Accounting-Request packets
Hi guys, Not to waste too much time, but I can't seem to find answers to two quick questions and I was hoping someone might know off the top of their heads: 1) Can a radius accounting session get the Start message from one host and the Stop message from another? 2) I've got wireshark showing incoming radius messages on a box here; but freeradius -X isn't showing them being spotted; if the a-v pairs weren't spot on, would if just silently discard the packets? Would it not even log that malformed packets were received? Thanks for your time, -- Mark Dennehy
Mark Dennehy wrote:
1) Can a radius accounting session get the Start message from one host and the Stop message from another?
It's not forbidden (surprisingly enough). But it's certainly unexpected, and happens very rarely (i.e. never) in real systems.
2) I've got wireshark showing incoming radius messages on a box here; but freeradius -X isn't showing them being spotted;
Then they're not showing up on the socket freeradius is using. There's likely a firewall in the way, or SELinux.
if the a-v pairs weren't spot on, would if just silently discard the packets? Would it not even log that malformed packets were received?
It logs nearly everything in debugging mode, including all packets it's discarding. Alan DeKok.
On Thu, Jan 22, 2009 at 4:47 PM, Alan DeKok <aland@deployingradius.com>wrote:
Mark Dennehy wrote:
1) Can a radius accounting session get the Start message from one host and the Stop message from another?
It's not forbidden (surprisingly enough). But it's certainly unexpected, and happens very rarely (i.e. never) in real systems.
So long as it's not forbidden by the RFC or freeradius, I don't mind being thought of as not a "real" system! :)
2) I've got wireshark showing incoming radius messages on a box here; but freeradius -X isn't showing them being spotted;
Then they're not showing up on the socket freeradius is using. There's likely a firewall in the way, or SELinux.
SELinux isn't present, and wireshark is actually running on the box in question, so they're past the firewall at this stage. What I'm seeing from wireshark is: Frame 15 (144 bytes on wire, 144 bytes captured) Linux cooked capture Internet Protocol, Src: 134.226.36.52 (134.226.36.52), Dst: 134.226.52.44 (134.226.52.44) User Datagram Protocol, Src Port: 36592 (36592), Dst Port: radius-acct (1813) Source port: 36592 (36592) Destination port: radius-acct (1813) Length: 108 Checksum: 0xbb58 [correct] Radius Protocol Code: Accounting-Request (4) Packet identifier: 0xe7 (231) Length: 100 Authenticator: 64CD64DA5BA51A7DBD010E28BFEC55F5 Attribute Value Pairs AVP: l=6 t=Acct-Status-Type(40): Stop(2) AVP: l=12 t=NAS-Identifier(32): metachilli AVP: l=6 t=NAS-IP-Address(4): 127.0.0.1 AVP: l=14 t=User-Name(1): qw2@metakall AVP: l=18 t=Acct-Session-Id(44): 4978936900000000 AVP: l=6 t=Acct-Terminate-Cause(49): Lost-Carrier(2) AVP: l=6 t=NAS-Port(5): 1813 AVP: l=6 t=Acct-Delay-Time(41): 0 AVP: l=6 t=NAS-IP-Address(4): 134.226.36.52 But freeradius -X doesn't even hiccup. There's no acknowlegement from it at all that this arrived.
It logs nearly everything in debugging mode, including all packets it's discarding.
*Nearly* everything? (Because I know what my luck is like :D ) -- Mark Dennehy
Mark Dennehy wrote:
So long as it's not forbidden by the RFC or freeradius, I don't mind being thought of as not a "real" system! :)
If this is only for your network, it's OK.
SELinux isn't present, and wireshark is actually running on the box in question, so they're past the firewall at this stage. What I'm seeing from wireshark is:
<shrug> FreeRADIUS prints all packets it receives on the socket. If it doesn't print a packet, it's because the kernel didn't put one into the socket. Alan DeKok.
Previously Mark Dennehy wrote:
SELinux isn't present, and wireshark is actually running on the box in question, so they're past the firewall at this stage.
Wireshark sees packets before they are processed by the (local) firewall. Wichert. -- Wichert Akkerman <wichert@wiggy.net> It is simple to make things. http://www.wiggy.net/ It is hard to make things simple.
Ah. I'll bet you the iptables setup is hosing the packets so. Thanks guys, much appreciated! On Thu, Jan 22, 2009 at 6:50 PM, Wichert Akkerman <wichert@wiggy.net> wrote:
Previously Mark Dennehy wrote:
SELinux isn't present, and wireshark is actually running on the box in question, so they're past the firewall at this stage.
Wireshark sees packets before they are processed by the (local) firewall.
Wichert.
-- Wichert Akkerman <wichert@wiggy.net> It is simple to make things. http://www.wiggy.net/ It is hard to make things simple. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
-- Mark Dennehy
participants (3)
-
Alan DeKok -
Mark Dennehy -
Wichert Akkerman