- Freeradius-Users - lists.freeradius.org

MSCHAP Combining AD Authentication with External Script
by Vertigo Altair 03 May '21

03 May '21

Hi FreeRADIUS People, I want to combine AD Authentication with my external script. I know it's not recommended to use an external script but I have to use that.. In my external script, basically I'm providing the cleartext-password to FreeRADIUS if the username is correct. I'm trying to working with two scenarios; 1. Try to authenticate first using the external script, if this script returns reject, this time try with authentication with the AD. 2. Try to authenticate first using the AD server, if the AD server returns reject, this time try with the external script. Thanks in advance,

2 1

ARTICLE: What does the "unresponsive child" error message mean?
by marketing＠networkradius.com 30 Apr '21

30 Apr '21

** What does "unresponsive child" error message mean? --------------------------------------------- Like any system, FreeRADIUS provides error messages to inform administrators of problems within the FreeRADIUS server itself. Sometimes however, error messages that are logged by FreeRADIUS are actually reporting an indication that something is wrong with one of the connected systems. A common cause of some of these errors is an unexpectedly slow database. The unresponsive child message is essentially a timeout error. It means that a request was sent to the database, and the database hasn’t responded within a set time limit. Most database queries should happen instantaneously from the perspective of a human being, which means much less than one second. In contrast, the unresponsive child message is produced by FreeRADIUS after about 30 seconds! That is, FreeRADIUS is letting you know that it hasn’t heard back from the database in a very long time. This long time to respond indicates a major problem with the database. Read the full article... https://networkradius.com/articles/2021/02/10/what-does-unresponsive-child-… ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/contact/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

FreeRadius with perl, Unknown attribute: Acct-Session-ID
by Fatih Boy 30 Apr '21

30 Apr '21

Hello, I’m trying to use FreeRadius server with perl module. I've install freeradius 3.0.13 on a clean CentOS 7 with perl module. Then enabled perl module by executing following command: ln -s /etc/raddb/mods-available/perl /etc/raddb/mods-enabled/perl Without making any further changes I've run freeradius from commandline using: radiusd -X Then I got the following error; /etc/raddb/policy.d/accounting[42]: Failed parsing expanded string: /etc/raddb/policy.d/accounting[42]: %{md5:%{1},%{Acct-Session-ID}} /etc/raddb/policy.d/accounting[42]: ^ Unknown attribute Note that; After getting error, I've also add following entry to /etc/raddb/users file. Nothing changed... DEFAULT Auth-type := perl I also add entries to file /etc/raddb/sites-available/default described at https://wiki.freeradius.org/modules/Rlm_perl Any ideas on what's wrong with my configuration? Am I missing some installation/configuration steps for perl module? Best, --fatih

2 3

post-auth language for two requirements
by Jessica Cohen 30 Apr '21

30 Apr '21

I am trying to configure post-auth to require both the NAS-IP-address and a script. I don't think AND works in post-auth. At least that's my guess because it's keeps failing. That or my syntax is incorrect. Looking for suggestions or alternatives. Thanks! Example: # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { if (%{NAS-IP-Address} = 10.100.17.52) AND (`/bin/sh /etc/doscripts/get.sh %{User-Name}` =~ /foo-admin/) { update reply { Service-Type == "guest" } noop } else { reject }

3 2

EAP module will no longer accept realmless identities by default
by Arran Cudbard-Bell 29 Apr '21

29 Apr '21

# # require_identity_realm:: Require the the EAP Identity provided contains # a realm. # # If `require_identity_realm` is `nai`, the EAP identity provided must # end with `@<label0>.<label1>[.<labelN>]`, i.e. an '@' followed by at least # two DNS labels. # # If `require_identity_realm` is `yes`, the EAP identity provided must # either match the NAI format described above, or a `Stripped-User-Domain` # attribute must be present in the request list. # This validation mode is intended to be user where Windows machine # authentication is intermixed with user authentication. # # If `require_identity_realm` is `no`, no identity format checks are performed. # It is NOT recommended to use this value. Future security standards will # key off the NAI realm to validate the certificate we (the EAP server) present. # If you do not require an NAI realm be present in the EAP identity string, # your users will not be able to take advantage of this added security when # it is added by OS and device vendors. # # require_identity_realm = nai A new configuration item has been added to the EAP module, which, by default will prevent users from authenticating unless they provide an NAI style realm in the EAP identity string, e.g. foo(a)example.org. This will likely be backported to the v3.0.x branch, though the default value will likely be "no" to avoid point release breakages. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Using One TIme Passwords with FreeRadius
by radius.pkoch＠dfgh.net 29 Apr '21

29 Apr '21

Dear reader of this mailinglist I'm new to the RADIUS business and I did my frist FreeRadius installation just two weeks ago. I still might misunderstand some of the concepts. So keep in mind that whenever I make statments about what FreeRadius does or should do - these are all my personal assumptions only and might be totally wrong. So far I only tried to get things working. I did not look at my "solution" from a security perspective. I'm describing my solution since this might be useful to other people. And I was hoping to get some feedback. My goal was to allow our users to authenticate with our WiFi accesspoints with a 2-factor method. This means for us, that they either have to user their identity card (which has a builtin smart card chip) or their OTP-token (which generates OATH TOTP values). The solution was expected to work with both laptops (Windows and MacOS) and smart phones/tablets (iPhones, Android). It was expected to work with company-devices (manages by our own MDM) and with BYO-devices from eployees or guests. I never heard of solutions that allows an iPhone to use a smart card for authentication. And using smart cards always needs prior installation of smart card middleware. But one time passwords can be used whenever a password has to be entered. Some of our employees have a second token for generation of "guest-passwords". So using passwords generated by our OTP-tokens seemed to be the only way to go. Without two-factor authentication our employees must go to a central helpdesk, prove their identity by showing their identity card or passport, just to get a piece of paper with a password that allows WiFi acces for twelve hours only. If they forward this password to a guest, they have to fill out another piece of paper. With this situation we cannot force the devices to use certain algorithms for WiFi-authentication. OTP-authentication might require that the supplicant sends the password in clear (PAP or PAP within EAP-TTLS). But configuring guest devices to use this authentication method is unrealistic. iPhones for example can do this, but only if they are under MDM-control. So we use EAP-PEAP with MSCHAPv2 because that's supported by all devices if the accesspoint is configured for WPA2-Enterprise. At least we hope that this is true. And we don't care about guests that visit us with their Win-XP laptops. MSCHAPv2 does not send the password in cleartext within the inner tunnel. But as you all know there's no need to compare password A with password B if you just want to check wether they are equal or not. Comparing HashFunction(A) with HashFunction(B) does work as well and the hash function used by MSCHAPv2 is well documented in RFC 2759. So how do you teach FreeRadius to verify an OATH time based one time password? rlm_otp and rlm_secureid where of no help. So I read the the source code of other FreeRadius modules to find the place where FreeRadius does authentication based on the RFC2759 hash function. I found it in rlm_mschap.c in function do_mschap(). There's a switch statement which looks at the value of method. If method==AUTH_INTERNAL FreeRadius calculates the MSCHAPv2 hash on it's own and complains if the password is missing. But to my great pleasure (I love this FreeRadius-software) I spotted another FreeRadius authentication method in that switch-statement, namely AUTH_NTLM_EXEC. With that method FreeRadius delegates the decision about wether the MSCHAPv2 hash value is correct or not to an external program. The location of this external program is configured by the ntlm_auth configuration directive. And the idea behind this was obviously to let the ntlm_auth programm from Samba do the decision. But there's no real reason why the ntlm_auth programm must be the Samba one. So I put ntlm_auth = "/etc/radius/check_otp '%{mschap:User-Name}' '%{mschap:Challenge}' '%{mschap:NT-Response}' '%{Packet-SRC-IP-Address}'" into mods-enabled/mschap and wrote my own "ntlm_auth"-style routine. It takes the username, challenge and a correct token values, calculates the response from these values and compares that with the given response. The 4th-parameter has informational purpoes only and will be included in syslog-messages when something goes wrong. Actually /etc/radius/check_otp does not do anything on its own, but just forwards all arguments to our authentication server. One could avoid that indirection across check_otp and let FreeRadius talk directly with our authentication server. I don't think that's worth the minimal performance improvement. And the interface between FreeRadius and the "ntlm_auth"-program is very easy to implement. This solutions is used within our IT-department since monday and will go into production next week. So far we had no problems. Everybody is glad that he must not visit the helpdesk anymore (which is mostely closed anyway due to corona). There are some pitfalls: Most important: If a one time password turned out to be correct, it will be reused by the supplicant many times. And for obvious reasons you don't want to enter a new token value over and over again. Hence the check_otp routine must accept token values that were successfully used within the past for some amount of time. We use 12 hours for guests and I have to fight with the security staff about wether this can be increased for employees. Their main argument is, that a valid password might be given to other people. So I'm looking for a way to detect wether two supplicants are using the same user/password-combination. iOS MAC-randomization is my enemy here. Maybe someone has an idea how to do this. Kind regards Peter

3 2

Clear-Text Password
by Hassan, Hazem (Nokia - EG/Cairo) 28 Apr '21

28 Apr '21

Hi , I am testing IPoE setup with free-radius and BNG. Access-Request is initiated from BNG with generic password for all subscriber =password123 ( example as below) PASSWORD [2] 16 PG7zlzih9VewuAuke.dOl Run the debugging on Radius (some time have the password decrypted and seen as show below) and some time not ... any idea? (0) Received Access-Request Id 2 from 10.113.139.50:64385 to 80.194.79.237:1812 length 263 (0) User-Name = "98:86:5d:90:c2:83" (0) User-Password = "password123" (0) NAS-IP-Address = 10.113.139.50 (0) ADSL-Agent-Circuit-Id = 0x4f4c5435312065746820312f312f30332f30312f382f31342f312f333030 (0) ADSL-Agent-Remote-Id = 0x4641363939423634 (0) NAS-Port-Type = Ethernet (0) NAS-Port-Id = "lag-2:13" (0) NAS-Identifier = "BNG-SR1" (0) Received Access-Request Id 2 from 10.113.139.50:64385 to 80.194.79.237:1812 length 263 (0) User-Name = "98:86:5d:90:c2:83" (0) User-Password = "WLkh9VewuAuke.dOl" (0) NAS-IP-Address = 10.113.139.50 (0) ADSL-Agent-Circuit-Id = 0x4f4c5435312065746820312f312f30332f30312f382f31342f312f333030 (0) ADSL-Agent-Remote-Id = 0x4641363939423634 (0) NAS-Port-Type = Ethernet (0) NAS-Port-Id = "lag-2:13" (0) NAS-Identifier = "BNG-SR1" Thanks, Hazem During the Holy RAMDAN (13April to 13May) working hours [ from 09:00 AM to 3:00 PM UK time]

2 1

allow WLAN-access in certain offices only
by radius.pkoch＠dfgh.net 28 Apr '21

28 Apr '21

Dear Freeradius experts, I have just compiled Freeradius from source and red some of the documentation. WPA2-EAP works with username bob and password hello. radiusd -X shows no errors. Now here's what I would like to achive and maybe some of you can point me into the right direction: We have equipped all of our offices (approx 100) with seperate WLAN access points. Every employee should be able to access the access point in its own office and in some of our conference rooms. Every employee owns an OAuth token that generates a 6digit one time password. Whenever a user tries to access a WLAN access point with his username and his one time password the following should happen: 1) if the password is wrong access should be denied 2) if the access point is not located in the office of the employee or in one of the conference rooms of the employees department access should be denied Our central oracle database has information about the ip-address and location of every access point and the office rooms of every employee. My first idea was to write a php-script (because that's the scripting language I'm familiar with) and use that via rlm_exec. I will do this as a proof of concept. Since neither I nor any of my colleagues have perl-experience I'd rather write a new module in C than use perl. Is there a module that will send all parameters to a unix or inet socket and receives the results from that socket? How abount rlm_socket? Kind regards Peter

3 9

WiMAX style continuation field used by other vendor
by Benjamin Thompson 26 Apr '21

26 Apr '21

Hi I am working with some Telrad equipment and have found that it uses attributes with vendor ID 5323 and which have the continuation field (format=1,1,c) as used in WiMAX attributes. I tried to add a dictionary with this format string but FreeRADIUS refused to start with the error "Only WiMAX VSAs can have continuations". I traced the error to this section of code (dict.c line 2097): if ((*pvalue != VENDORPEC_WIMAX) || (type != 1) || (length != 1)) { fr_strerror_printf("dict_init: %s[%d]: Only WiMAX VSAs can have continuations", fn, line); return -1; } I would like to ask whether it would be OK to allow continuations for other vendors too here (I am happy to submit a patch). Ben

2 5

RADSEC - ERROR: TLS Alert read:fatal:unknown CA
by Michael Cullen 26 Apr '21

26 Apr '21

Hi, I'm getting an unknown CA error when authenticating with RADSEC. I have EAP-TLS and EAP-TLS over TTLS working fine. This is passing locally when running eapol_test, pointing this at the running server fails with the following: Listening on auth+acct from client (10.0.2.232, 52947) -> (*, 2083, virtual-server=radsec) (0) Initiating new TLS session (0) Setting verify mode to require certificate from client (0) (other): before SSL initialization (0) TLS_accept: before SSL initialization (0) TLS_accept: before SSL initialization (0) <<< recv TLS 1.3 [length 0098] (0) TLS_accept: SSLv3/TLS read client hello (0) >>> send TLS 1.2 [length 0039] (0) TLS_accept: SSLv3/TLS write server hello (0) >>> send TLS 1.2 [length 03c6] (0) TLS_accept: SSLv3/TLS write certificate (0) >>> send TLS 1.2 [length 016d] (0) TLS_accept: SSLv3/TLS write key exchange (0) >>> send TLS 1.2 [length 00aa] (0) TLS_accept: SSLv3/TLS write certificate request (0) >>> send TLS 1.2 [length 0004] (0) TLS_accept: SSLv3/TLS write server done (0) TLS_accept: Need to read more data: SSLv3/TLS write server done (0) TLS - In Handshake Phase (0) TLS - got 1587 bytes of data (0) <<< recv TLS 1.2 [length 0002] (0) ERROR: TLS Alert read:fatal:unknown CA (0) TLS_accept: Need to read more data: error (0) ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (0) TLS - In Handshake Phase (0) TLS - Application data. (0) SSL_read Error (0) ERROR: Error in fragmentation logic (0) Application data status 4 Closing TLS socket from client port 52947 Client has closed connection ... shutting down socket auth+acct from client (10.0.2.232, 52947) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 11766) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 15359) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 65212) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 6123) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 59685) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 17646) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 48212) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 53313) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 36056) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 40139) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 48337) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 42353) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 22426) -> (*, 2083, virtual-server=radsec) .. . cleaning up socket auth+acct from client (10.0.2.232, 51317) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 19967) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 32633) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 39479) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 3427) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 11898) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 15455) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 26702) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 28398) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 7519) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 16029) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 24805) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 30665) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 37105) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 17261) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 23705) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 30053) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 24811) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 41416) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 25290) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 17735) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 21421) -> (*, 2083, virtual-server=radsec) Waking up in 0.8 seconds. ... cleaning up socket auth+acct from client (10.0.2.232, 15262) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 23391) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 28075) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 19519) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 8746) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 29993) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 60922) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 2533) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 50237) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 52840) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 62747) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 60782) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 17977) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 26652) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 57896) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 22108) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 6062) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 13844) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 43369) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 51246) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 54429) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 64595) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 2748) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 47575) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 52947) -> (*, 2083, virtual-server=radsec) Ready to process requests The radsec configuration is: server radsec { listen { type = auth+acct ipaddr = * port = 2083 proto = tcp tls { private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${certdir}/ca.pem dh_file = ${raddbdir}/dh random_file = /dev/random check_crl = no ca_path = ${cadir} cipher_list = "HIGH" ecdh_curve = "secp384r1" require_client_cert = yes auto_chain = no cache { enable = no lifetime = 24 max_entries = 255 } verify { tmpdir = /tmp/radiusd client = "/usr/bin/openssl verify -CAfile ${certdir}/ca.pem %{TLS-Client-Cert-Filename}" } } } authorize { eap } authenticate { eap } } In an attempt to fix this, I followed this guide (we are running on Alpine): https://wiki.alpinelinux.org/wiki/FreeRadius_EAP-TLS_configuration I'm interested to know whether this is really a unknown CA error or if something else is going on. Some things I'm investigating: 1. Why is the first recv TLS 1.3 and all consecutive send and recv TLS 1.2? (0) <<< recv TLS 1.3 [length 0098] (0) TLS_accept: SSLv3/TLS read client hello (0) >>> send TLS 1.2 [length 0039] (0) TLS_accept: SSLv3/TLS write server hello 2. I can see "TLS - got 1587 bytes of data", will this result in fragmentation in the handshake? (0) ERROR: Error in fragmentation logic 3. Could there be a problem with the identity being sent to the server? I'm seeing a lot of identity request and response, and we seem to be stuck in a loop. I'm using the certificate Common Name as the identity value. 57 12.824635 HewlettP_f7:de:e0 Apple_26:33:dc EAP 23 Request, Identity 551 30.363992 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 553 30.400277 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 558 30.433393 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 560 30.466359 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 562 30.499880 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 564 30.531438 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity Kind Regards, Michael

2 1