-WiSM-B port 32770 - ID: 205 due to unfinished request 
929613.  Giving up on old request.
Nov 11 17:57:37 dvlanc radiusd[17781]: Received conflicting packet from 
client Rich-core-WiSM-B port 32770 - ID: 36 due to unfinished request 
929843.  Giving up on old request.
Nov 11 17:57:41 dvlanc radiusd[17781]: Received conflicting packet from 
client Rich-core-WiSM-B port 32770 - ID: 205 due to unfinished request 
930139.  Giving up on old request.
Nov 11 17:57:41 dvlanc radiusd[17781]: Received conflicting packet from 
client Rich-core-WiSM-B port 32770 - ID: 216 due to unfinished request 
929934.  Giving up on old request.
Nov 11 17:57:44 dvlanc radiusd[17781]: Received conflicting packet from 
client resnet4-WiSM-A port 32770 - ID: 253 due to unfinished request 
929666.  Giving up on old request.
Nov 11 17:57:44 dvlanc radiusd[17781]: Received conflicting packet from 
client Rich-core-WiSM-B port 32770 - ID: 36 due to unfinished request 
930099.  Giving up on old request.

How do I view "into the beast" to find the start of these requests? For 
example, I see no way to locate the stream of events for request 928878 
so that I can narrow down where the problem is. My gut says it's located 
down the chain at the AD server (accessed via the radius protocol) 
taking too long but I have to prove it before I can get some action.

Would tcpdump/tshark/etc be the way to attempt to follow these 
authentications or is there a better way with some enhanced logging 
parameters? If we know the request numbers, how do you pair those with 
any internal logging (via maybe radmin). It would be useful if, say, all 
log messages like

Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [mbaker66] (from client 
Rich-core-WiSM-B port 13 cli e0-c9-7a-55-9b-f5)
Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [fpeterson99] (from 
client resnet4-WiSM-A port 13 cli a8-96-8a-f3-5f-5b)
Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [gabriwal3] (from 
client resnet4-WiSM-A port 13 cli 3c-d0-f8-61-f3-27)

included the request numbers in their logging output (or actually ANY 
log messages should include the request number it is involved in).

We are having some major problems as the freeradius server gets hit with 
load between classes and starts losing auth. We are attempting to remove 
the dependence upon samba by going with configuring a proxy to AD over 
radius for authentication rather than rely upon an ntlm_auth.

Thanks for any input/advice.