There's a new undocumented expansion '%{debug_attr:<attribute>}' in what will be 3.0.1. At debug level 2 it just prints out the names and values of attributes which match <attribute>. At debug level 3 it also prints out the type length and vendor. At debug level 4 it writes the attribute back out into wire format and attempts to decode it as different things. It is absolutely not recommended for production use, but can be helpful in determining what those unknown VSAs actually contain, and for finding the state of the various lists and attributes at various points in your policies. Here's some example output: Wed Jul 17 16:58:01 2013 : Info: (0) Attributes matching "request:" Wed Jul 17 16:58:01 2013 : Info: (0) request:User-Name = 'footed' Wed Jul 17 16:58:01 2013 : Debug: (0) type : string Wed Jul 17 16:58:01 2013 : Debug: (0) length : 6 Wed Jul 17 16:58:01 2013 : Debug: (0) as abinary : 0x666f6f746564 Wed Jul 17 16:58:01 2013 : Debug: (0) as octets : 0x666f6f746564 Wed Jul 17 16:58:01 2013 : Debug: (0) as ipv6prefix : 6f74:6564::/111 Wed Jul 17 16:58:01 2013 : Info: (0) request:User-Password = 'barram' Wed Jul 17 16:58:01 2013 : Debug: (0) type : string Wed Jul 17 16:58:01 2013 : Debug: (0) length : 6 Wed Jul 17 16:58:01 2013 : Debug: (0) as abinary : 0x62617272616d Wed Jul 17 16:58:01 2013 : Debug: (0) as octets : 0x62617272616d Wed Jul 17 16:58:01 2013 : Debug: (0) as ipv6prefix : 7272:616d::/97 Wed Jul 17 16:58:01 2013 : Info: (0) request:NAS-IP-Address = 172.16.184.1 Wed Jul 17 16:58:01 2013 : Debug: (0) type : ipaddr Wed Jul 17 16:58:01 2013 : Debug: (0) length : 4 Wed Jul 17 16:58:01 2013 : Debug: (0) as integer : 2886776833 Wed Jul 17 16:58:01 2013 : Debug: (0) as string : '\254\020\270\001' Wed Jul 17 16:58:01 2013 : Debug: (0) as date : 'Jun 23 2061 18:27:13 GMT' Wed Jul 17 16:58:01 2013 : Debug: (0) as abinary : 0xac10b801 Wed Jul 17 16:58:01 2013 : Debug: (0) as octets : 0xac10b801 Wed Jul 17 16:58:01 2013 : Debug: (0) as ipv6prefix : b801::/16 Wed Jul 17 16:58:01 2013 : Debug: (0) as signed : -1056964609 Wed Jul 17 16:58:01 2013 : Debug: (0) as uint32 : 2886776833 Wed Jul 17 16:58:01 2013 : Debug: (0) as int32 : -1056964609 Wed Jul 17 16:58:01 2013 : Info: (0) request:NAS-Port = 0 Wed Jul 17 16:58:01 2013 : Debug: (0) type : integer Wed Jul 17 16:58:01 2013 : Debug: (0) length : 4 Wed Jul 17 16:58:01 2013 : Debug: (0) as string : '\000\000\000' Wed Jul 17 16:58:01 2013 : Debug: (0) as ipaddr : 0.0.0.0 Wed Jul 17 16:58:01 2013 : Debug: (0) as date : 'Jan 1 1970 01:00:00 BST' Wed Jul 17 16:58:01 2013 : Debug: (0) as abinary : 0x00000000 Wed Jul 17 16:58:01 2013 : Debug: (0) as octets : 0x00000000 Wed Jul 17 16:58:01 2013 : Debug: (0) as ipv6prefix : ::/0 Wed Jul 17 16:58:01 2013 : Debug: (0) as signed : -1056964609 Wed Jul 17 16:58:01 2013 : Debug: (0) as int32 : -1056964609 Wed Jul 17 16:58:01 2013 : Info: (0) request:Message-Authenticator = 0xc085d8999a4255079ae9bdfda9a81161 Wed Jul 17 16:58:01 2013 : Debug: (0) type : octets Wed Jul 17 16:58:01 2013 : Debug: (0) length : 16 Wed Jul 17 16:58:01 2013 : Debug: (0) as string : '\300\205??\232BU\007\232\351\275\375\251\250\021a' Wed Jul 17 16:58:01 2013 : Debug: (0) as abinary : 0xc085d8999a4255079ae9bdfda9a81161 Wed Jul 17 16:58:01 2013 : Debug: (0) as ipv6addr : c085:d899:9a42:5507:9ae9:bdfd:a9a8:1161 Wed Jul 17 16:58:01 2013 : Debug: (0) expand: "%{debug_attr:request:}" -> '' Just wrote it to feed random crap into the parser really, and to see if decoding/re-encoding might be a good way to do attribute conversions where there's a type mismatch, but figured it might be useful as a diagnostic tool. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team