Hello, is it possible to log an EAP conversation's Access-Challenge packets that leave the FR server? I mean, other than dumping the output of -X but with a detail { } instance. During looking that up, I took a look at Post-Auth-Type and the dictionary only knows about the value "Local" = 0, but since REJECT exists and is also used I suspect that there might be more values available. Having something like Post-Auth-Type EAP-CHALLENGE { detail } would probably do the trick - if it exists. If more values are available, updating doc/Post-Auth-Type would enlighten people for sure. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter@restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473