Thank you for your quick reply. I tried radsniff -h before posting. What I'm hoping to do is to troubleshoot a particular user, but I don't think I'm using the -r option correctly. # ./radsniff -i lo -rFOO -ssecret -X radsniff: Invalid RADIUS filter "(null)": expecting operator No matter what I use for -r, I get the same reply. When I use it without -r, I get basically the same as radtest output. Could you reply with some examples of the correct usage of this command? Is it possible to do a regex on a username or on Access-Rejects with radsniff? thanks ------------------------------ Message: 5 Date: Fri, 22 Aug 2008 20:54:53 -0700 From: "Lemaster, Rob" <rlemaste@covad.com> Subject: radsniff To: <freeradius-users@lists.freeradius.org> Message-ID: <3BC5D44AB71A754FAE3CA68A7597EABE0F82C86C@ZANEVS03.cc-ntd1.covad.com> Content-Type: text/plain; charset="iso-8859-1" I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples? ------------------------------ Message: 6 Date: Sat, 23 Aug 2008 06:51:31 +0200 From: Alan DeKok <aland@deployingradius.com> Subject: Re: radsniff To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <48AF9753.8040602@deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Lemaster, Rob wrote:
I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples?
$ radsniff -h It's a simple wrapper around libpcap. It can also print out the contents of RADIUS packets using the FreeRADIUS dictionaries. Wireshark does more, but it's dictionaries aren't as up to date, and it's a *lot* bigger. Alan DeKok.