Hi, Here's my archi: NAS ---- FreeRADIUS Proxy(192.168.0.107) ---- WAP gateway(Home Server-192.168.1.6) I'm trying to proxy accounting requests to a WAP gateway (home server) using http://www.kannel.org/download/1.4.1/userguide-1.4.1/userguide.html#AEN1038 as the RADIUS client. I see malformed packets received by the Proxy. The same client when used with xtradius (+ an external perl script) to simply forward the accounting request to the wap gateway it works well. With Freeradius(2.0.4) proxy + MySQL(SQLIPPOOL) i see this error quite often. #../radius.log Wed May 28 14:00:28 2008 : Error: WARNING: Malformed RADIUS packet from host 192.168.1.6: too short (received 6 < minimum 20) Wed May 28 14:00:30 2008 : Error: Discarding duplicate request from client SLR1 port 1813 - ID: 242 due to unfinished request 194 Could you explain me the possible causes for this situation please? Any areas I have overlooked when configuring FreeRADIUS proxy(indicated below)? --------------------------------------------- FREERADIUS Proxy configuration --------------------------------------------- #../raddb/proxy.conf proxy server { default_fallback = no } home_server wap { type = acct ipaddr = 192.168.1.6 port = 1813 secret = secret response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool my_acct_failover { type = fail-over home_server = wap } ------------------------------------------------ I'm puzzled that, if it's a problem with the Radius client being used, then what makes things working well with XtRADIUS+perl? Is there a better way to forward ONLY an accounting request (with selected set of AVPs) ? Here's are two Accounting-responses (Malformed and Normal) captured on the Proxy side(192.168.0.107) Malformed Packet ================= --------------------------------------------------------------------------------------------------------- Frame 4 (60 bytes on wire, 60 bytes captured) Arrival Time: May 28, 2008 14:03:07.090143000 Time delta from previous packet: 0.004755000 seconds Time since reference or first frame: 37.437385000 seconds Frame Number: 4 Packet Length: 60 bytes Capture Length: 60 bytes Frame is marked: False Protocols in frame: eth:ip:udp:radius Ethernet II, Src: 00:1b:78:d2:bc:f8 (00:1b:78:d2:bc:f8), Dst: Xensourc_0f:5c:ef (00:16:3e:0f:5c:ef) Destination: Xensourc_0f:5c:ef (00:16:3e:0f:5c:ef) Address: Xensourc_0f:5c:ef (00:16:3e:0f:5c:ef) .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address Source: 00:1b:78:d2:bc:f8 (00:1b:78:d2:bc:f8) Address: 00:1b:78:d2:bc:f8 (00:1b:78:d2:bc:f8) .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address Type: IP (0x0800) Trailer: 0000000000000000 Internet Protocol, Src: 192.168.1.6 (192.168.1.6), Dst: 192.168.0.107 (192.168.0.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 38 Identification: 0x0a72 (2674) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 63 Protocol: UDP (0x11) Header checksum: 0x19e8 [correct] Good: True Bad : False Source: 192.168.1.6 (192.168.1.6) Destination: 192.168.0.107 (192.168.0.107) User Datagram Protocol, Src Port: radius-acct (1813), Dst Port: 1814 (1814) Source port: radius-acct (1813) Destination port: 1814 (1814) Length: 18 Checksum: 0x4f17 [correct] Radius Protocol Code: Accounting-Response (5) Packet identifier: 0xc7 (199) Length: 20 [Malformed Packet: RADIUS] Normal Response ================ ------------------------------------------------------------------------------------------------------ Frame 6 (62 bytes on wire, 62 bytes captured) Arrival Time: May 28, 2008 14:03:21.089332000 Time delta from previous packet: 0.009441000 seconds Time since reference or first frame: 51.436574000 seconds Frame Number: 6 Packet Length: 62 bytes Capture Length: 62 bytes Frame is marked: False Protocols in frame: eth:ip:udp:radius Ethernet II, Src: 00:1b:78:d2:bc:f8 (00:1b:78:d2:bc:f8), Dst: Xensourc_0f:5c:ef (00:16:3e:0f:5c:ef) Destination: Xensourc_0f:5c:ef (00:16:3e:0f:5c:ef) Address: Xensourc_0f:5c:ef (00:16:3e:0f:5c:ef) .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address Source: 00:1b:78:d2:bc:f8 (00:1b:78:d2:bc:f8) Address: 00:1b:78:d2:bc:f8 (00:1b:78:d2:bc:f8) .... ...0 .... .... .... .... = Multicast: This is a UNICAST frame .... ..0. .... .... .... .... = Locally Administrated Address: This is a FACTORY DEFAULT address Type: IP (0x0800) Internet Protocol, Src: 192.168.1.6 (192.168.1.6), Dst: 192.168.0.107 (192.168.0.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x0a76 (2678) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 63 Protocol: UDP (0x11) Header checksum: 0x19da [correct] Good: True Bad : False Source: 192.168.1.6 (192.168.1.6) Destination: 192.168.0.107 (192.168.0.107) User Datagram Protocol, Src Port: radius-acct (1813), Dst Port: 1814 (1814) Source port: radius-acct (1813) Destination port: 1814 (1814) Length: 28 Checksum: 0x84e0 [correct] Radius Protocol Code: Accounting-Response (5) Packet identifier: 0x93 (147) Length: 20 Authenticator: 6DEA7F8F0B31CED4BE0F4D3BC95AB370 ---------------------------------------------------- FREERADIUS Proxy configuration ---------------------------------------------------- ../raddb/proxy.conf proxy server { default_fallback = no } home_server wap { type = acct ipaddr = 192.168.1.6 port = 1813 secret = secret response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool my_acct_failover { type = fail-over home_server = wap } ------------------------------------------------ Thanks, srg