accounting Framed-IP-Address
HI, i can do accounting with mysql, it's working so fine. but i noticed that i don't have the real ip address of a workstation connected. i got this +-----------------+---------------------+---------------------+-------------------+-----------------+ | FramedIPAddress | AcctStartTime | AcctStopTime | CallingStationId | FramedIPAddress | +-----------------+---------------------+---------------------+-------------------+-----------------+ | bernard | 2010-03-16 13:07:29 | 2010-03-16 13:10:35 | 00-18-8B-B5-26-B7 | 3.118.236.192 | what is FramedIPAddress stand for? => cause i don't know this ip address how can retrie the real ip address ? (wired) thanks
Hi,
but i noticed that i don't have the real ip address of a workstation connected. i got this
+-----------------+---------------------+---------------------+-------------------+-----------------+ | FramedIPAddress | AcctStartTime | AcctStopTime | CallingStationId | FramedIPAddress | +-----------------+---------------------+---------------------+-------------------+-----------------+ | bernard | 2010-03-16 13:07:29 | 2010-03-16 13:10:35 | 00-18-8B-B5-26-B7 | 3.118.236.192 |
what is FramedIPAddress stand for? => cause i don't know this ip address how can retrie the real ip address ? (wired)
depends on the NAS and what type of connection. generally you wont have an IP address with eg WiFi for accounting start packets as the 802.1X starts before DHCP has done anything(!) - therefore its the accounting update packets that tend to hold more useful details regarding the IP address of the client....that functionality also depends on the NAS alan
hi, i got cisco 3750 switch and for accounting i put aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius aaa accounting dot1x default start-stop group radius but this ip i don't know where it took it lol FramedIPAddress = 3.118.236.192 thanks 2010/3/16 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
Hi,
but i noticed that i don't have the real ip address of a workstation connected. i got this
+-----------------+---------------------+---------------------+-------------------+-----------------+
| FramedIPAddress | AcctStartTime | AcctStopTime | CallingStationId | FramedIPAddress |
+-----------------+---------------------+---------------------+-------------------+-----------------+
| bernard | 2010-03-16 13:07:29 | 2010-03-16 13:10:35 | 00-18-8B-B5-26-B7 | 3.118.236.192 |
what is FramedIPAddress stand for? => cause i don't know this ip address how can retrie the real ip address ? (wired)
depends on the NAS and what type of connection.
generally you wont have an IP address with eg WiFi for accounting start packets as the 802.1X starts before DHCP has done anything(!) - therefore its the accounting update packets that tend to hold more useful details regarding the IP address of the client....that functionality also depends on the NAS
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
i tried to put *radius-server attribute 8 include-in-access-req but still the same; is it possible to retrieve from dhcp server the ip adress? * 2010/3/16 omega bk <omegabk@gmail.com>
hi,
i got cisco 3750 switch
and for accounting i put
aaa new-model aaa authentication dot1x default group radius aaa authorization network default group radius aaa accounting dot1x default start-stop group radius
but this ip i don't know where it took it lol FramedIPAddress = 3.118.236.192
thanks
2010/3/16 Alan Buxey <A.L.M.Buxey@lboro.ac.uk>
Hi,
but i noticed that i don't have the real ip address of a workstation connected. i got this
+-----------------+---------------------+---------------------+-------------------+-----------------+
| FramedIPAddress | AcctStartTime | AcctStopTime | CallingStationId | FramedIPAddress |
+-----------------+---------------------+---------------------+-------------------+-----------------+
| bernard | 2010-03-16 13:07:29 | 2010-03-16 13:10:35 | 00-18-8B-B5-26-B7 | 3.118.236.192 |
what is FramedIPAddress stand for? => cause i don't know this ip address how can retrie the real ip address ? (wired)
depends on the NAS and what type of connection.
generally you wont have an IP address with eg WiFi for accounting start packets as the 802.1X starts before DHCP has done anything(!) - therefore its the accounting update packets that tend to hold more useful details regarding the IP address of the client....that functionality also depends on the NAS
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, i'm trying syslog-ng to get ip address from dhcp log so i need to have the frameipaddress field to be empty in order to replace it from dhcp log so in syslog-ng.conf, i put : source dhcp { tcp(ip(0.0.0.0) port(514)); }; # log { source(dhcp); destination(acct_radius); }; destination acct_radius { pipe("/var/log/mysql.pipe" \ template("UPDATE radacct SET FramedIPAddress = SUBSTRING_INDEX(SUBSTRING_INDEX('$MSG','on ',-1),' to',1) \ WHERE TIMESTAMPDIFF(SECOND,AcctStartTime,CONCAT('$YEAR-$MONTH-$DAY',' ','$HOUR:$MIN:$SEC')) <= 180 AND \ REPLACE(REPLACE(CallingStationId,'-',''),':','') = *REPLACE(SUBSTRING(SUBSTRING_INDEX('$MSG','to ',-1),1,17),':','') \ AND FramedIPAddress = \"\" ;\n*") template-escape(yes)); }; but my FramedIPAddress field still got this strange ip adress 3.118.236.192 somebody has a clue? thanks
Hi,
destination acct_radius { pipe("/var/log/mysql.pipe" \ template("UPDATE radacct SET FramedIPAddress = SUBSTRING_INDEX(SUBSTRING_INDEX('$MSG','on ',-1),' to',1) \ WHERE TIMESTAMPDIFF(SECOND,AcctStartTime,CONCAT('$YEAR-$MONTH-$DAY',' ','$HOUR:$MIN:$SEC')) <= 180 AND \ REPLACE(REPLACE(CallingStationId,'-',''),':','') = REPLACE(SUBSTRING(SUBSTRING_INDEX('$MSG','to ',-1),1,17),':','') \ AND FramedIPAddress = \"\" ;\n") template-escape(yes)); };
but my FramedIPAddress field still got this strange ip adress 3.118.236.192
somebody has a clue?
<wild guess> 192.236.118.3 - which was the last address the client had and is therefore doing a DHCP request for - hence its appearing it your logs...and into your system </wild guesS> or it might even be 3.118.236.192 - you never know what people do with their own networks(!) - look at the live logs that syslog-ng is muching on to see what you see... or tcpdump in full debug/text mode the DHCP process. alan
participants (3)
-
Alan Buxey -
Alan DeKok -
omega bk