Morning all, A few months ago I was changing part of our RADIUS platform. I wanted to thoroughly test the change I was making in our test environment, so I captured a few thousand RADIUS packets from one of our live servers using tcpdump, then used tcpreplay to fire them at the test radius server and then set about comparing the output. I quickly found this to be very tedious and time consuming, so I started looking for a program that would read in the pcap file I'd made with tcpdump, fire the packets at the test server and compare the packet it got back with the response packets in the capture. After some googling I couldn't find anything, so I decided to write one. After using it successfully to test my change, I convinced the management here to let me open source the resulting code, which you can now get from: https://gitorious.org/radreplay/ Now I am a developer, but an Engineer, so my C might not be the best, however I've found this very useful and thought other people might also find it useful. It's simple to use and the output is fairly easy to interpret. It builds and runs fine on 32 and 64 bit Debian GNU/Linux, and doesn't have any dependencies other than the standard c library so should build and run pretty easily on other UNIX based platforms, YMMV. I've distributed the debian directory with it so if you are using Debian you can build a package. Obviously I can't fully support this, any work I do on this is now in my own time, not on the company's time, but if you find problems with it or have suggestions let me know and I'll try to see what I can do. Or if you have improvements clone it and send me a pull request! Regards, Ben -- | Ben Brown Broadband Solutions for | Infrastructure Engineer Home & Business@ | Plusnet Plc www.plus.net | Registered Office: Internet House, 2 Tenter Street, Sheffield, S1 4BY | Registered in England no: 3279013 + --------------- Plusnet - ISPA Best Consumer ISP 2008 ---------------
Ben Brown wrote:
I quickly found this to be very tedious and time consuming, so I started looking for a program that would read in the pcap file I'd made with tcpdump, fire the packets at the test server and compare the packet it got back with the response packets in the capture. After some googling I couldn't find anything, so I decided to write one.
Sounds good.
Now I am a developer, but an Engineer, so my C might not be the best, however I've found this very useful and thought other people might also find it useful. It's simple to use and the output is fairly easy to interpret.
OK... my main surprise is that you've re-written a RADIUS encoder/decoder, and a dictioanry file parser. All of that code already exists... The "radsniff" program distributed with FreeRADIUS reads PCAP files. It uses the FreeRADIUS library to read the dictionaries, and the library can send/receive packets. It may have been less work to glue some "send/receive" logic into radsniff. Still, the tool looks useful. Alan DeKok.
On Fri, Aug 19, 2011 at 01:35:32PM +0100, Alan DeKok wrote:
OK... my main surprise is that you've re-written a RADIUS encoder/decoder, and a dictioanry file parser. All of that code already exists...
I did initially look at using the radiusclient-ng library, but I found the dictionary parsing to be a bit too fragile. It would bomb out with very little provocation.
The "radsniff" program distributed with FreeRADIUS reads PCAP files. It uses the FreeRADIUS library to read the dictionaries, and the library can send/receive packets.
I wasn't aware of radsniff, I'll take a look at the code some time to see if I can integrate it. I quite like not needing any other libraries though, and it's such a small program really. Ben -- | Ben Brown Broadband Solutions for | Infrastructure Engineer Home & Business@ | Plusnet Plc www.plus.net | Registered Office: Internet House, 2 Tenter Street, Sheffield, S1 4BY | Registered in England no: 3279013 + --------------- Plusnet - ISPA Best Consumer ISP 2008 ---------------
Ben Brown wrote:
I did initially look at using the radiusclient-ng library, but I found the dictionary parsing to be a bit too fragile. It would bomb out with very little provocation.
Yes, it needs work.
The "radsniff" program distributed with FreeRADIUS reads PCAP files. It uses the FreeRADIUS library to read the dictionaries, and the library can send/receive packets.
I wasn't aware of radsniff, I'll take a look at the code some time to see if I can integrate it. I quite like not needing any other libraries though, and it's such a small program really.
The word I'm looking for is "robust". :) Your program works, and is simple. The code in FreeRADIUS works, and is a lot more capable. Alan DeKok.
participants (2)
-
Alan DeKok -
Ben Brown