I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from? Thu Jan 12 07:19:58 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "user" NAS-Port = 536936515 Acct-Session-Id = "0A000067" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "1cc41474b27ed376" Timestamp = 1137082798 Thu Jan 12 07:23:50 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "anotheruser" NAS-Port = 268501111 Acct-Session-Id = "0D008123" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "4ed0aac222580a10" Timestamp = 1137083030
Matthew Schumacher wrote:
I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from?
Thu Jan 12 07:19:58 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "user" NAS-Port = 536936515 Acct-Session-Id = "0A000067" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "1cc41474b27ed376" Timestamp = 1137082798 These appear to be from the loopback of the NAS, not the radius server.
-- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 Off. 325-691-1301 Cell 325-439-0533 fax 325-695-6841
Lewis Bergman wrote:
Matthew Schumacher wrote:
I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from?
Thu Jan 12 07:19:58 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "user" NAS-Port = 536936515 Acct-Session-Id = "0A000067" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "1cc41474b27ed376" Timestamp = 1137082798
These appear to be from the loopback of the NAS, not the radius server.
Thanks for your reply, however it doesn't make sense to me. How can the Client-IP-Address be 127.0.0.1 if the radius server records the source address of the packet in the Client-IP-Address attribute? If the packet came from the loopback of the nas then I would expect the NAS-IP-Address to be 127.0.0.1 but the Client-IP-Address to be where the packet was sourced from. schu
Matthew Schumacher wrote:
Lewis Bergman wrote:
Matthew Schumacher wrote:
I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from?
Thu Jan 12 07:19:58 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "user" NAS-Port = 536936515 Acct-Session-Id = "0A000067" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "1cc41474b27ed376" Timestamp = 1137082798
These appear to be from the loopback of the NAS, not the radius server.
Thanks for your reply, however it doesn't make sense to me. How can the Client-IP-Address be 127.0.0.1 if the radius server records the source address of the packet in the Client-IP-Address attribute? If the packet came from the loopback of the nas then I would expect the NAS-IP-Address to be 127.0.0.1 but the Client-IP-Address to be where the packet was sourced from. I assumed when you marked the NAS ip as legit, that the actual value in that field is a legit IP that you have listed in your clients.conf file. If that is the case, then that is where the packet originated from. My NAS's report the client IP as the NAS address if I log in from the network. Login-IP-Host = <ip of router> Client-IP-Address = <IP of NAS IP>
I think I remember if I logged in from the console port that it reports the Client address as the loopback. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 Off. 325-691-1301 Cell 325-439-0533 fax 325-695-6841
Lewis Bergman wrote:
Matthew Schumacher wrote:
Lewis Bergman wrote:
Matthew Schumacher wrote:
I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from?
Thu Jan 12 07:19:58 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "user" NAS-Port = 536936515 Acct-Session-Id = "0A000067" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "1cc41474b27ed376" Timestamp = 1137082798
I assumed when you marked the NAS ip as legit, that the actual value in that field is a legit IP that you have listed in your clients.conf file. If that is the case, then that is where the packet originated from. My NAS's report the client IP as the NAS address if I log in from the network. Login-IP-Host = <ip of router> Client-IP-Address = <IP of NAS IP>
I think I remember if I logged in from the console port that it reports the Client address as the loopback.
According to the freeradius documentation and the code the Client-IP-Address attribute always records the source address of the packet, and the NAS-IP-Address is provided by the NAS, and if it isn't freeradius puts in the source address. This means that the log above states that a packet with the NAS-IP-Address of a legit nas was sourced from 127.0.0.1 which is not possible since I don't have a client running on the local machine which is confirmed by the lack of packets shown in tcpdump. At this point I am starting to think there is a bug in freeradius where the Client-IP-Address gets recorded incorrectly. If you login to the serial port of your nas then you could see the NAS-IP-Address as 127.0.0.1 but you should never see a Client-IP-Address of 127.0.0.1 unless the client sourced it's packet from the radius servers loopback interface. schu
Matthew Schumacher wrote:
Lewis Bergman wrote:
Matthew Schumacher wrote:
I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from?
Thu Jan 12 07:19:58 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "user" NAS-Port = 536936515 Acct-Session-Id = "0A000067" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "1cc41474b27ed376" Timestamp = 1137082798
These appear to be from the loopback of the NAS, not the radius server.
Thanks for your reply, however it doesn't make sense to me. How can the Client-IP-Address be 127.0.0.1 if the radius server records the source address of the packet in the Client-IP-Address attribute? If the packet came from the loopback of the nas then I would expect the NAS-IP-Address to be 127.0.0.1 but the Client-IP-Address to be where the packet was sourced from.
schu
Okay, I'm looking at the rlm_preprocess.c code and see where the Client-IP-Address is set: /* * Add in a Client-IP-Address, to tell the user * the source IP of the request. That is, the client, * * Note that this MAY BE different from the NAS-IP-Address, * especially if the request is being proxied. * * Note also that this is a server configuration item, * and will NOT make it to any packets being sent from * the server. */ nas = paircreate(PW_CLIENT_IP_ADDRESS, PW_TYPE_IPADDR); if (!nas) { radlog(L_ERR, "No memory"); return -1; } nas->lvalue = request->packet->src_ipaddr; ip_hostname(nas->strvalue, sizeof(nas->strvalue), nas->lvalue); pairadd(&request->packet->vps, nas); return 0; But it looks like it always comes from request->packet->src_ipaddr which leads me to believe that I'm getting a packet sourced from 127.0.0.1 even though tcpdump doesn't see it. I also noticed that the udpfromto source could generate packets from 127.0.0.1 but it was not compiled in, and even if it was I should see it in tcpdump. Any thoughts on this? I need to get rid of these spurious accounting messages. Thanks, schu
But it looks like it always comes from request->packet->src_ipaddr which leads me to believe that I'm getting a packet sourced from 127.0.0.1 even though tcpdump doesn't see it.
I also noticed that the udpfromto source could generate packets from 127.0.0.1 but it was not compiled in, and even if it was I should see it in tcpdump.
Any thoughts on this? I need to get rid of these spurious accounting messages.
Your server isn't running radrelay or proxying to itself, is it? Probably not, just taking a stab at it.
Dusty Doris wrote:
But it looks like it always comes from request->packet->src_ipaddr which leads me to believe that I'm getting a packet sourced from 127.0.0.1 even though tcpdump doesn't see it.
I also noticed that the udpfromto source could generate packets from 127.0.0.1 but it was not compiled in, and even if it was I should see it in tcpdump.
Any thoughts on this? I need to get rid of these spurious accounting messages.
Your server isn't running radrelay or proxying to itself, is it?
Not that I know off, and if it was I would see it in tcpdump. Thanks for your comments though... I'll probably upgrade to the new radius server today and pray and hope this goes away, otherwise I'll have to run in debug mode (which I have been avoiding on a prod system) and figure this out. schu
Not that I know off, and if it was I would see it in tcpdump. Thanks for your comments though...
I'll probably upgrade to the new radius server today and pray and hope this goes away, otherwise I'll have to run in debug mode (which I have been avoiding on a prod system) and figure this out.
Yah, I usually try to avoid that too, but its not so bad. I'd typically do something like this. kill <radiusd pid>;radiusd -X > outfile That way it stops and reloads into debug quickly. Pipe the debug to outfile. Tail -f the outfile if you want to make sure its still working fine. Wait enough time that you think you might capture that event. Ctrl-C and start it back up. Then go back through the outfile to find the culprit. -Dusty
Matthew Schumacher wrote:
I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from?
After doing some debugging it looks like the server generates stop messages when Simultaneous-Use is on and a user logs in before we get a stop message. I have 2 services running on this machine one which uses Simultaneous-Use and one that doesn't. So when a user logs onto the second service these accounting messages are generated (for the wrong NAS). Is there anyway to disable this? I suppose I could use a different radutmp database for each of them, but would rather disable automatic acct message generation. schu
Matthew Schumacher <matt.s@aptalaska.net> wrote:
After doing some debugging it looks like the server generates stop messages when Simultaneous-Use is on and a user logs in before we get a stop message.
Or when a stop message is missing entirely.
I have 2 services running on this machine one which uses Simultaneous-Use and one that doesn't. So when a user logs onto the second service these accounting messages are generated (for the wrong NAS).
I'm not sure what you mean by that. Are you sharing databases between the two services?
Is there anyway to disable this? I suppose I could use a different radutmp database for each of them, but would rather disable automatic acct message generation.
You should really use a different radutmp database for each service. As for disabling the automatic messages, see rlm_radutmp.c Alan DeKok.
Alan DeKok wrote:
I have 2 services running on this machine one which uses Simultaneous-Use and one that doesn't. So when a user logs onto the second service these accounting messages are generated (for the wrong NAS).
I'm not sure what you mean by that. Are you sharing databases between the two services?
Yes, I'll work on a new config that makes each service use it's own radutmp. Thanks, schu
participants (4)
-
Alan DeKok -
Dusty Doris -
Lewis Bergman -
Matthew Schumacher