<div dir="ltr">hi,<div><br></div><div>the radius servers on my network are receiving spikes of ACCESS-ACCEPT traffic, I have been analysing traffic using tshark and noticed that some of the ACCESS-ACCEPT sent from the server back to the client does not have the AVP attributes set</div>
<div><br></div><div>below is an example</div><div><br></div><div><div>Frame 167 (62 bytes on wire, 62 bytes captured)</div><div> Arrival Time: Jul 12, 2013 21:52:57.089629000</div><div> [Time delta from previous captured frame: 0.008112000 seconds]</div>
<div> [Time delta from previous displayed frame: 0.571386000 seconds]</div><div> [Time since reference or first frame: 3.798843000 seconds]</div><div> Frame Number: 167</div><div> Frame Length: 62 bytes</div><div>
Capture Length: 62 bytes</div><div> [Frame is marked: False]</div><div> [Protocols in frame: eth:ip:udp:radius]</div><div>Ethernet II, Src: Vmware_b7:5f:ec (00:50:56:b7:5f:ec), Dst: Vmware_b7:60:10 (00:50:56:b7:60:10)</div>
<div> Destination: Vmware_b7:60:10 (00:50:56:b7:60:10)</div><div> Address: Vmware_b7:60:10 (00:50:56:b7:60:10)</div><div> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div><div> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div> Source: Vmware_b7:5f:ec (00:50:56:b7:5f:ec)</div><div> Address: Vmware_b7:5f:ec (00:50:56:b7:5f:ec)</div><div> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div><div> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div> Type: IP (0x0800)</div><div>Internet Protocol, Src: 10.66.xx.13 (10.66.xx.13), Dst: 10.66.xx.19 (10.66.xx.19)</div><div> Version: 4</div><div> Header length: 20 bytes</div><div> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)</div>
<div> 0000 00.. = Differentiated Services Codepoint: Default (0x00)</div><div> .... ..0. = ECN-Capable Transport (ECT): 0</div><div> .... ...0 = ECN-CE: 0</div><div> Total Length: 48</div><div> Identification: 0x98fe (39166)</div>
<div> Flags: 0x00</div><div> 0... = Reserved bit: Not set</div><div> .0.. = Don't fragment: Not set</div><div> ..0. = More fragments: Not set</div><div> Fragment offset: 0</div><div> Time to live: 64</div>
<div> Protocol: UDP (0x11)</div><div> Header checksum: 0x631b [correct]</div><div> [Good: True]</div><div> [Bad : False]</div><div> Source: 10.xx.xx.xx (10.66.xx.13)</div><div> Destination: 10.xx.xx.19 (10.66.xx.19)</div>
<div>User Datagram Protocol, Src Port: radius (1812), Dst Port: 38346 (38346)</div><div> Source port: radius (1812)</div><div> Destination port: 38346 (38346)</div><div> Length: 28</div><div> Checksum: 0x83e8 [correct]</div>
<div> [Good Checksum: True]</div><div> [Bad Checksum: False]</div><div>Radius Protocol</div><div> Code: Access-Accept (2)</div><div> Packet identifier: 0xa (10)</div><div> Length: 20</div><div> Authenticator: B08F0EA3338728A7D2F7BC9F2D18861C</div>
<div> [This is a response to a request in frame 166]</div><div> [Time from request: 0.008112000 seconds]</div></div><div><br></div><div><br></div><div>traffic was very low when i did this trace so i dont think it is a radius retransmit? the below is another ACCESS-ACCEPT packet but has the radius AVP attributes set, any idea why there is a difference between the first and the second below?</div>
<div><br></div><div><div>Frame 1056 (121 bytes on wire, 121 bytes captured)</div><div> Arrival Time: Jul 12, 2013 21:56:28.665290000</div><div> [Time delta from previous captured frame: 0.000353000 seconds]</div><div>
[Time delta from previous displayed frame: 0.000353000 seconds]</div><div> [Time since reference or first frame: 20.611588000 seconds]</div><div> Frame Number: 1056</div><div> Frame Length: 121 bytes</div><div>
Capture Length: 121 bytes</div><div> [Frame is marked: False]</div><div> [Protocols in frame: eth:ip:udp:radius]</div><div>Ethernet II, Src: Vmware_b7:5f:ec (00:50:56:b7:5f:ec), Dst: Vmware_b7:2d:6f (00:50:56:b7:2d:6f)</div>
<div> Destination: Vmware_b7:2d:6f (00:50:56:b7:2d:6f)</div><div> Address: Vmware_b7:2d:6f (00:50:56:b7:2d:6f)</div><div> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div><div> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div> Source: Vmware_b7:5f:ec (00:50:56:b7:5f:ec)</div><div> Address: Vmware_b7:5f:ec (00:50:56:b7:5f:ec)</div><div> .... ...0 .... .... .... .... = IG bit: Individual address (unicast)</div><div> .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)</div>
<div> Type: IP (0x0800)</div><div>Internet Protocol, Src: 10.66.xx.13 (10.66.53.13), Dst: 10.66.xx.36 (10.66.xx.36)</div><div> Version: 4</div><div> Header length: 20 bytes</div><div> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)</div>
<div> 0000 00.. = Differentiated Services Codepoint: Default (0x00)</div><div> .... ..0. = ECN-Capable Transport (ECT): 0</div><div> .... ...0 = ECN-CE: 0</div><div> Total Length: 107</div><div> Identification: 0xeebe (61118)</div>
<div> Flags: 0x00</div><div> 0... = Reserved bit: Not set</div><div> .0.. = Don't fragment: Not set</div><div> ..0. = More fragments: Not set</div><div> Fragment offset: 0</div><div> Time to live: 64</div>
<div> Protocol: UDP (0x11)</div><div> Header checksum: 0x0d0f [correct]</div><div> [Good: True]</div><div> [Bad : False]</div><div> Source: 10.66.xx.13 (10.66.xx.13)</div><div> Destination: 10.66.xx.36 (10.66.xx.36)</div>
<div>User Datagram Protocol, Src Port: radius (1812), Dst Port: 50336 (50336)</div><div> Source port: radius (1812)</div><div> Destination port: 50336 (50336)</div><div> Length: 87</div><div> Checksum: 0x47a5 [correct]</div>
<div> [Good Checksum: True]</div><div> [Bad Checksum: False]</div><div>Radius Protocol</div><div> Code: Access-Accept (2)</div><div> Packet identifier: 0x1c (28)</div><div> Length: 79</div><div> Authenticator: D38F5770F534410FA9BB0BE0753FB2E8</div>
<div> [This is a response to a request in frame 1053]</div><div> [Time from request: 0.011186000 seconds]</div><div> Attribute Value Pairs</div><div> AVP: l=6 t=Acct-Interim-Interval(85): 1800</div><div> Acct-Interim-Interval: 1800</div>
<div> AVP: l=6 t=Idle-Timeout(28): 1800</div><div> Idle-Timeout: 1800</div><div> AVP: l=6 t=Session-Timeout(27): 1800</div><div> Session-Timeout: 1800</div><div> AVP: l=41 t=Vendor-Specific(26) v=WISPr(14122)</div>
<div> VSA: l=35 t=WISPr-Redirection-URL(4): <a href="https://mydomain.com:443/">https://mydomain.com:443/</a></div><div> WISPr-Redirection-URL: <a href="https://mydomain.com:443/">https://mydomain.com:443/</a></div>
</div><div><br></div><div><br></div><div><br></div><div><br></div><div>krisdigitx</div></div>