@Rens: In my setup, the libwireshark-data package is installed and it contains a /usr/share/wireshark/radius/dictionary.rfc7268 file. I will be curious if you can decode these AVP numbered 186, 187 and 188. Unfortunately,I couldn't find any sample over the Internet containing those AVP. Le mar. 5 avr. 2022 à 14:35, Rens Houben via Freeradius-Users <freeradius-users@lists.freeradius.org> a écrit :
Van: Freeradius-Users <freeradius-users-bounces+rhouben=systemec.nl@lists.freeradius.org> namens Alan DeKok <aland@deployingradius.com>
On Apr 5, 2022, at 7:56 AM, Olivier <oza.4h07@gmail.com> wrote:
Debugging some Radius accounting sessions on Debian Bullseye, Wireshark shows some AVP as "t=Unkown-Attribute(186)" or "t=Unkown-Attribute(187)". Looking at [1], it seems those AVP belongs to RFC7268. In my PC, a /usr/share/wireshark/radius/dictionary.rfc7268 file exists and it contains data about AVP 186 and 187.
Is it possible to use Wireshark to read these Unkown attributes ? If positive, how ?
The RADIUS dictionaries should be loaded by default in Wireshark.
But if they're not, you'll have to ask the Wireshark people why their software doesn't work.
Alan DeKok.
Having just checked wireshark on a debian 11 system, I can confirm that it does in fact load the RADIUS dictionaries -- and it doesn't need to have freeradius installed to look them up either.
The dictionaries are contained in the libwireshark-data package which should have been installed automatically as a dependency of wireshark by apt.
-- Rens Houben Systemec Internet Services
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html