Freeradius error: "Discarding conflicting packet"
Hi, I've enabled extensive logging and radiusd runs as daemon process (# /usr/local/sbin/radiusd). I have a medium sized network with about 25 Access Points (AP's) now (Linksys WAP54G). It runs with following encryption options: WPA-Enterprise, AES, PEAP, mschapv2, without using certificates. Everything seems to run smoothly but before every login attempt the logs say (something like): "Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28." After that the user logs in correctly. I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'. Does anybody have an idea? Thanks in advance! In the freeradius source I found the following regarding the error: gettimeofday(&when, NULL); when.tv_sec -= 1; /* * If the cached request was received * within the last second, then we * discard the NEW request instead of the * old one. This will happen ONLY when * the client is severely broken, and is * sending conflicting packets very * quickly. */ if (timercmp(&when, &request->received, <)) { radlog(L_ERR, "Discarding conflicting packet from " "client %s port %d - ID: %d due to recent request %d.", client->shortname, packet->src_port, packet->id, request->number); return 0; } -- View this message in context: http://www.nabble.com/Freeradius-error%3A-%22Discarding-conflicting-packet%2... Sent from the FreeRadius - User mailing list archive at Nabble.com.
jelle-e wrote:
Everything seems to run smoothly but before every login attempt the logs say (something like):
"Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28."
That's pretty definitive.
After that the user logs in correctly.
I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'.
It's possible. If they're all the same manufacturer and software version, they could all have the same bug.
Does anybody have an idea? Thanks in advance!
Run "tcpdump" or "wireshark" to look at the packets. Odds are the AP's *are* sending conflicting packets. Look for 2 packets from the same client IP && port, with the same RADIUS code and ID, within a second of each other. If the packet contents are different, then the AP is broken. i.e. You can believe that FreeRADIUS is broken, but *only* on your system... and not on the other 10,000 systems with 100's of 1000's of AP's. Or, you can believe that your AP's are broken. Alan DeKok.
Hi, Thanks for your reply. I began testing different setups immediately. I located 1 AP which didn't regenerate the error (AP1) and swapped it with one which did generate the error (AP2). I then saw that AP1 (which now was located on the place of AP2), began generating the same errors. The clients are fixed , so I tested with the same clients on that location. My conclusion: 1) The error probably has something to do with the WAP54G, but; 2) The error is only produced in combination with some clients (don't know if it's a hardware issue, because it seems to have nothing to do with the OS. OSX and Windows Vista/XP are all 'sometimes' producing the error. 3) It might have something to do with overlapping channels, but my tests are not yet conclusive about that. It's all so much trial and error... I decided to just buy another AP (WAP200) to test and see if the same error pops up. I'm also going to try an Asus WL-G330ge, just to be sure. More on that later... Jelle ps: The models I use are Linksys WAP54G, v3.1, with firmware version 3.05. 2008/6/11 Alan DeKok <aland@deployingradius.com>:
jelle-e wrote:
Everything seems to run smoothly but before every login attempt the logs say (something like):
"Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28."
That's pretty definitive.
After that the user logs in correctly.
I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'.
It's possible. If they're all the same manufacturer and software version, they could all have the same bug.
Does anybody have an idea? Thanks in advance!
Run "tcpdump" or "wireshark" to look at the packets. Odds are the AP's *are* sending conflicting packets. Look for 2 packets from the same client IP && port, with the same RADIUS code and ID, within a second of each other. If the packet contents are different, then the AP is broken.
i.e. You can believe that FreeRADIUS is broken, but *only* on your system... and not on the other 10,000 systems with 100's of 1000's of AP's. Or, you can believe that your AP's are broken.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2008/6/13 Jelle Langbroek <jml@orkz.net>:
Hi,
Thanks for your reply. I began testing different setups immediately. I located 1 AP which didn't regenerate the error (AP1) and swapped it with one which did generate the error (AP2). I then saw that AP1 (which now was located on the place of AP2), began generating the same errors. The clients are fixed , so I tested with the same clients on that location. My conclusion: 1) The error probably has something to do with the WAP54G, but; 2) The error is only produced in combination with some clients (don't know if it's a hardware issue, because it seems to have nothing to do with the OS. OSX and Windows Vista/XP are all 'sometimes' producing the error. 3) It might have something to do with overlapping channels, but my tests are not yet conclusive about that.
It's all so much trial and error... I decided to just buy another AP (WAP200) to test and see if the same error pops up. I'm also going to try an Asus WL-G330ge, just to be sure. More on that later...
Jelle
ps: The models I use are Linksys WAP54G, v3.1, with firmware version 3.05.
2008/6/11 Alan DeKok <aland@deployingradius.com>:
jelle-e wrote:
Everything seems to run smoothly but before every login attempt the logs say (something like):
"Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28."
That's pretty definitive.
After that the user logs in correctly.
I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'.
It's possible. If they're all the same manufacturer and software version, they could all have the same bug.
Does anybody have an idea? Thanks in advance!
Run "tcpdump" or "wireshark" to look at the packets. Odds are the AP's *are* sending conflicting packets. Look for 2 packets from the same client IP && port, with the same RADIUS code and ID, within a second of each other. If the packet contents are different, then the AP is broken.
i.e. You can believe that FreeRADIUS is broken, but *only* on your system... and not on the other 10,000 systems with 100's of 1000's of AP's. Or, you can believe that your AP's are broken.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I use the EAP/TTLS and EAP/PAP scheme. I have the same error as you but is somewhat at ramdom. In my case, APs Linksys WRT54GL has OpenWRT WhiteRussian installed. Could be some bad in clients? I've seen things too weirds in Mac OS X clients... I'd like to know if your problems have been fixed with Asus WL-G330ge. Also, I think that overlapping channels can be causing the error, so I'll change that... Greets- -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
I use the EAP/TTLS and EAP/PAP scheme. I have the same error as you but is somewhat at ramdom. In my case, APs Linksys WRT54GL has OpenWRT WhiteRussian installed. Could be some bad in clients? I've seen things too weirds in Mac OS X clients...
I'd like to know if your problems have been fixed with Asus WL-G330ge. Also, I think that overlapping channels can be causing the error, so I'll change that...
Hi, I can tell you that with my tests, I figured out that it's happening with all sorts of clients (MacOSX, XP, Vista). It appears only to be happing with the WAP54G (and now the WRT54GL you say). When I replaced the WAP54G with a WAP200, the errors disappeared with the same clients. I tested this on many locations with many different clients and everywhere the same results. It must be the WAP54G then. I'm still using those AP's and I keep getting the error in the logs. It's indeed quite random. The error seems not harmful (although the sourcecode of freeRadius says the AP is broken). I haven't been able to link complaints of customers to this specific error, so I guess I should just stop paying attention. I ruled out the possibility that overlapping channels are causing the problem. I tested it with overlapping channels and without. Nothing changes regarding the error. I mailed Linksys about the problem, and they sent me a newer beta-firmware which isn't on their website. It's for the WAP54G ofcourse. If you want it, I put it on our website here: http://www.orxnet.org/files/<http://www.orxnet.org/> WAP54G-Cisco-EU-EN-3.08.02.zip It works, but doesn't give me the results I hoped for. So, I don't have the solution, but I guess it's not really that bad. If you ever solve the problem I'd like to hear it! :) Good luck! Gr, Jelle
Greets- -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin - - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jelle Langbroek wrote:
I can tell you that with my tests, I figured out that it's happening with all sorts of clients (MacOSX, XP, Vista).
The supplicant's aren't involved here. It's the NAS that retransmits the RADIUS packets.
It appears only to be happing with the WAP54G (and now the WRT54GL you say). When I replaced the WAP54G with a WAP200, the errors disappeared with the same clients.
i.e. the WAP54G is broken. It doesn't do RADIUS properly.
I tested this on many locations with many different clients and everywhere the same results. It must be the WAP54G then.
Yes.
I'm still using those AP's and I keep getting the error in the logs. It's indeed quite random. The error seems not harmful (although the sourcecode of freeRadius says the AP is broken).
:) It's a common complaint on this list. Some issues are FreeRADIUS bugs. Others are broken NASes. I'm in the process of putting together a RADIUS validation test suite, so that manufacturers can see if their products are compliant *before* shipping them. Alan DeKok.
2008/10/5 Alan DeKok <aland@deployingradius.com>:
Jelle Langbroek wrote:
I can tell you that with my tests, I figured out that it's happening with all sorts of clients (MacOSX, XP, Vista).
The supplicant's aren't involved here. It's the NAS that retransmits the RADIUS packets.
It appears only to be happing with the WAP54G (and now the WRT54GL you say). When I replaced the WAP54G with a WAP200, the errors disappeared with the same clients.
i.e. the WAP54G is broken. It doesn't do RADIUS properly.
I tested this on many locations with many different clients and everywhere the same results. It must be the WAP54G then.
Yes.
I'm still using those AP's and I keep getting the error in the logs. It's indeed quite random. The error seems not harmful (although the sourcecode of freeRadius says the AP is broken).
:) It's a common complaint on this list. Some issues are FreeRADIUS bugs. Others are broken NASes.
I'm in the process of putting together a RADIUS validation test suite, so that manufacturers can see if their products are compliant *before* shipping them.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I think is worthwhile to remark that that problem exists even using OpewnWRT on Linksys WRT54GL and not using original firmware... Is there a way to at least to minimize those errors? I've heard some people complains that sometimes try to reconnect and sometimes the only solution is reboot the AP. Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
If you're using Mikrotik than this message is 24/7/365 in your logs :) Sergio Belkin wrote:
2008/10/5 Alan DeKok <aland@deployingradius.com>:
Jelle Langbroek wrote:
I think is worthwhile to remark that that problem exists even using OpewnWRT on Linksys WRT54GL and not using original firmware...
Is there a way to at least to minimize those errors? I've heard some people complains that sometimes try to reconnect and sometimes the only solution is reboot the AP.
Thanks in advance!
Sergio Belkin wrote:
I think is worthwhile to remark that that problem exists even using OpewnWRT on Linksys WRT54GL and not using original firmware...
Which may be based on similar code to the original firmware.
Is there a way to at least to minimize those errors? I've heard some people complains that sometimes try to reconnect and sometimes the only solution is reboot the AP.
Fix the NAS. As you noted earlier, this doesn't happen with another NAS. The conclusion is that the NAS is broken. Alan DeKok.
2008/11/4 Alan DeKok <aland@deployingradius.com>:
Sergio Belkin wrote:
I think is worthwhile to remark that that problem exists even using OpewnWRT on Linksys WRT54GL and not using original firmware...
Which may be based on similar code to the original firmware.
Is there a way to at least to minimize those errors? I've heard some people complains that sometimes try to reconnect and sometimes the only solution is reboot the AP.
Fix the NAS. As you noted earlier, this doesn't happen with another NAS. The conclusion is that the NAS is broken.
But what do you mean for "fix the nas"? Should I use another brand/model of AP?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
2008/11/4 Sergio Belkin <sebelk@gmail.com>:
2008/11/4 Alan DeKok <aland@deployingradius.com>:
Sergio Belkin wrote:
I think is worthwhile to remark that that problem exists even using OpewnWRT on Linksys WRT54GL and not using original firmware...
Which may be based on similar code to the original firmware.
Is there a way to at least to minimize those errors? I've heard some people complains that sometimes try to reconnect and sometimes the only solution is reboot the AP.
Fix the NAS. As you noted earlier, this doesn't happen with another NAS. The conclusion is that the NAS is broken.
But what do you mean for "fix the nas"? Should I use another brand/model of AP?
What I am trying to tell you is are the about of 30 AP's that I am using broken?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
Jep, in my case I use about 30 AP's from Linksys (WAP54g). They all appear to be broken. To bad, but then again a reason to integrate the N standard with other AP's... :) 2008/11/4 Stephen Bowman <sbbowman@gmail.com>
But what do you mean for "fix the nas"? Should I use another brand/model of AP?
What I am trying to tell you is are the about of 30 AP's that I am using broken?
Yes.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Sorry for bothering but does anyone know what's wrong with these nases? Is there any way to go a little deeper than #radiusd -x ? Jelle wrote:
Jep, in my case I use about 30 AP's from Linksys (WAP54g). They all appear to be broken. To bad, but then again a reason to integrate the N standard with other AP's... :)
2008/11/4 Stephen Bowman <sbbowman@gmail.com <mailto:sbbowman@gmail.com>>
> But what do you mean for "fix the nas"? Should I use another brand/model of AP?
What I am trying to tell you is are the about of 30 AP's that I am using broken?
Yes.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg45635.h... There is nothing to see in server debug for the packet that's discarded. Ivan Kalik Kalik Informatika ISP Dana 4/11/2008, "Marinko Tarlac" <mangia81@gmail.com> piše:
Sorry for bothering but does anyone know what's wrong with these nases? Is there any way to go a little deeper than #radiusd -x ?
Jelle wrote:
Jep, in my case I use about 30 AP's from Linksys (WAP54g). They all appear to be broken. To bad, but then again a reason to integrate the N standard with other AP's... :)
2008/11/4 Stephen Bowman <sbbowman@gmail.com <mailto:sbbowman@gmail.com>>
> But what do you mean for "fix the nas"? Should I use another brand/model of AP?
What I am trying to tell you is are the about of 30 AP's that I am using broken?
Yes.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2008/11/4 <tnt@kalik.net>:
http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg45635.h...
There is nothing to see in server debug for the packet that's discarded.
Ivan Kalik Kalik Informatika ISP
Dana 4/11/2008, "Marinko Tarlac" <mangia81@gmail.com> piše:
Sorry for bothering but does anyone know what's wrong with these nases? Is there any way to go a little deeper than #radiusd -x ?
Jelle wrote:
Jep, in my case I use about 30 AP's from Linksys (WAP54g). They all appear to be broken. To bad, but then again a reason to integrate the N standard with other AP's... :)
2008/11/4 Stephen Bowman <sbbowman@gmail.com <mailto:sbbowman@gmail.com>>
> But what do you mean for "fix the nas"? Should I use another brand/model of AP?
What I am trying to tell you is are the about of 30 AP's that I am using broken?
Yes.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
OK, AP's are broken, now with best regards, how I convince to my boss that he should buy more than 30 new AP's, should I tell him... "read the freeradius mailing list"? -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
I used sniffer to checked radius packet between authenticator <--> radius I also use sniffer to checked eapol between supplicant <--> authenticator By using these 2 ways to troubleshooting authentication issues. Hope this info help you. Eric YIng 2008/11/4 Sergio Belkin <sebelk@gmail.com>
2008/11/4 <tnt@kalik.net>:
http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg45635.h...
There is nothing to see in server debug for the packet that's discarded.
Ivan Kalik Kalik Informatika ISP
Dana 4/11/2008, "Marinko Tarlac" <mangia81@gmail.com> piše:
Sorry for bothering but does anyone know what's wrong with these nases? Is there any way to go a little deeper than #radiusd -x ?
Jelle wrote:
Jep, in my case I use about 30 AP's from Linksys (WAP54g). They all appear to be broken. To bad, but then again a reason to integrate the N standard with other AP's... :)
2008/11/4 Stephen Bowman <sbbowman@gmail.com <mailto:
sbbowman@gmail.com>>
> But what do you mean for "fix the nas"? Should I use another brand/model of AP?
What I am trying to tell you is are the about of 30 AP's that I am using broken?
Yes.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
OK, AP's are broken, now with best regards, how I convince to my boss that he should buy more than 30 new AP's, should I tell him... "read the freeradius mailing list"?
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Nov 05, 2008 at 12:43:07AM -0200, Sergio Belkin wrote:
OK, AP's are broken, now with best regards, how I convince to my boss that he should buy more than 30 new AP's, should I tell him... "read the freeradius mailing list"?
Tell him that I co-wrote RFC 5080, which says that these AP's are broken: When sending requests, RADIUS clients MUST NOT reuse Identifiers for a source IP address and source UDP port until either a valid response has been received, or the request has timed out. These AP's violate the standards, and are broken. I know, because my name is on the standards. My name is also on the RADIUS "guidelines" document, which says how people should use RADIUS in the future. And my name is going on 3-4 other RADIUS standards. So it's not "people on the FreeRADIUS list told me", but instead "the people who wrote the standards say that the AP is broken". Alan DeKok.
2008/11/5 aland <aland@deployingradius.com>:
On Wed, Nov 05, 2008 at 12:43:07AM -0200, Sergio Belkin wrote:
OK, AP's are broken, now with best regards, how I convince to my boss that he should buy more than 30 new AP's, should I tell him... "read the freeradius mailing list"?
Tell him that I co-wrote RFC 5080, which says that these AP's are broken:
When sending requests, RADIUS clients MUST NOT reuse Identifiers for a source IP address and source UDP port until either a valid response has been received, or the request has timed out.
These AP's violate the standards, and are broken. I know, because my name is on the standards.
My name is also on the RADIUS "guidelines" document, which says how people should use RADIUS in the future. And my name is going on 3-4 other RADIUS standards.
So it's not "people on the FreeRADIUS list told me", but instead "the people who wrote the standards say that the AP is broken".
Alan DeKok.
-
Alan, thanks, That's really a quite convincing answer :) Of course I believe you , but please understand me, It's hard to me to realize that either Linksys make non-standard products or OpenWRT (white russian) developers had made such a mistake. So, I'd be glad to know what AP's are standard compliant.... is there a list? -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
Sergio Belkin wrote:
Alan, thanks, That's really a quite convincing answer :)
Yup. I'm not just a random loudmouth on this list.
Of course I believe you , but please understand me, It's hard to me to realize that either Linksys make non-standard products or OpenWRT (white russian) developers had made such a mistake.
<shrug> There are many, many, RADIUS client implementations that are nearly as bad.
So, I'd be glad to know what AP's are standard compliant.... is there a list?
Nope. I don't think very many are fully standards compliant. I suggest updating the Wiki with any issues you find. Alan DeKok.
I've upgraded to OpenWRT Kamikaze and problem seems goes away... 2008/11/6 Alan DeKok <aland@deployingradius.com>:
Sergio Belkin wrote:
Alan, thanks, That's really a quite convincing answer :)
Yup. I'm not just a random loudmouth on this list.
Of course I believe you , but please understand me, It's hard to me to realize that either Linksys make non-standard products or OpenWRT (white russian) developers had made such a mistake.
<shrug> There are many, many, RADIUS client implementations that are nearly as bad.
So, I'd be glad to know what AP's are standard compliant.... is there a list?
Nope. I don't think very many are fully standards compliant.
I suggest updating the Wiki with any issues you find.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -
participants (10)
-
Alan DeKok -
aland
-
Eric Ying -
Jelle -
Jelle Langbroek
-
jelle-e
-
Marinko Tarlac -
Sergio Belkin -
Stephen Bowman -
tnt＠kalik.net