On Thu, Jan 22, 2009 at 4:47 PM, Alan DeKok <aland@deployingradius.com>wrote:
Mark Dennehy wrote:
1) Can a radius accounting session get the Start message from one host and the Stop message from another?
It's not forbidden (surprisingly enough). But it's certainly unexpected, and happens very rarely (i.e. never) in real systems.
So long as it's not forbidden by the RFC or freeradius, I don't mind being thought of as not a "real" system! :)
2) I've got wireshark showing incoming radius messages on a box here; but freeradius -X isn't showing them being spotted;
Then they're not showing up on the socket freeradius is using. There's likely a firewall in the way, or SELinux.
SELinux isn't present, and wireshark is actually running on the box in question, so they're past the firewall at this stage. What I'm seeing from wireshark is: Frame 15 (144 bytes on wire, 144 bytes captured) Linux cooked capture Internet Protocol, Src: 134.226.36.52 (134.226.36.52), Dst: 134.226.52.44 (134.226.52.44) User Datagram Protocol, Src Port: 36592 (36592), Dst Port: radius-acct (1813) Source port: 36592 (36592) Destination port: radius-acct (1813) Length: 108 Checksum: 0xbb58 [correct] Radius Protocol Code: Accounting-Request (4) Packet identifier: 0xe7 (231) Length: 100 Authenticator: 64CD64DA5BA51A7DBD010E28BFEC55F5 Attribute Value Pairs AVP: l=6 t=Acct-Status-Type(40): Stop(2) AVP: l=12 t=NAS-Identifier(32): metachilli AVP: l=6 t=NAS-IP-Address(4): 127.0.0.1 AVP: l=14 t=User-Name(1): qw2@metakall AVP: l=18 t=Acct-Session-Id(44): 4978936900000000 AVP: l=6 t=Acct-Terminate-Cause(49): Lost-Carrier(2) AVP: l=6 t=NAS-Port(5): 1813 AVP: l=6 t=Acct-Delay-Time(41): 0 AVP: l=6 t=NAS-IP-Address(4): 134.226.36.52 But freeradius -X doesn't even hiccup. There's no acknowlegement from it at all that this arrived.
It logs nearly everything in debugging mode, including all packets it's discarding.
*Nearly* everything? (Because I know what my luck is like :D ) -- Mark Dennehy